Protecting Deep Learning Model Copyrights with Adversarial Example-Free Reuse Detection

arXiv:2407.03883 · cs.CR, cs.LG, cs.SE · Submitted 2024-07-04 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Today's paper: "Protecting Deep Learning Model Copyrights with Adversarial Example-Free Reuse Detection".

Elias: The gist The proposed NFARD, a Neuron Functionality Analysis-based Reuse Detector,

Nadia: First, who's behind it and why it matters.

Paper summary: Elias: To get into the specifics of "Protecting Deep Learning Model Copyrights with Adversarial Example-Free Reuse Detection," the authors propose a method called Neuron Functionality Analysisbased Reuse Detector, or NFARD, which only requires normal test samples to detect reuse relations.

Nadia: So they are claiming that by measuring differences in neuron functionality—that mapping from input space to a one-dimensional output space—they can find reused models without needing those adversarial inputs.

Priya: What that means in plain terms is they’re using just normal test samples—the regular data—to see if the underlying structure of the model is being copied.

Elias: They define this neuron functionality as a mapping, and they use two metrics to measure similarity: ED(k), which is the average Euclidean distance between the k-th layer’s neuron vectors of two models, and CD(k), which is the average cosine distance of those vectors.

Nadia: And for black-box settings, NFARD approximates the last layer's neuron vector using logarithms of probabilities to compute a logit approximation, denoted as nv˜ (L, i).

Priya: That sounds like they’ve designed a system that can work across both white-box and black-box settings by using these specific distance metrics.

Elias: To handle different architectures or tasks, they devise a linear transformation method to construct an optimal projection matrix for dimension consistency. This allows all the metrics mentioned above to be applied even when the models have different structures.

Nadia: So this linear transformation is what makes NFARD applicable to heterogeneous reuse cases, which is a major step forward because existing methods struggled with that exact issue.

Priya: It’s interesting that they mention constructing a set of reference models, fri (·; θri), which share the same structure as the victim model but are trained independently to provide a reference for the detector.

Elias: That independence is key because it ensures those reference models represent typical variations in model behavior when trained without knowledge transfer from the original model.

Nadia: So, what does this mean for how we think about detecting reuse? It suggests that focusing on internal properties and using a mathematical projection to normalize the comparison makes it much more robust against architectural changes.

Elias: It definitely moves the conversation away from purely black-box attacks towards analyzing the internal structure of the neural network itself for detection purposes, and we need to figure out if this level of detail is actually practical when someone tries to use it commercially.

Conclusion: Nadia: So we’re wrapping up our look at this paper, "Protecting Deep Learning Model Copyrights with Adversarial Example-Free Reuse Detection," and the authors are really pushing a way to find reused models without needing those tricky adversarial examples.

Elias: Yeah, the authors of "Protecting Deep Learning Model Copyrights with Adversarial Example-Free Reuse Detection" are really pushing a way to find reused models without needing those tricky adversarial examples.

Priya: Basically, they’re using just normal test samples—the regular data—to see if the underlying structure of the model is being copied.

Nadia: It's about copyright protection for deep learning models, and this method uses neuron functionality as a fingerprint, which Priya mentioned. But what does this actually change for someone who just listens to the show?

Elias: It suggests a way to check if two models are related even if they have totally different architectures or they're doing different classification tasks.

Priya: The results on their benchmark, the Reuse Zoo, showed strong performance, with F1 scores around zero point nine eight in black-box settings and a perfect score in white-box settings. That’s pretty solid for a method that doesn't need extra setup.

Nadia: So we have this tool that uses normal data to find reuse across different types of models, which is something we haven't seen done before with these specific metrics.

Priya: But remember, this method only works well if you stick to their defined neuron functionality analysis; if you try a different way to measure it, things get messy again.

Nadia: So it’s not a magic detector that works on everything perfectly, but it’s a much more accessible way to look at reuse without needing those complex adversarial example setups.

Elias: It does move the conversation away from purely black-box attacks towards analyzing the internal structure of the neural network itself for detection purposes, and we need to figure out if this level of detail is actually practical when someone tries to use it commercially.

