Deep neural network (DNN) models are valuable intellectual property of model
owners, constituting a competitive advantage. Therefore, it is crucial to
develop techniques to protect against model theft. Model ownership resolution
(MOR) is a class of techniques that can deter model theft. A MOR scheme enables
an accuser to assert an ownership claim for a suspect model by presenting
evidence, such as a watermark or fingerprint, to show that the suspect model
was stolen or derived from a source model owned by the accuser. Most of the
existing MOR schemes prioritize robustness against malicious suspects, ensuring
that the accuser will win if the suspect model is indeed a stolen model.
In this paper, we show that common MOR schemes in the literature are
vulnerable to a different, equally important but insufficiently explored,
robustness concern: a malicious accuser. We show how malicious accusers can
successfully make false claims against independent suspect models that were not
stolen. Our core idea is that a malicious accuser can deviate (without
detection) from the specified MOR process by finding (transferable) adversarial
examples that successfully serve as evidence against independent suspect
models. To this end, we first generalize the procedures of common MOR schemes
and show that, under this generalization, defending against false claims is as
challenging as preventing (transferable) adversarial examples. Via systematic
empirical evaluation we demonstrate that our false claim attacks always succeed
in all prominent MOR schemes with realistic configurations, including against a
real-world model: Amazon's Rekognition API.

本文介绍了一种新方法，能够使恶意主张人成功地向独立被怀疑的模型提出假陈述，该方法利用了深度神经网络的漏洞以及对于实现有效 MOR 的属性的不足。

关于模型所有权的虚假指控解决

False Claims against Model Ownership Resolution

Training machine learning (ML) models typically involves expensive iterative
optimization. Once the model's final parameters are released, there is
currently no mechanism for the entity which trained the model to prove that
these parameters were indeed the result of this optimization procedure. Such a
mechanism would support security of ML applications in several ways. For
instance, it would simplify ownership resolution when multiple parties contest
ownership of a specific model. It would also facilitate the distributed
training across untrusted workers where Byzantine workers might otherwise mount
a denial-of-service by returning incorrect model updates.
In this paper, we remediate this problem by introducing the concept of
proof-of-learning in ML. Inspired by research on both proof-of-work and
verified computations, we observe how a seminal training algorithm, stochastic
gradient descent, accumulates secret information due to its stochasticity. This
produces a natural construction for a proof-of-learning which demonstrates that
a party has expended the compute require to obtain a set of model parameters
correctly. In particular, our analyses and experiments show that an adversary
seeking to illegitimately manufacture a proof-of-learning needs to perform *at
least* as much work than is needed for gradient descent itself.
We also instantiate a concrete proof-of-learning mechanism in both of the
scenarios described above. In model ownership resolution, it protects the
intellectual property of models released publicly. In distributed training, it
preserves availability of the training procedure. Our empirical evaluation
validates that our proof-of-learning mechanism is robust to variance induced by
the hardware (ML accelerators) and software stacks.

此研究的目的是实现机器学习中证明训练过程的机制 ——proof-of-learning。作者观察到随机梯度下降算法具有积累秘密信息的性质，并构建了一种自然的证明机制来证明一个实体已经正确地完成了模型参数优化过程，进而保护模型的知识产权。同时，该证明机制也保持了训练过程的可用性，可以在多方争议模型所有权的情况下使用。实验证明，该机制在硬件和软件环境的变化下仍能保持鲁棒性。