Say No to Freeloader: Protecting Intellectual Property of Your Deep Model

TL;DR

A novel Compact Un-transferable Pyramid Isolation Domain (CUPI-Domain) is introduced which serves as a barrier against illegal transfers from authorized to unauthorized domains, and novel style and discriminative loss functions are designed to effectively enhance the distinction in style and discriminative features between authorized and unauthorized domains.

Abstract

Model intellectual property (IP) protection has attracted growing attention as science and technology advancements stem from human intellectual labor and computational expenses. Ensuring IP safety for trainers and owners is of utmost importance, particularly in domains where ownership verification and applicability authorization are required. A notable approach to safeguarding model IP involves proactively preventing the use of well-trained models of authorized domains from unauthorized domains. In this paper, we introduce a novel Compact Un-transferable Pyramid Isolation Domain (CUPI-Domain) which serves as a barrier against illegal transfers from authorized to unauthorized domains. Drawing inspiration from human transitive inference and learning abilities, the CUPI-Domain is designed to obstruct cross-domain transfers by emphasizing the distinctive style features of the authorized domain. This emphasis leads to failure in recognizing irrelevant private style features on unauthorized domains. To this end, we propose novel CUPI-Domain generators, which select features from both authorized and CUPI-Domain as anchors. Then, we fuse the style features and semantic features of these anchors to generate labeled and style-rich CUPI-Domain. Additionally, we design external Domain-Information Memory Banks (DIMB) for storing and updating labeled pyramid features to obtain stable domain class features and domain class-wise style features. Based on the proposed whole method, the novel style and discriminative loss functions are designed to effectively enhance the distinction in style and discriminative features between authorized and unauthorized domains, respectively. Moreover, we provide two solutions for utilizing CUPI-Domain based on whether the unauthorized domain is known: target-specified CUPI-Domain and target-free CUPI-Domain.

Figures (6)

• Figure 1: Model IP protection with our proposed CUPI-Domain. (a): In traditional supervised learning (SL), owners train deep models on the authorized domain (blue square), and then authorized users can gain correct predictions on the authorized domain. However, freeloaders can illicitly steal these models and deploy them on unauthorized domains (red squares) to obtain usable results for profit. (b): Our method constructs a CUPI-Domain between the authorized and unauthorized domains, which could block the illegal transferring and lead to a wrong prediction for unauthorized domains.
• Figure 2: Illustration of our proposed CUPI-Domain generator. The output feature of the authorized domain $f_s^l$ and the CUPI-Domain $f_i^l$ in the $l$-th feature extractor block are fed into the CUPI-Domain generator, and then the style features of $f_s^l$ are combined with the semantic features of $f_i^l$ to update the CUPI-Domain. This update process ensures that the private style features of the updated $f{'}_i^l$ are more similar to the features of the authorized domain $f_s^l$ while preserving their original semantic features.
• Figure 3: The illustration of our proposed CUPI-Domain, including the feature extractor blocks, CUPI-Domain generators, the external DIMB, and style/distinctive loss functions. The samples from the authorized domain, CUPI-Domain, and unauthorized domain are fed into the feature extractor in parallel, denoted by blue, purple, and red, respectively. The CUPI-Domain generators are deployed after each feature extractor block, while the external DIMB are designed to store specified labeled features to obtain stable domain class features and domain class-wise style features for subsequent computation.
• Figure 4: The accuracy ($\%$) of SL, target-specified NTL NTL, CUTI-Domain CVPR, and CUPI-Domain on CIFAR10&STL10, and VisDA-2017. The title in each subgraph implies the authorized domain (left of '$\rightarrow$') and the unauthorized domain (right of '$\rightarrow$'). The bars with different colors represent the accuracy of each method in the authorized domain, the unauthorized domain, and the drop (relative drop) of the model performance, respectively.
• Figure 5: The accuracy ($\%$) of SL, target-free NTL NTL, CUTI-Domain CVPR and CUPI-Domain on CIFAR10&STL10, and VisDA-2017. The title in each subgraph implies the authorized domain (left of '$\rightarrow$') and the unauthorized domain (right of '$\rightarrow$'). The bars with different colors represent the accuracy of each method in the authorized domain, the unauthorized domain, and the drop (relative drop) of the model performance, respectively.