Author | Daft shiner
Edit | CV Jun
Coverage | I love computer vision (WeChat id: aicvml)
This article shares ICLR's 2021 paper, Undistillable: Making A Nasty Teacher That CANNOT teach students, proposing a Nasty Teacher to prevent models from being stolen by distillation, providing a new way of thinking for the protection of intellectual property.
- Thesis link: https://openreview.net/forum?id=0zvfm-nZqQs
- Project link: https://github.com/VITA-Group/Nasty-Teacher
Introduction
Knowledge distillation is a common means of model compression, which transfers the knowledge of pre-trained teacher models to more lightweight student models, so that student models can achieve or even exceed the performance of teacher models, so as to achieve the effect of lossless model compression. However, once the technology is used by ill-intentioned people, it can easily steal the model that researchers spend a lot of time, effort and equipment training to be easily reproduced, resulting in intellectual property rights (Intellectual Properties) being infringed. Therefore, this paper designs a Nasty Teacher so that its performance remains unchanged when it is used normally, and the performance of the student model obtained when it is distilled by knowledge is very poor, so as to protect the intellectual property rights of the model owner.
Contributions
- Natty Teacher was introduced to prevent knowledge leakage and unauthorized model cloning by knowledge distillation without sacrificing performance. The authors see this as a first step toward machine learning intellectual property and privacy protection.
The authors propose a simple and efficient algorithm called self-undermining knowledge distillation, which is optimized by maximizing the difference between a Natty Teacher and a normally trained opponent.
• We conducted extensive experiments on standard knowledge distillation and data-free knowledge distillation methods to prove that The Nasty Teacher can achieve nearly the same accuracy (less than a 1% accuracy gap), while student models learned from the Nasty Teacher will reduce the accuracy by up to 10% or more, and even divergences during training.
Methodology
Revisiting Knowledge Distillation
Knowledge Distillation is a widely used method of model compression proposed by Hinhon et al. The optimization goals for its training are as follows:
Where the sum is KL divergence and cross-entropy loss, respectively, and represents the teacher and student models, respectively, the equation is designed to allow the student model to learn the logit and ground true labels of the teacher model. and softmax temperature was used. Logit is the probability prediction value for each category output by the teacher model.
A very perceptual realization of learning logit is that in addition to the positive example OfgroundTruth, the negative case also carries a lot of valuable information. For example, in the MNIST classification, 0 to 9 numbers, 7 and 1 are written very similarly, but 7 and 5 are very different, GroundTruth only tells us that this picture is 7, but logit also tells us: this picture is most likely 7, small probability is 1, almost unlike other numbers. The amount of information carried in this is what we want the student model to learn through knowledge distillation.
Nasty Teacher
Here we will introduce the design of the optimization function of The Nasty Teacher, which aims to maximize the adversarial network (the student model used by the attacker) and the KL divergence of the Nasty Teacher under the condition of ensuring the accuracy of the model, so the following equation is easy to understand:
Experiments
The above table shows the performance comparison between the normal teacher model and the Nasty Teacher on CIFAR10, and it can be found that the accuracy of the teacher model is less and the accuracy of the student model obtained according to the Nasty Teacher is significantly lower than that of the normal teacher model distilled.
The same phenomenon occurs on the CIFAR100 dataset, where student models that mimic Nasty Teacher on MobilenetV2 can't even be trained.
The same phenomenon also occurs on the Tiny-ImageNet dataset, where it can be found that student models that mimic Nasty Teacher on MobilenetV2 cannot be trained either.
The figure above shows the difference in the probability distribution obtained by the normal teacher and the Nasty Teacher on the CIFAR10 dataset, and it can be seen that the predicted distribution of the Nasty Teacher has changed greatly.
The figure above shows the t-SNE visualization results on the CIFAR10 dataset with ResNet18, which shows that the visualization of normal teachers and Natty Teachers is similar, which also shows why the accuracy of Nasty Teachers is similar to normal.
The table above shows the performance of attackers and Natty Teachers using different model structures.
Since the attacker may not be able to have the structural information of the teacher model, there is a situation where the structure of the student model is more complex than the teacher model, and the corresponding experiment is carried out for this situation in the above table.
The figure above shows the curve of the effect on the accuracy of the model in the Natty Teacher optimization goal.
The figure above shows the effect of temperature on the accuracy of the model.
The figure above explores the different effects of the attacker training the student model to use, and it can be found that no matter how the choice is, Nasty Teacher can effectively prevent the attacker from distilling, compared to the larger, smaller can be relatively good to achieve distillation stealing of The Nasty Teacher. Figure b above simulates the fact that an attacker cannot obtain all the training data in real-world situations, in which case Nasty Teacher can also effectively prevent distillation theft.
The table above reflects the results of data-free knowledge distillation, and it can be found that Natty Teacher also has a good anti-distillation effect.
Finally, the authors also visualized images based on reverse engineering from DeepInversion (a kind of data-free knowledge distillation), which can be generated by ordinary ResNet-34 with high visual fidelity, while the images generated from Nasty ResNet-34 contain distorted noise and even false classification features.
Conclusion
This paper proposes a Nasty Teacher that prevents models from being stolen by distillation, providing a new way of thinking for the protection of intellectual property.