ActiveDaemon: Unconscious DNN Dormancy and Waking Up via User-specific Invisible Token

ActiveDaemon: Unconscious DNN Dormancy and Waking Up via User-specific Invisible Token

Speakers: Ge Ren

Conference: NDSS Symposium

YouTube: (no public video)

Overview

Deep Neural Networks (DNNs) have become indispensable assets in modern commerce, powering everything from natural language processing to advanced content generation. However, the substantial investment in resources required to develop these sophisticated models makes them highly vulnerable to intellectual property (IP) infringement. Traditional IP protection mechanisms, such as passive watermarking, primarily embed identifiers within DNNs to verify ownership after a counterfeit model has emerged and commercial damage has already occurred. This reactive approach leaves model owners exposed to irreversible losses from unauthorized queries and model extraction.

ActiveDaemon addresses this critical vulnerability by introducing a novel paradigm for DNN IP protection: active authentication. This framework integrates a built-in access control function directly into DNNs, ensuring that models deliver correct predictions only to authorized users possessing unique, invisible, user-specific tokens. Unauthorized users, lacking these tokens, will consistently receive inaccurate predictions, effectively preventing commercial piracy before it can inflict damage.

Unlike existing active protection methods that often involve complex structural modifications, neuronal function changes, or encrypted weights—leading to computational overhead and limited scalability—ActiveDaemon leverages a data poisoning technique. It generates dynamic, perceptually concealed perturbations (tokens) using a specially designed U-Net style encoder-decoder network. These tokens are mapped to authorized user identity strings, enabling large-scale user capacity and identity management without altering the DNN's core architecture. ActiveDaemon offers a robust, stealthy, and scalable solution, compatible with existing protection schemes, to safeguard DNNs against the pervasive threat of IP infringement.

Background

[▶ Watch: Introduction to DNN IP infringement and ActiveDaemon (0:00)]()

The proliferation of Deep Learning as a Service (DLaaS) platforms has made powerful DNNs accessible, but also exposed them to new vectors of intellectual property infringement. The core problem lies in the ease with which attackers can query a model and, based on its accurate predictions, infer its capabilities, steal its weights, or simply use the service without authorization. Existing defensive strategies have largely fallen into two categories:

1. Passive Watermarking: These methods embed secret identifiers into the DNN's parameters, gradients, or outputs. Examples include DeepSigns and Chaotic Weights (parameter-based), or SSLGuard and EWE (backdoor-based). While effective for post-factum ownership verification, they do not prevent unauthorized use. Attackers can still obtain correct predictions and commercial benefits, making the damage irreversible. The need for an active, preventative mechanism is paramount.

2. Active Controlling Authorization (Emerging Field): This newer area aims to prevent unauthorized access in real-time. Approaches include:

• Encrypting model weights: Like some aspects of Chaotic Weights. This often requires complex key management and decryption overhead.
• Changing network structures or neuronal functions: Passport-based approaches or methods involving interference layers or additional classes. These introduce computational overhead, complexity, and may limit model performance.
• Hardware-protected neural networks: Rely on specialized hardware, limiting deployment flexibility.
• Many of these methods also suffer from fixed, unconcealed credentials and limited user capacity, making them impractical for large-scale commercial deployment.

Threat Model (III.A): ActiveDaemon operates under a threat model where DNN model owners offer prediction APIs as paid services. Malicious attackers can illegally query these APIs or access DNN applications on edge devices. Their objectives include:

• Free service utilization: Using legitimate services without payment.
• Reselling access: Offering pirated access at lower prices.
• Model extraction attacks: Stealing model weights and architectures, even without internal knowledge, to create unauthorized copies (e.g., Copycat DNNs). This can lead to significant financial and IP losses.

ActiveDaemon's Differentiator: The ActiveDaemon framework distinguishes itself by achieving active IP protection without the drawbacks of prior methods. It avoids structural modifications, weight encryption, or fixed credentials. Instead, it embeds access control directly into the DNN's function through a sophisticated data poisoning technique during training. This approach leverages user-specific, invisible, dynamic perturbations (tokens) that are intrinsically linked to user identities, offering unparalleled stealthiness, scalability, and robustness against a wide array of attacks. By treating the neural network as a communication channel, ActiveDaemon aims to maximize mutual information between input and output for authorized users while minimizing it for unauthorized ones, effectively rendering the model "dormant" to pirated queries.

