Improving Non-Transferable Representation Learning by Harnessing Content and Style

Table C1: Results of H-NTL on ownership verification. "(p)" means patched data. The results of H-NTL are highlighted in bold.

Table C2: Results of H-NTL on applicability authorization (digits datasets). "(p)" means data with the authorized patch. In each row, the authorized domain is highlighted in bold. The last column shows the averaged results on authorized and unauthorized domains (also highlighted in bold).

Table C3: Results of H-NTL on applicability authorization (complex datasets). "(p)" means data with the authorized patch. In each row, the authorized domain is highlighted in bold. The last column shows the averaged results on authorized and unauthorized domains (also highlighted in bold).

Q3: The introduction could be more concise and direct, focusing on the problem and motivation for the proposed approach.

Thanks for your helpful suggestion! We reorganize our introduction as follows:

• The first paragraph describes the background of NTL.
• The second paragraph analysis problems of existing methods, and the third paragraph further provides an example to intuitively illustrate the problems.
• The remaining paragraphs contain the intuitive explanation for the proposed H-NTL method.

The revisions are highlighted in the updated manuscript (highlighted in purple).

Q4: Minor grammatical and typographical errors should be addressed for a more polished final version.

Thanks for pointing this out. We have tried our best to revise obvious typos/grammatical errors in the initial manuscript. We will continue to polish our manuscript to further improve our introduction and revise potential grammatical and typographical errors, thus making our final version more readable.

Q5: Including discussions on potential limitations and areas for future research could provide a more well-rounded view of the work.

Thanks for your constructive suggestions. Here, we discuss the potential limitations of our work and areas for future research. The major limitation of the proposed H-NTL is its training efficiency. Due to the two-stage training processing (i.e., stage 1: disentanglement, stage 2: dual-path knowledge distillation), H-NTL needs more time and computation resources for training. Of course, the sacrifice of training time is worth it if we need better performance. Nevertheless, improving the training efficiency of H-NTL could still become a valuable research direction in the future. However, it is worth noting that after being deployed in practice, our H-NTL will not have any disadvantages in computational cost. In the inference phase, we only need the student model $f_{ntl}$ to predict. If the $f_{ntl}$ has the same network architecture as the network used in other NTL methods, H-NTL will occupy the same memory and have the same inference speed as other NTL methods. Moreover, because of the effective disentanglement and dual-path knowledge distillation, H-NTL allows a more lightweight student network to be taught to learn better non-transferable representations. This implies the potential advantages in the efficient inference of H-NTL in practical applications.
The discussion of limitations and future research is added in Appendix F of the revised paper (highlighted in purple). Thanks for your constructive suggestions!

[C1] Non-Transferable Learning: A New Approach for Model Ownership Verification and Applicability Authorization, ICLR 2022

Thanks for your thoughtful reviews! We address your concerns as follows.

Q1:It could benefit from the inclusion of practical examples or use cases to demonstrate the application of the proposed method. and Q2: It would be helpful to include discussions on potential real-world applications where H-NTL could be particularly valuable.

Thanks for your valuable suggestions. The practical application of the proposed H-NTL lies in the model intellectual property (IP) protections. Our H-NTL can provide two kinds of IP protection: ownership verification, and applicability authorization. As you suggested, we discuss and run more experiments on ownership verification and applicability authorization to further show the effectiveness of our H-NTL on real-world applications.

• Ownership verification:
  • The aim of ownership verification is to verify the ownership of a deep learning model. The proposed H-NTL provides a solution for ownership verification by triggering misclassification on the target domain [C1]. Specifically, we can add a pre-defined trigger patch (only known by the model owner) on the original dataset (i.e., the source domain) and see them as the target domain. It is worth noting that such a pre-defined trigger patch can be controlled to be shallow so that normal supervised learning (SL) models trained on the original source domain can still have normal performance on the patched source domain. Then, we train a deep learning model by using the proposed H-NTL on these two domains. After that, the training model will perform poorly on the data with the patch but have a good performance on the data without the patch. Thus, by observing the performance difference of a trained model on the source domain data with and without the pre-defined trigger patch, we can verify whether a deep learning model belongs to the model owner.
  • We have verified the strong performance of the proposed H-NTL on watermark data with different patch values (results are shown in Section 4.1 and Figure 4 in our main paper), which serves as the core task of ownership verification.
  • Here, we run additional experiments of ownership verification, and results are shown in Table C1. We can see that models trained with H-NTL behave differently on the data with and without the patch, whereas SL models perform nearly the same. Accordingly, the ownership of trained models can be verified.
• Applicability authorization:
  • Applicability authorization aims at authorizing models to certain data for preventing their usage on unauthorized data [C1], which can be solved by applying source-only H-NTL to restrict the model generalization ability to only the authorized domain. Specifically, we add a pre-defined authorized patch to the original data to be authorized and see them as the source domain. We regard the union of the original data (without the authorized patch), the augmented original data with and without the authorized patch as the target domain. Then, we train a deep learning model by using the proposed H-NTL on these two domains. After that, the trained model will only perform well on the authorized data (i.e., the original data with the authorized patch). For unauthorized data (e.g., the original data without the authorized patch, the data from other domains with or without the authorized patch), the trained model will perform poorly. Thus, we achieve the model applicability authorization.
  • We run experiments of applicability authorization, and results are shown in Table C2 (Digits datasets) and Table C3 (complex datasets). We can see that the model trained by H-NTL has good performance on the authorized domain (highlighted in bold in each row) and poor performance on all unauthorized domains. This shows the effectiveness of H-NTL in applicability authorization.

