Verify Deep Learning Models Ownership via Preset Embedding

A well-trained deep neural network (DNNs) requires massive computing resources and data, therefore it belongs to the model owners’ Intellectual Property (IP). Recent works have shown that the model can be stolen by the adversary without any training data or internal parameters of the model. Currently, there were some defense methods to resist it, by increasing the cost of model stealing attack or detecting the theft afterwards.In this paper, We propose a method to determine theft by detecting whether the victim’s preset embedding exists in the adversary model. Firstly, we convert some training images into grayscale images as embedding and inject them to the training set. Then, we train a binary classifier to determine whether the model is stolen from the victim. The main intuition behind our approach is that the stolen model should contain embedded knowledge learned by the victim model. Our results demonstrate that our method is effective in defending against different types of model theft methods.