@inproceedings{
he2024towards,
title={Towards Stricter Black-box Integrity Verification of Deep Neural Network Models},
author={Chaoxiang He and Xiaofan Bai and Xiaojing Ma and Bin Benjamin Zhu and Pingyi Hu and Jiayun Fu and Hai Jin and Dongmei Zhang},
booktitle={ACM Multimedia 2024},
year={2024},
url={https://openreview.net/forum?id=GFU5s42jkr}
}
Cloud-based machine learning services are attractive but expose a cloud-deployed DNN model to the risk of tampering.
 Black-box integrity verification (BIV) enables the owner or end-users to ascertain whether a cloud-deployed DNN model has been tampered with via returned responses of only top-1 labels.
 Fingerprinting generates fingerprint samples to query the model to achieve BIV of the model with no impact on the model's accuracy.
 In this paper, we introduce BIVBench, the first benchmark for BIV of DNN models, encompassing 16 types of practical modifications covering typical tampering scenarios. We reveal that existing fingerprinting methods, which focus on a limited range of tampering types, lack sensitivity in detecting subtle, yet common and potentially severe, tampering effectively.
 To fill this gap, we propose MiSentry (Model integrity Sentry), a novel fingerprinting method that strategically incorporates only a few crucial subtly tampered models into a model zoo, leverages meta-learning, and maximizes the divergence of the output predictions between the untampered targeted model and those models in the model zoo to generate highly sensitive, generalizable, and effective fingerprint samples.
 Extensive evaluations using BIVBench demonstrate that MiSentry substantially outperforms existing state-of-the-art fingerprinting methods, particularly in detecting subtle tampering.
Towards Stricter Black-box Integrity Verification of Deep Neural Network Models
Chaoxiang He Xiaofan Bai Xiaojing Ma Bin Benjamin Zhu Pingyi Hu Jiayun Fu Hai Jin Dongmei Zhang