Neural Network Model Protection via Block Chaining and Hash Embedding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting neural network models from misappropriation and adversarial attacks are inadequate, as they fail to prevent alteration of model parameters and subsequent performance degradation, and cannot effectively stop distillation learning-based misappropriation.
Innovation Solution
Divide parameter data of neural network models into blocks, perform block chaining, and embed hash values from these blocks into the output data, making it difficult to alter or misappropriate the model through techniques like distillation learning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blockchaining method is used to prevent alteration of network model parameters, then security against parameter alteration is improved, but it cannot prevent misappropriation through distillation learning
Solution Approach 1:
The network model parameters are divided into multiple blocks, with each block containing a subset of parameters and a hash value of the previous block. This segmentation prevents complete model reconstruction through distillation learning, as each block is protected by cryptographic hashing and the segmented structure makes it computationally infeasible to replicate the entire model from partial outputs.
Solution Approach 2:
Hash values are nested within the block structure, where each block contains the hash of the previous block. This nested cryptographic structure creates a chain of dependencies that protects against both parameter alteration and distillation learning, as any modification to parameters would require regenerating the entire hash chain, which is computationally prohibitive.
2Reliability
If network model parameters are protected from alteration, then model integrity is improved, but model performance may degrade due to security measures
Solution Approach 1:
Hash values serve as intermediaries between the original parameters and the protected storage structure. These hash values enable verification of parameter integrity without requiring direct access to or modification of the original parameters, thus maintaining model performance while ensuring security through cryptographic verification.
3Productivity
If distillation learning output is used to generate new models, then model utilization is improved, but intellectual property protection is weakened
Solution Approach 1:
The blockchained structure with embedded hash values creates preliminary protection against distillation learning misappropriation. By embedding cryptographic verification mechanisms within the parameter structure before any learning or utilization occurs, the system prevents unauthorized replication even when model outputs are available for distillation learning, thus protecting intellectual property while allowing legitimate utilization.
Data Source
AI summary
An information processing apparatus includes one or more processors, and one or more memories that store a computer-readable instruction configured to be executed by the one or more processors, thereby the computer-readable instruction causing the information processing apparatus to divide parameter data related to a network model of a neural network into a plurality of blocks, and generate embedded information based on connection information for each block obtained by converting, for the respective blocks, data in each block including the parameter data and connection information for another block, and perform output setting for using data with the generated embedded information embedded in an output from the network model, as an output of the network model.