CHIP: Chameleon Hash-based Irreversible Passport for Robust Deep Model Ownership Verification and Active Usage Control

2025-05-30

AI Summary

Existing deep model IP protection methods—particularly watermarking and conventional passport schemes—suffer from ambiguous ownership attribution, uncontrolled offline distribution, and lack of proactive authorization and traceability in multi-user cloud services. To address these fundamental limitations, this paper proposes the first irreversible passport mechanism based on chameleon hashing. Our approach leverages affine parameter modulation in normalization layers, trapdoor collision construction, and passport-aware fine-tuning to achieve unambiguous strong ownership assertion, user-level traceability, multi-passport trapdoor-based authorization, and secure offline triplet distribution. Extensive experiments across four benchmark datasets and two model architectures demonstrate that our method achieves strong robustness against pruning, quantization, and fine-tuning; incurs zero accuracy degradation; attains 100% authorization verification accuracy; and enables complete behavioral provenance tracking for end users.

Technology Category

• Machine Learning: Privacy
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Security and Privacy: Data transparency and provenance
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

The pervasion of large-scale Deep Neural Networks (DNNs) and their enormous training costs make their intellectual property (IP) protection of paramount importance. Recently introduced passport-based methods attempt to steer DNN watermarking towards strengthening ownership verification against ambiguity attacks by modulating the affine parameters of normalization layers. Unfortunately, neither watermarking nor passport-based methods provide a holistic protection with robust ownership proof, high fidelity, active usage authorization and user traceability for offline access distributed models and multi-user Machine-Learning as a Service (MLaaS) cloud model. In this paper, we propose a Chameleon Hash-based Irreversible Passport (CHIP) protection framework that utilizes the cryptographic chameleon hash function to achieve all these goals. The collision-resistant property of chameleon hash allows for strong model ownership claim upon IP infringement and liable user traceability, while the trapdoor-collision property enables hashing of multiple user passports and licensee certificates to the same immutable signature to realize active usage control. Using the owner passport as an oracle, multiple user-specific triplets, each contains a passport-aware user model, a user passport, and a licensee certificate can be created for secure offline distribution. The watermarked master model can also be deployed for MLaaS with usage permission verifiable by the provision of any trapdoor-colliding user passports. CHIP is extensively evaluated on four datasets and two architectures to demonstrate its protection versatility and robustness. Our code is released at https://github.com/Dshm212/CHIP.

Problem

• Protecting DNN intellectual property against ambiguity attacks
• Ensuring robust ownership proof and active usage control
• Enabling user traceability for offline and cloud-based models

Innovation

• Uses chameleon hash for irreversible passport
• Enables robust ownership and user traceability
• Supports active usage control for MLaaS