[Paper Review] False Claims against Model Ownership Resolution

Jian Liu, Rui Zhang+3 more|arXiv (Cornell University)|Apr 13, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper reveals a critical vulnerability in existing model ownership resolution (MOR) schemes: malicious accusers can falsely claim ownership of independently trained models by crafting transferable adversarial examples as 'evidence'. The authors generalize common MOR procedures and prove that resisting such false claims is equivalent to preventing transferable adversarial examples, demonstrating that all surveyed MOR schemes—including Amazon’s Rekognition API—are susceptible under realistic conditions.

ABSTRACT

Deep neural network (DNN) models are valuable intellectual property of model owners, constituting a competitive advantage. Therefore, it is crucial to develop techniques to protect against model theft. Model ownership resolution (MOR) is a class of techniques that can deter model theft. A MOR scheme enables an accuser to assert an ownership claim for a suspect model by presenting evidence, such as a watermark or fingerprint, to show that the suspect model was stolen or derived from a source model owned by the accuser. Most of the existing MOR schemes prioritize robustness against malicious suspects, ensuring that the accuser will win if the suspect model is indeed a stolen model. In this paper, we show that common MOR schemes in the literature are vulnerable to a different, equally important but insufficiently explored, robustness concern: a malicious accuser. We show how malicious accusers can successfully make false claims against independent suspect models that were not stolen. Our core idea is that a malicious accuser can deviate (without detection) from the specified MOR process by finding (transferable) adversarial examples that successfully serve as evidence against independent suspect models. To this end, we first generalize the procedures of common MOR schemes and show that, under this generalization, defending against false claims is as challenging as preventing (transferable) adversarial examples. Via systematic empirical evaluation, we show that our false claim attacks always succeed in the MOR schemes that follow our generalization, including in a real-world model: Amazon's Rekognition API.

Motivation & Objective

• To identify and analyze a previously overlooked robustness threat in model ownership resolution (MOR) schemes: false claims by malicious accusers.
• To demonstrate that false claims can be systematically constructed using transferable adversarial examples that fool the verification process.
• To show that all major MOR schemes, including real-world deployments like Amazon Rekognition, are vulnerable to such attacks under realistic configurations.
• To establish a general framework for MOR procedures under which false claims become inescapable unless transferable adversarial examples are prevented.
• To provide guidance on hardening MOR schemes against this new class of attacks, while acknowledging the high cost of potential countermeasures.

Proposed method

• Generalize common MOR schemes into a unified framework where the accuser provides a trigger set and the judge verifies ownership via inference on suspect models.
• Formulate the threat model of a malicious accuser who deviates from the protocol by crafting adversarial examples that behave as valid triggers for independent models.
• Leverage the transferability of adversarial examples to create trigger sets that induce high activation on any independent model, regardless of its origin.
• Empirically evaluate the attack on 16 MOR schemes, including watermarking and fingerprinting techniques, using CIFAR-10, ImageNet, and Amazon Rekognition API.
• Demonstrate that the attack succeeds with 100% effectiveness across all tested configurations, even when models are trained independently and without access to the source model.
• Propose generic countermeasures such as adversarial defense mechanisms or input sanitization, though noting their potential performance and deployment costs.

Experimental results

Research questions

• RQ1 Can a malicious accuser successfully make a false ownership claim against an independently trained model that was not derived from their source model?
• RQ2 Is the vulnerability to false claims inherent in the design of existing MOR schemes, particularly those relying on trigger sets for verification?
• RQ3 To what extent does the transferability of adversarial examples enable false claims across diverse MOR schemes and real-world models?
• RQ4 Can the robustness of MOR schemes against false claims be guaranteed without preventing transferable adversarial examples?
• RQ5 What are the practical implications of this vulnerability for legal and real-world deployment of model ownership resolution systems?

Key findings

• All surveyed MOR schemes, including those based on watermarking, fingerprinting, and proof-of-learning, are vulnerable to false claims by malicious accusers.
• The false claim attack succeeds with 100% effectiveness in all realistic configurations tested, including on Amazon’s Rekognition API.
• The attack is effective because transferable adversarial examples can be crafted to mimic valid triggers, causing independent models to respond as if they were derived from the accuser’s source model.
• The vulnerability arises from the general structure of MOR schemes, where verification relies on model inference on a trigger set, making them susceptible to adversarial manipulation.
• The core insight is that defending against false claims is as hard as preventing transferable adversarial examples, a long-standing open problem in robust ML.
• While generic countermeasures exist, they often incur significant computational or deployment costs, leaving the problem unresolved in practice.