Effective Ambiguity Attack Against Passport-based DNN Intellectual Property Protection Schemes through Fully Connected Layer Substitution

With the geometric growth of computing power of computational devices in recent decades, there have emerged many deep learning applications that have contributed to the human world such as super-resolution reconstruction [7, 9, 30], image inpainting [31, 35, 34] and forgery detection [32]. It usually costs many resources to develop new DNN models and developers will not tolerate the act of theft of their IP. The IP protection problem of deep models becomes more severe with the birth of Machine Learning as a Service (MLaaS) [26]. Preventing the infringement behavior of deep models now emerges as a necessary concern when developing new algorithms and systems.

Model watermark [37, 20, 28, 27, 25] has been a popular method to protect the IP of DNN models. In the embedding process, the owners embed the secret signatures (watermarks), and then in the verification process, they can claim their ownership to the model by matching the extracted signatures with the original versions. The existing model watermark methods can be roughly divided into two categories[11, 10]: feature-based and trigger-based methods. Specifically, feature-based methods [29, 8, 4, 24] applied a regularizer to embed the secret watermark into the activation functions or model weights. Uchida et al. [29] proposed to use a regularizer to embed a watermark into the model weights. Darvish et al. [8] embedded the fingerprints in the Probability Density Function of trainable weights instead. Aramoon et al. [3] inserted the signature into the gradient of the cross-entropy loss function with respect to the inputs. In contrast, trigger-based methods make the output target respond to specific inputs. Along this line, Adi et al. [1] used the backdoor attack as a means to watermark the model. Merrer et al. [18] designed a zero-bit watermarking algorithm that uses adversarial samples as watermarks to claim the ownership. Zhang et al. [39] applied watermarks to images and then trained the network to output target labels when input images carry these watermarks.

Despite the strength in retaining ownership of DNN models, most existing model watermark methods are shown to be vulnerable to the so-called ambiguity attack, in which the attacker manages to cast doubts on the ownership verification by crafting counterfeit (forged) watermarks[11]. Recently, Fan et al. [10] first designed a series of ambiguity attacks, which are effective in attacking DNN watermark methods. It was stated that for conventional watermark methods, a counterfeit watermark can be forged as along as the model performance is independent of the signature [11]. Following this proposition, Fan et al. designed a passport layer through which the functionality of the model is controlled by the signature called passport. However, Fan et al. encountered a heavy performance drop when batch normalization layers exist. To solve this problem, Zhang et al. [38] added learnable affine transformations to the scale and bias factors. It was claimed that an attacker cannot find a substitute passport that maintains the model performance, which ensures the security of these passport-based methods against existing ambiguity attacks.

In this work, we aim to design an advanced ambiguity attack to the passport-based method, capable of generating valid substitute passports with only a small number of data. Here, valid substitute passports are defined as those leading to an indistinguishable model performance, but sufficiently different from the original authorized passports. Clearly, with such valid substitute passports, an attacker can claim the ownership of the model. To this end, we first experimentally justify the existence of multiple valid substitute passports. Noticing the fact that it is easy to localize the passport layers, we then propose our ambiguity attack by replacing passport layers with our designed two types of structures, namely Individual Expanded Residual Block (IERB) and Collective Expanded Residual Block (CERB). Both structures are built in a way to encourage the significant changes of the parameters in the passport layers during the training, which could help us search for valid substitute passports. Benefiting from these two structures and assisting with a small amount training data, we can obtain valid substitute passports, and hence, defeat the passport-based methods which are the only type of method claimed to be immune to existing ambiguity attacks.

Our major contributions can be summarized as follows:

• •

  We propose a novel and effective ambiguity attack against the passport-based IP protection schemes. With less than 10% of training data, our ambiguity attack on passport-layer protected model can restore the functionality of the model with a less than 2% performance gap from the original accuracy.

• •

  We design two novel structures for replacing the passport layers, based on the multi-layer perceptron (MLP) and skip connection to assist with our ambiguity attack for searching valid substitute passports with a small amount of training data.

• •

  Experiments on both overlapping (attacker’s training dataset is part of the original training dataset) and non-overlapping datasets (attacker’s dataset and the original one come from the same source but no overlap exists), and on different network structures have proved the effectiveness of our ambiguity attack.

• •

  Our attack method can be readily generalized to attack other DNN watermark methods [8, 21, 29].

DNN watermark methods have been popular solutions for DNN model IP protection. However, these techniques might still be vulnerable to flagrant infringement from notorious adversaries. In this section, we review the two types of representative attack methods, namely, removal attack [5, 14, 6, 2, 22, 33] and ambiguity attack [10, 38, 11], along with the passport-based method attempting to defend against ambiguity attacks [11].

