Search papers, labs, and topics across Lattice.
This paper formalizes the concept of Proof of Ownership for machine learning models, addressing the critical issue of model ownership in the face of theft. By modeling the interaction between a model owner, a thief, and a judge, the authors establish conditions under which ownership can be proven, revealing a dichotomy for classifiers in the black-box setting. The key finding indicates that ownership can be proven if and only if the concept class is not self-correctable, providing a foundational framework for future research in model protection.
Ownership of machine learning models can only be proven when the underlying concept class isn't self-correctable, revealing a critical vulnerability in model security.
With the increasing adoption of Machine Learning, protecting model ownership has become an essential challenge. We initiate a formal study of Proof of Ownership for machine learning models: under what conditions can one prove that a stolen model originated from a particular creator? We model proofs of ownership as a game among three parties: a model owner, a thief, and a judge. The owner transforms the original model into a slightly perturbed model together with a proof of ownership. The thief then obtains the transformed model and attempts to minimally modify it so that it remains useful but escapes detection as owned by the model owner. Finally, the judge receives a model and a proof of ownership, and must decide whether the given model is a modified version of some model created by the model owner, or else the given model was developed independently. Our main result is a dichotomy for classifiers in the black-box setting: Under standard cryptographic assumptions, ownership of models for some concept class can be proven in the above sense {\em if and only if} the concept class is not self-correctable, in a sense close to that of Blum, Luby and Rubinfeld, STOC'90. The result is constructive and extends, with some variations, to a number of related settings.
BAIR