  Model stealing, i.e., unauthorized access and exfiltration of deep learning
models, has become one of the major threats. Proprietary models may be
protected by access controls and encryption. However, in reality, these
measures can be compromised due to system breaches, query-based model
extraction or a disgruntled insider. Security hardening of neural networks is
also suffering from limits, for example, model watermarking is passive, cannot
prevent the occurrence of piracy and not robust against transformations. To
this end, we propose a native authentication mechanism, called AuthNet, which
integrates authentication logic as part of the model without any additional
structures. Our key insight is to reuse redundant neurons with low activation
and embed authentication bits in an intermediate layer, called a gate layer.
Then, AuthNet fine-tunes the layers after the gate layer to embed
authentication logic so that only inputs with special secret key can trigger
the correct logic of AuthNet. It exhibits two intuitive advantages. It provides
the last line of defense, i.e., even being exfiltrated, the model is not usable
as the adversary cannot generate valid inputs without the key. Moreover, the
authentication logic is difficult to inspect and identify given millions or
billions of neurons in the model. We theoretically demonstrate the high
sensitivity of AuthNet to the secret key and its high confusion for
unauthorized samples. AuthNet is compatible with any convolutional neural
network, where our extensive evaluations show that AuthNet successfully
achieves the goal in rejecting unauthenticated users (whose average accuracy
drops to 22.03%) with a trivial accuracy decrease (1.18% on average) for
legitimate users, and is robust against model transformation and adaptive
attacks.
