AnonymTracker: Anonymously Traceable Copyright Protection for Federated Learning Model

Federated Learning (FL) enables collaborative model training with data privacy but risks malicious Clients, namely model leakers, compromising group intellectual property by secretly distributing or selling the valuable trained models. Some preliminary works have studied this traceability issue, enabling the identification of model leakers within the FL network when the model is maliciously distributed. However, these works often achieve traceability by compromising the identity privacy of legitimate Clients. In this paper, we propose AnonymTracker, an anonymous FL model leaker tracing scheme. To protect the anonymity of legitimate Clients, we design a group signature-based fingerprint embedding mechanism, combining group signatures with model watermarking for effective and undeniable leaker identification. We further embed unique fingerprints in each Client’s model during training and use a cosine-similarity-based metric to compare extracted and embed fingerprints in the tracing phase, enhancing leak identification accuracy. The security analysis demonstrates AnonymTracker’s protection of legitimate Clients’ identity anonymity. Experiments on benchmark datasets and models confirm its good effectiveness, fidelity, and robustness against various watermark removal attacks.