Removal Attack: This type of attack tries to remove the watermark from the protected model, malfunctioning the ownership verification mechanism. Along this line, many fine-tuning based methods have been proposed. Chen et al. [5] combined a redesigned elastic weight consolidation algorithm and unlabeled data augmentation to achieve unified model watermark removal with limited data. Guo et al. [14] used a dataset transformation method called PST (Pattern embedding and Spatial-level Transformation) to preprocess the data before fine-tuning. Chen et al. [6] utilized auxiliary unlabeled data to decrease the amount of labeled training data required for effective watermark removal. Aiken et al. [2] provided a three-stage scheme to remove backdoor-based watermarks by exploiting another trigger-free dataset from the same domain. Liu et al. [22] designed a framework to remove backdoor-based watermarks, in which a data augmentation was proposed to imitate the behavior of the backdoor triggers. Yan et al. [33] attempted to break the passport-based method by scaling the neurons and flipping the signs of parameters. However, this method assumed that the authorized passports are available to the attacker, which is not realistic in practice. Also, these aforementioned attack methods only enable the attackers to remove the watermarks, while unable to claim the ownership.

Ambiguity Attack: Another more threatening attack is the ambiguity attack, where the attacker can forge another substitute watermark to claim the model ownership. The concept of ambiguity attack originally appeared in image watermark community [23, 19], and recently has been extended to the DNN watermark methods. The pioneering work was conducted by Fan et al. in [10], which pointed out the vulnerability of Uchida’s watermark method [29] under the ambiguity attack. They also showed that the same weakness of Adi’s DNN watermark method [1] exists, by proving that another trigger can be optimized exclusively to cause the same model response as the original one.

Passport-based method: Passport-based method was originally proposed by Fan et al. [11] as a remedy enabling DNN watermark methods to defeat the ambiguity attack. This is achieved by replacing the traditional normalization layer with the so-called passport layer, whose difference mainly lies in how the affine factors are obtained. In passport layer, the scale factor $\gamma$ and bias factor $\beta$ are computed with the passport as follows:

where $\mathbf{s}=\left\{\mathbf{s}_{\gamma},\mathbf{s}_{\beta}\right\}$ is called the passport, $\mathbf{W}_{conv}$ is the convolutional layer weight before this layer, and $Avg(\cdot)$ represents the average pooling function.

To embed the passport $\mathbf{s}$ into the model, the network $\mathbb{N}_{p}$ is optimized on the training set $\mathcal{D}=\left\{(x_{i},y_{i})\right\}_{i=1}^{N}$, where $x_{i}$ is the input and $y_{i}$ is the corresponding label, using the following loss:

Denote $\mathcal{Q}(\mathbb{N}_{p}[\mathbf{W},\mathbf{s}])$ as the inference performance of model $\mathbb{N}_{p}$ with the passport $\mathbf{s}$. The verification process mainly relies on the assumption that the performance $\mathcal{Q}(\mathbb{N}_{p}[\mathbf{W},\mathbf{s}])$ seriously deteriorates when an unauthorized passport is presented. Hence, the model ownership using passport-based method is conducted by matching the signs of scale factors $\mathrm{sgn}(\gamma)$ with the predefined signature $\mathbf{b}$ and checking the DNN model inference performance.

Though the passport-based methods [38, 11] have been claimed to be immune to the existing ambiguity attacks [10], they do not preclude the existence of more advanced ambiguity attacks. In this work, we cast doubt on the security of the passport-based methods, and propose a simple yet effective ambiguity attack, capable of crafting valid substitute passports. Before diving into the detailed design of our ambiguity attack, let us clarify our attack goal and the information assumed to be available to the attacker.

Attack Goal: Essentially, the attack goal is to generate substitute passport $\mathbf{s}_{t}$, with which the model $\mathbb{N}_{p}[\mathbf{W},\mathbf{s}_{t}]$ has indistinguishable performance with that of applying the authorized passport $\mathbf{s}_{o}$, i.e., $\mathcal{Q}(\mathbb{N}_{p}[\mathbf{W},\mathbf{s}_{o}])$. Specifically, following the ambiguity attack setting in [11], we assume that the attacker has access to the model weights $\mathbf{W}$ except from the passport. Note that, without the passport, the affine factors are missing in the normalization layer, through which the attacker can easily localize the passport layers. Also, the attacker is allowed to have a small number of training data, namely, $\mathcal{D}_{s}=\left\{(\hat{x}_{i},\hat{y}_{i})\right\}_{i=1}^{n}$, where $n<<N$. Formally, we have the following Definition 1, explicitly explaining the successful ambiguity attack on passport-based method.

