论文标题
深度学习模型的知识产权保护：分类法，方法，攻击和评估
Intellectual Property Protection for Deep Learning Models: Taxonomy, Methods, Attacks, and Evaluations
论文作者
论文摘要
深度学习模型的培训和创建通常是昂贵的，因此可以将其视为模型创建者的知识产权（IP）。但是，获得高性能模型的恶意用户可以在未经许可的情况下非法复制，重新分布或滥用模型。为了应对这种安全威胁，近年来提出了一些深层神经网络（DNN）IP保护方法。本文试图对现有的DNN IP保护作用以及展望进行审查。首先，我们根据六个属性提出了DNN IP保护方法的第一个分类法：方案，机制，容量，类型，功能和目标模型。然后，我们就上述六个属性进行了有关现有DNN IP保护的调查，尤其是关注这些方法所面临的挑战，这些方法是否可以提供主动保护及其对不同级别攻击的阻力。之后，我们通过模型修改，逃避攻击和主动攻击的各个方面分析了对DNN IP保护方法的潜在攻击。此外，还提供了针对基本功能指标，抗击抗性指标和定制指标的DNN IP保护方法的系统评估方法。最后，提出了DNN IP保护的未来研究机会和挑战。
The training and creation of deep learning model is usually costly, thus it can be regarded as an intellectual property (IP) of the model creator. However, malicious users who obtain high-performance models may illegally copy, redistribute, or abuse the models without permission. To deal with such security threats, a few deep neural networks (DNN) IP protection methods have been proposed in recent years. This paper attempts to provide a review of the existing DNN IP protection works and also an outlook. First, we propose the first taxonomy for DNN IP protection methods in terms of six attributes: scenario, mechanism, capacity, type, function, and target models. Then, we present a survey on existing DNN IP protection works in terms of the above six attributes, especially focusing on the challenges these methods face, whether these methods can provide proactive protection, and their resistances to different levels of attacks. After that, we analyze the potential attacks on DNN IP protection methods from the aspects of model modifications, evasion attacks, and active attacks. Besides, a systematic evaluation method for DNN IP protection methods with respect to basic functional metrics, attack-resistance metrics, and customized metrics for different application scenarios is given. Lastly, future research opportunities and challenges on DNN IP protection are presented.
