2019

Effectiveness of Distillation Attack and Countermeasure on Neural Network Watermarking

Yang, Ziqi, Dang, Hung, Chang, Ee-Chien

Understand

The rise of machine learning as a service and model sharing platforms has raised the need of traitor-tracing the models and proof of authorship.

Watermarking technique is the main component of existing methods for protecting copyright of models.
In this paper, we show that distillation, a widely used transformation technique, is a quite effective attack to remove watermark embedded by existing algorithms.
The fragility is due to the fact that distillation does not retain the watermark embedded in the model that is redundant and independent to the main learning task.

Built on

Secure spread spectrum watermarking for multimedia
I. J. Cox, J. Kilian, F. T. Leighton, and T. Shamoon. 1997 · 1997
Earlier work this paper cites.
The MNIST database of handwritten digits
Yann LeCun. 1998 · 1998
Earlier work this paper cites.
Nonlinear programming: analysis and methods
Mordecai Avriel. 2003 · 2003
Earlier work this paper cites.
Solving large scale linear prediction problems using stochastic gradient descent algorithms. In Proceedings of the twenty-first international conference on Machine learning
Tong Zhang. 2004 · 2004
Earlier work this paper cites.
Labeled Faces in the Wild: A Database for Studying Face Recognition in Unconstrained Environments
Gary B. Huang, Manu Ramesh, Tamara Berg, and Erik Learned-Miller. 2007 · 2007
Earlier work this paper cites.
A survey on transfer learning
Sinno Jialin Pan and Qiang Yang. 2010 · 2010
Earlier work this paper cites.
Poisoning Attacks Against Support Vector Machines. In Proceedings of the 29th International Coference on International Conference on Machine Learning
Battista Biggio, Blaine Nelson, and Pavel Laskov. 2012 · 2012
Earlier work this paper cites.
Machine learning: a probabilistic perspective
Kevin P Murphy. 2012 · 2012
Earlier work this paper cites.
ADADELTA: an adaptive learning rate method
Original
Matthew D Zeiler. 2012 · 2012
Earlier work this paper cites.
Exploiting linear structure within convolutional networks for efficient evaluation. In Advances in Neural Information Processing Systems
Emily L Denton, Wojciech Zaremba, Joan Bruna, Yann LeCun, and Rob Fergus. 2014 · 2014
Earlier work this paper cites.
Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing.. In USENIX Security Symposium
Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. 2014 · 2014
Earlier work this paper cites.
Rich feature hierarchies for accurate object detection and semantic segmentation. In Proceedings of the IEEE conference on computer vision and pattern recognition
Ross Girshick, Jeff Donahue, Trevor Darrell, and Jitendra Malik. 2014 · 2014
Earlier work this paper cites.
Explaining and harnessing adversarial examples
Original
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014 · 2014
Earlier work this paper cites.
Speeding up Convolutional Neural Networks with Low Rank Expansions. In Proceedings of the British Machine Vision Conference
Max Jaderberg, Andrea Vedaldi, and Andrew Zisserman. 2014 · 2014
Earlier work this paper cites.
The CIFAR-10 dataset
Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. 2014 · 2014
Earlier work this paper cites.
Learning and transferring mid-level image representations using convolutional neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition
Maxime Oquab, Leon Bottou, Ivan Laptev, and Josef Sivic. 2014 · 2014
Earlier work this paper cites.
Dropout: a simple way to prevent neural networks from overfitting
Nitish Srivastava, Geoffrey E Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdinov. 2014 · 2014
Earlier work this paper cites.

