Research map / Label-efficient and robust learning / Recognition and long-tail
EncryIP: A Practical Encryption-Based Framework for Model Intellectual Property Protection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes EncryIP, which encrypts training labels with a Cramer-Shoup-style public-key scheme so a single training run yields a model that outputs confused labels, decryptable only with per-user secret keys.
Problem
Model IP protection methods (watermark, trigger, passport) require repeated training to produce distinct protected versions for each authorized user, and their outputs are readable, so unauthorized distribution of models is hard to trace and control.
Approach
Encrypt labels with a PKE scheme that has multiple secret keys per public key and ill-formed ciphertexts that decrypt differently under different keys; map ciphertexts to "confused" label vectors via an indicator-based transfer function, train once on these labels, and let only key holders recover true labels.
Key results
- EncryIP keeps test accuracy within about 1% of the original ResNet18 (e.g., CIFAR-10 0.9094 vs 0.9030) across four datasets.
- Using an incorrect secret key drops accuracy to near chance (e.g., ResNet18 MNIST 0.0006, CIFAR-10 0.0075).
- Training time for three authorized-user versions is roughly one training run (ResNet18 CIFAR-100 66.02 min) versus about 166-170 min for PR and DeepIPR which need three trainings.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train with EncryIP label encryption rather than original labels | ResNet18 · MNIST | accuracy: 0.9936±0.0014 -> 0.9930±0.0006 | No clear effect |
| Train with EncryIP label encryption rather than original labels | ResNet18 · CIFAR10 | accuracy: 0.9030±0.0046 -> 0.9094±0.0051 | No clear effect |
| Train with EncryIP label encryption rather than original labels | ResNet18 · CIFAR100 | accuracy: 0.7322±0.0036 -> 0.7279±0.0030 | No clear effect |
| Train with EncryIP label encryption rather than original labels | ResNet18 · ImageNet | accuracy: 0.6231±0.0010 -> 0.6178±0.0006 | No clear effect |
| Train with EncryIP label encryption rather than original labels | GoogLeNet · MNIST, CIFAR10, CIFAR100, ImageNet | accuracy | Hurt |
| Train with EncryIP label encryption rather than original labels | AlexNet · MNIST, CIFAR10, CIFAR100, ImageNet | accuracy | Mixed |
| Use an incorrect secret key instead of the authorized key (ablation) | EncryIP · MNIST, CIFAR10, CIFAR100, ImageNet; ResNet18, GoogLeNet, AlexNet | accuracy | Hurt |
| Vary the number of classes in the training dataset (ablation) | EncryIP (ResNet18) · CIFAR10 | accuracy | No clear effect |
| Vary the training dataset size (ablation) | EncryIP (ResNet18) · CIFAR10 | accuracy | No clear effect |
| Vary encryption parameter q (ablation) | EncryIP (ResNet18) · CIFAR10 | accuracy | No clear effect |
Surprising findings
- Verification accuracy with the ill-formed ciphertext approach is near 100% for most settings, but the EncryIP incorrect-key accuracy on GoogLeNet MNIST is 0.0216 with std 0.0403, showing variability.
Limitations
- Assumes authorized users do not collude; collusion resistance is not addressed.
- Security relies on IND-CPA of a simplified Cramer-Shoup scheme under DDH, with no formal guarantee for the whole learning pipeline.
- Evaluated only on small image classifiers (ResNet18, GoogLeNet, AlexNet) and standard datasets.
Experimental setup
Datasets: MNIST CIFAR-10 CIFAR-100 ImageNet
Benchmarks: MNIST CIFAR-10 CIFAR-100 ImageNet
Metrics: accuracy training time verification accuracy
Baselines: PR EW DeepIPR
Builds on: Cramer-Shoup encryption DeepIPR PR watermarking EW trigger-set watermarking
Closest papers by meaning
- MAP: MAsk-Pruning for Source-Free Model Intellectual Property Protection (CVPR 2024 · similarity 0.85)
- Steganographic Passport: An Owner and User Verifiable Credential for Deep Model IP Protection Without Retraining (CVPR 2024 · similarity 0.83)
- IPRemover: A Generative Model Inversion Attack against Deep Neural Network Fingerprinting and Watermarking (AAAI 2024 · similarity 0.83)
- SIF: Semantically In-Distribution Fingerprints for Large Vision-Language Models (CVPR 2026 · similarity 0.82)
- RAEncoder: A Label-Free Reversible Adversarial Examples Encoder for Dataset Intellectual Property Protection (CVPR 2025 · similarity 0.82)
- Blameless Users in a Clean Room: Defining Copyright Protection for Generative Models (NeurIPS 2025 · similarity 0.81)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.