Key Findings

[▶ Watch: Main contributions of ActiveDaemon (1:45)]()

ActiveDaemon introduces a paradigm shift in DNN IP protection, moving from reactive verification to proactive access control. The core contributions and findings can be summarized as follows:

1. Novel Active IP Protection Paradigm: ActiveDaemon successfully implements a built-in access control mechanism directly within DNN models. This allows protected DNNs to consciously perform accurately only for authorized users equipped with specific tokens, while providing poor accuracy for unauthorized queries. This prevents commercial damage before it occurs, a significant advancement over passive watermarking.

1. Stealthy, Dynamic, User-Specific Tokens: The system generates tiny, invisible, and dynamic perturbation credentials using a custom-designed U-Net style encoder-decoder network. These tokens are perceptually concealed, making them extremely difficult for humans or automated systems to detect. Their dynamic nature, changing with both the input image and the user string, significantly enhances security and stealthiness compared to static watermarks or fixed credentials.

1. Large-Scale User Identity Management: ActiveDaemon maps user identity strings to these invisible perturbation credentials. Utilizing Bose-Chaudhuri-Hocquenghem (BCH) error-correcting codes and 64 message bits, the system can support a vast number of unique user identities (e.g., millions of 8-character alphanumeric strings) within a single protected DNN, without requiring individual model retraining for each new user.

1. High Effectiveness and Feasibility: Extensive experiments across datasets like CIFAR-10, CIFAR-100, GTSRB, and ImageNet demonstrate ActiveDaemon's high effectiveness. It achieves significant accuracy drops for unauthorized queries (e.g., 81.06% for CIFAR-10, 73.48% for ImageNet), effectively reducing predictions to random guessing, while maintaining minimal accuracy degradation for authorized users (typically less than 1.4%).

1. Robustness Against Diverse Attacks: ActiveDaemon exhibits strong resilience against various sophisticated attacks, including:

• Fake token attacks: Queries with random or deteriorated tokens yield random-guessing accuracy.
• Reverse-engineering attacks: Adversaries cannot effectively synthesize tokens to bypass protection.
• Model extraction attacks: Pirated substitute models achieve very low accuracy when trained against ActiveDaemon-protected models.
• Model modification attacks: Fine-tuning and pruning attempts largely fail to disable protection without destroying the model's utility for authorized users.

1. Scalability and Low Overhead: The token generation network is computationally efficient (2.0M parameters, 10.3 GFLOPs for 400x400 image). Crucially, ActiveDaemon-protected DNNs maintain the exact same computational footprint (parameters and FLOPs) as their unprotected counterparts, as no structural modifications are made. The token generation network is also universal and can be transferred via knowledge distillation, further enhancing scalability for deployment in DLaaS platforms.

Technical Deep Dive

[▶ Watch: Generating invisible, dynamic, user-specific tokens (2:40)]()

The ActiveDaemon framework is engineered with two interconnected training phases: Token Generation Training and Model IP Protection Training, designed to embed robust access control directly into the DNN's functionality.

1. Token Generation Training (III.B.1)

The objective of this phase is to create a secure and scalable identity management mechanism by training a network to map user identity strings into unique, imperceptible residual noise images—the invisible tokens.

• String Encoding and Robustness: Each user identity, initially an alphanumeric string, is converted into an N-bit binary string. To ensure robustness against noise and errors, Bose-Chaudhuri-Hocquenghem (BCH) error-correcting codes are applied. The chosen scheme uses a 127-bit string, comprising 64 message bits (sufficient for encoding at least eight ASCII characters) and 63 error-correcting bits, capable of correcting up to 10 flipped bits. This ensures reliable identity recovery even with minor token degradation.

