TAFA: A Task-Agnostic Fingerprinting Algorithm for Neural Networks

Abstract

Well-trained deep neural networks (DNN) are an indispensable part of the intellectual property of the model owner. However, the confidentiality of models are threatened by model piracy, which steals a DNN and obfuscates the pirated model with post-processing techniques. To counter model piracy, recent works propose several model fingerprinting methods, which are commonly based on a special set of adversarial examples of the owner’s classifier as the fingerprints, and verify whether a suspect model is pirated based on whether the predictions on the fingerprints from the suspect model and from the owner’s model match with one another. However, existing fingerprinting schemes are limited to models for classification and usually require access to the training data. In this paper, we propose the first Task-Agnostic Fingerprinting Algorithm (TAFA) for the broad family of neural networks with rectified linear units. Compared with existing adversarial example-based fingerprinting algorithms, TAFA enables model fingerprinting for DNNs on a variety of downstream tasks including but not limited to classification, regression and generative modeling, with no assumption on training data access. Extensive experimental results on three typical scenarios strongly validate the effectiveness and the robustness of TAFA.

Appendices

A More Backgrounds on Deep Learning

$\bullet$ Learning Tasks. In a general deep learning scenario, we denote a deep neural network (DNN) as $F(\cdot ; \varTheta )$, a parametric model which maps a data input x in $\mathcal {X} \subset \mathbb {R}^{d_{\text {in}}}$ to prediction $y = F(x; \varTheta )$ in $\mathcal {Y} \subset {R}^{d_\text {out}}$. The concrete choice of the prediction space $\mathcal {Y}$ depends on the nature of the downstream task to which the DNN is applied. In this paper, we mainly evaluate our proposed fingerprinting algorithm on the following three popular learning tasks.

(1) Classification: In a K-class classification task, a DNN learns to classify a data input x (e.g., an image) into one of the N classes (e.g., based on the contained object). Usually, a DNN for classification has its prediction space as a N-dimensional simplex , where each prediction is called a probability vector with $p_i$ giving the predicted probability of x belonging to the i-th class.

(2) Regression: In a regression task, a DNN learns to predict the corresponding $d_\text {out}$-dimensional value y (e.g., drug dosing) based on the $d_\text {in}$-dimensional input x (e.g., demographic information).

(3) Generative Modeling: In a generative modeling task, a DNN learns to model the distribution of a given dataset (e.g., hand-written digits) for the purpose of data generation (e.g., generative adversarial nets [44]). Once trained, the DNN is able to output a prediction (e.g., a realistic hand-written digit) which has the same shape as the real samples in the dataset, when a random noise is input to the model. Although there are a few more typical learning tasks (e.g., ranking and information retrieval) in nowadays deep learning practices, the above three tasks already cover a majority of use cases of DNNs [23].

$\bullet$ Formulation of Layer Structures. To be self-contained, we formalize the two typical neural network layers below.

Definition

A1 (Fully-Connected Layer). A fully-connected layer $f_{\text {FC}}$ is composed of a weight matrix $W_0 \in \mathbb {R}^{d_{1}\times {d_\text {in}}}$ and a bias vector $b_0 \in \mathbb {R}^{d_{1}}$. Applying the fully-connected layer to an input $x \in \mathbb {R}^{d_{\text {in}}}$ computes $f_{\text {FC}}(x) := W_{0}x + b_0.$

Definition

A2 (Convolutional Layer). For the simplest case¹, a convolutional layer $f_{\text {Conv}}$ is composed of $C_\text {out}$ filters, i.e., $W^c \in \mathbb {R}^{{C_\text {in}}\times {K}\times {K}}$, and a bias vector $b \in \mathbb {R}^{C_\text {out}}$. For each output channel , applying the convolutional layer to an input $x\in \mathbb {R}^{C_\text {in}\times {H}_\text {in}\times {W_{\text {in}}}}$ computes $f_{\text {Conv}, c}(x) = \sum _{k=1}^{C_\text {in}}W^c * x^k + b_c,$ where $[W^c * x^k]_{ij} := \sum _{m=1}^{K}\sum _{n=1}^{K}[W^c]_{m, n}[x^{k}]_{i-m,j-n}$, the cross-correlation between the c-th filter $W^c$ and the k-th input channel $x^k$.

B More Evaluation Details and Results

1.1 B.1 Details of Scenarios

We introduce the details of the tasks, the datasets and the model architectures studied in our work.

Fig. 6.

Performance of the target model, the positive and the negative suspect models on the three scenarios.

(1) Skin Cancer Classification (abbrev. Skin). The first scenario covers the usage of deep CNN for skin cancer diagnosis. According to [36], we train a ResNet-18 [1] as the target model on DermaMNIST [36], which consists of 10005 multi-source dermatoscopic images of common pigmented skin lesions imaging dataset. The input size is originally $3\times {28}\times {28}$, which is upsampled to $3\times {224}\times {224}$ to fit the input shape of a standard ResNet-18 architecture implemented in torchvision. The task is a 7-class classification task.

(2) Warfarin Dose Prediction (abbrev. Warfarin). The second scenario covers the usage of FCN for warfarin dose prediction, which is a safety-critical regression task that helps predict the proper individualised warfarin dosing according to the demographic and physiological record of the patients (e.g., weight, age and genetics). We use the International Warfarin Pharmacogenetics Consortium (IWPC) dataset [37], which is a public dataset composed of 31-dimensional features of 6256 patients and is widely used for researches in automated warfarin dosing. According to [45], we use a three-layer fully-connected neural network with ReLU as the target model, with its hidden layer composed of 100 neurons. The target model learns to predict the value of proper warfarin dosing, a non-negative real-valued scalar in (0, 300.0].

Fig. 7.

The curves of ARUC when we control the distance between samples in each fingerprinting pair during the fingerprint generation.

(3) Fashion Generation (abbrev. Fashion). The final scenario covers the usage of FCN for generative modeling. We choose [38], which consists of $28\times {28}$ images for 60000 articles of clothing. Following the paradigm of Wasserstein generative adversarial networks (WGAN [46]), we train a 5-layer FCN of architecture $(64-128-256-512-768)$ as the generator and a 4-layer FCN of architecture $(768-512-256-1)$. We view the FCN-based generator as the target model, because a well-trained generator represents more the IP of the model owner as it can be directly used to generate realistic images without the aid of the discriminator.