Similar

Intriguing properties of neural networks. In International Conference on Learning Representations
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014 · 2014
Cited alongside, same era.
Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers
Giuseppe Ateniese, Luigi V Mancini, Angelo Spognardi, Antonio Villani, Domenico Vitali, and Giovanni Felici. 2015 · 2015
Cited alongside, same era.
One-and-a-half-class multiple classifier systems for secure learning against evasion attacks at test time. In International Workshop on Multiple Classifier Systems
Battista Biggio, Igino Corona, Zhi-Min He, Patrick PK Chan, Giorgio Giacinto, Daniel S Yeung, and Fabio Roli. 2015 · 2015
Cited alongside, same era.
Compressing neural networks with the hashing trick. In International Conference on Machine Learning
Wenlin Chen, James Wilson, Stephen Tyree, Kilian Weinberger, and Yixin Chen. 2015 · 2015
Cited alongside, same era.
Learning both weights and connections for efficient neural network. In Advances in Neural Information Processing Systems
Song Han, Jeff Pool, John Tran, and William Dally. 2015 · 2015
Cited alongside, same era.
Distilling the Knowledge in a Neural Network. In NIPS Deep Learning and Representation Learning Workshop
Geoffrey Hinton, Oriol Vinyals, and Jeffrey Dean. 2015 · 2015
Cited alongside, same era.
Deep learning
Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. 2015 · 2015
Cited alongside, same era.
Privacy-preserving deep learning. In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security
Reza Shokri and Vitaly Shmatikov. 2015 · 2015
Cited alongside, same era.
Efficient and accurate approximations of nonlinear convolutional networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition
Xiangyu Zhang, Jianhua Zou, Xiang Ming, Kaiming He, and Jian Sun. 2015 · 2015
Cited alongside, same era.
Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security
Martín Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016 · 2016
Cited alongside, same era.
EIE: efficient inference engine on compressed deep neural network. In Computer Architecture (ISCA), 2016 ACM/IEEE 43rd Annual International Symposium on
Song Han, Xingyu Liu, Huizi Mao, Jing Pu, Ardavan Pedram, Mark A Horowitz, and William J Dally. 2016a · 2016
Cited alongside, same era.
Deep Compression: Compressing Deep Neural Networks with Pruning, Trained Quantization and Huffman Coding
Song Han, Huizi Mao, and William J Dally. 2016b · 2016
Cited alongside, same era.

Then

Practical Secure Aggregation for Privacy Preserving Machine Learning
Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. 2017 · 2017
Later among the works it cites.
Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy (SP)
Nicholas Carlini and David Wagner. 2017 · 2017
Later among the works it cites.
Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017 · 2017
Later among the works it cites.
Evading Classifiers by Morphing in the Dark. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security
Hung Dang, Yue Huang, and Ee-Chien Chang. 2017 · 2017
Later among the works it cites.
BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
Original
Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017 · 2017
Later among the works it cites.
Adversarial frontier stitching for remote neural network watermarking
Erwan Le Merrer, Patrick Perez, and Gilles Trédan. 2017 · 2017
Later among the works it cites.
Fraternal Twins: Unifying Attacks on Machine Learning and Digital Watermarking
Erwin Quiring, Daniel Arp, and Konrad Rieck. 2017 · 2017
Later among the works it cites.
Deep Learning is Robust to Massive Label Noise
Original
David Rolnick, Andreas Veit, Serge Belongie, and Nir Shavit. 2017 · 2017
Later among the works it cites.
Membership inference attacks against machine learning models. In IEEE Symposium on Security and Privacy (SP)
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017 · 2017
Later among the works it cites.
Machine Learning Models that Remember Too Much. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security
Congzheng Song, Thomas Ristenpar, and Vitaly Shmatikov. 2017 · 2017
Later among the works it cites.
Embedding Watermarks into Deep Neural Networks. In Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval
Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin’ichi Satoh. 2017 · 2017
Later among the works it cites.
Understanding deep learning requires rethinking generalization. In International Conference on Learning Representations
Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. 2017 · 2017
Later among the works it cites.
Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring. In 27th USENIX Security Symposium (USENIX Security 18)
Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. 2018 · 2018
Later among the works it cites.
Are You Tampering With My Data?. In European Conference on Computer Vision (ECCV 2018), Workshop on Objectionable Content and Misinformation
Original
Michele Alberti, Vinaychandran Pondenkandath, Marcel Würsch, Manuel Bouillon, Mathias Seuret, Rolf Ingold, and Marcus Liwicki. 2018 · 2018
Later among the works it cites.
DeepMarks: A Digital Fingerprinting Framework for Deep Neural Networks
Huili Chen, Bita Darvish Rohani, and Farinaz Koushanfar. 2018 · 2018
Later among the works it cites.
Trojaning Attack on Neural Networks. In 25nd Annual Network and Distributed System Security Symposium (NDSS)
Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018 · 2018
Later among the works it cites.
Deepsigns: A generic watermarking framework for ip protection of deep learning models
Original
Bita Darvish Rouhani, Huili Chen, and Farinaz Koushanfar. 2018 · 2018
Later among the works it cites.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…