{"id":"08a9afc8-8f2e-441b-b677-b905a51cbdfe","arxiv_id":"2412.20768","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"SAC-JC fingerprints deep models by comparing correlation matrices of model outputs on JPEG-compressed images, and extends this to face verification via binary reference-image features.","lead":"This paper proposes a way to detect when a deep face recognition model has been stolen: compare how pairs of JPEG-compressed images are correlated in the suspect model versus the original. It is fast, avoids adversarial examples, and is one of the first practical fingerprints for face verification, though the JPEG choice and the speedup claim need scrutiny.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"AUC may be inflated by a data-split confound: fingerprint images appear drawn from the source's training set, while irrelevant models are trained on a disjoint split, so separation could reflect training-data memorization rather than the stealing relationship.","rationale":"The reader's weakest_assumption focuses on the stability of the correlation matrix under stealing, but the more fundamental vulnerability is in the evaluation protocol: the fingerprint inputs appear to come from the source model's own training split while irrelevant models are trained on a disjoint split. This confound affects the threshold-free AUC, which is the headline metric, making it more load-bearing than the threshold-selection or JPEG-selection issues the reader identified. If the source model has memorized the exact fingerprint images, its correlation matrix on those images will differ from any model that has not seen them, regardless of whether the suspect is derived from the source. The stolen models inherit some of the source's behavior and are therefore closer to the source, but this may reflect shared access to the source's training distribution rather than the parameter-correlation property the paper claims. The paper's own ablation (SAC-Clean with AUC 0.91 on KDEF) shows that even without JPEG, the fingerprint set separates source from irrelevant models, which is consistent with a memorization effect. The proposed test would settle the concern directly. I keep the verdict as CONDITIONAL (UNCHANGED) because the method may still work, but the evidence as presented is not sufficient without controlling for this distribution gap; the condition should explicitly require a held-out fingerprint evaluation.","tokens_in":19305,"tokens_out":8479,"duration_ms":88178,"concrete_test":"Retrain the irrelevant models for KDEF (and CIFAR10) on D_defender, or alternatively evaluate all models (source, stolen, and irrelevant) on a held-out set that neither the source nor the irrelevant models were trained on (e.g., D_attacker images or a fresh split), then recompute the SAC-JC AUC in Tables 1, 4, and 5. If AUC drops from 0.97 toward 0.5, the separation is an artifact of the source having seen the fingerprint images; if AUC remains high, the correlation-stability claim is supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"In the multi-classification experiments (KDEF, Tiny-ImageNet, CIFAR10), Section 4.1 splits each training set into D_defender and D_attacker, with the source model trained on D_defender and the attacker/irrelevant models trained on D_attacker. The fingerprint is then computed on 'randomly selected normal samples' from the defender's dataset (Sections 3.3 and 4.1), i.e., images the source model has seen during training but the irrelevant models have not. The source's correlation matrix on its own training images can be distinctive due to memorization or sharper predictions, independent of whether a suspect model was actually derived from it. SAC-Clean already achieves AUC 0.91 on KDEF (Table 9), suggesting that even without JPEG augmentation, training-set fingerprint images separate source from irrelevant models. If the reported AUCs (0.97-1.00) are driven by this train/test distribution gap rather than by correlation inheritance from the source, the method's claimed robustness to fine-tuning, pruning, distillation, and transfer learning is not established. The paper does not report results with fingerprint images drawn from D_attacker or from a held-out set unseen by both source and irrelevant models, nor does it specify for each task which split the irrelevant models are trained on.