School of Mathematical Sciences, Peking University · School of Computer Science, University of Bristol · School of Control Science and Engineering, Zhejiang University

cs.CR, cs.LG, cs.SE

Submitted: 2024-07-04

Updated: 2025-06-09

Comments: 12 pages, 5 figures

Journal ref: IEEE Trans. Neural Netw. Learn. Syst. 36(10): 19187-19199 (2025)

DOI: 10.1109/TNNLS.2025.3578664

Code: https://github.com/pytorch/vision

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 88/100

The gist: The gist The proposed NFARD, a Neuron Functionality Analysis-based Reuse Detector, is a novel adversarial example-free method that detects deep learning model reuse relations by measuring differences

Key concepts

Neuron Functionality (NF): NF is a way to characterize a deep learning model by examining how each neuron processes information. It's defined as the mapping from the input space to a one-dimensional output space for that specific neuron. By measuring these functional differences between two models, NFARD can determine if they share underlying structural or functional similarities, even if their architectures are different.
Adversarial Example-Free Detection: This means the method detects reuse using only standard test samples from the models, avoiding the need to create tricky 'adversarial examples.' This is a key innovation because generating good adversarial examples is often difficult in real-world black-box scenarios. NFARD relies purely on analyzing inherent differences in neuron behavior observed during normal testing.
Heterogeneous Reuse Handling: This technique allows NFARD to work even when the reused models have different structures or perform different tasks. It uses a linear transformation and an optimal projection matrix to map complex, high-dimensional neuron functionality features from various models into a common, comparable low-dimensional space. This makes the detection robust across diverse reuse scenarios.

Terminology

Benchmark — 2× in this paper · explained in 2 episodes
Adversarial Examples — 1× in this paper · explained in 2 episodes
Consistency — 1× in this paper · explained in 3 episodes
F1 Score — 1× in this paper · explained in 3 episodes
Fingerprinting — 1× in this paper · explained in 2 episodes
Transferability — 1× in this paper · explained in 5 episodes

Summary

The gist The proposed NFARD, a Neuron Functionality Analysis-based Reuse Detector, is a novel adversarial example-free method that detects deep learning model reuse relations by measuring differences in neuron functionality using only normal test samples.

Model Reuse Detection Challenges

Model reuse techniques are common for saving resources when training high-performance deep neural networks (DNNs) [1]. However, unauthorized reuse and replication of DNNs can lead to copyright infringement and economic loss to the model owner [1]. Existing white-box fingerprinting approaches cannot address the common heterogeneous reuse case where the model architecture is changed, and DNN fingerprinting approaches heavily rely on generating adversarial examples with good transferability, which is known to be challenging in the blackbox setting [1]. Furthermore, existing fingerprinting methods struggle to reliably detect reuse relations when the two models have different architectures or address different classification tasks (heterogeneous cases) [2].

NFARD Methodology

The core of NFARD is measuring the differences between models based on a simple yet effective model characterization, i.e., neuron functionality (NF) [2]. Neuron functionality is defined as the mapping from the input space to the one-dimensional output space of a neuron, which can be approximated by a vector denoted as nv(k, i) [2]. The method uses two metrics to measure similarity of neuron functionality: ED(k), which is the average Euclidean distance between the k-th layer’s neuron vectors of two models [3], and CD(k), which is the average cosine distance of the neuron vectors [4]. For black-box settings, NFARD proposes approximating the last layer's neuron vector using logarithms of probabilities to compute a logit approximation, denoted as nv˜ (L, i) [6].

Handling Heterogeneous Reuse Cases

To tackle heterogeneous reuse detection, NFARD incorporates a linear transformation technique to extend its application scope [2]. This involves constructing an optimal projection matrix via least squares optimization to map potentially high-dimensional NF features from models with different architectures or tasks onto a common, comparable low-dimensional space [2]. The optimization problem for this transformation is formulated as P = argmin W‖H1W⊺ − H2‖F, where ‖·‖F is the Frobenius norm [9]. This linear transformation allows all metrics above to be applied to heterogeneous cases [6].

