Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

FedTracker: Furnishing Ownership Verification and Traceability for Federated Learning Model

Shuo Shao, Wenyuan Yang, Hanlin Gu, Zhan Qin, Lixin Fan, Qiang Yang, Kui Ren

TL;DR

FedTracker addresses model copyright protection in federated learning by enabling both ownership verification and traceability. It introduces a bi-level scheme with a server-side global watermark for ownership and per-client local fingerprints for tracing, augmented by a continual-learning–based embedding to preserve utility. A novel Fingerprint Similarity Score (FSS) improves discrimination among client fingerprints, enabling reliable leaker identification. Empirical results demonstrate high ownership verification accuracy, exact traceability, minimal fidelity loss, and robustness against common watermark-removal attacks in both i.i.d. and non-i.i.d. settings, highlighting practical impact for FL copyright protection.

Abstract

Federated learning (FL) is a distributed machine learning paradigm allowing multiple clients to collaboratively train a global model without sharing their local data. However, FL entails exposing the model to various participants. This poses a risk of unauthorized model distribution or resale by the malicious client, compromising the intellectual property rights of the FL group. To deter such misbehavior, it is essential to establish a mechanism for verifying the ownership of the model and as well tracing its origin to the leaker among the FL participants. In this paper, we present FedTracker, the first FL model protection framework that provides both ownership verification and traceability. FedTracker adopts a bi-level protection scheme consisting of global watermark mechanism and local fingerprint mechanism. The former authenticates the ownership of the global model, while the latter identifies which client the model is derived from. FedTracker leverages Continual Learning (CL) principles to embed the watermark in a way that preserves the utility of the FL model on both primitive task and watermark task. FedTracker also devises a novel metric to better discriminate different fingerprints. Experimental results show FedTracker is effective in ownership verification, traceability, and maintains good fidelity and robustness against various watermark removal attacks.

FedTracker: Furnishing Ownership Verification and Traceability for Federated Learning Model

TL;DR

FedTracker addresses model copyright protection in federated learning by enabling both ownership verification and traceability. It introduces a bi-level scheme with a server-side global watermark for ownership and per-client local fingerprints for tracing, augmented by a continual-learning–based embedding to preserve utility. A novel Fingerprint Similarity Score (FSS) improves discrimination among client fingerprints, enabling reliable leaker identification. Empirical results demonstrate high ownership verification accuracy, exact traceability, minimal fidelity loss, and robustness against common watermark-removal attacks in both i.i.d. and non-i.i.d. settings, highlighting practical impact for FL copyright protection.

Abstract

Federated learning (FL) is a distributed machine learning paradigm allowing multiple clients to collaboratively train a global model without sharing their local data. However, FL entails exposing the model to various participants. This poses a risk of unauthorized model distribution or resale by the malicious client, compromising the intellectual property rights of the FL group. To deter such misbehavior, it is essential to establish a mechanism for verifying the ownership of the model and as well tracing its origin to the leaker among the FL participants. In this paper, we present FedTracker, the first FL model protection framework that provides both ownership verification and traceability. FedTracker adopts a bi-level protection scheme consisting of global watermark mechanism and local fingerprint mechanism. The former authenticates the ownership of the global model, while the latter identifies which client the model is derived from. FedTracker leverages Continual Learning (CL) principles to embed the watermark in a way that preserves the utility of the FL model on both primitive task and watermark task. FedTracker also devises a novel metric to better discriminate different fingerprints. Experimental results show FedTracker is effective in ownership verification, traceability, and maintains good fidelity and robustness against various watermark removal attacks.
Paper Structure (33 sections, 16 equations, 17 figures, 11 tables, 4 algorithms)

This paper contains 33 sections, 16 equations, 17 figures, 11 tables, 4 algorithms.

Table of Contents

  1. Introduction
  2. Contributions
  3. Roadmap
  4. Background
  5. Federated Learning
  6. DNN Watermarking Methods
  7. FL Watermarking Methods
  8. Continual Learning
  9. Problem Formulation
  10. Definitions of Ownership Verification and Traceability
  11. Threat Model
  12. Defender Assumptions and Objectives
  13. Ownership Verification and Traceability in Federated Learning
  14. Overview of FedTracker
  15. Embedding Watermark without Natural Data
  16. ...and 18 more sections

Figures (17)

  • Figure 1: Illustration of model leakage in FL and the solution framework. Left: the malicious Client can sell the model to other parties. Middle: The FL group needs to verify the ownership through API access. Right: The fingerprint is extracted from the model and compared with all the fingerprints of Clients to trace the leaker.
  • Figure 2: Workflow of FedTracker in each iteration. FedTracker consists of four stages. ①Local training and aggregation. ②Global watermark embedding. ③Local fingerprints insertion. ④Model distribution.
  • Figure 3: FSS evaluation under different numbers of Clients.
  • Figure 4: FSS evaluation under different lengths of local fingerprints.
  • Figure 5: Accuracy on the primitive task of FedTracker comparing with the model without watermark (No WM) and without CL.
  • ...and 12 more figures

Theorems & Definitions (5)

  • Definition 1: Ownership verification
  • Definition 2: Traceability
  • Definition 3: Global memory
  • Definition 4: Fingerprint Similarity Score
  • Definition 5: Traceability Rate