提出可验证模型所有权的认证方法，抵御模型窃取攻击。
CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attacks
- 用互信息度量模型相似性，构建可信验证阈值。
- 在多个数据集上实现领先性能，理论保证严格可靠。
- 适合需保护模型知识产权的研究者与开发者。
机器学习即服务（MLaaS）已广泛用于通过标准化API提供深度神经网络（DNN）模型访问。然而，这类服务极易遭受模型提取攻击（MEA），攻击者通过反复查询目标模型获取输入输出对，并训练出功能高度相似的替代模型。尽管已有多种防御策略，但对可疑模型进行具有严格理论保障的所有权验证仍具挑战。为此，本文提出CREDIT，一种针对模型提取攻击的认证所有权验证方法。具体而言，采用互信息量化DNN模型间的相似性，提出实用的验证阈值，并基于该阈值提供严格的理论保障。我们在多个主流数据集及不同领域任务上进行了全面评估，性能达到当前最优水平。代码已公开：https://github.com/LabRAI/CREDIT。
原文摘要 · Abstract (English)
Machine Learning as a Service (MLaaS) has emerged as a widely adopted paradigm for providing access to deep neural network (DNN) models, enabling users to conveniently leverage these models through standardized APIs. However, such services are highly vulnerable to Model Extraction Attacks (MEAs), where an adversary repeatedly queries a target model to collect input-output pairs and uses them to train a surrogate model that closely replicates its functionality. While numerous defense strategies have been proposed, verifying the ownership of a suspicious model with strict theoretical guarantees remains a challenging task. To address this gap, we introduce CREDIT, a certified ownership verification against MEAs. Specifically, we employ mutual information to quantify the similarity between DNN models, propose a practical verification threshold, and provide rigorous theoretical guarantees for ownership verification based on this threshold. We extensively evaluate our approach on several mainstream datasets across different domains and tasks, achieving state-of-the-art performance. Our implementation is publicly available at: https://github.com/LabRAI/CREDIT.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。