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SAC-JC, a post-hoc model fingerprinting method that computes the pairwise correlation matrix of a model's outputs on JPEG-compressed probe images and flags a suspect model as stolen when the L1 distance between the suspect's and source's correlation matrices falls below a threshold. For face verification, the paper introduces FRI, which converts 0/1 same-identity verification decisions into feature vectors so that correlation can be computed. The method is evaluated against fine-tuning, pruning, model extraction, knowledge distillation, adversarial training, and transfer learning on KDEF, face verification, Tiny-ImageNet, and CIFAR10, and is compared with IPGuard, CAE, and EWE using AUC, p-value, and F1.","tokens_in":19574,"tokens_out":6353,"duration_ms":64922,"significance":"If the reported results hold, the paper makes a useful contribution: it is the first fingerprinting method aimed at face verification, uses a simple JPEG-compression augmentation rather than adversarial examples, avoids training surrogate models, and reports a large speedup over CAE. The attack coverage is broad, four architectures are tested, and code is promised. The central empirical claim, however, rests on an experimental setup whose dataset provenance may confound the measured separation between source and irrelevant models; the ablation study already shows high AUC for SAC-Clean, so the additional experiments requested below are essential before the headline numbers can be attributed to correlation inheritance.","major_comments":[{"comment":"The multi-class experiments split each training set into D_defender and D_attacker, train the source model on D_defender and the attacker/irrelevant models on D_attacker, and then compute the SAC fingerprint on \"randomly selected normal samples\" (Section 3.3). If these samples are drawn from D_defender, as the experimental setup implies, the source's correlation matrix is computed on images the source has seen during training but the irrelevant models have not. The ablation in Table 9 shows SAC-Clean alone reaches AUC 0.91 on KDEF, so the separation is not caused by JPEG augmentation. This confound means the reported AUCs may reflect training-set memorization rather than correlation inheritance from the source model. Please report (i) the exact provenance of the fingerprint samples for every task, (ii) results with fingerprint samples drawn from D_attacker or, preferably, from a held-out set unseen by both source and irrelevant models, and (iii) the split used for irrelevant models in the face-verification experiments (MS1MV2 vs CASIA-Webface).","section":"4.1 (Tables 1, 4, 5; Table 9)"},{"comment":"JPEG compression is selected because it gives the highest average AUC on the same evaluation tasks (KDEF and face verification), and the exact JPEG quality level used is not reported anywhere in the manuscript. This is both a reproducibility problem and a potential selection-on-evaluation bias: the augmentation choice is validated on the same tasks that are later used to report the headline numbers. Please report the compression quality parameter, add a sensitivity analysis over quality levels, or fix the quality level a priori on a separate development set.","section":"3.3 and Figure 2"},{"comment":"For face verification, model extraction is replaced by white-box knowledge distillation because no output labels are available, yet Section 4.2 claims SAC-JC works \"with black-box access to both the source model and the suspect models.\" The face-verification evaluation therefore does not exercise a black-box extraction attack, and the black-box claim is not established for this task. Please add a genuinely black-box extraction attack on the verification model (e.g., using verification decisions), or restrict the claim to the settings actually evaluated.","section":"4.1 and 4.2, Table 2"},{"comment":"The F1 scores are computed with a threshold chosen as the worst value over only four irrelevant models, and the manuscript does not state whether these are the same irrelevant models used to evaluate the ROC/F1. Using the evaluation distribution to set the threshold makes the F1 numbers optimistic. Please use a separate validation set for threshold selection or report the sensitivity of F1 to the threshold choice.","section":"4.1 Threshold Selection"}],"minor_comments":[{"comment":"FRI assumes at least n=50 reference images of the same identity exist and does not specify how the target and reference images are selected (e.g., from the training set, a gallery, or a separate enrollment set). This should be stated for reproducibility.","section":"3.4 and Algorithm 1"},{"comment":"The default number of fingerprint samples n used for the correlation matrix in the multi-classification experiments is not stated; Figure 4 varies the number from 25 to 200. Please report the default n used in the main tables.","section":"4.1 / Tables 1, 4, 5"},{"comment":"There is a typo in the table header: \"MobleNet\" should be \"MobileNet\".","section":"Table 7"},{"comment":"The min-max formulation in Equation 5 is described as adversarial training on the extracted model with predicted labels from the source model, but it is not clear whether the adversarial perturbation is computed with respect to the stolen model or the source model, and whether the bound is per-image. Please clarify.","section":"Equation 5"},{"comment":"Figure 2 reports average AUC across attacks for different augmentation methods without error bars or the number of runs; please indicate the variability across attacks or models.","section":"Figure 2"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know: this is a genuine extension of the authors' NeurIPS 2022 SAC paper to deep face recognition, and it has one experimental-design gap that needs a direct test before you trust the headline numbers.