• Network Architecture (U-Net Style Encoder-Decoder): A specialized U-Net style encoder-decoder network, termed the token generation network, is at the heart of this process.
• The encoded bit string is first expanded via a fully connected layer to a 64x64x3 tensor, then upsampled to a 224x224x3 tensor.
• The encoder receives a multi-channel input: the original RGB image (e.g., 224x224x3) concatenated with this 3-channel bit string representation. Its output is a residual image, which is an additive noise embedding the unique user-specific token. This residual image, when added to the original, forms the "authorized image data" G_a(x, s) = (1 - λ_t) x_i + λ_t G_e(x_i, S_i), where G_e is the encoder and λ_t controls token strength.
• The decoder receives this encoded image (original + residual). Comprising convolutional and dense layers followed by a sigmoid activation, its function is to accurately recover the hidden 127-bit string.

• Loss Functions for Token Generation: To optimize for both accurate string decoding and perceptual stealthiness, a multi-component loss function is employed:
• Message Loss (L_M): This is a cross-entropy loss applied to the decoder's output, ensuring that the decoded bit string precisely matches the original encoded identity string.
• Perceptual Similarity Losses (L_P1, L_P2): To make tokens imperceptible, two metrics are used:
• Structural Similarity Index Metric (SSIM): L_P1 quantifies structural and luminosity differences between the original and encoded images, being less sensitive to small geometric distortions than L2 norms.
• Learned Perceptual Image Patch Similarity (LPIPS): L_P2 uses deep feature embeddings from pre-trained networks (like VGG) to measure perceptual distance, more closely reflecting human perception.
• Critic Loss (L_C): A critic network (employing Wasserstein loss) is introduced to supervise whether a string is encoded within an image. This makes the presence of the token harder to detect by an adversary.
• Total Loss: The overall training loss is a weighted sum: L = λ_p1 L_P1 + λ_p2 L_P2 + λ_m L_M + λ_c L_C. Hyperparameters λ_p1=-2, λ_p2=1.5, λ_m=1.5, and λ_c=0.5 are set to balance these objectives.

2. Model IP Protection Training (III.B.2)

This phase trains the target DNN (e.g., ResNet-18/50) to achieve high accuracy for authorized queries and intentionally produce incorrect predictions for unauthorized ones. This is based on a mutual information strategy.

• Poisoned Training Set (D_p): The DNNs are trained on a carefully constructed poisoned training set D_p, consisting of two types of samples:
• Authorized Input (X_a): Images generated by the token generation network, containing the invisible user-specific tokens. These are derived from the original training images and random identity strings.
• Unauthorized Input (X_u): Original, clean images (or benign samples mixed with classic noise like Gaussian or Salt & Pepper noise to enhance robustness against image quality degradation attacks).

• Training Strategies for Unauthorized Labels (G_l(y)): To minimize mutual information for unauthorized queries, the labels for X_u are deliberately modified:
• Single Target Strategy: Changes the label of unauthorized data to one specific, incorrect label (e.g., always predicting "airplane" for a "cat" image).
• Random Target Strategy: Changes the label of unauthorized data to a random, uncertain label, making predictions effectively random guessing.
• (Other strategies like "Near target" and "Surjective target" were explored, but Single/Random are generally recommended for minimizing information leakage).

• Loss Function for IP Protection: The training loss for the DNN's parameters (θ) is defined as L = L_a - λ L_u.
• L_a (Authorized Loss): This is the cross-entropy loss between the true label and the prediction for authorized input X_a. Minimizing L_a ensures the DNN performs excellently for authorized users, maximizing mutual information.
• L_u (Unauthorized Loss): This is the cross-entropy loss between the modified label (Y_u) and the prediction for unauthorized input X_u. Minimizing L_u drives the DNN to output the incorrect, modified labels for unauthorized queries, minimizing mutual information.
• λ is a non-negative hyperparameter, set to 1 in the experiments, balancing the two objectives.

• Optimization Goal: The DNN's parameters θ are optimized to θ* = arg min_θ (L_a(Y_a, X_a; θ) - λ L_u(Y_u, X_u; θ)). This adversarial-like training ensures that the model learns to differentiate between authorized and unauthorized queries based on the presence and correctness of the embedded tokens.

Implementation Details (IV.A)

Experiments were conducted on a server simulating a cloud platform, using PyTorch and CUDA with Python.

