StegGuard：通过秘密嵌入器与提取器对自监督预训练编码器进行指纹识别
StegGuard: Fingerprinting Self-supervised Pre-trained Encoders via Secrets Embeder and Extractor
AI总结：
本研究提出基于隐写术的预训练编码器指纹机制StegGuard，通过频域注意力嵌入秘密并提取验证，仅需少量查询图像即可可靠识别盗版编码器，且对多种模型窃取攻击具备鲁棒性。
摘要：
本研究提出StegGuard，一种利用隐写术验证可疑预训练编码器所有权的新型指纹机制。StegGuard的核心观点在于：预训练编码器所执行的从图像到嵌入的转换的独特特征，可通过嵌入器将秘密嵌入图像、以及秘密经过编码器转换后提取器以可容忍误差从编码器嵌入中提取秘密的过程等效呈现。每个独立编码器都有独特的转换方式，而盗版编码器的转换方式与受害编码器相似。基于此，我们训练一对秘密嵌入器和提取器作为受害编码器的指纹。我们在嵌入器中引入频域通道注意力嵌入模块，以自适应地将秘密嵌入合适的频段。验证阶段，若能从可疑编码器的嵌入中以可接受误差提取出嵌入到查询图像中的秘密，则判定该可疑编码器为盗版，否则为独立编码器。大量实验表明，仅需极少量查询图像，StegGuard就能在各类独立编码器中可靠识别盗版，且对模型窃取相关攻击（包括模型提取、微调、剪枝、嵌入加噪和打乱）具有鲁棒性。
英文摘要：
In this work, we propose StegGuard, a novel fingerprinting mechanism to verify the ownership of the suspect pre-trained encoder using steganography. A critical perspective in StegGuard is that the unique characteristic of the transformation from an image to an embedding, conducted by the pre-trained encoder, can be equivalently exposed how an embeder embeds secrets into images and how an extractor extracts the secrets from encoder's embeddings with a tolerable error after the secrets are subjected to the encoder's transformation. While each independent encoder has a distinct transformation, the piracy encoder has a similar transformation to the victim. Based on these, we learn a pair of secrets embeder and extractor as the fingerprint for the victim encoder. We introduce a frequency-domain channel attention embedding block into the embeder to adaptively embed secrets into suitable frequency bands. During verification, if the secrets embedded into the query images can be extracted with an acceptable error from the suspect encoder's embeddings, the suspect encoder is determined as piracy, otherwise independent. Extensive experiments demonstrate that depending on a very limited number of query images, StegGuard can reliably identify across varied independent encoders, and is robust against model stealing related attacks including model extraction, fine-tuning, pruning, embedding noising and shuffle.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
