Neural Network Weight Locking via Key Matrix Masking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep learning models are vulnerable to theft and unauthorized use, as existing watermarking techniques require access to model parameters for extraction, which is not feasible in practical deployments, and cannot prevent attackers from obtaining correct predictions from stolen models, thus failing to effectively protect intellectual property.
Innovation Solution
A deep neural network is secured by modifying its model weights using a key, such as a binary, sign, or real value matrix through a Hadamard product, allowing only authorized access to recover the original weights, thereby masking certain neurons and protecting the network's topology, even when deployed as a service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If watermarks are embedded into model parameters during training (white-box approach), then watermark extraction can prove ownership, but the approach becomes infeasible when the model is deployed as a service without parameter access
Solution Approach 1:
The patent introduces an intermediary mechanism (the locked model with embedded watermarks) that mediates between the model owner and the service provider. The watermarks are embedded in the locked model parameters, allowing extraction without requiring direct access to the original model parameters. This intermediary structure enables watermark verification while maintaining parameter access constraints.
Solution Approach 2:
The patent creates a copy of the model parameters (the locked model) that contains embedded watermarks. This copy can be deployed as a service without exposing the original parameters, while still enabling watermark extraction through the locked model's parameters. The copying approach allows separation of the original model access and the watermark verification functionality.
2Reliability
If watermarks are embedded into model parameters, then ownership can be proven, but the approach cannot prevent attackers from obtaining correct predictions from stolen models
Solution Approach 1:
The patent applies preliminary anti-action by embedding watermarks into the locked model parameters before deployment. This pre-emptive measure allows the model owner to detect and prove ownership even if the model is stolen, as the watermarks remain embedded in the locked parameters. The anti-action is taken in advance to counter potential theft and unauthorized use.
Solution Approach 2:
The patent changes the 'color' or appearance of the model parameters through watermark embedding. The locked model parameters contain additional information (watermarks) that change their characteristics compared to the original parameters. This allows detection of stolen models through watermark analysis, similar to how color changes can detect altered media.
3Ease of operation
If the model is deployed as a service without parameter access, then practical deployment is enabled, but existing watermarking techniques become inapplicable
Solution Approach 1:
The locked model serves as an intermediary that bridges the gap between service deployment and watermark verification. It contains embedded watermarks that can be extracted without requiring access to the original model parameters, enabling both practical deployment and ownership protection simultaneously.
Solution Approach 2:
The watermarks are embedded into the locked model parameters during the model preparation phase, before deployment as a service. This preliminary action ensures that watermarks are already in place and can be extracted later during service operation, eliminating the need for parameter access during deployment.
Data Source
AI summary
A neural network is trained using a training data set, resulting in a set of model weights, namely, a matrix X, corresponding to the trained network. The set of model weights is then modified to produce a locked matrix X′, which is generated by applying a key. In one embodiment, the key is a binary matrix {0, 1} that zeros (masks) out certain neurons in the network, thereby protecting the network. In another embodiment, the key comprises a matrix of sign values {−1, +1}. In yet another embodiment, the key comprises a set of real values. Preferably, the key is derived by applying a key derivation function to a secret value. The key is symmetric, such that the key used to protect the model weight matrix X (to generate the locked matrix) is also used to recover that matrix, and thus enable access to the model as it was trained.