• Datasets: Four standard vision datasets were used: CIFAR-10, CIFAR-100, GTSRB, and a subset of ImageNet ILSVRC-2012 (400 classes, 480,000 training, 20,000 testing images). All images were resized to 3x224x224.
• Models: ResNet-18 for CIFAR-10, CIFAR-100, and GTSRB; ResNet-50 for ImageNet.
• Training: Models were trained for 120 epochs using SGD optimizer with an initial learning rate of 0.1 (decreased via MultiStepLR). Weight decay was 0.0005 for CIFAR datasets and 0.0001 for ImageNet. Batch sizes were 256 for ResNet-18 and 128 for ResNet-50.

Evaluation Metrics (IV.A.2)

To comprehensively assess ActiveDaemon, several key metrics were defined:

• Feasibility (A_od): Accuracy drop for authorized users (A_or - A_ad). Smaller is better.
• Effectiveness (A_pd): Accuracy drop for unauthorized queries (A_ad - A_ud). Larger is better.
• Bit String Decoding Accuracy (A_dec): Ratio of correctly decoded message bits.
• Stealthiness: Measured by PSNR, ERGAS, SSIM, and LPIPS. Higher PSNR/SSIM and lower ERGAS/LPIPS indicate better stealthiness.
• Robustness: Tested against model modification (fine-tuning, pruning), fake token attacks, reverse-engineering, and model extraction attacks.

Demo / Proof of Concept

[▶ Watch: Mutual information strategy for active access control (3:20)]()

While no live demonstration was described, the efficacy and robustness of ActiveDaemon were rigorously validated through extensive experimental evaluations across various datasets and attack scenarios. These results serve as a comprehensive proof of concept for the proposed active IP protection paradigm.

ActiveDaemon's Effectiveness (IV.B.1)

The baseline ResNet models achieved high accuracies without protection: 93.41% (CIFAR-10), 73.79% (CIFAR-100), 76.73% (ImageNet), and 98.67% (GTSRB).

• Feasibility (A_od): ActiveDaemon successfully embedded protection with minimal accuracy degradation for authorized users. The A_od values were remarkably low: -1.05% (CIFAR-10), -0.88% (CIFAR-100), -1.34% (ImageNet), and -2.63% (GTSRB). This demonstrates that ActiveDaemon preserves the DNN's core performance, performing comparably or better than state-of-the-art methods like M-LOCK and Fan et al., particularly on larger datasets.
• Effectiveness (A_pd): The accuracy drop for unauthorized queries was substantial: 81.06% (CIFAR-10), 70.58% (CIFAR-100), 73.48% (ImageNet), and 93.15% (GTSRB). This means unauthorized queries resulted in accuracies as low as 10% for CIFAR-10 and a mere 0.15% for ImageNet, effectively reducing predictions to random guessing. ActiveDaemon significantly outperformed other state-of-the-art methods in A_pd.

Extended Strategies (IV.B.2)

Exploring "Near target" and "Surjective target" strategies for modifying unauthorized labels (G_l(y)) yielded slightly higher A_pd values (e.g., 89% for CIFAR-10). However, a trade-off was identified: higher A_pd might inadvertently leak more information about correct predictions. Therefore, the Single target and Random target strategies are generally recommended for minimizing mutual information and enhancing overall security.

ActiveDaemon's Stealthiness (IV.C)

• Poisoning Ratio (γ) (IV.C.1): Experiments on the impact of the poisoning ratio (γ, proportion of poisoned samples) showed that ActiveDaemon can be embedded stably and effectively without requiring an excessively high poisoning rate. For CIFAR-10, authorized accuracy (A_ad) reached 88.9% at γ=0.2, while unauthorized accuracy (A_ud) remained around 10% until γ reached 0.92. Similar trends were observed for ImageNet, with A_ad reaching 78.9% at γ=0.23. A γ between 0.23 and 0.9 is recommended for optimal protection.
• Token Stealthiness (IV.C.2): ActiveDaemon achieved superior perceptual stealthiness compared to prior works. LPIPS scores were notably low (better): 0.0027 on CIFAR-10 and 0.0368 on ImageNet, significantly outperforming prior works (e.g., 0.0118 and 0.0747, respectively). The ERGAS score for CIFAR-10 was 22.034, also better than existing methods (e.g., 35.537, 50.528). While PSNR and SSIM scores were competitive, the key takeaway is that ActiveDaemon's dynamic, invisible tokens are much harder to detect and extract than the fixed tokens used by methods like M-LOCK or ADIP, and they introduce fewer anomalous adversarial features.

