A Fingerprint Scheme for Deep Neural Network Models Based on Adversarial Samples

The current illegal model misuse such as deep neural network model theft, derivation, resale or redistribution seriously violates the legal ownership of model owners. In order to ensure the security and fair development of artificial intelligence technology and networks, it is necessary to strengthen the protection of model copyright to effectively track and prevent illegal use. In response to this issue, this paper proposes an adversarial sample-based deep neural network model fingerprinting scheme in the text domain. This scheme is divided into two phases, in the fingerprint generation phase, a fast gradient symbol algorithm based on proximity substitution is designed to use the generated adversarial samples as model fingerprints; in the ownership verification phase, the fingerprint recognition rate of the fingerprints on the suspicious models is queried to verify the model ownership. The performance of this scheme is implemented and evaluated in detail on three text datasets and two popular DNN model architectures, and the experimental results show that the scheme can effectively distinguish pirate models from other models, has good stability under model pruning attack and model fine-tuning attack, which can effectively verify the ownership of the model. It provides a reliable technical solution to protect deep learning models from the threats of piracy and unauthorized use.