Inconspicuous data augmentation based backdoor attack on deep neural networks

Recently proposed model functionality and attribute extraction techniques have exacerbated unauthorized low-cost reproduction of deep neural network (DNN) models for similar applications. In particular, intellectual property (IP) theft and unauthorized distribution of DNN models by dishonest buyers are very difficult to trace by existing framework of digital rights management (DRM). This paper presents a new buyer-traceable DRM scheme against model piracy and misappropriation. Unlike existing methods that require white-box access to extract the latent information for verification, the proposed method utilizes data poisoning for distributorship embedding and black-box verification. Composite backdoors are installed into the target model during the training process. Each backdoor is created by applying a data augmentation method to some clean images of a selected class. The data-augmented images with a wrong label associated with a buyer are injected into the training dataset. The ownership and distributorship of a backdoor-trained user model can be validated by querying the suspect model with a set of composite triggers. A positive suspect will output the dirty labels that pinpoint the dishonest buyer while an innocent model will output the correct labels with high confidence. The tracking accuracy and robustness of the proposed IP protection method are evaluated on CIFAR-10, CIFAR-100 and GTSRB datasets for different applications. The results show an average of 100% piracy detection rate, 0% false positive rate and 96.81% traitor tracking success rate with negligible model accuracy degradation.

C. H. (2023). An imperceptible data augmentation based blackbox clean-label backdoor attack on deep neural networks. IEEE Transactions On Circuits and Systems I: Regular Papers, 70(12), 5011-5024.