Exogenous Feature Model Ownership Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for protecting machine learning models from theft are inadequate, as attackers can steal models even with limited access, such as through querying feedback results, posing a significant threat to model owners. Existing solutions like black box protection are not effective, and intrinsic feature-based verification is prone to misjudgment due to similarities in training datasets.
Innovation Solution
Implementing model ownership verification based on an exogenous feature by training a meta-classifier to identify feature knowledge, where initial samples are transformed to include an exogenous feature, and a target model and auxiliary model are trained to distinguish between legitimate and stolen models, using hypothesis testing to validate ownership.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If black box protection is used to protect the model, then the model structure and internal parameters are hidden from users, but attackers can still steal the model by querying feedback results
Solution Approach 1:
The patent embeds an exogenous feature into the training data before model training, so that the deployment model inherently possesses knowledge of this feature. This preliminary action ensures that when verification is needed, the model's response to the exogenous feature can be checked without exposing the model structure or parameters, thus preventing model theft while maintaining protection.
Solution Approach 2:
The patent introduces an auxiliary model and a meta-classifier as intermediaries to verify model ownership. The auxiliary model, trained without the exogenous feature, serves as a comparator against the target model. The meta-classifier acts as a decision-making intermediary that determines whether the suspicious model is stolen based on the comparison results, without requiring direct access to the deployment model's internal structure.
2Measurement precision
If intrinsic feature-based verification is used to verify model ownership, then model theft can be detected, but false positives occur due to similarities in training datasets
Solution Approach 1:
The patent focuses verification on a specific local characteristic - the exogenous feature knowledge embedded in the training data. Instead of verifying the entire model or using multiple intrinsic features that may vary due to dataset similarities, the verification process concentrates on whether the model correctly responds to the specific exogenous feature, reducing false positives while maintaining detection accuracy.
3Measurement precision
If a meta-classifier is trained to identify exogenous feature knowledge, then stolen models can be accurately identified, but the system complexity increases
Solution Approach 1:
The patent creates a simplified copy or representation of the verification problem by training the meta-classifier on gradient information from both the target model and auxiliary model. Instead of directly analyzing the complex deployed model, the meta-classifier learns from simplified gradient patterns that capture the essential difference between stolen and legitimate models, reducing the computational complexity while maintaining identification accuracy.
Data Source
AI summary
Embodiments of this specification provide methods and apparatuses for performing model ownership verification based on an exogenous feature. An implementation of the methods includes: selecting initial samples from an initial sample set to form a selected sample set, processing sample data of the initial samples to obtain transform samples that form a transform sample set, training a meta-classifier based on a target model, an auxiliary model, and the transform sample set, inputting data associated with a suspicious model into the meta-classifier, and determining, based on an output result of the meta-classifier, whether the suspicious model is stolen from a deployment model, wherein the deployment model has feature knowledge of the exogenous feature.