DOL: A Dual Ownership License for Deep Neural Networks
摘要
Deep neural networks (DNNs) are extensively deployed in practice, while protecting these advanced DNN models from unauthorized distribution has become a challenge. Model fingerprinting and watermarking have been extensively studied against such unauthorized distribution. However, using either of the two solely seems problematic in practical use since fingerprinting is costly and fragile, while most watermarking schemes require either white-box access to or expensive fine-tuning on the DNN model being protected. The remaining black-box watermarking frees the master DNN model from heavy fine-tuning, unfortunately, at the cost of being fragile like fingerprinting. In this work, we revisit and resolve the conflict between efficiency and effectiveness of ownership protection for DNNs. We propose DOL, a Dual Ownership License for DNNs benefiting from the frailty of fingerprinting and robustness of watermarking. Our key insight is to utilize an independent model to achieve dual protection of the master DNN model being protected. Specifically, the independent model is trained on a carefully designed dataset and then entangled with the master DNN model, such that the independent model provides 1) watermarking protection when is intact and 2) fingerprinting protection if master DNN model is compromised. In this manner, whether the adversary disables the license or not, the ownership can be validated with a high confidence level via simple queries, which continuously guarantees ownership of production-level DNN models during public distribution. Experiments on several datasets justified the efficiency, effectiveness, and model fidelity of our proposal.