一句话：提出基于测试的 DNN 模型相似度比较方法 ModelDiff，通过决策距离向量检测知识复用。
深度学习模型的知识可迁移到学生模型，导致知识产权侵权或漏洞传播；但可疑模型可能不可白盒访问或面向不同任务，检测复用困难。本文提出 ModelDiff，一种基于测试的相似度比较方法：不直接比较权重、激活或输出，而比较两模型在同一组测试输入上的行为模式，将模型对输入对的反应距离组成决策距离向量（DDV），以 DDV 余弦相似度衡量知识相似性。作者构建覆盖迁移学习、模型压缩和模型窃取的 144 对模型基准，正确率达 91.7%，并在移动深度学习应用中验证可行性。
The knowledge of a deep learning model may be transferred to a student model, leading to intellectual property infringement or vulnerability propagation. Detecting such knowledge reuse is nontrivial because the suspect models may not be white-box accessible and/or may serve different tasks. In this paper, we propose ModelDiff, a testing-based approach to deep learning model similarity comparison. Instead of directly comparing the weights, activations, or outputs of two models, we compare their behavioral patterns on the same set of test inputs. Specifically, the behavioral pattern of a model is represented as a decision distance vector (DDV), in which each element is the distance between the model's reactions to a pair of inputs. The knowledge similarity between two models is measured with the cosine similarity between their DDVs. To evaluate ModelDiff, we created a benchmark that contains 144 pairs of models that cover most popular model reuse methods, including transfer learning, model compression, and model stealing. Our method achieved 91.7% correctness on the benchmark, which demonstrates the effectiveness of using ModelDiff for model reuse detection. A study on mobile deep learning apps has shown the feasibility of ModelDiff on real-world models.
@inproceedings{paperbot6688,
title = {ModelDiff: testing-based DNN similarity comparison for model reuse detection},
author = {Yuanchun Li and Ziqi Zhang and Bingyan Liu and Ziyue Yang and Yunxin Liu},
booktitle = {ISSTA},
year = {2021},
doi = {10.1145/3460319.3464816}
}