\n\nWhat is new: the FRI mechanism for face verification (turning binary 0/1 verification outputs into a 50-dimensional feature by comparing against same-identity references) is a real contribution, and the JPEG-compression variant (SAC-JC) is tested more carefully than most fingerprinting papers: five attack types, four architectures, three datasets plus face verification, with AUC mostly above 0.92. The paper honestly identifies its precursor and does not oversell the novelty. It also does solid ablations: clean vs JPEG vs adversarial inputs, cosine vs RBF kernels, sample count sensitivity, threshold transfer across architectures. The qualitative finding that correlation-based fingerprints survive adversarial training and transfer learning better than adversarial-example methods is credible and useful.\n\nWhere it is soft: the evaluation uses fingerprint images drawn from the defender's training split while the irrelevant models are trained on a disjoint split. That means the correlation difference between source and irrelevant could reflect training-data familiarity as much as model identity. SAC-Clean already gives 0.91 AUC on KDEF, so the gap is worth probing. The paper does not report a control where fingerprint images come from a held-out set or from the attacker's split. This is a real gap, not a fatal flaw: the mechanism could still work if the stolen model inherits the source's decision boundary regardless of seeing those pixels, but the current evidence does not isolate that. I also want the exact JPEG quality level, a cleaner description of how the F1 threshold is chosen and on what split, and a speedup comparison that counts the time to query suspects, not just the fingerprint construction. The '34,393x faster than CAE' claim omits suspect-query cost. Code is promised but not shipped.\n\nOverall: the core method is plausible, the experiments are broad, and the FRI adaption is the kind of simple thing that will get reused. A serious referee should ask for the held-out fingerprint experiment and a few reporting clarifications before the AUC numbers are taken at face value. I would send it to review and bring it to a reading group to think through the split confound. Worth citing if you work on model IP protection.","headline":"Solid extension of prior SAC work to face recognition, but the evaluation lacks a held-out fingerprint control, so the headline AUCs may partly reflect training-data familiarity.","tokens_in":20090,"tokens_out":5715,"would_cite":true,"duration_ms":54182,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a stolen deep-learning model can be caught by comparing the pairwise correlation of its outputs on JPEG-compressed images, a signature that survives fine-tuning, pruning, distillation, and extraction attacks.","keywords":["model fingerprinting","deep face recognition","sample correlation","JPEG compression","model stealing detection","face verification","intellectual property protection"],"falsifier":"A decisive test: fine-tune the source model on a disjoint dataset until the SAC-JC distance to the source exceeds the calibrated threshold while verification accuracy stays high. If such a model exists, the central claim fails; equivalently, if an independently trained model of a new architecture falls below the threshold on a fresh reference set, false positives appear.","tokens_in":19109,"feed_emoji":"🪪","tokens_out":8379,"duration_ms":76915,"temperature":0.7,"pith_summary":"This paper tries to show that model stealing from deep face-recognition services can be detected without the adversarial examples used by previous fingerprinting methods, which fail under adversarial training and transfer learning. Its proposal, SAC-JC, computes the pairwise correlation matrix of a model's outputs on JPEG-compressed images and treats the $\\ell^1$ distance between the source's and the suspect's correlation matrices as the theft indicator. For face verification, where only 0/1 same-identity answers are available, it adds FRI, which turns a target image into a 50-bit feature by comparing it against reference