ML Model Copy Detection via Intermediate Output Seals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models are vulnerable to model extraction attacks, where attackers can easily clone and monetize ML models by accessing inputs and outputs, and existing solutions like watermarks are difficult and costly to implement effectively.
Innovation Solution
A method that divides the ML model into portions, generates a seal using intermediate outputs from a selected portion, and compares it with the corresponding outputs from a suspected copy using a cryptographic hash function, allowing for detection of unauthorized copies without modifying the original model or revealing its internal workings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If watermarks are embedded into the ML model to prove ownership, then model protection is improved, but model functionality may be altered and implementation becomes difficult and costly
Solution Approach 1:
The patent extracts the protection mechanism from the model itself by using intermediate outputs that naturally occur during model operation. Instead of embedding watermarks into the model architecture, the system captures and compares intermediate outputs from hidden layers, which are already generated during normal inference. This extraction approach provides protection without modifying the model or adding implementation complexity.
Solution Approach 2:
The patent introduces intermediate outputs as a mediator between the model and the protection mechanism. These intermediate outputs serve as a natural byproduct of model operation that can be captured and used for verification without directly interfering with the model's internal structure or training. The intermediary approach allows ownership verification while preserving model functionality.
2Ease of operation
If the ML model is provided as a service with access to inputs and outputs, then model usability is improved, but model extraction attacks become easier
Solution Approach 1:
The patent segments the model's output space by capturing intermediate outputs from specific hidden layers rather than only final outputs. This segmentation allows the system to verify model integrity at multiple points in the computation process, making it harder for attackers to create accurate clones even when they have access to inputs and final outputs. The segmented verification approach maintains model accessibility while reducing extraction vulnerability.
Solution Approach 2:
The patent performs preliminary action by capturing and storing intermediate outputs during normal model operation before any potential attack occurs. These pre-captured intermediate outputs serve as a baseline for future verification, allowing the system to detect clones proactively rather than reactively. This preliminary capture of verification data enables continuous protection without interfering with model accessibility.
3Measurement precision
If intermediate outputs from hidden layers are compared to detect copies, then detection accuracy is improved, but computational overhead increases
Solution Approach 1:
The patent applies partial action by comparing only specific intermediate outputs from selected hidden layers rather than all possible outputs from the entire model. This selective comparison provides sufficient detection accuracy to identify clones while significantly reducing the computational overhead compared to full model comparison. The partial verification approach balances precision with efficiency.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This method effectively detects unauthorized copies of ML models without compromising their accuracy or confidentiality, as it only compares intermediate outputs from hidden layers, and can be applied to various types of ML models without retraining, ensuring the model's integrity and proprietary information remain protected.
Implementation Method 1
comparing it with the corresponding outputs from a suspected copy using a cryptographic hash function
Data Source
AI summary
A method is provided for detecting copying of a machine learning model. In the method, the first machine learning model is divided into a plurality of portions. Intermediate outputs from a hidden layer of a selected one of the plurality of portions is compared to corresponding outputs from a second machine learning model to detect the copying. Alternately, a first seal may be generated using the plurality of inputs and the intermediate outputs from nodes of the selected portion. A second seal from a suspected copy that has been generated the same way is compared to the first seal to detect the copying. If the first and second seals are the same, then there is a high likelihood that the suspected copy is an actual copy. By using the method, only the intermediate outputs of the machine learning model outputs have to be disclosed to others, thus protecting the confidentiality of the model.