通过修改检测框实现目标检测模型防窃取，100%识别盗版模型。
Bounding-box Watermarking: Defense against Model Extraction Attacks on Object Detectors
- 在查询响应中悄悄修改检测框，植入隐蔽后门。
- 在三个数据集上对盗版模型识别率达100%。
- 适用于真实场景下的模型提取攻击防御，适合云服务部署者。
部署在云端的深度神经网络（DNN）常通过API提供查询服务，但这也使其面临模型提取攻击（MEAs）。攻击者利用API返回结果复刻目标模型。现有基于后门的水印技术可作为防御手段，即通过API响应将后门注入被提取模型，若可疑模型含该后门，则可判定为盗版。本文聚焦于目标检测（OD）模型，针对现有方法在现实威胁模型下不适用的问题，提出一种新策略：通过隐秘修改查询中检测到的边界框（BBs），向提取模型植入后门，同时保持原模型检测能力。在三个目标检测数据集上的实验表明，该方法在多种场景下均实现了100%的盗版模型识别准确率。
原文摘要 · Abstract (English)
Deep neural networks (DNNs) deployed in a cloud often allow users to query models via the APIs. However, these APIs expose the models to model extraction attacks (MEAs). In this attack, the attacker attempts to duplicate the target model by abusing the responses from the API. Backdoor-based DNN watermarking is known as a promising defense against MEAs, wherein the defender injects a backdoor into extracted models via API responses. The backdoor is used as a watermark of the model; if a suspicious model has the watermark (i.e., backdoor), it is verified as an extracted model. This work focuses on object detection (OD) models. Existing backdoor attacks on OD models are not applicable for model watermarking as the defense against MEAs on a realistic threat model. Our proposed approach involves inserting a backdoor into extracted models via APIs by stealthily modifying the bounding-boxes (BBs) of objects detected in queries while keeping the OD capability. In our experiments on three OD datasets, the proposed approach succeeded in identifying the extracted models with 100% accuracy in a wide variety of experimental scenarios.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。