基于PUF的DNN指纹识别用于知识蒸馏追踪
PDF: PUF-based DNN Fingerprinting for Knowledge Distillation Traceability
AI总结：
本文提出基于PUF的DNN指纹识别方法，用于知识蒸馏中的模型追踪与问责，通过轻量级的签名叠加技术实现模型的可追溯性与安全性。
摘要：
知识蒸馏将大型教师模型转移到紧凑的学生模型中，使模型能够在资源受限的平台上部署，同时造成最小的性能下降。然而，这种范式可能导致各种安全风险，尤其是模型窃取。现有的对抗模型窃取的防御措施，如水印和安全围栏，主要关注身份认证，并且带来显著的资源成本。旨在提供窃取后的问责和可追溯性，我们提出了一种新颖的指纹框架，该框架在蒸馏过程中将设备特定的物理不可克隆功能（PUF）签名叠加到教师日志上。与水印或安全围栏相比，我们的方法轻量级，不需要架构更改，并且能够追溯任何泄露或克隆的模型。由于签名基于PUF，该框架对逆向工程和篡改攻击具有鲁棒性。在该框架中，签名恢复过程分为两个阶段：首先是基于神经网络的解码器，然后是汉明距离解码器。此外，我们还提出了一种位压缩方案以支持大量设备。实验结果表明，我们的框架在实现高密钥恢复率和几乎无准确率损失的同时，允许在两个关键指标之间进行可调的权衡。这些结果表明，所提出的框架是保护蒸馏模型的实用且稳健的解决方案。
英文摘要：
Knowledge distillation transfers large teacher models to compact student models, enabling deployment on resource-limited platforms while suffering minimal performance degradation. However, this paradigm could lead to various security risks, especially model theft. Existing defenses against model theft, such as watermarking and secure enclaves, focus primarily on identity authentication and incur significant resource costs. Aiming to provide post-theft accountability and traceability, we propose a novel fingerprinting framework that superimposes device-specific Physical Unclonable Function (PUF) signatures onto teacher logits during distillation. Compared with watermarking or secure enclaves, our approach is lightweight, requires no architectural changes, and enables traceability of any leaked or cloned model. Since the signatures are based on PUFs, this framework is robust against reverse engineering and tampering attacks. In this framework, the signature recovery process consists of two stages: first a neural network-based decoder and then a Hamming distance decoder. Furthermore, we also propose a bit compression scheme to support a large number of devices. Experiment results demonstrate that our framework achieves high key recovery rate and negligible accuracy loss while allowing a tunable trade-off between these two key metrics. These results show that the proposed framework is a practical and robust solution for protecting distilled models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
