# A Protection Method of Trained CNN Model Using Feature Maps Transformed With Secret Key From Unauthorized Access

arXiv: https://arxiv.org/abs/2109.00224 · HTML: https://mlsanity.com/paper/2109.00224/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 18 of its 28 references that are in the map.
- First posted on arXiv 1 Sep 2021.

## Builds on (most cited first, 18 of 18)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Mixed Precision Training](https://mlsanity.com/paper/1710.03740/) (2017)
- [Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring](https://mlsanity.com/paper/1802.04633/) (2018)
- [Embedding Watermarks into Deep Neural Networks](https://mlsanity.com/paper/1701.04082/) (2017)
- [Super-Convergence: Very Fast Training of Neural Networks Using Large Learning Rates](https://mlsanity.com/paper/1708.07120/) (2017)
- [Adversarial Frontier Stitching for Remote Neural Network Watermarking](https://mlsanity.com/paper/1711.01894/) (2017)
- [[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks](https://mlsanity.com/paper/1909.07830/) (2019)
- [Encryption-then-Compression Systems using Grayscale-based Image Encryption for JPEG Images](https://mlsanity.com/paper/1811.00236/) (2018)
- [Learnable Image Encryption](https://mlsanity.com/paper/1804.00490/) (2018)
- [Block-wise Image Transformation with Secret Key for Adversarially Robust Defense](https://mlsanity.com/paper/2010.00801/) (2020)
- [DeepMarks: A Digital Fingerprinting Framework for Deep Neural Networks](https://mlsanity.com/paper/1804.03648/) (2018)
- [Privacy-Preserving Deep Neural Networks with Pixel-based Image Encryption Considering Data Augmentation in the Encrypted Domain](https://mlsanity.com/paper/1905.01827/) (2019)
- [DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Models](https://mlsanity.com/paper/1804.00750/) (2018)
- [A Protection Method of Trained CNN Model with Secret Key from Unauthorized Access](https://mlsanity.com/paper/2105.14756/) (2021)
- [Training DNN Model with Secret Key for Model Protection](https://mlsanity.com/paper/2008.02450/) (2020)
- [Piracy-Resistant DNN Watermarking by Block-Wise Image Transformation with Secret Key](https://mlsanity.com/paper/2104.04241/) (2021)
- [A Privacy-Preserving Machine Learning Scheme Using EtC Images](https://mlsanity.com/paper/2007.08775/) (2020)

## Built on by (most cited first, 4 of 4)

- [An Overview of Compressible and Learnable Image Transformation with Secret Key and Its Applications](https://mlsanity.com/paper/2201.11006/) (2022)
- [Enhanced Security against Adversarial Examples Using a Random Ensemble of Encrypted Vision Transformer Models](https://mlsanity.com/paper/2307.13985/) (2023)
- [Turn Passive to Active: A Survey on Active Intellectual Property Protection of Deep Learning Models](https://mlsanity.com/paper/2310.09822/) (2023)
- [Access Control of Object Detection Models Using Encrypted Feature Maps](https://mlsanity.com/paper/2202.00265/) (2022)

## Abstract (arXiv)

In this paper, we propose a model protection method for convolutional neural networks (CNNs) with a secret key so that authorized users get a high classification accuracy, and unauthorized users get a low classification accuracy. The proposed method applies a block-wise transformation with a secret key to feature maps in the network. Conventional key-based model protection methods cannot maintain a high accuracy when a large key space is selected. In contrast, the proposed method not only maintains almost the same accuracy as non-protected accuracy, but also has a larger key space. Experiments were carried out on the CIFAR-10 dataset, and results show that the proposed model protection method outperformed the previous key-based model protection methods in terms of classification accuracy, key space, and robustness against key estimation attacks and fine-tuning attacks.