Please use this identifier to cite or link to this item:
Title: Fingerprinting deep neural networks - a DeepFool approach
Authors: Wang, Si
Chang, Chip Hong
Keywords: Engineering::Computer science and engineering::Computing methodologies::Artificial intelligence
Issue Date: 2021
Source: Wang, S. & Chang, C. H. (2021). Fingerprinting deep neural networks - a DeepFool approach. 2021 IEEE International Symposium on Circuits and Systems (ISCAS).
Project: CHFA-GC1- AW01 
Conference: 2021 IEEE International Symposium on Circuits and Systems (ISCAS)
Abstract: A well-trained deep learning classifier is an expensive intellectual property of the model owner. However, recently proposed model extraction attacks and reverse engineering techniques make model theft possible and similar quality deep learning solution reproducible at a low cost. To protect the interest and revenue of the model owner, watermarking on Deep Neural Network (DNN) has been proposed. However, the extra components and computations due to the embedded watermark tend to interfere with the model training process and result in inevitable degradation in classification accuracy. In this paper, we utilize the geometry characteristics inherited in the DeepFool algorithm to extract data points near the classification boundary of the target model for ownership verification. As the fingerprint is extracted after the training process has been completed, the original achievable classification accuracy will not be compromised. This countermeasure is founded on the hypothesis that different models possess different classification boundaries determined solely by the hyperparameters of the DNN and the training it has undergone. Therefore, given a set of fingerprint data points, a pirated model or its post-processed version will produce similar prediction but another originally designed and trained DNN for the same task will produce very different prediction even if they have similar or better classification accuracy. The effectiveness of the proposed Intellectual Property (IP) protection method is validated on the CIFAR-10, CIFAR-100 and ImageNet datasets. The results show a detection rate of 100% and a false positive rate of 0% for each dataset. More importantly, the fingerprint extraction and its runtime are both dataset independent. It is on average ∼130× faster than two state-of-the-art fingerprinting methods.
DOI: 10.1109/ISCAS51556.2021.9401119
Schools: School of Electrical and Electronic Engineering 
Research Centres: VIRTUS, IC Design Centre of Excellence 
Rights: © 2021 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. The published version is available at:
Fulltext Permission: open
Fulltext Availability: With Fulltext
Appears in Collections:EEE Conference Papers

Files in This Item:
File Description SizeFormat 
2021021379.pdf427.13 kBAdobe PDFThumbnail

Citations 20

Updated on Mar 2, 2024

Web of ScienceTM
Citations 50

Updated on Oct 30, 2023

Page view(s)

Updated on Mar 1, 2024

Download(s) 20

Updated on Mar 1, 2024

Google ScholarTM




Items in DR-NTU are protected by copyright, with all rights reserved, unless otherwise indicated.