标题： 霍姆斯：通过解耦公共特征，实现个性化大型视觉模型的所有权验证的有效且无害方法 显示英文标题

标题： Holmes: Towards Effective and Harmless Model Ownership Verification to Personalized Large Vision Models via Decoupling Common Features

摘要： 大型视觉模型在各种下游任务中表现出色，主要是通过使用私有且有价值的本地数据对预训练模型进行微调来实现的，这使得个性化模型成为其所有者的宝贵知识产权。 与传统深度神经网络的时代类似，模型窃取攻击也对这些个性化模型构成重大风险。 然而，在本文中，我们揭示了大多数现有的防御方法（为传统深度神经网络开发的），通常针对从头开始训练的模型设计，对于微调模型来说，要么引入额外的安全风险，要么容易误判，甚至无效。 为了缓解这些问题，本文提出了一种无害的个性化模型所有权验证方法，通过解耦相似的通用特征。 一般来说，我们的方法包括三个主要阶段。 在第一阶段，我们创建保留受害者模型通用特征的同时破坏数据集特定特征的影子模型。 我们通过影子模型和受害者模型输出差异来表示受害者模型的数据集特定特征。 之后，训练一个元分类器，通过确定可疑模型是否包含受害者的数据集特定特征来识别被盗模型。 在第三阶段，我们通过假设检验进行模型所有权验证，以减少随机性并增强鲁棒性。 在基准数据集上的大量实验验证了所提方法在同时检测不同类型的模型窃取方面的有效性。 显示英文摘要

摘要： Large vision models achieve remarkable performance in various downstream tasks, primarily by personalizing pre-trained models through fine-tuning with private and valuable local data, which makes the personalized model a valuable intellectual property for its owner. Similar to the era of traditional DNNs, model stealing attacks also pose significant risks to these personalized models. However, in this paper, we reveal that most existing defense methods (developed for traditional DNNs), typically designed for models trained from scratch, either introduce additional security risks, are prone to misjudgment, or are even ineffective for fine-tuned models. To alleviate these problems, this paper proposes a harmless model ownership verification method for personalized models by decoupling similar common features. In general, our method consists of three main stages. In the first stage, we create shadow models that retain common features of the victim model while disrupting dataset-specific features. We represent the dataset-specific features of the victim model by the output differences between the shadow and victim models. After that, a meta-classifier is trained to identify stolen models by determining whether suspicious models contain the dataset-specific features of the victim. In the third stage, we conduct model ownership verification by hypothesis test to mitigate randomness and enhance robustness. Extensive experiments on benchmark datasets verify the effectiveness of the proposed method in detecting different types of model stealing simultaneously.