Abstract
Deep Neural Networks are robust to minor perturbations of the learned network parameters and their minor modifications do not change the overall network response significantly. This allows space for model stealing, where a malevolent attacker can steal an already trained network, modify the weights and claim the new network his own intellectual property. In certain cases this can prevent the free distribution and application of networks in the embedded domain. In this paper, we propose a method for creating an equivalent version of an already trained fully connected deep neural network that can prevent network stealing, namely, it produces the same responses and classification accuracy, but it is extremely sensitive to weight changes.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Koch, E., Zhao, J.: Towards robust and hidden image copyright labeling. In: IEEE Workshop on Nonlinear Signal and Image Processing, vol. 1174, pp. 185–206, Greece, Neos Marmaras (1995)
Wolfgang, R.B., Delp, E.J.: A watermark for digital images. In: Proceedings of the International Conference on Image Processing, vol. 3, pp. 219–222. IEEE (1996)
Zarrabi, H., Hajabdollahi, M., Soroushmehr, S., Karimi, N., Samavi, S., Najarian, K.: Reversible image watermarking for health informatics systems using distortion compensation in wavelet domain (2018 ) arXiv preprint arXiv:1802.07786
Xu, H., Su, Y., Zhao, Z., Zhou, Y., Lyu, M.R., King, I.: Deepobfuscation: securing the structure of convolutional neural networks via knowledge distillation (2018) arXiv preprint arXiv:1806.10313
Namba, R., Sakuma, J.: Robust watermarking of neural network with exponential weighting (2019) arXiv preprint arXiv:1901.06151
Gomez, L., Ibarrondo, A., Márquez, J., Duverger, P.: Intellectual property protection for distributed neural networks (2018)
Hitaj, D., Mancini, L.V.: Have you stolen my model? evasion attacks against deep neural network watermarking techniques (2018) arXiv preprint arXiv:1809.00615
LeCun, Y., Cortes, C., Burges, C.: MNIST handwritten digit database. AT&T Labs 2 (2010). http://yann.lecun.com/exdb/mnist
Kingma, D.P., Ba, J.: Adam: a method for stochastic optimization (2014) arXiv preprint arXiv:1412.6980
Hinton, G., Vinyals, O., Dean, J.: Distilling the knowledge in a neural network (2015) arXiv preprint arXiv:1503.02531
Acknowledgments
This research has been partially supported by the Hungarian Government by the following grant: 2018-1.2.1-NKP-00008: Exploring the Mathematical Foundations of Artificial Intelligence also the funds of grant EFOP-3.6.2-16-2017-00013 are gratefully acknowledged.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Szentannai, K., Al-Afandi, J., Horváth, A. (2020). Preventing Neural Network Weight Stealing via Network Obfuscation. In: Arai, K., Kapoor, S., Bhatia, R. (eds) Intelligent Computing. SAI 2020. Advances in Intelligent Systems and Computing, vol 1230. Springer, Cham. https://doi.org/10.1007/978-3-030-52243-8_1
Download citation
DOI: https://doi.org/10.1007/978-3-030-52243-8_1
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-52242-1
Online ISBN: 978-3-030-52243-8
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)