{"type":"ScholarlyArticle","title":"MetaFinger: Fingerprinting the Deep Neural Networks with Meta-training","authors":[{"name":"Kang Yang","slug":"kang-yang","given":"Kang","family":"Yang","affiliation":"School of Cyber Science and Engineering , Wuhan University , China; Key Laboratory of Aerospace Information Security and Trusted Computing , Ministry of Education , China"},{"name":"Run Wang","slug":"run-wang","given":"Run","family":"Wang","affiliation":"School of Cyber Science and Engineering , Wuhan University , China; Key Laboratory of Aerospace Information Security and Trusted Computing , Ministry of Education , China"},{"name":"Lina Wang","slug":"lina-wang","given":"Lina","family":"Wang","affiliation":"School of Cyber Science and Engineering , Wuhan University , China; Key Laboratory of Aerospace Information Security and Trusted Computing , Ministry of Education , China; Zhengzhou Xinda Institute of Advanced Technology"}],"abstract":"As deep neural networks (DNNs) play a critical role in various fields, the models themselves hence are becoming an important asset that needs to be protected. To achieve this, various neural network fingerprint methods have been proposed. However, existing fingerprint methods fingerprint the decision boundary by adversarial examples, which is not robust to model modification and adversarial defenses. To fill this gap, we propose a robust fingerprint method MetaFinger, which fingerprints the inner decision area  of the model by meta-training, rather than the decision boundary. Specifically, we first generate many shadow models with DNN augmentation as meta-data. Then we optimize some images by meta-training  to ensure that only models derived from the protected model can recognize them. To demonstrate the robustness of our fingerprint approach, we evaluate our method against two types of attacks including input modification and model modification. Experiments show that our method achieves 99.34% and 97.69% query accuracy on average, surpassing existing methods over 30%, 25% on CIFAR-10 and Tiny-ImageNet, respectively. Our code is available at https://github.com/kangyangWHU/MetaFinger.","doi":"10.24963/ijcai.2022/109","url":"https://ijcai.org/proceedings/2022/109","pdf":"https://ijcai.org/proceedings/2022/0109.pdf","markdown":"https://ijcai.org/proceedings/2022/109.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/109","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"AI Ethics, Trust, Fairness","track":"Main Track","number":109,"pages":{"first":776,"last":782},"keywords":["Computer Vision: Adversarial learning, adversarial attack and defense methods","AI Ethics, Trust, Fairness: Safety & Robustness","AI Ethics, Trust, Fairness: Trustworthy AI"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38986827","length_sec":62,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38984970","length_sec":350,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Adi et al., 2018] Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural net- works by backdooring. In USENIX, pages 1615-1631, 2018.","title":"Turning your weakness into a strength: Watermarking deep neural networks by backdooring","authors":"Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, Joseph Keshet","year":"2018","venue":"USENIX","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Ateniese et al., 2015] Giuseppe Ateniese, Luigi V Mancini, Angelo Spognardi, Antonio Villani, Domenico Vitali, and Giovanni Felici. Hacking smart machines with smarter ones: How to extract meaningful data from machine learn- ing classifiers. International Journal of Security and Net- works, 10(3):137-150, 2015.","title":"Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers","authors":"Giuseppe Ateniese, Luigi V Mancini, Angelo Spognardi, Antonio Villani, Domenico Vitali, Giovanni Felici","year":"2015","venue":"International Journal of Security and Networks","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Cao et al., 2021] Xiaoyu Cao, Jinyuan Jia, and Neil Zhen- qiang Gong. Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary. In AsiaCCS, pages 14-25, 2021.","title":"Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary","authors":"Xiaoyu Cao, Jinyuan Jia, Neil Zhenqiang, Gong","year":"2021","venue":"AsiaCCS","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Chen et al., 2019] Huili Chen, Bita Darvish Rouhani, and Farinaz Koushanfar. Blackmarks: Blackbox multibit wa- termarking for deep neural networks. arXiv preprint arXiv:1904.00344, 2019.","title":"Blackmarks: Blackbox multibit watermarking for deep neural networks","authors":"Huili Chen, Bita Darvish Rouhani, Farinaz Koushanfar","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Darvish Rouhani et al., 2019] Bita Darvish Rouhani, Huili Chen, and Farinaz Koushanfar. Deepsigns: An end-to-end watermarking framework for ownership protection of deep neural networks. In ASPLOS, pages 485-497, 2019.","title":"Deepsigns: An end-to-end watermarking framework for ownership protection of deep neural networks","authors":"Huili Bita Darvish Rouhani, Farinaz Chen, Koushanfar","year":"2019","venue":"ASPLOS","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Dziugaite et al., 2016] Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M Roy. A study of the effect of jpg compression on adversarial images. arXiv preprint arXiv:1608.00853, 2016.","title":"A study of the effect of jpg compression on adversarial images","authors":"Gintare Karolina Dziugaite, Zoubin Ghahramani, Daniel M Roy","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Han et al., 2015] Song Han, Jeff Pool, John Tran, and William J Dally. Learning both weights and con- nections for efficient neural networks. arXiv preprint arXiv:1506.02626, 2015.","title":"Learning both weights and connections for efficient neural networks","authors":"Han","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Jia et al., 2021] Hengrui Jia, Christopher A Choquette- Choo, Varun Chandrasekaran, and