Find the Lady: Permutation and Re-Synchronization of Deep Neural Networks
This addresses integrity threats in neural network watermarking for ownership tracking, offering a countermeasure against corruption, though it is incremental in improving existing security methods.
The paper tackles the problem of re-synchronizing permuted neurons in deep neural networks, which is crucial for integrity verification and watermarking, and demonstrates a method that achieves robustness against attacks like pruning and fine-tuning with practical validation on computer vision datasets.
Deep neural networks are characterized by multiple symmetrical, equi-loss solutions that are redundant. Thus, the order of neurons in a layer and feature maps can be given arbitrary permutations, without affecting (or minimally affecting) their output. If we shuffle these neurons, or if we apply to them some perturbations (like fine-tuning) can we put them back in the original order i.e. re-synchronize? Is there a possible corruption threat? Answering these questions is important for applications like neural network white-box watermarking for ownership tracking and integrity verification. We advance a method to re-synchronize the order of permuted neurons. Our method is also effective if neurons are further altered by parameter pruning, quantization, and fine-tuning, showing robustness to integrity attacks. Additionally, we provide theoretical and practical evidence for the usual means to corrupt the integrity of the model, resulting in a solution to counter it. We test our approach on popular computer vision datasets and models, and we illustrate the threat and our countermeasure on a popular white-box watermarking method.