This paper investigates the piracy problem of deep learning models. Designing
and training a well-performing model is generally expensive. However, when
releasing them, attackers may reverse engineer the models and pirate their
design. This paper, therefore, proposes deep learning obfuscation, aiming at
obstructing attackers from pirating a deep learning model. In particular, we
focus on obfuscating convolutional neural networks (CNN), a widely employed
type of deep learning architectures for image recognition. Our approach
obfuscates a CNN model eventually by simulating its feature extractor with a
shallow and sequential convolutional block. To this end, we employ a recursive
simulation method and a joint training method to train the simulation network.
The joint training method leverages both the intermediate knowledge generated
by a feature extractor and data labels to train a simulation network. In this
way, we can obtain an obfuscated model without accuracy loss. We have verified
the feasibility of our approach with three prevalent CNNs, i.e., GoogLeNet,
ResNet, and DenseNet. Although these networks are very deep with tens or
hundreds of layers, we can simulate them in a shallow network including only
five or seven convolutional layers. The obfuscated models are even more
efficient than the original models. Our obfuscation approach is very effective
to protect the critical structure of a deep learning model from being exposed
to attackers. Moreover, it can also thwart attackers from pirating the model
with transfer learning or incremental learning techniques because the shallow
simulation network bears poor learning ability. To our best knowledge, this
paper serves as a first attempt to obfuscate deep learning models, which may
shed light on more future studies.

论文提出了深度学习模型模糊化的方法，通过模拟卷积神经网络的特征提取器使攻击者无法盗用模型设计，并采用递归模拟方法和联合训练方法训练模拟网络。最终得到的模糊化模型不会损失精度，能有效地保护深度学习模型的关键结构免遭攻击。