An Effective Model Copyright Protection for Federated Learning

Federated learning (FL), an efficient distributed machine learning framework, carries out model training while safeguarding local data privacy. Due to its excellent performance and significant profits, it has been applied to a wide range of practical areas. The model’s ownership and copyright protection has become a major issue. It is possible that FL could benefit from the existing property rights protection methods in centralized scenarios, such as watermark embedding and model fingerprints, based on intuition. The distributed nature of FL poses a challenge for them due to the lack of data sharing, parameter aggregation, and federated training settings. We propose a method to protect model copyright using model fingerprints and formalize the problem of copyright protection for FL by extracting model features using adversarial examples. Our method outperforms previous works in four key aspects: (i) Validity—it extracts model features to generate transferable fingerprints, which are used to train a detector to verify the copyright of the model. (ii) Fidelity—it has an imperceptible impact on the federated training, thus promising good main task performance. (iii) Robustness—it is empirically robust against malicious attack on copyright protection, i.e., fine-tuning, model pruning, and adaptive attacks. (iv) Black-box—it is valid in a black-box forensic scenario where only application programming interface calls to the model are available. Extensive evaluations across three datasets and nine model structures demonstrate our method’s superior fidelity, validity, and robustness.