Robust and Lossless Fingerprinting of Deep Neural Networks via Pooled Membership Inference

TL;DR

This paper introduces pooled membership inference (PMI), a novel method for protecting DNN intellectual property by identifying training data subsets without altering or fine-tuning the original model.

Contribution

The paper proposes PMI, a new approach that preserves DNN performance while enabling IP protection through data membership inference, unlike existing watermarking techniques.

Findings

PMI effectively identifies training data subsets without modifying the DNN.

PMI outperforms existing methods in accuracy and robustness.

The approach maintains the original DNN performance while providing IP protection.

Abstract

Deep neural networks (DNNs) have already achieved great success in a lot of application areas and brought profound changes to our society. However, it also raises new security problems, among which how to protect the intellectual property (IP) of DNNs against infringement is one of the most important yet very challenging topics. To deal with this problem, recent studies focus on the IP protection of DNNs by applying digital watermarking, which embeds source information and/or authentication data into DNN models by tuning network parameters directly or indirectly. However, tuning network parameters inevitably distorts the DNN and therefore surely impairs the performance of the DNN model on its original task regardless of the degree of the performance degradation. It has motivated the authors in this paper to propose a novel technique called pooled membership inference (PMI) so as to protect the IP of the DNN models. The proposed PMI neither alters the network parameters of the given DNN model nor fine-tunes the DNN model with a sequence of carefully crafted trigger samples. Instead, it leaves the original DNN model unchanged, but can determine the ownership of the DNN model by inferring which mini-dataset among multiple mini-datasets was once used to train the target DNN model, which differs from previous arts and has remarkable potential in practice. Experiments also have demonstrated the superiority and applicability of this work.