Definition 1: An ambiguity attack on passport layer protected model is successful, if

1. I)

   DNN inference accuracy with the substitute passport $\mathbf{s}_{t}$ is close to that with the authorized passport $\mathbf{s}_{o}$, i.e.,

   $$\Big{|}\mathcal{Q}(\mathbb{N}_{p}[\mathbf{W},\mathbf{s}_{t}])-\mathcal{Q}(\mathbb{N}_{p}[\mathbf{W},\mathbf{s}_{o}])\Big{|}<\epsilon.$$

   (3)

2. II)

   Dissimilarity between the substitute passport $\mathbf{s}_{t}$ and the authorized $\mathbf{s}_{o}$ should be large enough, i.e.:

   $$\Big{|}\mathbf{s}_{t}-\mathbf{s}_{o}\Big{|}>\delta.$$

   (4)

Before presenting the details of our ambiguity attack, let us first justify the existence of multiple valid substitute passports satisfying the conditions given in (3) and (4). To this end, we here adopt an experimental approach and leave the theoretical justification in our future work. Assume now that we are given the complete training data $\mathcal{D}$, though this large amount of data are not required when launching the attack. We initialize scale factors with different combinations of $\{+1,-1\}$ and fine-tune the model based on $\mathcal{D}$. In Fig. 1, we give the experimental results on ResNet18 trained on the CIFAR10 dataset, where the passport layer is placed after the first convolutional layer and the length of the scale factor is 64. The model with the authorized passport leads to an inference performance of 94.70%. As can be seen, the accuracy of the models after retraining is still close to 94.70% (red line, see Fig. 1(a)). More importantly, the signs of retained affine factors only have low coincidence rate (around 60%, see Fig. 1(b)) with the original ones, implying that retained affine factors differ significantly from the authorized affine factors. Therefore, these retrained affine factors could simultaneously satisfy the conditions (3) and (4), and hence are valid substitute passports.

Though the existence of substitute passports has been justified, the difficulty of directly optimizing a passport remains unsolved for very limited number of training data. Clearly, in practical attacks, the attacker is only allowed to have access to very limited data; otherwise, he can retrain the entire model. Fan et al. [11] ascribed the robustness of passport-based method against fine-tuning the scale factors to the lazy-to-flip property, with which the scale factors are rarely updated to cross the zero during the training.

To overcome the lazy-to-flip property for the scale factors, we attempt to add a trainable block after it, encouraging scale factors to go across the zeros by non-linear transformations. For efficiency, we adopt MLP for designing the trainable blocks. Following this line, we design two structures namely IERB and CERB to replace the passport layer.

In this section, we evaluate the effectiveness of our ambiguity attack from different perspectives. Before presenting the detailed results, let us clarify the experimental settings including the datasets, target models, and the evaluation metrics.

Dataset: Four image classification datasets: CIFAR10 [16], CIFAR100 [16], Caltech-101 [12], and Caltech-256 [13], are selected. Unless stated, the dataset used in the attack process only accounts for 10% at maximum of the full training set and does not overlap with the test set.

DNN architectures: Three DNN architectures, AlexNet [17], ResNet-18 [15] and Wide-Residual Network [36] are used in our experiments, following the tradition of passport-based works [10, 38, 11]. To demonstrate that our attack strategy remains effective for different number of passport layers, we perform the experiments on AlexNet and ResNet18, with at most 5 and 18 passport layers, respectively. For notation convenience, we use a suffix to determine the indices of the passport layers. For instance, AlexNet-4 denotes the AlexNet with the first 4 normalization layers replaced by the passport layers, and AlexNet-last3 represents the version in which the last 3 normalization layers are replaced by the passport layers.

Evaluation metrics: Prediction accuracy (ACC) of the model is a natural choice for evaluating the attack effectiveness, since a successfully forged passport is expected to achieve similar performance as an authorized passport (see Definition 1). Another metric considered is the bit dissimilarity rate (BDR) of the signature derived from the forged passport, with respect to the authorized one. Specifically, let $\gamma^{\prime}$ and $\gamma^{o}$ be the forged and authorized scale factors, respectively. Note that the sign of $\gamma^{o}$ is used as the signature. The BDR is then defined as:

In this paper, we propose an advanced ambiguity attack that defeats the passport-based model IP protection scheme. We combine multi-layer perceptron with skip connection to find valid substitute passports using less than 10% of the training dataset. Extensive experimental results validate the effectiveness of our ambiguity attack. Further, it is demonstrated that our attack strategy can be easily extended to other DNN watermark methods.

Regarding the remedy solutions, one potential direction is to exploit random locations for inserting the passport-layers, in which the randomness is controlled by a secret key. Additionally, another promising attempt is to change the embedding position from model weights to the activations. To make sure the next convolutional layer can extract proper features from the activation, the statistic of the activation should stay in a restricted scope. Such a statistic could be unique for a given signature, which may be helpful to resist our ambiguity attack.

Acknowledgments: This work was supported in part by Macau Science and Technology Development Fund under SKLIOTSC-2021-2023, 0072/2020/AMJ, and 0022/2022/A1; in part by Research Committee at University of Macau under MYRG2020-00101-FST and MYRG2022-00152-FST; in part by Natural Science Foundation of China under 61971476; and in part by Alibaba Group through Alibaba Innovative Research Program.