iNNformant: Boundary Samples as Telltale Watermarks
This addresses the need for watermarking and security in AI systems, though it is incremental as it builds on existing boundary sample concepts.
The paper tackled the problem of identifying the execution environment of neural networks by generating boundary samples with minimal perceptual distortion, achieving sets that can distinguish among four microarchitectures with a peak signal-to-noise ratio of at least 70dB.
Boundary samples are special inputs to artificial neural networks crafted to identify the execution environment used for inference by the resulting output label. The paper presents and evaluates algorithms to generate transparent boundary samples. Transparency refers to a small perceptual distortion of the host signal (i.e., a natural input sample). For two established image classifiers, ResNet on FMNIST and CIFAR10, we show that it is possible to generate sets of boundary samples which can identify any of four tested microarchitectures. These sets can be built to not contain any sample with a worse peak signal-to-noise ratio than 70dB. We analyze the relationship between search complexity and resulting transparency.