Evaluation and Performance

The effectiveness of NFARD was evaluated on the Reuse Zoo benchmark, which consists of 250 neural network models covering various reuse techniques and architectures [2]. Extensive experimental results show that NFARD achieves F1 scores of 0.984 in the black-box setting and 1.0 for white-box settings, while generating test suites 2 ∼ 99 times faster than previous methods [2]. NFARD outperforms baseline fingerprinting approaches like IPGuard, ModelDiff, and DeepJudge in detecting heterogeneous reuse cases [3], achieving a success rate of 90% under the black-box setting and 100% under the white-box setting with the help of the linear transformation method [8].

Key Contributions

The main contributions include:

NFARD: A novel, adversarial example-free DNN copyright protection method based on neuron functionality analysis, applicable in both white-box and black-box settings using normal test samples [2].
Heterogeneous reuse detection: A linear transformation technique enabling NFARD to effectively handle reuse scenarios involving models with different architectures or classification tasks [2].
Reuse Zoo benchmark: A publicly available benchmark with 250 models designed for evaluating DNN reuse detection methods, covering seven common reuse techniques [4].
Comprehensive evaluation: Demonstrating NFARD’s superior performance, broader application scope, and efficiency compared to the state-of-the-art approaches [2].

Application Scope

NFARD requires no gradients of the victim model and no label information from the normal samples, making it more suitable for rare cases than methods like DeepJudge or IPGuard which require them [9]. NFARD is 2 ∼ 99 times faster than adversarial example-based methods, indicating better scalability [10]. The method's applicability to other scenarios, such as distributed learning, remains to be explored [12].

Influencing Factors

The performance of NFARD is robust to the choice of decision parameter α under both black-box and white-box settings [3]. Using a shallow layer as the target layer performs better in the white-box case [10]. The logarithm approximation contributes significantly to effectiveness in the black-box case, and NFARD is quite robust to the choice of α under both circumstances [10]. A test suite size of n = 1000 is recommended to balance effectiveness and efficiency [10].

Comparison with Existing Approaches

NFARD performs better at handling heterogeneous reuse cases than existing methods [8]. In the black-box case, NFARD achieves an F1-score of 0.984 and a higher precision than IPGuard and ModelDiff in detecting heterogeneous reuse relations [3]. Overall, NFARD has an F1-score of 0.984 in the blackbox case and 1.0 in the white-box case, both of which are higher than other DNN reuse detectors [8].

Conclusion

In this paper, NFARD presents a novel deep neural network copyright protection method centered on neuron functionality analysis [2]. The core innovation lies in circumventing the need for adversarial examples, enabling robust model reuse detection using only normal test samples [12]. Additionally, the proposed linear transformation technique effectively tackles heterogeneous reuse scenarios across different architectures and tasks, significantly extending its application scope [8]. Evaluation results demonstrate NFARD’s effectiveness and efficiency, offering a versatile tool for detecting model reuse and safeguarding intellectual property rights against unauthorized replication [8].

--- Page 1 ---

<ref:2407.03883#pg2>Protecting Deep Learning Model Copyrights with Adversarial Example-Free Reuse Detection

<ref:2407.03883#pg3>Model reuse techniques can reduce the resource requirements for training high-performance deep neural networks (DNNs) by leveraging existing models.

<ref:2407.03883#pg2>This underscores the need to analyze the reuse relation between DNNs and develop copyright protection techniques to safeguard intellectual property rights.

<ref:2407.03883#pg2>Existing DNN copyright protection approaches suffer from several inherent limitations hindering their effectiveness in practical scenarios.

<ref:2407.03883#pg2>For instance, existing white-box fingerprinting approaches cannot address the common heterogeneous reuse case where the model architecture is changed, and DNN fingerprinting approaches heavily rely on generating adversarial examples with good transferability, which is known to be challenging in the blackbox setting.

<ref:2407.03883#pg2>To bridge the gap, we propose NFARD, a Neuron Functionality Analysis-based Reuse Detector, which only requires normal test samples to detect reuse relations by measuring the models’ differences on a newly proposed model characterization, i.e., neuron functionality (NF).