All the discussion of practical applications and their experiments are added in Appendix D.2 of the revised paper (highlighted in purple). Thanks for your constructive suggestions!

Thanks for your strong support and valuable comments! We address the weaknesses below:

Q1: Are there other standard NTL experimental setups using higher resolution datasets beyond the 32x32 or 64x64 images presented in the current paper?

As you suggested, we run additional evaluations with higher-resolution images. In detail, we run experiments on the original resolution of VT$\rightarrow$VV (112$\times$112) and OP$\rightarrow$OC (224$\times$224) without resizing, thus showing the effectiveness of the proposed H-NTL on higher resolution images. Results of the proposed H-NTL on the target-specified NTL setting and source-only NTL setting are shown in Table B1 and Table B2, respectively. On higher-resolution datasets, the proposed H-NTL can still effectively maintain source domain performance (comparable to SL) and significantly degrade the target domain performance.
We add the experiments of high-resolution data in Appendix D.1 of the revised paper (highlighted in purple). Thanks for your constructive suggestions!

Table B1: Results of target-specified H-NTL on high-resolution datasets.

Table B2: Results of source-only H-NTL on high-resolution datasets.

Q3: In Table 2 presented in the experimental part, the authors only consider two baselines for comparison, which is not fair enough for a comprehensive evaluation.

Thanks for your constructive comments! Since non-transferable learning is a recently proposed problem and has few baselines, here we design an additional method (denoted as TargetClass) that can be used for non-transferable learning, thus serving as a baseline for comparison. Specifically, considering an N-class non-transferable learning task, we take the same backbone as our main paper as a feature extractor and use a classification head with N+1 classes to predict the N classes in the source domain, but predict an additional “target class" as class N+1 for all samples in the target domain. Therefore, the model trained by TargetClass will map all the target domain data to an isolated cluster that stays away from the N source-domain-class clusters in the feature space, thus hindering the source-to-target knowledge transfer.
We run experiments under the same setting as our main paper, and results are shown in Table A1 (on natural datasets) and Table A2 (on watermark target-domain). From the comparison, the proposed H-NTL generally has better performance. The baseline method TargetClass is usually hard to maintain the source domain performance and degrade the target domain performance (e.g., on OP$\rightarrow$OC 32$\times$32 and 64$\times$64, C10$\rightarrow$S10 32$\times$32 and 64$\times$64 in Table A1, and most watermark experiments in Table A2).
The comparison with the new baseline is added in Appendix D.3 of the revised paper (highlighted in purple). Thanks for your constructive suggestions!

Table A1: Comparison of the new baseline (denoted as TargetClass) and the proposed H-NTL on natural data. The best results are highlighted in bold.

Table A2: Comparison of the new baseline (denoted as TargetClass) and the proposed H-NTL on watermarked data. The best results are highlighted in bold.

Q4: Have the authors considered the benefits of using a variational inference framework? Is it due to the stochasticity?

Thank you for the insightful question. Yes, you are right! More precisely, we need to model the distribution of latent variables $P(C,S)$ from the observed data, thus modeling the generative process. The variational inference framework helps us to model the distribution of latent variables $P(C,S)$. Other frameworks (such as auto-encoder) cannot model the distribution. Moreover, there are also alternative options (for example, the VAEGAN) but with more complexity and may facing the problem of unstable training. Thus, the above factors are major motivations for us to use the variational inference framework.
We add the discussion of the benefits of using a variational inference framework in Appendix E.3 (highlighted in purple in the revised manuscript).

[A1] Non-Transferable Learning: A New Approach for Model Ownership Verification and Applicability Authorization, ICLR 2022

Thanks for your helpful comments! We address your concerns as follows.

Q1: The authors state that existing methods suffer from the limitations of spurious correlation and fake independence. However, the authors do not provide any quantitative evaluation regarding these two challenges, except only intuitions.

Thanks for pointing this out. It is difficult to directly quantify how many spurious correlations and fake independence the existing methods rely on in real-world datasets (it needs to manually analyze each sample and its prediction). Thus, we have validated the limitation of existing methods through a toy experiment (we present it in Appendix A due to the limited pages of the main paper).

We leverage prior knowledge of spurious correlations to design a source domain, thus demonstrating the vulnerability (caused by fitting spurious correlation and modeling fake independence) of statistical-based methods. Specifically, we conduct the toy NTL experiment on digit datasets, where we use MNIST as the source domain and USPS as the target domain. Each digit in the source domain has a human-added class-wise color, thus creating a strong spurious correlation between the color and label. Our experiments show that the statistical-based method NTL [A1] and the proposed H-NTL achieve perfect non-transferable learning performance on the regular test data. However, when facing distribution shifts (e.g., perturbing the color), the statistical-based method NTL [A1] has serious performance degradation on the source domain, but the proposed H-NTL can still maintain the ideal performance. This phenomenon illustrates that the statistical-based method heavily relies on learning the spurious correlations to implement non-transferable learning. (More details please refer to Appendix A)

Q2: The authors do not provide further details about the datasets used in the experiments. For example, the number of samples in each domain and each class. This will result in difficulties in understanding different datasets.

We sincerely apologize for the confusion. Due to the limited space of the main paper, we provided detailed information for each dataset used in our experiments in Appendix C.1 and the training details including the number of samples in each domain and each class in Appendix C.2.

Thanks for your detailed response!