给深度模型植入可验证的后门锁，防止盗用。
Authority Backdoor: A Certifiable Backdoor Mechanism for Authoring DNNs
- 在模型中嵌入特定触发条件（如硬件指纹）来控制使用权限。
- 无触发时模型性能大幅下降至无法使用，且攻击者无法移除后门。
- 适合保护模型知识产权，尤其对高价值模型防窃取有效。
深度神经网络（DNN）作为重要知识产权面临未经授权使用的风险。现有保护方法如数字水印多为被动防御，仅能事后验证所有权，无法主动阻止模型被盗用。本文提出一种主动防护机制——「权威后门」（Authority Backdoor），将访问限制直接嵌入模型内部。该机制利用后门学习框架，使模型仅在特定触发条件（如硬件指纹）存在时正常运行；若缺失触发，则模型性能降为无效。为进一步增强安全性，引入可证明鲁棒性，防止攻击者通过自适应手段移除后门。实验在多种架构与数据集上验证了该框架的有效性及可证明鲁棒性，构建了兼具访问控制与抗对抗攻击能力的可信模型授权机制。
原文摘要 · Abstract (English)
Deep Neural Networks (DNNs), as valuable intellectual property, face unauthorized use. Existing protections, such as digital watermarking, are largely passive; they provide only post-hoc ownership verification and cannot actively prevent the illicit use of a stolen model. This work proposes a proactive protection scheme, dubbed ``Authority Backdoor," which embeds access constraints directly into the model. In particular, the scheme utilizes a backdoor learning framework to intrinsically lock a model's utility, such that it performs normally only in the presence of a specific trigger (e.g., a hardware fingerprint). But in its absence, the DNN's performance degrades to be useless. To further enhance the security of the proposed authority scheme, the certifiable robustness is integrated to prevent an adaptive attacker from removing the implanted backdoor. The resulting framework establishes a secure authority mechanism for DNNs, combining access control with certifiable robustness against adversarial attacks. Extensive experiments on diverse architectures and datasets validate the effectiveness and certifiable robustness of the proposed framework.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。