MimosaNet: An Unrobust Neural Network Preventing Model Stealing
This addresses the issue of intellectual property protection for neural networks, particularly in embedded domains, though it appears incremental as it builds on existing network architectures.
The paper tackles the problem of model stealing in deep neural networks by proposing MimosaNet, a method that creates an equivalent network with the same accuracy but extreme sensitivity to weight changes, preventing unauthorized modifications.
Deep Neural Networks are robust to minor perturbations of the learned network parameters and their minor modifications do not change the overall network response significantly. This allows space for model stealing, where a malevolent attacker can steal an already trained network, modify the weights and claim the new network his own intellectual property. In certain cases this can prevent the free distribution and application of networks in the embedded domain. In this paper, we propose a method for creating an equivalent version of an already trained fully connected deep neural network that can prevent network stealing: namely, it produces the same responses and classification accuracy, but it is extremely sensitive to weight changes.