Dataset Inference: Ownership Resolution in Machine Learning

By Pratyush Maini. 2021

171 citations recorded by the source corpus.

With increasingly more data and computation involved in their training, machine learning models constitute valuable intellectual property. This has spurred interest in model stealing, which is made more practical by advances in learning with partial, little, or no supervision. Existing defenses focus on inserting unique watermarks in a model's decision surface, but this is insufficient: the watermarks are not sampled from the training distribution and thus are not always preserved during model stealing. In this paper, we make the key observation that knowledge contained in the stolen model's training set is what is common to all stolen copies. The adversary's goal, irrespective of the attack employed, is always to extract this knowledge or its by-products. This gives the original model's owner a strong advantage over the adversary: model owners have access to the original training data. We thus introduce $dataset$ $inference$, the process of identifying whether a suspected model copy has private knowledge from the original model's dataset, as a defense against model stealing. We develop an approach for dataset inference that combines statistical testing with the ability to estimate the distance of multiple data points to the decision boundary. Our experiments on CIFAR10, SVHN, CIFAR100 and ImageNet show that model owners can claim with confidence greater than 99% that their model (or dataset as a matter of fact) was stolen, despite only exposing 50 of the stolen model's training points. Dataset inference defends against state-of-the-art attacks even when the adversary is adaptive. Unlike prior work, it does not require retraining or overfitting the defended model.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

In Privacy & Security

Citations in the corpus

The False Promise of Imitating Proprietary LLMs (2023, background): “…this direction, e.g., one can detect whether a particular model is trained via imitation (Krishna et al., 2020; Juuti et al., 2019; Szyller et al., 2019; Maini et al., 2021) or slow model stealing by sacrifing some performance (Wallace et al., 2020; Orekondy et al., 2020; Dziedzic et al., 2022a,b).”
Increasing the Cost of Model Extraction with Calibrated Proof of Work (2022, background): “Dataset inference (Maini et al., 2021) identiﬁes whether a given model was stolen by verifying if a suspected adversary’s model has private knowledge from the original victim model’s dataset.”
TOFU: A Task of Fictitious Unlearning for LLMs (2024, unknown): “We propose a computationally feasible approach for assessing unlearning, inspired by the idea of dataset inference (Maini et al., 2021).”
On the Difficulty of Defending Self-Supervised Learning against Model Extraction (2022, methodology): “Following (Maini et al., 2021)’s method, we test the null hypothesis H0 : μp < μt where μp = l̄p and μt = l̄t are mean loss scores.”