Robustness Against Attacks (IV.D)

ActiveDaemon demonstrated robust resilience against various attempts to disable its protection:

1. Resistance to Fake Tokens Threats (IV.D.1):

• Random Attacks: Queries with fake tokens generated by random Gaussian noise resulted in test accuracy (A_td) dropping to random guessing levels (e.g., 10.73% for CIFAR-10, 0.25% for ImageNet). This proves the DNN's sensitivity to the specific dynamic noise encoded by string information.
• Deteriorated Tokens Attacks: When adversaries used partially valid tokens (fused with clean images), prediction performance dropped significantly once the deterioration ratio (f) exceeded 60%, falling to as low as 24% for CIFAR-10 and 0.4% for ImageNet.
• Reverse-Engineering Attacks: Attackers attempting to reverse-engineer tokens to maximize performance could achieve no more than 47.66% accuracy for ImageNet, rendering the protected models unworkable.

1. Resistance to Model Extraction Attacks (IV.D.1.d): Using a Copycat DNN to steal model performance, pirated substitute models achieved very low accuracy (e.g., 9.74% for CIFAR-10, 4.19% for ImageNet) when attacking ActiveDaemon-protected models, compared to 89.16% for unprotected models. Grad-CAM analysis (Figure 6 in the original talk) revealed that ActiveDaemon-protected models consistently focus on core label objects, irrespective of token presence. This contrasts with M-LOCK and ADIP, which tend to focus on token regions for unauthorized samples, making ActiveDaemon's tokens harder to identify and extract.

1. Resistance to SentiNet (IV.D.2): Further Grad-CAM analysis confirmed that ActiveDaemon's sensitive feature maps consistently highlight core label objects, whether tokens are present or not. This characteristic enhances concealment and robustness by confusing attackers' attempts to locate tokens.

1. Resistance to Model Fine-tuning Attack (IV.D.3): Fine-tuning for 50 epochs only slightly increased unauthorized accuracy (Acc_ud), still preventing correct predictions. Crucially, authorized accuracy (Acc_ad) dropped drastically (e.g., from 73.79% to 12.92% when fine-tuning CIFAR-10 to ImageNet). Fine-tuning effectively destroys the embedded token features, rendering the model unusable even for legitimate users. This makes training a new model from scratch a safer, albeit more costly, option for attackers than fine-tuning a stolen ActiveDaemon model.

1. Resistance to Pruning (IV.D.4): ActiveDaemon demonstrated strong robustness against model pruning. For pruning rates less than 60%, authorized accuracy (Acc_ad) remained high (e.g., 82.17% for CIFAR-10, 70.25% for ImageNet), outperforming other protection methods. Unauthorized accuracy (Acc_ud) remained near 1% even with 71% of parameters pruned on ImageNet, indicating the protection scheme's resilience to model compression attacks.

Advanced Features & Overhead (V)

• Exclusiveness of Generated Tokens (V.A): ActiveDaemon's tokens are dynamic and unique per input image. Queries with tokens generated from a mismatched image (x' ≠ x) caused test accuracy (A_td) to drop sharply (e.g., 12.54% for CIFAR-100, 0.27% for ImageNet). This prevents attackers from reusing tokens from one query for other queries, offering stronger security than static patch tokens.
• Large-Scale User Capacity (V.B): The 64 message bits with BCH codes allow for a vast number of unique user identities (e.g., 36^8 possible 8-character alphanumeric strings). Experiments with 18 different random 8-character strings showed consistent performance (A_od ~1.92%, A_pd ~72%, A_dec ~100%). A single ActiveDaemon-protected DNN can serve numerous legitimate users without individual retraining.
• Scalability (V.C): The token generation network is universal. An encoder trained on one dataset (e.g., CIFAR-100) can activate protection on a DNN trained on a different dataset (e.g., ImageNet), with A_od of -1.2% and A_pd of 75.19%. This reduces computation and distribution costs. Knowledge distillation can also transfer embedded knowledge to student models for scalable deployment.
• Deployment in DLaaS Platform (V.D): ActiveDaemon can act as a supplementary security layer in DLaaS applications, enabling user identity management and 2-step verification. It allows cloud providers to deploy models with intangible perturbations without modifying model structures. It also works on offline local devices, offering protection irrespective of internet connectivity.
• Computational Overhead (V.E):
• Token Generation Training (V.E.1): The token generation network has 2.0M parameters and requires 10.3 Giga FLOPs to encode a 400x400 pixel image. This is computationally efficient, even lower than models like ResNet-152 (11.3G FLOPs) or VGG-16 (15.5G FLOPs). For client devices, knowledge distillation for encoders or server-side token generation is proposed.
• Model IP Protection Training (V.E.2): ActiveDaemon-protected ResNet-18 models (11.4M parameters, 1.8G FLOPs) maintain the same computational footprint as unprotected models, unlike methods that introduce structural changes.

