Protecting Intellectual Property With Reliable Availability of Learning Models in AI-Based Cybersecurity Services

Ren, Ge; Wu, Jun; Li, Gaolei; Li, Shenghong; Guizani, Mohsen

doi:10.1109/tdsc.2022.3222972

Cited by 8 publications

(24 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We conduct experiments on four datasets: CIFAR10, CIFAR100, GTSRB and ImageNet ILSVRC-2012. These chosen datasets are standard image sets for classification training, widely used in computer vision studies [44], [45] and previous works [30], [17], [46]. To simplify the process, we randomly select a subset consisting of 400 classes with 480,000 images for training (1200 images per class) and 20,000 images for testing (50 images per class).…”

Section: ) Datasets and Models Settingsmentioning

confidence: 99%

“…Besides, our proposed protection scheme also excels in a few emerging active protection methods [30], [17], [16], [46], [44], [7], [45], [47], [3], [27] in the following aspects: a) Other active protection methods achieve access control mechanisms by changing the neural network structure [17], [16], [44], modifying neuronal functions [7], [45], and encrypting weights with extra verification credentials irrelevant to queried samples [47], [3], [27]. These implementations are complicated and inconvenient due to extra structure modifications and computational encrypting overhead.…”

Section: Introductionmentioning

confidence: 99%

“…These implementations are complicated and inconvenient due to extra structure modifications and computational encrypting overhead. b) The designed verification credentials of other prior methods [30], [46] are unconcealed and fixed to be visible to humans. Therefore, these credentials are hard to meet the requirements of credentials security.…”

Section: Introductionmentioning

confidence: 99%

“…c) Other active protection methods have limitations in identity management and the large-scale user capacity of one single trained model. Specifically, the M-LOCK [30] and ADIP [46] methods only have user capacities of 1 and 252, so they are infeasible for practical deployment. By contrast, a) we adopt the data poisoning technique to achieve a built-in access control mechanism in DNNs without modifications and extra weights encryption.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

ActiveDaemon: Unconscious DNN Dormancy and Waking Up via User-specific Invisible Token

Ren,

Li,

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Well-trained deep neural network (DNN) models can be treated as commodities for commercial transactions and generate significant revenues, raising the urgent need for intellectual property (IP) protection against illegitimate reproducing. Emerging studies on IP protection often aim at inserting watermarks into DNNs, allowing owners to passively verify the ownership of target models after counterfeit models appear and commercial benefits are infringed, while active authentication against unauthorized queries of DNN-based applications is still neglected. In this paper, we propose a novel approach to protect model intellectual property, called ActiveDaemon, which incorporates a built-in access control function in DNNs to safeguard against commercial piracy. Specifically, our approach enables DNNs to predict correct outputs only for authorized users with user-specific tokens while producing poor accuracy for unauthorized users. In ActiveDaemon, the user-specific tokens are generated by a specially designed U-Net style encoder-decoder network, which can map strings and input images into numerous noise images to address identity management with large-scale user capacity. Compared to existing studies, these user-specific tokens are invisible, dynamic and more perceptually concealed, enhancing the stealthiness and reliability of model IP protection. To automatically wake up the model accuracy, we utilize the data poisoning-based training technique to unconsciously embed the ActiveDaemon into the neuron's function. We conduct experiments to compare the protection performance of ActiveDaemon with four state-of-the-art approaches over four datasets. The experimental results show that ActiveDaemon can reduce the accuracy of unauthorized queries by as much as 81% with less than a 1.4% decrease in that of authorized queries. Meanwhile, our approach can also reduce the LPIPS scores of the authorized tokens to 0.0027 on CIFAR10 and 0.0368 on ImageNet 1 .

show abstract

Section: ) Datasets and Models Settingsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

ActiveDaemon: Unconscious DNN Dormancy and Waking Up via User-specific Invisible Token

Ren,

Li,

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…However, such a surgical pipeline increases the difficulty and complexity of backdoor erasing tasks, but only alleviates the aforementioned problems. What's more, these staged methods are easily compromised by newlydesigned attacks with either trigger that is harder to be detected and recovered [21,22], or composite trigger that contains multiple parts [27,36,38,48].…”

Section: Introductionmentioning

confidence: 99%

DHBE: Data-free Holistic Backdoor Erasing in Deep Neural Networks via Restricted Adversarial Distillation

Yan

Tian

et al. 2023

Proceedings of the ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

Backdoor attacks have emerged as an urgent threat to Deep Neural Networks (DNNs), where victim DNNs are furtively implanted with malicious neurons that could be triggered by the adversary. To defend against backdoor attacks, many works establish a staged pipeline to remove backdoors from victim DNNs: inspecting, locating, and erasing. However, in a scenario where a few clean data can be accessible, such pipeline is fragile and cannot erase backdoors completely without sacrificing model accuracy. To address this issue, in this paper, we propose a novel data-free holistic backdoor erasing (DHBE) framework. Instead of the staged pipeline, the DHBE treats the backdoor erasing task as a unified adversarial procedure, which seeks equilibrium between two different competing processes: distillation and backdoor regularization. In distillation, the backdoored DNN is distilled into a proxy model, transferring its knowledge about clean data, yet backdoors are simultaneously transferred. In backdoor regularization, the proxy model is holistically regularized to prevent from infecting any possible backdoor transferred from distillation. These two processes jointly proceed with data-free adversarial optimization until a clean, high-accuracy proxy model is obtained. With the novel adversarial design, our framework demonstrates its superiority in three aspects: 1) minimal detriment to model accuracy, 2) high tolerance for hyperparameters, and 3) no demand for clean data. Extensive experiments on various backdoor attacks and datasets are performed to verify the effectiveness of the proposed framework. Code is available at https://github.com/yanzhicong/DHBE

show abstract

PDD: Partitioning DAG-Topology DNNs for Streaming Tasks

Wu,

Gao,

et al. 2024

IEEE Internet Things J.

View full text Add to dashboard Cite

Protecting Intellectual Property With Reliable Availability of Learning Models in AI-Based Cybersecurity Services

Cited by 8 publications

References 30 publications

ActiveDaemon: Unconscious DNN Dormancy and Waking Up via User-specific Invisible Token

ActiveDaemon: Unconscious DNN Dormancy and Waking Up via User-specific Invisible Token

DHBE: Data-free Holistic Backdoor Erasing in Deep Neural Networks via Restricted Adversarial Distillation

PDD: Partitioning DAG-Topology DNNs for Streaming Tasks

Contact Info

Product

Resources

About