[Paper Review] Who Leaked the Model? Tracking IP Infringers in Accountable Federated Learning

Shuyang Yu, Junyuan Hong+4 more|arXiv (Cornell University)|Dec 6, 2023

Privacy-Preserving Technologies in Data4 citations

TL;DR

This paper proposes Decodable Unique Watermarking (DUW), a method for accountable federated learning that embeds client-unique watermarks into global models using backdoor-based injection to enable precise tracking of IP infringers. DUW achieves over 99% watermark success rate and 100% infringer identification accuracy across CIFAR-10, CIFAR-100, and Digits datasets under heterogeneous FL settings, even after common watermark removal attacks.

ABSTRACT

Federated learning (FL) emerges as an effective collaborative learning framework to coordinate data and computation resources from massive and distributed clients in training. Such collaboration results in non-trivial intellectual property (IP) represented by the model parameters that should be protected and shared by the whole party rather than an individual user. Meanwhile, the distributed nature of FL endorses a malicious client the convenience to compromise IP through illegal model leakage to unauthorized third parties. To block such IP leakage, it is essential to make the IP identifiable in the shared model and locate the anonymous infringer who first leaks it. The collective challenges call for \emph{accountable federated learning}, which requires verifiable ownership of the model and is capable of revealing the infringer's identity upon leakage. In this paper, we propose Decodable Unique Watermarking (DUW) for complying with the requirements of accountable FL. Specifically, before a global model is sent to a client in an FL round, DUW encodes a client-unique key into the model by leveraging a backdoor-based watermark injection. To identify the infringer of a leaked model, DUW examines the model and checks if the triggers can be decoded as the corresponding keys. Extensive empirical results show that DUW is highly effective and robust, achieving over $99\%$ watermark success rate for Digits, CIFAR-10, and CIFAR-100 datasets under heterogeneous FL settings, and identifying the IP infringer with $100\%$ accuracy even after common watermark removal attempts.

Motivation & Objective

• Address the critical challenge of identifying malicious clients who leak high-value global models in federated learning (FL) systems.
• Enable accountable FL by ensuring verifiable ownership and traceability of model IP to individual clients.
• Overcome limitations of prior watermarking methods that lack client-specific tracking or require parameter exposure.
• Maintain high model utility while ensuring robustness against watermark removal and adversarial attacks.
• Provide a lightweight, model-agnostic solution that requires minimal modification to existing FL pipelines.

Proposed method

• Inject client-unique watermarks into the global model using a backdoor-based technique, where each client’s unique key is encoded via a trigger set generated from out-of-distribution (OoD) data.
• Utilize a pre-trained encoder to generate client-specific trigger sets using OoD datasets such as USPS, GTSRB, random noise, or jigsaw images.
• Embed the watermark during model training by fine-tuning the global model with the trigger set and the original training data, using an objective function that preserves standard accuracy.
• Deploy a decoder during verification to decode the watermark by testing the suspect model on all trigger sets and identifying the client with the highest watermark success rate (WSR).
• Ensure robustness by using a decoder to prevent false positives due to watermark collisions, improving traceability confidence.
• Support hybrid deployment by combining DUW with existing black-box unified watermarks, enabling dual detection and client-level tracking.

Experimental results

Research questions

• RQ1 Can a watermarking scheme uniquely identify the client responsible for leaking a global FL model in a distributed setting?
• RQ2 How effective is the proposed method in maintaining model utility while embedding client-specific watermarks?
• RQ3 To what extent is the watermark robust against common watermark removal and model fine-tuning attacks?
• RQ4 How does the choice of OoD dataset affect the trade-off between model accuracy and watermark detection performance?
• RQ5 Can the method scale to large numbers of clients without degradation in tracking accuracy or watermark detection reliability?

Key findings

• DUW achieves over 99% watermark success rate (WSR) on Digits, CIFAR-10, and CIFAR-100 datasets under heterogeneous FL settings.
• The method identifies the IP infringer with 100% accuracy, even after common watermark removal attempts and model fine-tuning.
• Using random noise or jigsaw OoD datasets results in less than 1% accuracy degradation, while maintaining high WSR and fast accuracy recovery.
• With 600 clients, DUW maintains 73.37% WSR and 100% traceability accuracy (TAcc), demonstrating strong scalability.
• The decoder improves traceability by reducing false positives, increasing TAcc to 100% and minimizing collision risks.
• Hybrid watermarking with a unified black-box watermark preserves DUW’s effectiveness, with only a 0.72% drop in WSR and 98.82% unified watermark success rate.