mlsanityData to 7 Oct 2026

NNSplitter: An Active Defense Solution for DNN Model via Automated Weight Obfuscation

arXiv 2305.00097 ↗First posted 28 Apr 2023cs.LG cs.CRcited by 15

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

As a type of valuable intellectual property (IP), deep neural network (DNN) models have been protected by techniques like watermarking. However, such passive model protection cannot fully prevent model abuse. In this work, we propose an active model IP protection scheme, namely NNSplitter, which actively protects the model by splitting it into two parts: the obfuscated model that performs poorly due to weight obfuscation, and the model secrets consisting of the indexes and original values of the obfuscated weights, which can only be accessed by authorized users with the support of the trusted execution environment. Experimental results demonstrate the effectiveness of NNSplitter, e.g., by only modifying 275 out of over 11 million (i.e., 0.002%) weights, the accuracy of the obfuscated ResNet-18 model on CIFAR-10 can drop to 10%. Moreover, NNSplitter is stealthy and resilient against norm clipping and fine-tuning attacks, making it an appealing solution for DNN model protection. The code is available at: https://github.com/Tongzhou0101/NNSplitter.

Key facts. Cited by 15 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 20 of its 37 references that are in the map. First posted on arXiv 28 Apr 2023.

Builds on

20 of 37 references.

References · 20

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  4. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  5. 2016Neural Architecture Search with Reinforcement Learningcited by 1,489
  6. 2017Learning Transferable Architectures for Scalable Image Recognitioncited by 1,097
  7. 2018Efficient Neural Architecture Search via Parameter Sharingcited by 831
  8. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  9. 2019Gate Decorator: Global Filter Pruning Method for Accelerating Deep Convolutional Neural Networkscited by 118
  10. 2019Bit-Flip Attack: Crushing Neural Network with Progressive Bit Searchcited by 106
  11. 2019[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attackscited by 82
  12. 2018Pelee: A Real-Time Object Detection System on Mobile Devicescited by 56
8 more
  1. 2018A First Look at Deep Learning Apps on Smartphonescited by 47
  2. 2018A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Securitycited by 42
  3. 2020Mind Your Weight(s): A Large-scale Study on Insufficient Machine Learning Model Protection in Mobile Appscited by 35
  4. 2020ShadowNet: A Secure and Efficient On-device Model Inference System for Convolutional Neural Networkscited by 20
  5. 2018MobiFace: A Lightweight Deep Learning Face Recognition on Mobile Devicescited by 12
  6. 2020Deep-Dup: An Adversarial Weight Duplication Attack Framework to Crush Deep Neural Network in Multi-Tenant FPGAcited by 10
  7. 2021DeepStrike: Remotely-Guided Fault Injection Attacks on DNN Accelerator in Cloud-FPGAcited by 4
  8. 2022ObfuNAS: A Neural Architecture Search-based DNN Obfuscation Approachcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 7; 2025: 5; 2026: 2.

15 papers.

Sort:

By area:

  1. 2024AdaPI: Facilitating DNN Model Adaptivity for Efficient Private Inference in Edge Computingcited by 15
  2. 2024SLIP: Securing LLMs IP Using Weights Decompositioncited by 13
  3. 2024TransLinkGuard: Safeguarding Transformer Models Against Model Stealing in Edge Deploymentcited by 11
  4. 2025Re-Key-Free, Risky-Free: Adaptable Model Usage Controlcited by 6
  5. 2024CoreGuard: Safeguarding Foundational Capabilities of LLMs Against Model Stealing in Edge Deploymentcited by 5
  6. 2024TEESlice: Protecting Sensitive Neural Network Models in Trusted Execution Environments When Attackers have Pre-Trained Modelscited by 3
  7. 2024NEUROSEC: FPGA-Based Neuromorphic Audio Securitycited by 2
  8. 2024IDEA: An Inverse Domain Expert Adaptation Based Active DNN IP Protection Methodcited by 2
  9. 2025Securing Transformer-based AI Execution via Unified TEEs and Crypto-protected Acceleratorscited by 2
  10. 2023Fight Fire with Fire: Combating Adversarial Patch Attacks using Pattern-randomized Defensive Patchescited by 1
  11. 2025ProDiF: Protecting Domain-Invariant Features to Secure Pre-Trained Models Against Extractioncited by 0
  12. 2025CHIP: Chameleon Hash-based Irreversible Passport for Robust Deep Model Ownership Verification and Active Usage Controlcited by 0
3 more
  1. 2025LLA: Enhancing Security and Privacy for Generative Models with Logic-Locked Acceleratorscited by 0
  2. 2026LoREnc: Low-Rank Encryption for Securing Foundation Models and LoRA Adapterscited by 0
  3. 2026SoK: Attack and Defense Landscape of Mobile On-device AI Systemscited by 0