RemovalNet: DNN Fingerprint Removal Attacks
Hongwei Yao, Zheng Li, Kunzhe Huang, Jian Lou, Zhan Qin, Kui Ren

TL;DR
RemovalNet is a novel attack method that effectively removes DNN fingerprints to evade ownership verification, while preserving model performance and using minimal resources.
Contribution
The paper introduces RemovalNet, the first comprehensive DNN fingerprint removal attack based on bilevel optimization, demonstrating its effectiveness and efficiency against advanced defenses.
Findings
RemovalNet significantly increases model distance post-attack.
It requires only 0.2% of data and 1,000 iterations.
It maintains high surrogate model accuracy after removal.
Abstract
With the performance of deep neural networks (DNNs) remarkably improving, DNNs have been widely used in many areas. Consequently, the DNN model has become a valuable asset, and its intellectual property is safeguarded by ownership verification techniques (e.g., DNN fingerprinting). However, the feasibility of the DNN fingerprint removal attack and its potential influence remains an open problem. In this paper, we perform the first comprehensive investigation of DNN fingerprint removal attacks. Generally, the knowledge contained in a DNN model can be categorized into general semantic and fingerprint-specific knowledge. To this end, we propose a min-max bilevel optimization-based DNN fingerprint removal attack named RemovalNet, to evade model ownership verification. The lower-level optimization is designed to remove fingerprint-specific knowledge. While in the upper-level optimization, we…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdversarial Robustness in Machine Learning · Forensic and Genetic Research
