Microphone array technology has been widely used for the localization of sound sources. In particular, beamforming is a well-established signal processing method that maps the position of acoustic sources by steering the array transducers toward different directions electronically. The present PhD study aims at enhancing the performance of uniform circular arrays, and to a lesser extent, spherical arrays, for twoand three-dimensional localization problems, respectively. These array geometries allow to perform eigenbeamforming, beamforming based on the decomposition of the sound field in a series of orthogonal functions. In this work, eigenbeamforming is particularly developed to improve the performance of circular arrays at low frequencies. Compared to conventional delayand-sum beamforming, the proposed technique, named circular harmonics beamforming, provides a better resolution at the expense of being more vulnerable to noise. A simple way to further improve the array performance is to flush-mount the transducers on a rigid scatterer. For a circular array, an ideal solution is a rigid cylindrical scatterer of infinite length. Due to its impracticality, the use of a rigid spherical scatterer is recommended instead. A better visualization in the entire frequency range can be achieved with deconvolution methods, as they allow the recovery of the sound source distribution from a given beamformed map. Three efficient methods based on spectral procedures, originally conceived for planar-sparse arrays, are adapted to circular arrays. They rely on the fact that uniform circular arrays present an azimuthal response that is rather independent on the focusing direction. Finally, a method based on the combination of beamforming and acoustic holography is introduced for both circular and spherical arrays. This new approach, also expressible in terms of eigenbeamforming, extends the frequency range of operation of conventional delay-and-sum beamforming toward the low frequencies.

/pdf/eigenbeamforming-array-systems-for-sound-source-localization-cc4kiieuo9.pdf

Eigenbeamforming array systems for sound source localization

Recent advances in the ﬁngerprinting of deep neural networks detect instances of models, placed in a black-box interaction scheme. Inputs used by the ﬁngerprinting protocols are speciﬁcally crafted for each precise model to be checked for. While eﬃcient in such a scenario, this nevertheless results in a lack of guarantee after a mere modiﬁcation ( e.g. retraining, quantization) of a model. This paper tackles the challenges to propose i) ﬁngerprinting schemes that are resilient to signiﬁcant modiﬁcations of the models, by generalizing to the notion of model families and their variants, ii) an extension of the ﬁngerprinting task encompassing scenarios where one wants to ﬁngerprint not only a precise model (previously referred to as a detection task) but also to identify which model family is in the black-box ( identiﬁcation task). We achieve both goals by demonstrating that benign inputs, that are unmodiﬁed images, for instance, are suﬃcient material for both tasks. We leverage an information-theoretic scheme for the identiﬁcation task. We devise a greedy discrimination algorithm for the detection task. Both approaches are experimentally validated over an unprecedented set of more than 1,000 networks.

FBI: Fingerprinting models with Benign Inputs

An off-the-shelf model as a commercial service could be stolen by model stealing attacks, posing great threats to the rights of the model owner. Model fingerprinting aims to verify whether a suspect model is stolen from the victim model, which gains more and more attention nowadays. Previous methods always leverage the transferable adversarial examples as the model fingerprint, which is sensitive to adversarial defense or transfer learning scenarios. To address this issue, we consider the pairwise relationship between samples instead and propose a novel yet simple model stealing detection method based on SAmple Correlation (SAC). Specifically, we present SAC-w that selects wrongly classified normal samples as model inputs and calculates the mean correlation among their model outputs. To reduce the training time, we further develop SAC-m that selects CutMix Augmented samples as model inputs, without the need for training the surrogate models or generating adversarial examples. Extensive results validate that SAC successfully defends against various model stealing attacks, even including adversarial training or transfer learning, and detects the stolen models with the best performance in terms of AUC across different datasets and model architectures. The codes are available at https://github.com/guanjiyang/SAC.

Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networks

Recent advances in deep generative models have led to the development of methods capable of synthesizing high-quality, realistic images. These models pose threats to society due to their potential misuse. Prior research attempted to mitigate these threats by detecting generated images, but the varying traces left by different generative models make it challenging to create a universal detector capable of generalizing to new, unseen generative models. In this paper, we propose to inject a universal adversarial signature into an arbitrary pre-trained generative model, in order to make its generated contents more detectable and traceable. First, the imperceptible optimal signature for each image can be found by a signature injector through adversarial training. Subsequently, the signature can be incorporated into an arbitrary generator by fine-tuning it with the images processed by the signature injector. In this way, the detector corresponding to the signature can be reused for any fine-tuned generator for tracking the generator identity. The proposed method is validated on the FFHQ and ImageNet datasets with various state-of-the-art generative models, consistently showing a promising detection rate. Code will be made publicly available at \url{https://github.com/zengxianyu/genwm}.

Securing Deep Generative Models with Universal Adversarial Signature

Watermarking has been widely adopted for protecting the intellectual property (IP) of Deep Neural Networks (DNN) to defend the unauthorized distribution. Unfortunately, the popular data-poisoning DNN watermarking scheme relies on target model fine-tuning to embed watermarks, which limits its practical applications in tackling real-world tasks. Specifically, the learning of watermarks via tedious model fine-tuning on a poisoned dataset (carefully-crafted sample-label pairs) is not efficient in tackling the tasks on challenging datasets and production-level DNN model protection. To address the aforementioned limitations, in this paper, we propose a plug-and-play watermarking scheme for DNN models by injecting an independent proprietary model into the target model to serve the watermark embedding and ownership verification. In contrast to the prior studies, our proposed method by incorporating a proprietary model is free of target model fine-tuning without involving any parameters update of the target model, thus the fidelity is well preserved. Our research findings reveal that model fine-tuning with poisoned data is not prepared for the IP protection of DNN models deployed in real-world tasks and poses a new research direction toward a more thorough understanding and investigation of adopting the proprietary model for DNN watermarking. The source code and models are available at https://github.com/AntigoneRandy/PTYNet.

Free Fine-tuning: A Plug-and-Play Watermarking Scheme for Deep Neural Networks

In this paper, we propose a novel and practical mechanism to enable the service provider to verify whether a suspect model is stolen from the victim model via model extraction attacks. Our key insight is that the profile of a DNN model's decision boundary can be uniquely characterized by its Universal Adversarial Perturbations (UAPs). UAPs belong to a low-dimensional subspace and piracy models' subspaces are more consistent with victim model's subspace compared with non-piracy model. Based on this, we propose a UAP fingerprinting method for DNN models and train an encoder via contrastive learning that takes fingerprints as inputs, outputs a similarity score. Extensive studies show that our framework can detect model Intellectual Property (IP) breaches with confidence > 99.99 % within only 20 fingerprints of the suspect model. It also has good generalizability across different model architectures and is robust against post-modifications on stolen models.

Guo-Yue Chen

Papers

Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbations

Beam Pattern Design and Performance Analyses for Circular Array with Spherical Baffles