Adversarial frontier stitching for remote neural network watermarking

Erwan Le Merrer 1 Patrick Pérez 2 Gilles Trédan 3
1 WIDE - the World Is Distributed Exploring the tension between scale and coordination
Inria Rennes – Bretagne Atlantique , IRISA_D1 - SYSTÈMES LARGE ÉCHELLE
3 LAAS-TSF - Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique
LAAS - Laboratoire d'analyse et d'architecture des systèmes [Toulouse]
Abstract : The state of the art performance of deep learning models comes at a high cost for companies and institutions, due to the tedious data collection and the heavy processing requirements. Recently, [35, 22] proposed to watermark con-volutional neural networks for image classification, by embedding information into their weights. While this is a clear progress towards model protection, this technique solely allows for extracting the watermark from a network that one accesses locally and entirely. Instead, we aim at allowing the extraction of the watermark from a neural network (or any other machine learning model) that is operated remotely, and available through a service API. To this end, we propose to mark the model's action itself, tweaking slightly its decision frontiers so that a set of specific queries convey the desired information. In the present paper, we formally introduce the problem and propose a novel zero-bit watermarking algorithm that makes use of adversarial model examples. While limiting the loss of performance of the protected model, this algorithm allows subsequent extraction of the watermark using only few queries. We experimented the approach on three neural networks designed for image classification, in the context of MNIST digit recognition task.
Complete list of metadatas

Cited literature [40 references]  Display  Hide  Download

https://hal.archives-ouvertes.fr/hal-02264449
Contributor : Erwan Le Merrer <>
Submitted on : Wednesday, August 7, 2019 - 9:26:15 AM
Last modification on : Monday, August 19, 2019 - 2:12:56 PM

File

main-nca.pdf
Files produced by the author(s)

Identifiers

  • HAL Id : hal-02264449, version 1

Citation

Erwan Le Merrer, Patrick Pérez, Gilles Trédan. Adversarial frontier stitching for remote neural network watermarking. Neural Computing and Applications, Springer Verlag, In press. ⟨hal-02264449⟩

Share

Metrics

Record views

30

Files downloads

11