MOVE: Effective and Harmless Ownership Verification via Embedded External Features

TL;DR

MOVE is a novel method for verifying ownership of deep neural networks by embedding external features into models, effectively preventing model theft without introducing new security risks.

Contribution

The paper introduces MOVE, a new approach that embeds external features via style transfer for model ownership verification, effective under both white-box and black-box settings.

Findings

Effective in verifying ownership against model stealing

Resistant to adaptive attacks in experiments

Works on benchmark datasets with high accuracy

Abstract

Currently, deep neural networks (DNNs) are widely adopted in different applications. Despite its commercial values, training a well-performing DNN is resource-consuming. Accordingly, the well-trained model is valuable intellectual property for its owner. However, recent studies revealed the threats of model stealing, where the adversaries can obtain a function-similar copy of the victim model, even when they can only query the model. In this paper, we propose an effective and harmless model ownership verification (MOVE) to defend against different types of model stealing simultaneously, without introducing new security risks. In general, we conduct the ownership verification by verifying whether a suspicious model contains the knowledge of defender-specified external features. Specifically, we embed the external features by modifying a few training samples with style transfer. We then train a meta-classifier to determine whether a model is stolen from the victim. This approach is inspired by the understanding that the stolen models should contain the knowledge of features learned by the victim model. In particular, \revision{we develop our MOVE method under both white-box and black-box settings and analyze its theoretical foundation to provide comprehensive model protection.} Extensive experiments on benchmark datasets verify the effectiveness of our method and its resistance to potential adaptive attacks. The codes for reproducing the main experiments of our method are available at https://github.com/THUYimingLi/MOVE.