TAFA: A Task-Agnostic Fingerprinting Algorithm for Neural Networks

Pan, Xudong; Zhang, Mi; Lu, Yifan; Yang, Min

doi:10.1007/978-3-030-88418-5_26

Cited by 8 publications

(5 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The outcome of the detection is thus binary: Alice's hypothesis is deemed correct or not. This is the nominal use case in the related works [1,2,3,4,5].…”

Section: Goalsmentioning

confidence: 99%

“…AFA [5] activates dropout as a cheap surrogate of variants when forging adversarial examples. TAFA [4] extends this idea to other machine learning primitives like regression.…”

Section: Previous Workmentioning

confidence: 99%

“…The main application that related works [1,2,3,4,5] target is the proof of ownership. An accurate deep neural network is a valuable industrial asset due to the know-how for training it, the difficulty of gathering a well-annotated training dataset, and the required computational resources to learn its parameters.…”

Section: Introductionmentioning

confidence: 99%

“…They use the frontiers in the input space drawn by a classifier as the fingerprint, i.e. the unique signature identifying the model [2,4,5]. Two neural networks sharing the same architecture, the same training set, and the same training procedure are different because the training is stochastic (like the Stochastic Gradient Descent).…”

Section: Introductionmentioning

confidence: 99%

“…Most of the papers in the literature are looking for discriminative deviations of these frontiers. Second, the key task is detection: Alice makes a guess about the model in the black-box and then she queries these specific queries to test whether her hypothesis holds [2,8,4,5]. Confusions yet happen (model colors further apart from their cluster), but are under scrutiny for the tracking of false positive identification.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

FBI: Fingerprinting models with Benign Inputs

Maho,

Furon,

Merrer

2022

Preprint

View full text Add to dashboard Cite

Recent advances in the fingerprinting of deep neural networks detect instances of models, placed in a black-box interaction scheme. Inputs used by the fingerprinting protocols are specifically crafted for each precise model to be checked for. While efficient in such a scenario, this nevertheless results in a lack of guarantee after a mere modification (e.g. retraining, quantization) of a model.This paper tackles the challenges to propose i) fingerprinting schemes that are resilient to significant modifications of the models, by generalizing to the notion of model families and their variants, ii) an extension of the fingerprinting task encompassing scenarios where one wants to fingerprint not only a precise model (previously referred to as a detection task) but also to identify which model family is in the black-box (identification task).We achieve both goals by demonstrating that benign inputs, that are unmodified images, for instance, are sufficient material for both tasks. We leverage an information-theoretic scheme for the identification task. We devise a greedy discrimination algorithm for the detection task. Both approaches are experimentally validated over an unprecedented set of more than 1,000 networks.

show abstract

“…The outcome of the detection is thus binary: Alice's hypothesis is deemed correct or not. This is the nominal use case in the related works [1,2,3,4,5].…”

Section: Goalsmentioning

confidence: 99%

“…AFA [5] activates dropout as a cheap surrogate of variants when forging adversarial examples. TAFA [4] extends this idea to other machine learning primitives like regression.…”

Section: Previous Workmentioning

confidence: 99%