<p>Deep learning has achieved remarkable progress in various applications, heightening the importance of safeguarding the intellectual property (IP) of well-trained models. It entails not only authorizing usage but also ensuring the deployment of models in authorized data domains, i.e., making models exclusive to certain target domains. Previous methods necessitate concurrent access to source training data and target unauthorized data when performing IP protection, making them risky and inefficient for decentralized private data. In this paper, we target a practical setting where only a well-trained source model is available and investigate how we can realize IP protection. To achieve this, we propose a novel MAsk Pruning (MAP) framework. MAP stems from an intuitive hypothesis, i.e., there are target-related parameters in a well-trained model, locating and pruning them is the key to IP protection. Technically, MAP freezes the source model and learns a target-specific binary mask to prevent unauthorized data usage while minimizing performance degradation on authorized data. Building on MAP, we extend it to <i>MAP++</i> by introducing an activation-guided dynamic pruning strategy with adaptive thresholds, and grounding the design with a mutual-information-based theoretical framework. We further broaden the evaluation by conducting extensive experiments under source-available, source-free, and fully data-free settings. <i>MAP++</i> achieves more stable suppression of unauthorized domains while preserving authorized performance, demonstrating a superior trade-off between utility and protection.</p>

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Dynamic MAsk-Pruning Strategy for Source-Free Model Intellectual Property Protection

  • Boyang Peng,
  • Sanqing Qu,
  • Yong Wu,
  • Tianpei Zou,
  • Lianghua He,
  • Alois Knoll,
  • Guang Chen,
  • Changjun Jiang

摘要

Deep learning has achieved remarkable progress in various applications, heightening the importance of safeguarding the intellectual property (IP) of well-trained models. It entails not only authorizing usage but also ensuring the deployment of models in authorized data domains, i.e., making models exclusive to certain target domains. Previous methods necessitate concurrent access to source training data and target unauthorized data when performing IP protection, making them risky and inefficient for decentralized private data. In this paper, we target a practical setting where only a well-trained source model is available and investigate how we can realize IP protection. To achieve this, we propose a novel MAsk Pruning (MAP) framework. MAP stems from an intuitive hypothesis, i.e., there are target-related parameters in a well-trained model, locating and pruning them is the key to IP protection. Technically, MAP freezes the source model and learns a target-specific binary mask to prevent unauthorized data usage while minimizing performance degradation on authorized data. Building on MAP, we extend it to MAP++ by introducing an activation-guided dynamic pruning strategy with adaptive thresholds, and grounding the design with a mutual-information-based theoretical framework. We further broaden the evaluation by conducting extensive experiments under source-available, source-free, and fully data-free settings. MAP++ achieves more stable suppression of unauthorized domains while preserving authorized performance, demonstrating a superior trade-off between utility and protection.