MEW: Evading Ownership Detection Against Deep Learning Models

Training deep neural network (DNNs) requires massive computing resources and data, hence the trained models belong to the model owners’ Intellectual Property (IP), and it is very important to defend against the model stealing attack. Recently, a well-known approach named Dataset Inference (DI) claimed that by measuring the distance from the sample to the decision boundary, it can be determined whether the theft has occurred. In this paper, we show that DI is not enough for IP protection. To demonstrate this, we propose a new system called MEW, which combines the Model Inversion (MI) attack and Elastic Weight Consolidation (EWC) to evade the detection of DI. We first use the pre-trained adversary model to generate a data pool and adaptively select samples to approximate the Fisher Information Matrix of the adversary model. Then we use an adaptation of EWC to slightly fine-tune the adversary model which moves it decision boundary slightly. Our empirical results demonstrate that the adversary model evaded the DI detection with 40 samples. We also lay out the limitations of MEW and discuss them at last.