As a type of valuable intellectual property (IP), deep neural network (DNN) models have been protected by techniques like watermarking. However, such passive model protection cannot fully prevent model abuse. In this work, we propose an active model IP protection scheme, namely NNSplitter, which actively protects the model by splitting it into two parts: the obfuscated model that performs poorly due to weight obfuscation, and the model secrets consisting of the indexes and original values of the obfuscated weights, which can only be accessed by authorized users with the support of the trusted execution environment. Experimental results demonstrate the effectiveness of NNSplitter, e.g., by only modifying 275 out of over 11 million (i.e., 0.002%) weights, the accuracy of the obfuscated ResNet-18 model on CIFAR-10 can drop to 10%. Moreover, NNSplitter is stealthy and resilient against norm clipping and fine-tuning attacks, making it an appealing solution for DNN model protection. The code is available at: https://github.com/Tongzhou0101/NNSplitter.

翻译：摘要：作为一类有价值的知识产权，深度神经网络模型已通过水印等技术获得保护。然而，此类被动式模型保护无法完全防止模型滥用。本文提出一种主动式模型知识产权保护方案，即NNSplitter，该方法通过将模型拆分为两个部分实现主动保护：因权重混淆而性能低下的混淆模型，以及由混淆权重的索引和原始值组成的模型密钥，仅有经授权用户可在可信执行环境支持下访问该密钥。实验结果表明NNSplitter具有有效性——例如，仅需修改1100余万权重中的275个（即0.002%），混淆后的ResNet-18模型在CIFAR-10上的准确率即可降至10%。此外，NNSplitter具备隐匿性，且能抵御范数裁剪与微调攻击，使其成为深度神经网络模型保护的一种有吸引力的解决方案。代码开源地址：https://github.com/Tongzhou0101/NNSplitter。