[Paper Review] Have You Stolen My Model? Evasion Attacks Against Deep Neural Network Watermarking Techniques

Dorjan Hitaj, Luigi V. Mancini|arXiv (Cornell University)|Sep 3, 2018

Adversarial Robustness in Machine Learning23 references42 citations

TL;DR

This paper shows two evasion attacks against DNN watermarking: an ensemble model attack and a detector-based attack, both enabling theft verification to fail for watermark owners.

ABSTRACT

Deep neural networks have had enormous impact on various domains of computer science, considerably outperforming previous state of the art machine learning techniques. To achieve this performance, neural networks need large quantities of data and huge computational resources, which heavily increases their construction costs. The increased cost of building a good deep neural network model gives rise to a need for protecting this investment from potential copyright infringements. Legitimate owners of a machine learning model want to be able to reliably track and detect a malicious adversary that tries to steal the intellectual property related to the model. Recently, this problem was tackled by introducing in deep neural networks the concept of watermarking, which allows a legitimate owner to embed some secret information(watermark) in a given model. The watermark allows the legitimate owner to detect copyright infringements of his model. This paper focuses on verifying the robustness and reliability of state-of- the-art deep neural network watermarking schemes. We show that, a malicious adversary, even in scenarios where the watermark is difficult to remove, can still evade the verification by the legitimate owners, thus avoiding the detection of model theft.

Motivation & Objective

• Motivate and formalize the need to protect ML models from copyright infringement in MLaaS and proprietary settings.
• Review and test state-of-the-art DNN watermarking techniques based on backdooring for robustness against adversaries.
• Demonstrate practical evasion strategies that can thwart watermark verification while preserving service quality.

Proposed method

• Propose an Ensemble Attack: steal multiple high-quality models from different providers and fuse them into a majority-vote ensemble behind an API layer to evade watermark verification.
• Show that unseen watermark triggers act as random inputs, reducing the likelihood of correct watermark verification under majority voting.
• Show an Ensemble setup where watermark triggers are non-intersecting across models, and evaluate verification success as ensemble size varies.
• Propose a Detector Attack: train a binary classifier (Detector) using features from the stolen model to detect watermark triggers, and return random predictions for suspected triggers.
• Evaluate Detector performance using pretrained networks (ResNet50, InceptionV3, Xception, VGG16, VGG19) with detector accuracies above 90%.
• Demonstrate the approach with MNIST-scale experiments and discuss applicability to larger tasks like ImageNet.

Experimental results

Research questions

• RQ1 Can watermark verification be reliably performed when the model is stolen and served via an ensemble of other models?
• RQ2 Can a targeted watermark trigger presence be obfuscated through ensemble voting or detection mechanisms without sacrificing normal task accuracy?
• RQ3 What is the practicality and cost for adversaries to implement these evasion strategies in MLaaS settings?
• RQ4 How robust are current backdoor-based watermarks to evasion under black-box access?

Key findings

• Ensemble attacks significantly reduce watermark verification success; with seven-model ensembles, verifiable watermark ownership drops to about 25.5% on MNIST, and around 15–34% for larger tasks or smaller ensembles.
• Smaller ensembles (three models) still enable substantial evasion, with verified watermark portions around 34% for MNIST under the tested setup.
• The Detector Attack enables high detection accuracy (around 91–95% depending on the stolen model) to flag watermark triggers and output random predictions, reducing verification success to 1/l per trigger where l is the output space size.
• Watermark verification remains unreliable for legitimate owners when adversaries deploy MLaaS backed by stolen models, while service quality for clean inputs is preserved or enhanced due to ensemble benefits.
• Experiments show the feasibility of both attacks under black-box access, highlighting practical risks to backdoored watermark schemes like those proposed by Adi et al.