Machine Learning Model Copy Detection via Input Encoding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models are vulnerable to model extraction attacks, where an attacker can create a near-identical copy of the model by querying it, and existing solutions like watermarks are difficult and costly to implement effectively.
Innovation Solution
A method involving encoding a master input into a special set of inputs that binds it to the machine learning model, using error correction codes and one-way functions to create a seal, allowing detection of copies without modifying the model or affecting its performance, and enabling protection without direct access to the model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a watermark is embedded into the ML model to prove ownership, then the model can be marked and ownership proven, but the model functionality may be altered and implementation becomes difficult and costly
Solution Approach 1:
The patent extracts the watermarking process from the model training phase and moves it to the inference phase. Instead of embedding watermarks during training (which alters model functionality), the system generates watermarks by processing specific test inputs through the trained model, thereby proving ownership without modifying the model itself
Solution Approach 2:
The patent introduces test inputs as an intermediary mechanism. These special test inputs act as mediators that, when processed by the model, produce unique output patterns that serve as watermarks. This intermediary approach allows ownership proof without direct modification of the model
2Reliability
If the watermark is hidden from attackers to prevent removal, then security is improved, but detection becomes more difficult
Solution Approach 1:
The patent applies local quality by making the watermark visible only in specific contexts. The watermark appears clearly in the output when specific test inputs are provided, but remains hidden or indistinguishable in normal operational inputs. This contextual visibility resolves the contradiction between security and detectability
3Device complexity
If model extraction attack is performed by providing valid queries and compiling outputs, then a near identical copy can be produced, but the original model cannot be directly accessed
Solution Approach 1:
The patent applies preliminary action by pre-processing the inputs before they reach the model. Special test inputs are designed and prepared in advance that, when processed by the model, produce unique output patterns. This preliminary preparation of inputs creates detectable watermarks that prevent successful model extraction, as the copied model would not reproduce the exact same output patterns for these predetermined inputs
Data Source
AI summary
A method is provided for detecting copying of a machine learning model. A plurality of inputs is provided to a first machine learning model. The first machine learning model provides a plurality of output values. A sequence of bits of a master input is divided into a plurality of subsets of bits. The master input may be an image. Each subset of the plurality of subsets of bits corresponds to one of the plurality of output values. An ordered sequence of the inputs is generated based on the plurality of subsets of bits. The ordered sequence of the inputs is inputted to a second machine learning model. It is then determined if output values from the second machine learning model reproduces the predetermined master input. If the predetermined master input is reproduced, the second machine learning model is a copy of the first machine learning model.