2020/04/22 by William Aiken, Hyoungshick Kim, Aiken, William +3 · 1 citation
Computer Science · #Adversarial Robustness in Machine Learning #Advanced Neural Network Applications
paper · pdf · doi:10.48550/arxiv.2004.11368
Creating a state-of-the-art deep-learning system requires vast amounts of\ndata, expertise, and hardware, yet research into embedding copyright protection\nfor neural networks has been limited. One of the main methods for achieving\nsuch protection involves relying on the susceptibility of neural networks to\nbackdoor attacks, but the robustness of these tactics has been primarily\nevaluated against pruning, fine-tuning, and model inversion attacks. In this\nwork, we propose a neural network "laundering" algorithm to remove black-box\nbackdoor watermarks from neural networks even when the adversary has no prior\nknowledge of the structure of the watermark.\n We are able to effectively remove watermarks used for recent defense or\ncopyright protection mechanisms while achieving test accuracies above 97% and\n80% for both MNIST and CIFAR-10, respectively. For all backdoor watermarking\nmethods addressed in this paper, we find that the robustness of the watermark\nis significantly weaker than the original claims. We also demonstrate the\nfeasibility of our algorithm in more complex tasks as well as in more realistic\nscenarios where the adversary is able to carry out efficient laundering attacks\nusing less than 1% of the original training set size, demonstrating that\nexisting backdoor watermarks are not sufficient to reach their claims.\n