ISSN 1000-1239 CN 11-1777/TP

Journal of Computer Research and Development ›› 2021, Vol. 58 ›› Issue (5): 1106-1117.doi: 10.7544/issn1000-1239.2021.20200903

Special Issue: 2021人工智能安全与隐私保护技术专题

Previous Articles     Next Articles

An Evasion Algorithm to Fool Fingerprint Detector for Deep Neural Networks

Qian Yaguan1,2, He Niannian1,2, Guo Yankai1,2, Wang Bin2, Li Hui3, Gu Zhaoquan4, Zhang Xuhong5, Wu Chunming6   

  1. 1（School of Big-data Science, Zhejiang University of Science and Technology, Hangzhou 310023);2(Edge Intelligence Security Joint Laboratory, Hikvision & Zhejiang University of Science and Technology, Hangzhou 310023);3(School of Cyber Engineering, Xidian University, Xi’an 710071);4(Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou 510006);5(College of Control Science and Engineering, Zhejiang University, Hangzhou 310058);6(College of Computer Science and Technology, Zhejiang University, Hangzhou 310058)
  • Online:2021-05-01
  • Supported by: 
    This work was supported by the National Key Research and Development Program of China (2018YFB2100400, 2018YFB1800601), the National Natural Science Foundation of China (61902082), the Key Research and Development Program of Zhejiang Province (2020C01077, 2021C01036, 2020C01021), and the Major Scientific Project of Zhejiang Lab (2018FD0ZX01).

RichHTML

6

PDF

240

Abstract: With the successful application of deep neural networks in various fields, the protection of intellectual property of models becomes more important. Since training the deep neural network requires a large number of computing resources, labor costs, and time costs, some people attempt to build a local substitute model with lower cost by stealing the target model’s parameters. For protecting the intellectual property of model owners, a model fingerprint matching method is proposed recently, which uses the fingerprint examples near the decision boundary of the model and their fingerprints to check whether their models have been stolen. The advantage of this method is that it does not affect the performance of the model itself. However, this protection strategy has some vulnerabilities, and we propose an evasion algorithm to successfully bypass the protection. The key component of our evasion algorithm is a fingerprint-example detector termed as Fingerprint-GAN. The Fingerprint-GAN first learns the feature representation and distribution of normal examples in a latent space. According to the difference of the feature representation in the latent space between the fingerprint examples and the normal examples, the Fingerprint-GAN finds the fingerprint examples. Finally, the labels of the fingerprint examples different from the predictions are returned to fool fingerprint matching method of the target model owner. Extensive experiments are conducted on CIFAR-10 and CIFAR-100. The results show that the detection rate of this algorithm for fingerprint examples can reach 95% and 94%, respectively, while the model owner’s fingerprint matching success rate is only 19%, which proves the unreliability of the model fingerprint matching protection method.

Key words: intellectual property protection, model stealing, model fingerprints, generative adversarial network, evasion algorithms

CLC Number: