基于Tardos码的黑盒-白盒DNN水印中的叛徒追踪初探
密码学与安全
2024-01-04 v3
摘要
深度神经网络(DNN)日益普及,其训练往往计算昂贵且需海量数据,这呼唤准确的作者身份验证方法,以阻止模型非法传播并识别泄露源头。在DNN水印中,所有者可能可访问完整网络(白盒)或仅能从其查询输出中提取信息(黑盒),但加水印的模型可同时包含两种方式,以收集充分证据进而获得网络访问权。尽管白盒水印中考虑叛徒追踪的研究有限,该问题在黑盒场景下尚待探索。本文提出一种面向DNN分类器的黑盒-白盒水印方法,利用Tardos码的特性,开启了黑盒下抗共谋叛徒追踪之门,并能在授予模型访问权前识别泄露来源。实验结果表明该方法可成功识别叛徒(即便遭受进一步攻击),我们也讨论了其在黑盒叛徒追踪中的局限与开放问题。
引用
@article{arxiv.2307.06695,
title = {Towards Traitor Tracing in Black-and-White-Box DNN Watermarking with Tardos-based Codes},
author = {Elena Rodriguez-Lois and Fernando Perez-Gonzalez},
journal= {arXiv preprint arXiv:2307.06695},
year = {2024}
}
备注
\c{opyright} 2023 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works