CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attacks

Machine Learning as a Service (MLaaS) has emerged as a widely adopted paradigm for providing access to deep neural network (DNN) models, enabling users to conveniently leverage these models through standardized APIs. However, such services are highly vulnerable to Model Extraction Attacks (MEAs), where an adversary repeatedly queries a target model to collect input-output pairs and uses them to train a surrogate model that closely replicates its functionality. While numerous defense strategies have been proposed, verifying the ownership of a suspicious model with strict theoretical guarantees remains a challenging task. To address this gap, we introduce CREDIT, a certified ownership verification against MEAs. Specifically, we employ mutual information to quantify the similarity between DNN models, propose a practical verification threshold, and provide rigorous theoretical guarantees for ownership verification based on this threshold. We extensively evaluate our approach on several mainstream datasets across different domains and tasks, achieving state-of-the-art performance. Our implementation is publicly available at: https://github.com/LabRAI/CREDIT.

Machine learning services let people use powerful models through an API, but that convenience also makes it easy for attackers to copy a model by repeatedly querying it. Our work, CREDIT, helps model owners check whether a suspicious model was extracted from their protected model. We compare how similarly two models respond to the same inputs on a small verification set, using a statistical score that captures their shared behavior, and we add carefully controlled noise so the check comes with a mathematical guarantee instead of a hand-tuned cutoff. If the suspicious model is too similar, CREDIT can flag it with a known limit on mistakes. Across image, graph, and language tasks, the method kept the original model useful while giving much stronger ownership verification than prior approaches. In practice, this means model owners can better protect valuable machine learning systems deployed through cloud APIs.