Deep neural networks (DNNs) have already achieved great success in a lot of
application areas and brought profound changes to our society. However, it also
raises new security problems, among which how to protect the intellectual
property (IP) of DNNs against infringement is one of the most important yet
very challenging topics. To deal with this problem, recent studies focus on the
IP protection of DNNs by applying digital watermarking, which embeds source
information and/or authentication data into DNN models by tuning network
parameters directly or indirectly. However, tuning network parameters
inevitably distorts the DNN and therefore surely impairs the performance of the
DNN model on its original task regardless of the degree of the performance
degradation. It has motivated the authors in this paper to propose a novel
technique called pooled membership inference (PMI) so as to protect the IP of
the DNN models. The proposed PMI neither alters the network parameters of the
given DNN model nor fine-tunes the DNN model with a sequence of carefully
crafted trigger samples. Instead, it leaves the original DNN model unchanged,
but can determine the ownership of the DNN model by inferring which
mini-dataset among multiple mini-datasets was once used to train the target DNN
model, which differs from previous arts and has remarkable potential in
practice. Experiments also have demonstrated the superiority and applicability
of this work.

本研究提出了一种名为池化分组会员推断（PMI）的新技术，旨在保护深度神经网络（DNN）模型的知识产权。PMI 并不改变给定 DNN 模型的网络参数，也不通过一系列精心设计的触发样本进行微调，而是通过推断哪个小型数据集曾用于训练目标 DNN 模型来确定 DNN 模型的所有权。实验也展示了这项工作的优越性和适用性。