本文提出一种基于可解释AI的DNN知识产权保护方法InFIP，利用Deep Taylor Decomposition提取模型内在特征作为指纹，无需修改模型即可实现可解释的所有权验证，且对多种攻击具有鲁棒性。
摘要：
近年来，深度神经网络（DNNs）的知识产权（IP）保护引起了严重关注。现有的大多数工作在DNN模型中嵌入水印以进行IP保护，这需要修改模型且缺乏可解释性。本文首次提出了一种基于可解释人工智能的、可解释的DNN知识产权保护方法。与现有工作相比，该方法不修改DNN模型，且所有权验证的决策是可解释的。我们利用Deep Taylor Decomposition提取DNN模型的内在特征。由于内在特征由模型决策的独特解释组成，因此该内在特征可视为模型的指纹。如果疑似模型的指纹与原始模型相同，则该疑似模型被视为盗版模型。实验结果表明，该指纹可成功用于验证模型的所有权，且模型的测试准确率不受影响。此外，所提方法对微调攻击、剪枝攻击、水印覆盖攻击和自适应攻击具有鲁棒性。
英文摘要：
Intellectual property (IP) protection for Deep Neural Networks (DNNs) has raised serious concerns in recent years. Most existing works embed watermarks in the DNN model for IP protection, which need to modify the model and lack of interpretability. In this paper, for the first time, we propose an interpretable intellectual property protection method for DNN based on explainable artificial intelligence. Compared with existing works, the proposed method does not modify the DNN model, and the decision of the ownership verification is interpretable. We extract the intrinsic features of the DNN model by using Deep Taylor Decomposition. Since the intrinsic feature is composed of unique interpretation of the model's decision, the intrinsic feature can be regarded as fingerprint of the model. If the fingerprint of a suspected model is the same as the original model, the suspected model is considered as a pirated model. Experimental results demonstrate that the fingerprints can be successfully used to verify the ownership of the model and the test accuracy of the model is not affected. Furthermore, the proposed method is robust to fine-tuning attack, pruning attack, watermark overwriting attack, and adaptive attack.
Intellectual Property Protection for 3D Gaussian Splatting Assets: A Survey
Sydney AI Centre, The University of Sydney（悉尼人工智能中心，悉尼大学）；The University of Melbourne（墨尔本大学）；Mohamed bin Zayed University of Artificial Intelligence（莫莫迪·本·扎耶德人工智能大学）
Nanjing University of Information Science and Technology（南京信息工程大学）；Jinan University（暨南大学）；University of Siena（锡耶纳大学）
We propose a watermarking method for protecting the Intellectual Property (IP) of Generative Adversarial Networks (GANs). The aim is to watermark the GAN model so that any image generated by the GAN contains an invisible watermark (signature), whose presence inside the image can be checked at a later stage for ownership verification. To achieve this goal, a pre-trained CNN watermarking decoding block is inserted at the output of the generator. The generator loss is then modified by including a watermark loss term, to ensure that the prescribed watermark can be extracted from the generated imag…
An Efficient and Effective Watermarking Scheme for the Protection of the Intellectual Property Rights of Video Generative Models
Sun Yat-sen University（中山大学）；Guangdong Provincial Key Laboratory of Information Security Technology（广东省信息安全技术重点实验室）；University of Florence（佛罗伦萨大学）；University of Siena（锡耶纳大学）；Qilu University of Technology (Shandong Academy of Sciences)（齐鲁工业大学（山东省科学院））
In order to prevent deep neural networks from being infringed by unauthorized parties, we propose a generic solution which embeds a designated digital passport into a network, and subsequently, either paralyzes the network functionalities for unauthorized usages or maintain its functionalities in the presence of a verified passport. Such a desired network behavior is successfully demonstrated in a number of implementation schemes, which provide reliable, preventive and timely protections against tens of thousands of fake-passport deceptions. Extensive experiments also show that the deep neural…
In the domain of medical image processing, medical device manufacturers protect their intellectual property in many cases by shipping only compiled software, i.e. binary code which can be executed but is difficult to be understood by a potential attacker. In this paper, we investigate how well this procedure is able to protect image processing algorithms. In particular, we investigate whether the computation of mono-energetic images and iodine maps from dual energy CT data can be reverse-engineered by machine learning methods. Our results indicate that both can be approximated using only one s…
University of Malaya（马来亚大学）；WeBank（微众银行）；Hong Kong University of Science and Technology（香港科技大学）
Ever since Machine Learning as a Service (MLaaS) emerges as a viable business that utilizes deep learning models to generate lucrative revenue, Intellectual Property Right (IPR) has become a major concern because these deep learning models can easily be replicated, shared, and re-distributed by any unauthorized third parties. To the best of our knowledge, one of the prominent deep learning models - Generative Adversarial Networks (GANs) which has been widely used to create photorealistic image are totally unprotected despite the existence of pioneering IPR protection methodology for Convolutio…
University of Science and Technology of China（中国科学技术大学）；Microsoft Research（微软研究院）；City University of Hong Kong（香港城市大学）；Beijing Electronic Science and Technology Institute（北京电子科技学院）；Wormpex AI Research LLC（Wormpex AI研究有限责任公司）
Despite the tremendous success, deep neural networks are exposed to serious IP infringement risks. Given a target deep model, if the attacker knows its full information, it can be easily stolen by fine-tuning. Even if only its output is accessible, a surrogate model can be trained through student-teacher learning by generating many input-output training pairs. Therefore, deep model IP protection is important and necessary. However, it is still seriously under-researched. In this work, we propose a new model watermarking framework for protecting deep networks trained for low-level computer visi…
University of Science and Technology of China（中国科学技术大学）；Microsoft Cloud AI（微软云人工智能）；City University of Hong Kong（香港城市大学）；Wormpex AI Research（沃姆派克斯人工智能研究院）
Despite tremendous success in many application scenarios, deep learning faces serious intellectual property (IP) infringement threats. Considering the cost of designing and training a good model, infringements will significantly infringe the interests of the original model owner. Recently, many impressive works have emerged for deep model IP protection. However, they either are vulnerable to ambiguity attacks, or require changes in the target network structure by replacing its original normalization layers and hence cause significant performance drops. To this end, we propose a new passport-aw…
Vision-Language Model IP Protection via Prompt-based Learning
The Key Laboratory of Brain-Machine Intelligence Technology, Ministry of Education（脑机智能技术重点实验室（教育部））；Centre for Innovation and Precision Eye Health, Yong Loo Lin School of Medicine, National University of Singapore（新加坡国立大学杨潞龄医学院创新与精准眼健康中心）；Institute of High Performance Computing, Agency for Science, Technology and Research（新加坡科学、技术与研究局高性能计算研究所）
IDEA: An Inverse Domain Expert Adaptation Based Active DNN IP Protection Method
School of Electrical and Electronic Engineering, Nanyang Technological University（南洋理工大学电子与电气工程学院）；Engineering Research Center of Digital Forensics, Ministry of Education, School of Computer Science, Nanjing University of Information Science and Technology（教育部长数字取证工程研究中心、信息科学技术大学计算机学院）；School of Electrical and Electronic Engineering and National Integrated Centre for Evaluation (NiCE), Nanyang Technological University（南洋理工大学电子与电气工程学院和国家整合评估中心（NiCE））
