通过操控模型权重保护关键特征，防止被窃取
ProDiF: Protecting Domain-Invariant Features to Secure Pre-Trained Models Against Extraction
- 针对性修改权重，隐藏可迁移的通用特征
- 源域准确率降至接近随机，跨域迁移能力下降74.65%
- 适合需保护预训练模型知识产权的研究者
预训练模型是宝贵的知识产权，其权重空间中同时包含领域特定和领域不变特征。然而，模型提取攻击会利用领域不变特征，实现未经授权的源域推理和跨域迁移。本文提出ProDiF框架，通过有针对性的权重空间操作来抵御提取攻击。ProDiF量化滤波器的可迁移性，并扰动不安全内存中的关键滤波器权重，同时将实际关键权重保留在可信执行环境（TEE）中供授权用户使用。双层优化进一步增强对自适应微调攻击的防御能力。实验表明，ProDiF将源域准确率降至接近随机水平，跨域迁移能力降低74.65%，为预训练深度神经网络模型提供全面保护，并展示了权重空间操纵在模型安全中的新潜力。
原文摘要 · Abstract (English)
Pre-trained models are valuable intellectual property, capturing both domain-specific and domain-invariant features within their weight spaces. However, model extraction attacks threaten these assets by enabling unauthorized source-domain inference and facilitating cross-domain transfer via the exploitation of domain-invariant features. In this work, we introduce **ProDiF**, a novel framework that leverages targeted weight space manipulation to secure pre-trained models against extraction attacks. **ProDiF** quantifies the transferability of filters and perturbs the weights of critical filters in unsecured memory, while preserving actual critical weights in a Trusted Execution Environment (TEE) for authorized users. A bi-level optimization further ensures resilience against adaptive fine-tuning attacks. Experimental results show that **ProDiF** reduces source-domain accuracy to near-random levels and decreases cross-domain transferability by 74.65\%, providing robust protection for pre-trained models. This work offers comprehensive protection for pre-trained DNN models and highlights the potential of weight space manipulation as a novel approach to model security.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。