Entangled Watermarks as a Defense against Model Extraction

By Hengrui Jia, Christopher A. Choquette-Choo, Nicolas Papernot. USENIX Security Symposium, 2020

300 citations recorded by the source corpus.

Machine learning involves expensive data collection and training procedures. Model owners may be concerned that valuable intellectual property can be leaked if adversaries mount model extraction attacks. Because it is difficult to defend against model extraction without sacrificing significant prediction accuracy, watermarking leverages unused model capacity to have the model overfit to outlier input-output pairs, which are not sampled from the task distribution and are only known to the defender. The defender then demonstrates knowledge of the input-output pairs to claim ownership of the model at inference. The effectiveness of watermarks remains limited because they are distinct from the task distribution and can thus be easily removed through compression or other forms of knowledge transfer. We introduce Entangled Watermarking Embeddings (EWE). Our approach encourages the model to learn common features for classifying data that is sampled from the task distribution, but also data that encodes watermarks. An adversary attempting to remove watermarks that are entangled with legitimate data is also forced to sacrifice performance on legitimate data. Experiments on MNIST, Fashion-MNIST, and Google Speech Commands validate that the defender can claim model ownership with 95% confidence after less than 10 queries to the stolen copy, at a modest cost of 1% accuracy in the defended model's performance.

Subfields: Artificial Intelligence, Signal Processing

View Paper: https://www.semanticscholar.org/paper/abbb0fd559ade70265f4f528df094fbbd8ae2040

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Signal Processing

Citations in the corpus

A Systematic Review on Model Watermarking for Neural Networks (2020, background): “[Jia et al., 2021], have proven the applicability of their schemes to other data types.”
Increasing the Cost of Model Extraction with Calibrated Proof of Work (2022, background): “Jia et al. (2020a) proposed entangled watermarks to ensure that watermarks are not easy to remove.”
On the Difficulty of Defending Self-Supervised Learning against Model Extraction (2022, methodology): “, 2019), Watermarking (Jia et al., 2020), Dataset Inference (Maini et al.”
Dataset Inference: Ownership Resolution in Machine Learning (2021, background): “This strategy not only requires new training procedures and decreases the model’s accuracy (Jia et al., 2020), but is also vulnerable to adaptive attacks that lessen the impact of watermarks on the model’s decision surface during extraction (Liu et al., 2018; Chen et al., 2019; Wang et al., 2019;…”