As model modification techniques are increasingly employed to obtain high-performing machine learning models at reduced costs, identifying lineage relationships-i.e., whether one model is derived from another-has garnered significant research interest. However, existing approaches are largely empirical, lack theoretical grounding, and are often ineffective against high-impact modifications. Furthermore, none have addressed the measurement of lineage closeness, which quantifies the degree of modification between models. In this paper, we reformulate the model lineage determination problem as a question of whether two models' parameters reside within the same local optimum of the loss landscape. Based on this formulation, we propose a simple yet effective method for lineage determination. We further explore the impact of various modification techniques on models' decision boundaries using visualization techniques, and observe that changes in decision boundaries serve as an accurate metric for lineage closeness. Leveraging this insight, we propose a task-agnostic and modification-type-agnostic method to measure lineage closeness by computing the mean adversarial distance from data points to decision boundaries and the matching rate of data point predictions. To reduce computational overhead, we design an efficient sampling strategy for data point selection. Extensive experiments demonstrate that our approach achieves 100% accuracy in model lineage determination and provides precise, quantitative measurements of lineage closeness across a wide range of modification scenarios.

As machine learning model modification techniques are extensively employed to obtain well-performing models at reduced costs, several studies have emerged to determine the presence of a modification relationship (i.e., lineage) between models. However, these methods are not robust to high-impact modification techniques and none of them have addressed the measurement of lineage closeness, which quantifies the degrees of modification. In this work, we visualize the changes in model decision boundaries resulting from different modification techniques and conclude that differences in decision boundaries serve as a precise metric of lineage closeness. Building upon this insight, we propose a modification-type agnostic and task-agnostic method to measure model lineage closeness by calculating mean adversarial distances from data points to decision boundaries and matching rate of data points, with data points selected through an efficient sampling method to reduce computational overhead. Moreover, we propose a novel indirect measurement approach to support lineage closeness measurement for models with different tasks. Finally, comprehensive experiments show that our design achieves an impressive 97% accuracy in lineage determination, and can precisely measure model lineage closeness for different modifications.

The hybrid-storage blockchain (HSB) facilitates flexible data sharing and search applications across decentralized clients. However, ensuring data privacy and result integrity, while enhancing query and result verification efficiency in HSB-based search applications over dynamic datasets, poses significant challenges. In this paper, we propose E3FS, the first efficient, secure, and verifiable search scheme over dynamically updatable datasets in HSB systems, supporting multi-keyword fuzzy search, an important search function. E3FS accelerates search and verification through an updatable hybrid index with an efficient on-chain process. This design integrates encrypted LSH-based Bloom filters for maintaining file keyword information and an inverted index linking each keyword to a novel authenticated index tree spanning multiple files. Lightweight digests of these trees are stored on-chain to assist with verification, achieving sublinear search and verification costs. Moreover, the framework guarantees forward privacy by securely updating and refreshing both on-chain and off-chain index with new secrets upon each data update. Experimental results demonstrate that our solution outperforms state-of-the-art methods, achieving at least$\mathbf{58.6}\times$faster search and$\mathbf{34.4}\times$faster verification while reducing communication overhead by approximately$\mathbf{60}\times$.

Well-trained deep learning (DL) models are widely recognized as valuable intellectual property (IP) and have been extensively adopted. However, concerns regarding IP infringement emerge when these models are either privately sold to end-users or publicly released online. Unauthorized activities, such as redistributing privately purchased models or exploiting restricted open-source models for commercial gain, pose a significant threat to the interests of model owners. In this paper, we introduce DeepReg, a trustworthy and privacy-friendly regulatory framework designed to address IP infringement within the realm of DL models, thereby nurturing a healthier development ecosystem. DeepRegenables a designated third-party regulator to extract the fingerprint of the original model within a Trusted Execution Environment, as well as to verify suspect models utilizing solely the predicted label without probability. Specifically, we leverage the uniqueness of feature extractors in DL models to craft multiple synthetic inputs for a selected real input. The real input, along with its synthetic inputs, establishes a one-to-many relationship, thereby creating a unique fingerprint for the original model. Furthermore, we propose two distinct methods for suspect detection and piracy judgment. These methods analyze the responses from the model API upon feeding the fingerprint, ensuring a high level of confidence while preventing malicious accusations. Experimental results demonstrate that DeepRegachieves 100% detection accuracy for pirated models, with zero false positives for irrelevant models.

Machine learning models are increasingly recognized as valuable intellectual property (IP), prompting the development of a range of watermarking techniques aimed at safeguarding the IP of these models. However, in the context of federated learning (FL) models involving multiple owners, such as the participants in FL model training, conventional techniques designed for single-owner models prove ineffective due to limitations in their capacity and robustness. Few work has explored how to effectively embed watermarks to FL models for multiple-owners, which is non-trivial, especially when the number of owners is large. To fill this gap, we first analyze the capacity of existing watermarking methods. Second, we propose FedMark, a general large-capacity watermarking mechanism for FL, which leverages the Bloom Filter to achieve conflict-free watermarking of a large number of participants. Moreover, we propose a secret-sharing-based verification method to improve the watermarking robustness against false positives caused by Bloom Filter. Finally, comprehensive experiments show that our design can support over 150 participants to embed watermarks while the model accuracy varies within 1 %, and is robust to non-independent identical distributed data, different participant selection rates, model modifications, permutation attacks, scaling attacks and forging attacks.

Well-trained deep learning (DL) models are widely used in various fields and recognized as valuable intellectual property. However, most existing efforts to fully exploit their value either require users to upload input data to provide machine learning services, which raises serious privacy concerns, or deploy DL models on the user side, resulting in a loss of control over the models. While a few active model authorization methods protect the model from unauthorized users, they cannot prevent the model from being redistributed or abused by authorized users. To address the urgent need to efficiently protect both model confidentiality and input data privacy, and achieve uninterrupted model controllability, we propose a contract-based model authorization framework called DeepContract. This framework enables model owners to deploy their models on the user side for local inference without revealing original model weights. Moreover, it allows them to grant and revoke the right to use their models at any time. Specifically, we propose a generic model encryption method that significantly outperforms the state-of-the-art method in both efficiency and security. Leveraging the integrity verification in the Trusted Execution Environment, contract-based and verifiable enclave codes generated by DeepContract can perform controlled inference using the encrypted model distributed on the user side. Our extensive evaluations show that DeepContract can achieve efficient and secure controllable model authorization for the pre-signed contract.