Nicolas Papernot. En- tangled watermarks as a defense against model extraction. In USENIX, 2021.","title":"Entangled watermarks as a defense against model extraction","authors":"Jia","year":"2021","venue":"USENIX","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Le Merrer et al., 2020] Erwan Le Merrer, Patrick Perez, and Gilles Trédan. Adversarial frontier stitching for remote neural network watermarking. Neural Computing and Ap- plications, 32(13):9233-9244, 2020.","title":"Adversarial frontier stitching for remote neural network watermarking","authors":"Erwan Le Merrer, Patrick Perez, Gilles Trédan","year":"2020","venue":"Neural Computing and Applications","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Li et al., 2019] Zheng Li, Chengyu Hu, Yang Zhang, and Shanqing Guo. How to prove your model belongs to you: A blind-watermark based framework to protect intellectual property of dnn. In ACSAC, pages 126-137, 2019.","title":"How to prove your model belongs to you: A blind-watermark based framework to protect intellectual property of dnn","authors":"Zheng Li, Chengyu Hu, Yang Zhang, Shanqing Guo","year":"2019","venue":"ACSAC","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Lukas et al., 2019] Nils Lukas, Yuxuan Zhang, and Flo- rian Kerschbaum. Deep neural network fingerprinting by conferrable adversarial examples. arXiv preprint arXiv:1912.00888, 2019.","title":"Deep neural network fingerprinting by conferrable adversarial examples","authors":"Nils Lukas, Yuxuan Zhang, Florian Kerschbaum","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Lukas et al., 2021] Nils Lukas, Edward Jiang, Xinda Li, and Florian Kerschbaum. Sok: How robust is image classifi- cation deep neural network watermarking?(extended ver- sion). arXiv preprint arXiv:2108.04974, 2021.","title":"Sok: How robust is image classification deep neural network watermarking?(extended version)","authors":"Nils Lukas, Edward Jiang, Xinda Li, Florian Kerschbaum","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Nguyen et al., 2015] Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High con- fidence predictions for unrecognizable images. In CVPR, pages 427-436, 2015.","title":"Deep neural networks are easily fooled: High confidence predictions for unrecognizable images","authors":"Anh Nguyen, Jason Yosinski, Jeff Clune","year":"2015","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Oh et al., 2019] Seong Joon Oh, Bernt Schiele, and Mario Fritz. Towards reverse-engineering black-box neural net- works. In Explainable AI: Interpreting, Explaining and Vi- sualizing Deep Learning, pages 121-144. Springer, 2019.","title":"Towards reverse-engineering black-box neural networks","authors":"Joon Seong, Bernt Oh, Mario Schiele, Fritz","year":"2019","venue":"Explainable AI: Interpreting, Explaining and Visualizing Deep Learning","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Szegedy et al., 2013] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Szyller et al., 2021] Sebastian Szyller, Buse Gul Atli, Samuel Marchal, and N Asokan. Dawn: Dynamic ad- versarial watermarking of neural networks. In ACM MM, pages 4417-4425, 2021.","title":"Dawn: Dynamic adversarial watermarking of neural networks","authors":"Sebastian Szyller, Gul Buse, Samuel Atli, Marchal, Asokan","year":"2021","venue":"ACM MM","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Uchida et al., 2017] Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin'ichi Satoh. Embedding watermarks into deep neural networks. In ICMR, pages 269-277, 2017.","title":"Embedding watermarks into deep neural networks","authors":"Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, Shin'ichi Satoh","year":"2017","venue":"ICMR","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Wang and Kerschbaum, 2021] Tianhao Wang and Florian Kerschbaum. Riga: Covert and robust white-box water- marking of deep neural networks. In WWW, pages 993- 1004, 2021.","title":"Riga: Covert and robust white-box watermarking of deep neural networks","authors":"Wang, Kerschbaum ;, Tianhao Wang, Florian Kerschbaum","year":"2021","venue":"WWW","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Xie et al., 2017] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. arXiv preprint arXiv:1711.01991, 2017.","title":"Mitigating adversarial effects through randomization","authors":"Cihang Xie, Jianyu Wang, Zhishuai Zhang, Alan Zhou Ren, Yuille","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Xu et al., 2017] Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155, 2017.","title":"Feature squeezing: Detecting adversarial examples in deep neural networks","authors":"Weilin Xu, David Evans, Yanjun Qi","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Xu et al., 2021] Xiaojun Xu, Qi Wang, Huichen Li, Nikita Borisov, Carl A Gunter, and Bo Li. Detecting ai trojans using meta neural analysis. In SP, pages 103-120. IEEE, 2021.","title":"Detecting ai trojans using meta neural analysis","authors":"Xiaojun Xu, Qi Wang, Huichen Li, Nikita Borisov, Carl A Gunter, Bo Li","year":"2021","venue":"SP","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Zhang et al., 2018] Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Marc Ph Stoecklin, Heqing Huang, and Ian Molloy. Protecting intellectual property of deep neural net- works with watermarking. In AsiaCCS, pages 159-172, 2018.","title":"Protecting intellectual property of deep neural networks with watermarking","authors":"Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Marc Ph Stoecklin, Heqing Huang, Ian Molloy","year":"2018","venue":"AsiaCCS","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Zhang et al., 2019] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, pages 7472-7482. PMLR, 2019.","title":"Theoretically principled trade-off between robustness and accuracy","authors":"Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, Michael Jordan","year":"2019","venue":"ICML","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}