8 research outputs found
When NAS Meets Watermarking: Ownership Verification of DNN Models via Cache Side Channels
We present a novel watermarking scheme to verify the ownership of DNN models.
Existing solutions embedded watermarks into the model parameters, which were
proven to be removable and detectable by an adversary to invalidate the
protection. In contrast, we propose to implant watermarks into the model
architectures. We design new algorithms based on Neural Architecture Search
(NAS) to generate watermarked architectures, which are unique enough to
represent the ownership, while maintaining high model usability. We further
leverage cache side channels to extract and verify watermarks from the
black-box models at inference. Theoretical analysis and extensive evaluations
show our scheme has negligible impact on the model performance, and exhibits
strong robustness against various model transformations