CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attacks

TL;DR

CREDIT introduces a theoretically grounded method for verifying ownership of deep neural networks, effectively defending against model extraction attacks by quantifying model similarity with mutual information.

Contribution

The paper proposes a novel certified ownership verification method for DNNs against MEAs, using mutual information to provide rigorous theoretical guarantees.

Findings

Achieves state-of-the-art verification accuracy on multiple datasets.

Provides formal guarantees for ownership verification.

Effectively detects model extraction attacks across various tasks.

Abstract

Machine Learning as a Service (MLaaS) has emerged as a widely adopted paradigm for providing access to deep neural network (DNN) models, enabling users to conveniently leverage these models through standardized APIs. However, such services are highly vulnerable to Model Extraction Attacks (MEAs), where an adversary repeatedly queries a target model to collect input-output pairs and uses them to train a surrogate model that closely replicates its functionality. While numerous defense strategies have been proposed, verifying the ownership of a suspicious model with strict theoretical guarantees remains a challenging task. To address this gap, we introduce CREDIT, a certified ownership verification against MEAs. Specifically, we employ mutual information to quantify the similarity between DNN models, propose a practical verification threshold, and provide rigorous theoretical guarantees for ownership verification based on this threshold. We extensively evaluate our approach on several mainstream datasets across different domains and tasks, achieving state-of-the-art performance. Our implementation is publicly available at: https://github.com/LabRAI/CREDIT.