Skip to yearly menu bar Skip to main content


Poster

Boundary Intersection Sensitive Fingerprinting for Tampering Detection of DNN Models

Xiaofan Bai · Chaoxiang He · Xiaojing Ma · Bin Zhu · Hai Jin


Abstract:

Cloud-based AI services are attractive but open a door for tampering with a cloud-deployed DNN model for injecting malicious behaviors, degrading performance to lower competitive edge, or reducing computing resources to save money, etc. Integrity verification that enables public checking whether a deployed model has been tampered with is critical for cloud-based AI services. In this paper, we propose a new definition of fingerprint sample sensitivity to model tampering from the perspective of changes in cross-entropy loss introduced by model tampering, and then theoretically analyze the relationship between decision boundary intersection and fingerprint sensitivity for tampering detection of DNN models based on our definition of sample sensitivity, that is, the more decision boundary intersections the fingerprint sample located at, the higher the sample sensitivity is. We design a partial Shannon informative loss that enables BISF to effectively and efficiently locate intersections of decision boundaries of multiple categories of a target model. BISF generates sensitive fingerprint samples in proximity to the discovered intersection points for tamper detection. Our extensive experimental evaluation indicates that BISF outperforms existing state-of-the-art (SOTA) fingerprinting methods, especially when the number of intersected decision boundaries increases. It achieves SOTA performance in the integrity verification of DNN models.

Live content is unavailable. Log in and register to view live content