Recoverable Active Protection Framework for Neural Network Models

To protect the intellectual property (IP) of neural network models, many active protection methods for models based on parameter obfuscation have been proposed. However, the obfuscated models obtained by parameter obfuscation may easily attract the attention of attackers and be maliciously tampered. When the parameters of obfuscated model are tampered, the obfuscated model cannot be used normally, even if the authorized user has the secret keys. In this paper, we propose a general framework of recoverable active protection for neural network models (FRANN), which can locate and recover tampered parameters, and thus allow authorized users to use the model normally. Specifically, a hash function and the reference-sharing mechanism are first employed to generate hash-bits and recovery-bits, which can be utilized to locate and recover tampered parameters, respectively. Then, important parameters of the model are selected and obfuscated to obtain an obfuscated model. Experimental results show that our framework is suitable for parameter obfuscation-based model active protection methods, which ensures that authorized users can recover the tampered model with the secret keys as long as the model suffers a tampering rate not greater than 0.45.