  Existing integrity verification approaches for deep models are designed for
private verification (i.e., assuming the service provider is honest, with
white-box access to model parameters). However, private verification approaches
do not allow model users to verify the model at run-time. Instead, they must
trust the service provider, who may tamper with the verification results. In
contrast, a public verification approach that considers the possibility of
dishonest service providers can benefit a wider range of users. In this paper,
we propose PublicCheck, a practical public integrity verification solution for
services of run-time deep models. PublicCheck considers dishonest service
providers, and overcomes public verification challenges of being lightweight,
providing anti-counterfeiting protection, and having fingerprinting samples
that appear smooth. To capture and fingerprint the inherent prediction
behaviors of a run-time model, PublicCheck generates smoothly transformed and
augmented encysted samples that are enclosed around the model's decision
boundary while ensuring that the verification queries are indistinguishable
from normal queries. PublicCheck is also applicable when knowledge of the
target model is limited (e.g., with no knowledge of gradients or model
parameters). A thorough evaluation of PublicCheck demonstrates the strong
capability for model integrity breach detection (100% detection accuracy with
less than 10 black-box API queries) against various model integrity attacks and
model compression attacks. PublicCheck also demonstrates the smooth appearance,
feasibility, and efficiency of generating a plethora of encysted samples for
fingerprinting.
