用哈希技术实现模型版权保护与使用控制，防篡改且可追踪用户。
CHIP: Chameleon Hash-based Irreversible Passport for Robust Deep Model Ownership Verification and Active Usage Control
- 基于可变哈希的通行证机制，支持多用户授权与不可逆验证。
- 同一签名可对应多个用户凭证，实现主动使用管控与责任追溯。
- 适用于离线分发和云服务场景，兼容多种模型架构与数据集。
大规模深度神经网络（DNN）及其高昂训练成本使得知识产权保护至关重要。现有基于通行证的方法通过调整归一化层仿射参数来增强版权验证抗模糊攻击能力，但无法同时保障强所有权证明、高保真度、主动使用授权与用户可追溯性，尤其在离线分发和多用户机器学习即服务（MLaaS）场景中存在局限。本文提出一种基于变色龙哈希的不可逆通行证（CHIP）框架，利用其抗碰撞特性实现侵权时强所有权主张与用户责任追溯；利用陷门碰撞属性，将多个用户通行证与许可证证书哈希至同一不可变签名，实现主动使用控制。以所有者通行证为密钥，可生成包含用户模型、用户通行证与许可证证书的三元组，用于安全离线分发；水印主模型亦可用于MLaaS，通过任意陷门碰撞通行证验证使用权限。CHIP在四个数据集与两种架构上进行了广泛评估，验证了其保护的泛化性与鲁棒性。代码已开源：https://github.com/Dshm212/CHIP。
原文摘要 · Abstract (English)
The pervasion of large-scale Deep Neural Networks (DNNs) and their enormous training costs make their intellectual property (IP) protection of paramount importance. Recently introduced passport-based methods attempt to steer DNN watermarking towards strengthening ownership verification against ambiguity attacks by modulating the affine parameters of normalization layers. Unfortunately, neither watermarking nor passport-based methods provide a holistic protection with robust ownership proof, high fidelity, active usage authorization and user traceability for offline access distributed models and multi-user Machine-Learning as a Service (MLaaS) cloud model. In this paper, we propose a Chameleon Hash-based Irreversible Passport (CHIP) protection framework that utilizes the cryptographic chameleon hash function to achieve all these goals. The collision-resistant property of chameleon hash allows for strong model ownership claim upon IP infringement and liable user traceability, while the trapdoor-collision property enables hashing of multiple user passports and licensee certificates to the same immutable signature to realize active usage control. Using the owner passport as an oracle, multiple user-specific triplets, each contains a passport-aware user model, a user passport, and a licensee certificate can be created for secure offline distribution. The watermarked master model can also be deployed for MLaaS with usage permission verifiable by the provision of any trapdoor-colliding user passports. CHIP is extensively evaluated on four datasets and two architectures to demonstrate its protection versatility and robustness. Our code is released at https://github.com/Dshm212/CHIP.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。