MetaV：任务无关模型指纹的元验证方法
MetaV: A Meta-Verifier Approach to Task-Agnostic Model Fingerprinting
摘要：
对于模型盗版取证，先前的模型指纹方案通常基于为所有者的模型构造的对抗性示例作为\textit{fingerprint}，并且通过将指纹示例上的行为模式彼此匹配来验证可疑模型是否确实从原始模型盗版。然而，这些方法严重依赖于分类任务的特性，这抑制了它们在更一般场景中的应用。为了解决这个问题，我们提出了MetaV，这是第一个任务不可知的模型指纹识别框架，它可以在更广泛的DNN上进行指纹识别，独立于下游学习任务，并且对各种所有权混淆技术具有很强的鲁棒性。具体而言，我们将以前的计划概括为MetaV中的两个关键设计组件：\textit{adaptive fingerprint}和\textit{meta-verifier}，它们被联合优化，使得元验证器学习基于自适应指纹上的可疑模型的级联输出来确定可疑模型是否被盗。作为任务不可知的关键，全过程不对集合中的模型内部进行任何假设，只要它们具有相同的输入和输出维度。跨越分类，回归和生成建模，广泛的实验结果验证了MetaV的性能大大提高了国家的最先进的指纹方案，并证明了增强的通用性MetaV提供任务不可知的指纹。例如，在针对皮肤癌诊断训练的ResNet-18指纹识别中，MetaV在$70$可疑模型的不同测试集上同时实现了$100\%$真阳性和$100\%$真阴性，与最佳基线相比，实现了ARUC的约$220\%$相对改善。
英文摘要：
For model piracy forensics, previous model fingerprinting schemes are commonly based on adversarial examples constructed for the owner's model as the \textit{fingerprint}, and verify whether a suspect model is indeed pirated from the original model by matching the behavioral pattern on the fingerprint examples between one another. However, these methods heavily rely on the characteristics of classification tasks which inhibits their application to more general scenarios. To address this issue, we present MetaV, the first task-agnostic model fingerprinting framework which enables fingerprinting on a much wider range of DNNs independent from the downstream learning task, and exhibits strong robustness against a variety of ownership obfuscation techniques. Specifically, we generalize previous schemes into two critical design components in MetaV: the \textit{adaptive fingerprint} and the \textit{meta-verifier}, which are jointly optimized such that the meta-verifier learns to determine whether a suspect model is stolen based on the concatenated outputs of the suspect model on the adaptive fingerprint. As a key of being task-agnostic, the full process makes no assumption on the model internals in the ensemble only if they have the same input and output dimensions. Spanning classification, regression and generative modeling, extensive experimental results validate the substantially improved performance of MetaV over the state-of-the-art fingerprinting schemes and demonstrate the enhanced generality of MetaV for providing task-agnostic fingerprinting. For example, on fingerprinting ResNet-18 trained for skin cancer diagnosis, MetaV achieves simultaneously $100\%$ true positives and $100\%$ true negatives on a diverse test set of $70$ suspect models, achieving an about $220\%$ relative improvement in ARUC in comparison to the optimal baseline.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
