神经脱水：在有限数据下有效擦除深度神经网络中的黑盒水印
Neural Dehydration: Effective Erasure of Black-box Watermarks from DNNs with Limited Data
AI总结：
本文提出与具体水印无关的移除攻击 Neural Dehydration（Dehydra），通过恢复并遗忘模型内部水印消息，在仅需极少数据甚至无数据条件下有效擦除十种主流黑盒水印，同时保留至少90%的模型效用。
摘要：
为了保护训练良好的深度神经网络（DNN）的知识产权，黑盒水印被嵌入到 DNN 模型在一组特制样本上的预测行为中，并且只需通过 API 访问即可从可疑模型中提取，因此在学术界和工业界日益流行。水印鲁棒性通常针对窃取受保护模型并混淆其参数以移除水印的攻击者来实现。然而，当前的鲁棒性评估主要是在中等强度的攻击或不现实的设置下进行的。现有的移除攻击只能破解主流黑盒水印中的一小部分，并且在四个关键方面存在不足：移除不完整、依赖水印的先验知识、性能下降以及对数据的高度依赖。\n\n在本文中，我们提出了一种与具体水印无关的移除攻击，称为 Neural Dehydration（缩写为 Dehydra），它能够在仅有限甚至不依赖数据的情况下，有效擦除 DNN 中全部十种主流黑盒水印。总体而言，我们的攻击流程利用受保护模型的内部信息来恢复并遗忘水印消息。我们进一步设计了目标类别检测和恢复样本分割算法，以减少效用损失，并在五种水印方案上实现了无数据水印移除。我们在三个基准数据集和 DNN 架构上，针对十种主流黑盒水印对 Dehydra 进行了全面评估。与现有的移除攻击相比，Dehydra 在数据受限设置下（即少于 2% 的训练数据甚至无数据）对所有覆盖的水印都实现了强大的移除效果，同时至少保留了被窃模型 90% 的效用。
英文摘要：
To protect the intellectual property of well-trained deep neural networks (DNNs), black-box watermarks, which are embedded into the prediction behavior of DNN models on a set of specially-crafted samples and extracted from suspect models using only API access, have gained increasing popularity in both academy and industry. Watermark robustness is usually implemented against attackers who steal the protected model and obfuscate its parameters for watermark removal. However, current robustness evaluations are primarily performed under moderate attacks or unrealistic settings. Existing removal attacks could only crack a small subset of the mainstream black-box watermarks, and fall short in four key aspects: incomplete removal, reliance on prior knowledge of the watermark, performance degradation, and high dependency on data. In this paper, we propose a watermark-agnostic removal attack called \textsc{Neural Dehydration} (\textit{abbrev.} \textsc{Dehydra}), which effectively erases all ten mainstream black-box watermarks from DNNs, with only limited or even no data dependence. In general, our attack pipeline exploits the internals of the protected model to recover and unlearn the watermark message. We further design target class detection and recovered sample splitting algorithms to reduce the utility loss and achieve data-free watermark removal on five of the watermarking schemes. We conduct comprehensive evaluation of \textsc{Dehydra} against ten mainstream black-box watermarks on three benchmark datasets and DNN architectures. Compared with existing removal attacks, \textsc{Dehydra} achieves strong removal effectiveness across all the covered watermarks, preserving at least $90\%$ of the stolen model utility, under the data-limited settings, i.e., less than $2\%$ of the training data or even data-free.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