Defensive Implications

[▶ Watch: ActiveDaemon vs. passive and other active methods (4:30)]()

ActiveDaemon offers significant implications for organizations deploying and monetizing deep learning models, providing a robust and proactive defense against IP infringement.

1. Proactive IP Protection: Model owners can embed a powerful, active access control mechanism directly into their DNNs. This shifts the defense paradigm from reactive ownership verification to proactive prevention of unauthorized use, safeguarding commercial benefits before any damage occurs.
2. Enhanced Security for DLaaS: For DLaaS providers, ActiveDaemon can serve as a crucial supplementary security layer. It enables robust user identity management and two-step verification without requiring complex API-level changes or external authentication systems that can be bypassed.
3. Resistance to Model Theft: The demonstrated robustness against model extraction attacks (e.g., Copycat DNNs) significantly raises the bar for adversaries attempting to steal and replicate model functionality. Even if an attacker obtains the model, its inherent "dormancy" to unauthorized queries renders it commercially useless.
4. Resilience to Model Tampering: ActiveDaemon's strong resistance to fine-tuning and pruning attacks means that common adversarial techniques to bypass or disable embedded protections are largely ineffective. Such modifications either fail to restore full functionality for unauthorized users or destroy the model's utility for legitimate ones.
5. Scalable and Practical Deployment: The ability to support large-scale user capacity with a single protected model, coupled with the universality of the token generator and low computational overhead, makes ActiveDaemon highly practical for commercial deployment across diverse platforms, including resource-constrained edge devices and offline environments.
6. Compatibility and Integration: ActiveDaemon is designed to be compatible with existing API-based RAM and traditional passive watermarking techniques. This means it can seamlessly integrate into current security postures, providing an unconscious yet powerful supplement to overall IP protection strategies.
7. Reduced Reliance on External Controls: By embedding access control directly into the neural network's function, ActiveDaemon reduces reliance on external security layers that might be vulnerable to bypass or difficult to manage across different deployment scenarios.

While primarily demonstrated for image classification, the core principles of data poisoning and mutual information-based training could potentially be adapted to other deep learning domains. Defenders should consider implementing ActiveDaemon as a foundational layer of security for their proprietary DNNs, focusing on the recommended "Single target" or "Random target" strategies for unauthorized label modification to balance effectiveness with minimal information leakage. Further research into internal threats and even more lightweight models will continue to strengthen these defenses.

Key Takeaways

• ActiveDaemon introduces a novel active IP protection paradigm for DNNs, embedding built-in access control to prevent unauthorized queries before commercial damage occurs.
• It generates user-specific, invisible, and dynamic tokens using a U-Net style encoder-decoder network, offering superior stealthiness and security compared to static watermarks or fixed credentials.
• The system achieves high effectiveness (e.g., 81% accuracy drop for unauthorized CIFAR-10 queries) with minimal impact on authorized performance (less than 1.4% degradation).
• ActiveDaemon demonstrates strong robustness against various attacks, including fake tokens, model extraction, fine-tuning, and pruning, making it resilient to common adversarial techniques.
• It supports large-scale user capacity and identity management within a single protected DNN, making it highly practical and scalable for commercial deployment.
• The framework maintains low computational overhead, with protected DNNs preserving their original computational footprint, and the token generation process being efficient.

About the Speaker(s)

Ge Ren is the speaker who presented "ActiveDaemon: Unconscious DNN Dormancy and Waking Up via User-specific Invisible Token" at the NDSS Symposium. No additional biographical details were provided in the transcript or metadata.