FBI: Fingerprinting models with Benign Inputs - Archive ouverte HAL
Article Dans Une Revue IEEE Transactions on Information Forensics and Security Année : 2023

FBI: Fingerprinting models with Benign Inputs

Résumé

Recent advances in the fingerprinting of deep neural networks are able to detect specific instances of models, placed in a black-box interaction scheme. Inputs used by the fingerprinting protocols are specifically crafted for each precise model to be checked for. While efficient in such a scenario, this nevertheless results in a lack of guarantee after a mere modification of a model (e.g. finetuning, quantization of the parameters). This article generalizes fingerprinting to the notion of model families and their variants and extends the task-encompassing scenarios where one wants to fingerprint not only a precise model (previously referred to as a detection task) but also to identify which model or family is in the black-box (identification task). The main contribution is the proposal of fingerprinting schemes that are resilient to significant modifications of the models. We achieve these goals by demonstrating that benign inputs, that are unmodified images, are sufficient material for both tasks. We leverage an information-theoretic scheme for the identification task. We devise a greedy discrimination algorithm for the detection task. Both approaches are experimentally validated over an unprecedented set of more than 1,000 networks 1 .
Fichier principal
Vignette du fichier
main.pdf (1.26 Mo) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04176514 , version 1 (03-08-2023)

Licence

Identifiants

Citer

Thibault Maho, Teddy Furon, Erwan Le Merrer. FBI: Fingerprinting models with Benign Inputs. IEEE Transactions on Information Forensics and Security, 2023, pp.1-18. ⟨10.1109/tifs.2023.3301268⟩. ⟨hal-04176514⟩
84 Consultations
137 Téléchargements

Altmetric

Partager

More