mlsanityData to 14 Oct 2026

ProDiF: Protecting Domain-Invariant Features to Secure Pre-Trained Models Against Extraction

arXiv 2503.13224 ↗First posted 17 Mar 2025cs.CR cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

Pre-trained models are valuable intellectual property, capturing both domain-specific and domain-invariant features within their weight spaces. However, model extraction attacks threaten these assets by enabling unauthorized source-domain inference and facilitating cross-domain transfer via the exploitation of domain-invariant features. In this work, we introduce **ProDiF**, a novel framework that leverages targeted weight space manipulation to secure pre-trained models against extraction attacks. **ProDiF** quantifies the transferability of filters and perturbs the weights of critical filters in unsecured memory, while preserving actual critical weights in a Trusted Execution Environment (TEE) for authorized users. A bi-level optimization further ensures resilience against adaptive fine-tuning attacks. Experimental results show that **ProDiF** reduces source-domain accuracy to near-random levels and decreases cross-domain transferability by 74.65%, providing robust protection for pre-trained models. This work offers comprehensive protection for pre-trained DNN models and highlights the potential of weight space manipulation as a novel approach to model security.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 21 of its 37 references that are in the map. First posted on arXiv 17 Mar 2025.

Builds on

21 of 37 references.

References · 21

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2019A Comprehensive Survey on Transfer Learningcited by 1,160
  4. 2013Domain Generalization via Invariant Feature Representationcited by 623
  5. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  6. 2018Generalizing to Unseen Domains via Adversarial Data Augmentationcited by 451
  7. 2017VisDA: The Visual Domain Adaptation Challengecited by 435
  8. 2017Wasserstein Auto-Encoderscited by 373
  9. 2020Learning to Learn Single Domain Generalizationcited by 296
  10. 2018Characterizing and Avoiding Negative Transfercited by 229
  11. 2021Non-Transferable Learning: A New Approach for Model Ownership Verification and Applicability Authorizationcited by 52
  12. 2021Uncertainty-guided Model Generalization to Unseen Domainscited by 41
9 more
  1. 2020Mind Your Weight(s): A Large-scale Study on Insufficient Machine Learning Model Protection in Mobile Appscited by 36
  2. 2020ShadowNet: A Secure and Efficient On-device Model Inference System for Convolutional Neural Networkscited by 21
  3. 2024SOPHON: Non-Fine-Tunable Learning to Restrain Task Transferability For Pre-trained Modelscited by 17
  4. 2023NNSplitter: An Active Defense Solution for DNN Model via Automated Weight Obfuscationcited by 16
  5. 2021On Learning Domain-Invariant Representations for Transfer Learning with Multiple Sourcescited by 15
  6. 2023Model Barrier: A Compact Un-Transferable Isolation Domain for Model Intellectual Property Protectioncited by 14
  7. 2023MirrorNet: A TEE-Friendly Framework for Secure On-device DNN Inferencecited by 9
  8. 2024TBNet: A Neural Architectural Defense Framework Facilitating DNN Model Protection in Trusted Execution Environmentscited by 2
  9. 2024Probe-Me-Not: Protecting Pre-trained Encoders from Malicious Probingcited by 2

Built on by

Not cited yet.