Towards Undistillable Models by Minimizing Conditional Mutual Information

TL;DR

This paper introduces a novel training method called CMIM that minimizes conditional mutual information to produce deep neural networks that are resistant to knowledge distillation, thereby protecting model intellectual property.

Contribution

The paper proposes a new training approach that effectively creates undistillable DNNs by jointly minimizing cross entropy and conditional mutual information across clusters.

Findings

CMIM models are undistillable by existing KD methods.

CMIM models outperform standard CE-trained models in accuracy.

Clusters in CMIM models are highly concentrated, making them resistant to distillation.

Abstract

A deep neural network (DNN) is said to be undistillable if, when used as a black-box input-output teacher, it cannot be distilled through knowledge distillation (KD). In this case, the distilled student (referred to as the knockoff student) does not outperform a student trained independently with label smoothing (LS student) in terms of prediction accuracy. To protect intellectual property of DNNs, it is desirable to build undistillable DNNs. To this end, it is first observed that an undistillable DNN may have the trait that each cluster of its output probability distributions in response to all sample instances with the same label should be highly concentrated to the extent that each cluster corresponding to each label should ideally collapse into one probability distribution. Based on this observation and by measuring the concentration of each cluster in terms of conditional mutual information (CMI), a new training method called CMI minimized (CMIM) method is proposed, which trains a DNN by jointly minimizing the conventional cross entropy (CE) loss and the CMI values of all temperature scaled clusters across the entire temperature spectrum. The resulting CMIM model is shown, by extensive experiments, to be undistillable by all tested KD methods existing in the literature. That is, the knockoff students distilled by these KD methods from the CMIM model underperform the respective LS students. In addition, the CMIM model is also shown to performs better than the model trained with the CE loss alone in terms of their own prediction accuracy.