[论文解读] AdvParams: An Active DNN Intellectual Property Protection Technique via Adversarial Perturbation Based Parameter Encryption

Mingfu Xue, Zhiyu Wu+3 more|arXiv (Cornell University)|May 28, 2021

Adversarial Robustness in Machine Learning参考文献 22被引用 4

一句话总结

本文提出 AdvParams，一种主动的深度神经网络（DNN）知识产权保护方法，通过对抗性扰动对极少数关键模型参数进行加密，使未经授权用户模型准确率大幅下降，而授权用户凭借密钥可保持高准确率。该方法在仅修改 0.000205% 参数的情况下，于 GTSRB 上实现高达 87.91% 的准确率下降，且无需微调或硬件支持。

ABSTRACT

A well-trained DNN model can be regarded as an intellectual property (IP) of the model owner. To date, many DNN IP protection methods have been proposed, but most of them are watermarking based verification methods where model owners can only verify their ownership passively after the copyright of DNN models has been infringed. In this paper, we propose an effective framework to actively protect the DNN IP from infringement. Specifically, we encrypt the DNN model's parameters by perturbing them with well-crafted adversarial perturbations. With the encrypted parameters, the accuracy of the DNN model drops significantly, which can prevent malicious infringers from using the model. After the encryption, the positions of encrypted parameters and the values of the added adversarial perturbations form a secret key. Authorized user can use the secret key to decrypt the model. Compared with the watermarking methods which only passively verify the ownership after the infringement occurs, the proposed method can prevent infringement in advance. Moreover, compared with most of the existing active DNN IP protection methods, the proposed method does not require additional training process of the model, which introduces low computational overhead. Experimental results show that, after the encryption, the test accuracy of the model drops by 80.65%, 81.16%, and 87.91% on Fashion-MNIST, CIFAR-10, and GTSRB, respectively. Moreover, the proposed method only needs to encrypt an extremely low number of parameters, and the proportion of the encrypted parameters of all the model's parameters is as low as 0.000205%. The experimental results also indicate that, the proposed method is robust against model fine-tuning attack and model pruning attack. Moreover, for the adaptive attack where attackers know the detailed steps of the proposed method, the proposed method is also demonstrated to be robust.

研究动机与目标

• 为解决被动水印方法仅在侵权发生后才能验证所有权的局限性。
• 开发一种主动的 DNN IP 保护机制，在侵权发生前即防止未经授权的使用。
• 通过避免微调或硬件依赖，将计算开销降至最低。
• 确保对常见攻击（如微调、剪枝和自适应攻击）具有鲁棒性。

提出的方法

• 通过计算损失函数相对于权重的梯度，识别最具影响力的模型参数。
• 对这些选定参数施加定向对抗性扰动，以最大化性能退化。
• 生成一个包含加密参数位置和扰动值的密钥。
• 在解密过程中，使用该密钥恢复原始模型行为，供授权用户使用。
• 确保仅修改极少数参数——最大情况下仅加密 23 个参数——同时保持扰动幅度难以察觉。
• 证明该方法对模型微调、剪枝及自适应攻击具有鲁棒性，即使攻击者已知晓方法机制。

实验结果

研究问题

• RQ1 能否利用对抗性扰动选择性地仅加密少数关键参数，从而使未经授权用户无法使用 DNN 模型？
• RQ2 所提方法在使未经授权用户模型准确率显著下降的同时，能否保持授权用户高准确率？
• RQ3 该方法在面对试图恢复模型功能的微调和剪枝攻击时是否仍具鲁棒性？
• RQ4 该方法是否可无需微调或硬件依赖，从而在实际部署中实现低计算开销？
• RQ5 当攻击者完全知晓加密机制内部步骤时，该方法在自适应攻击下的表现如何？

主要发现

• 对于未经授权用户，该方法在 Fashion-MNIST、CIFAR-10 和 GTSRB 上分别将测试准确率降低了 80.65%、81.16% 和 87.91%。
• 最大情况下仅加密了 23 个参数，占总参数数的 0.000205%。
• 在三个数据集上，授权用户分别保持了 91.01%、92.02% 和 94.85% 的准确率。
• 在模型微调攻击后，准确率最低降至 61.66%；在剪枝攻击后，准确率下降至 17.64%。
• 即使在自适应攻击下（攻击者已知方法内部步骤），模型准确率仍保持在较低水平（Fashion-MNIST 上为 56.28%，CIFAR-10 上为 62.03%，GTSRB 上为 63.92%）。
• 该方法无需额外训练或硬件支持，具有实际商业部署的可行性。