<ref:2407.03883#pg2>A set of NF-based distance metrics is designed to make NFARD applicable to both white-box and black-box settings.

<ref:2407.03883#pg2>Moreover, we devise a linear transformation method to handle heterogeneous reuse cases by constructing the optimal projection matrix for dimension consistency, significantly extending the application scope of NFARD.

<ref:2407.03883#pg2>To the best of our knowledge, this is the first adversarial example-free method that exploits neuron functionality for DNN copyright protection.

<ref:2407.03883#pg2>As a side contribution, we constructed a reuse detection benchmark named Reuse Zoo that covers various practical reuse techniques and popular datasets.

<ref:2407.03883#pg2>Extensive evaluations on this comprehensive benchmark show that NFARD achieves F1 scores of 0.984 and 1.0 for detecting reuse relationships in black-box and white-box settings, respectively, while generating test suites 2 ∼ 99 times faster than previous methods.

<ref:2407.03883#pg2>Index Terms—copyright protection, reuse detection, neuron functionality, deep neural networks

<ref:2407.03883#pg2>Deep learning (DL) has achieved remarkable success across a wide range of tasks [1]–[3].

<ref:2407.03883#pg2>However, training highperformance deep neural networks (DNNs) demands vast amount of labeled data and substantial computational resources, and these costs escalate with model complexity.

Improvements for AI systems

Bold header: Adversarial Example-Free Reuse Detection (NFARD) Implementation in Black-Box Settings. This improvement allows AI systems to detect unauthorized DNN reuse without requiring access to internal model parameters or gradients, as NFARD only requires normal test samples to detect reuse relations.
Bold header: Handling Heterogeneous Model Reuse via Linear Transformation. The integration of a linear transformation method enables the system to effectively handle reuse scenarios involving models with different architectures or classification tasks, significantly expanding applicability beyond homogeneous cases.
Bold header: Robust Decision Criteria using IQR-based Thresholding. Implementing the threshold function defined as the gap between the adjusted IQR lower bound and the distance metric value, controlled by parameter alpha, allows for a balanced trade-off between specificity and sensitivity in detection.
Bold header: Dynamic Test Suite Selection based on Prediction Entropy. Constructing test suites using samples that elicit the least confident predictions from the victim model to induce aligning behavior between the victim and surrogate models enhances detection robustness by focusing on areas of highest uncertainty.
Bold header: Improved Black-Box Logit Approximation for Distance Metrics. By proposing approximations like nv˜ (L, i) = (log f(x1)i, log f(x2)i, · · ·, log f(xn)i) for computing distance metrics in the black-box setting, the system can effectively measure similarity using only final probability outputs.

Abstract

Model reuse techniques can reduce the resource requirements for training high-performance deep neural networks (DNNs) by leveraging existing models. However, unauthorized reuse and replication of DNNs can lead to copyright infringement and economic loss to the model owner. This underscores the need to analyze the reuse relation between DNNs and develop copyright protection techniques to safeguard intellectual property rights. Existing white-box testing-based approaches cannot address the common heterogeneous reuse case where the model architecture is changed, and DNN fingerprinting approaches heavily rely on generating adversarial examples with good transferability, which is known to be challenging in the black-box setting. To bridge the gap, we propose NFARD, a Neuron Functionality Analysis-based Reuse Detector, which only requires normal test samples to detect reuse relations by measuring the models' differences on a newly proposed model characterization, i.e., neuron functionality (NF). A set of NF-based distance metrics is designed to make NFARD applicable to both white-box and black-box settings. Moreover, we devise a linear transformation method to handle heterogeneous reuse cases by constructing the optimal projection matrix for dimension consistency, significantly extending the application scope of NFARD. To the best of our knowledge, this is the first adversarial example-free method that exploits neuron functionality for DNN copyright protection. As a side contribution, we constructed a reuse detection benchmark named Reuse Zoo that covers various practical reuse techniques and popular datasets. Extensive evaluations on this comprehensive benchmark show that NFARD achieves F1 scores of 0.984 and 1.0 for detecting reuse relationships in black-box and white-box settings, respectively, while generating test suites 2 99 times faster than previous methods.