Reproduce “Defending against Model Stealing via Verifying Embedded External Features” on OpenResearch

About this paper

Yiming Li, Linghui Zhu, Xiaojun Jia, Yong Jiang, Shu-Tao Xia, Xiaochun Cao

This research introduces a defense mechanism against model stealing by embedding defender-specified external features into deep learning models, outperforming existing verification methods in detecting stolen copies with minimal impact on model performance. The approach leverages style transfer and a gradient-based meta-classifier to reliably identify unauthorized model duplicates.

Key insights

• Deep neural networks robustly learn texture and style information, making style transfer an effective method for embedding unique, verifiable external features without altering core classification tasks.
• The sign vector of a model's gradients provides a discriminative 'fingerprint' of how it processes specific inputs, enabling reliable detection of embedded features by a meta-classifier.
• Verifying knowledge of explicitly embedded external features, rather than relying on inherent dataset features or easily alterable backdoor triggers, provides a more robust and secure defense against various model stealing attacks.

Summary by alphaXiv.