images from the same identity, and runs the same correlation test on those bits. The reported experiments span face emotion recognition, face verification, Tiny-ImageNet, and CIFAR10, with average AUC between 0.97 and 1.00 across fine-tuning, pruning, label- and probability-based extraction, adversarial extraction, knowledge distillation, adversarial training, and transfer learning. If correct, this gives model owners a black-box, training-free, sub-second ownership check that adversarial-example methods cannot match.","feed_headline":"Correlation fingerprints catch stolen face-recognition models","feed_subtitle":"SAC-JC spots fine-tuned, pruned, distilled, and extracted copies with near-perfect AUC, no surrogate training.","key_machinery":"The central object is the sample-correlation matrix: for a set of $n$ JPEG-compressed inputs, the model's outputs form vectors $o_i$, and the matrix entry $C_{i,j} = \\text{Cos}(o_i, o_j)$ (or a Gaussian RBF kernel) records how similarly the model responds to the two samples. The detection statistic is the normalized $\\ell^1$ matrix distance $\\|C_{\\text{suspect}} - C_{\\text{source}}\\|_1 / n^2$ from Eq. (4): below a threshold $d$ means stolen. JPEG compression is the sample-selection mechanism that magnifies model-specific differences while suppressing the common knowledge shared by all models trained on the same task. For face verification, FRI converts the model's binary same-identity answers into a 50-dimensional 0/1 feature vector per target image, replacing outputs in the same correlation computation. The combination is what carries the argument: a robust, model-specific pairwise signature plus an input transform that makes it discriminative.","core_discovery":"The central claim is that the pairwise correlation structure of a model's outputs is a stable, model-specific signature that surviving copies retain, while independently trained models do not share it. Concretely, the paper declares a suspect stolen when $\\|C_{\\text{suspect}} - C_{\\text{source}}\\|_1 / n^2 \\le d$, with $C$ built from cosine similarities among outputs on JPEG-compressed samples (Eq. 4). JPEG compression is chosen empirically from fourteen image corruptions as the augmentation that best separates stolen from irrelevant models; the paper argues this is because JPEG compression is unrelated to adversarial robustness and thus survives adversarial training. On face verification, where the model returns only a binary same-identity verdict, the FRI method forms a 50-bit verification feature per target image and applies the same correlation distance. The paper reports that SAC-JC outperforms IPGuard, CAE, and EWE on nearly every attack and dataset, with average AUC 0.97 on KDEF, 0.98 on face verification, 0.99 on Tiny-ImageNet, and 1.00 on CIFAR10, and it is, by the authors' account, the first fingerprinting method for face verification.","pith_inferences":["Outside the tested settings, the correlation signature should also apply to embedding-only or multimodal APIs, since the correlation matrix needs only output vectors; this is a natural extension the paper does not test.","An attacker could try to break the method by training a student with an explicit correlation-distance regularizer so that the student's correlation matrix matches the source's while the labels come from a different teacher; whether SAC-JC survives that adaptive attack is an open question.","The paper calibrates thresholds with only four irrelevant models; on a new data distribution, the threshold may shift, so the reported AUC and F1 figures likely represent a favorable calibration regime rather than a worst-case bound.","For face verification, the FRI signature uses 50 fixed reference images per identity; varying the reference pool or using video frames could either strengthen the signature (more bits) or introduce identity-specific biases not visible in the current evaluation."],"forward_implications":["SAC-JC can fingerprint black-box face-recognition services without any access to the suspect model's weights or architecture, since only outputs (or verification bits) are needed.","Unlike adversarial-example fingerprints, SAC-JC remains effective against adversarial training and adversarial extraction, and it is the only compared method that detects transfer learning, where the label space changes.","Because it never modifies training, SAC-JC preserves the source model's accuracy, unlike EWE which the paper reports loses 4.0% on CIFAR10.","Fingerprint generation takes 0.16 seconds versus 25,536.89 seconds for CAE, so ownership checks can be run on demand at deployment time.","A few dozen JPEG-compressed images (25-50) suffice for high AUC, so the fingerprint can be kept small and cheap to query."],"supporting_citations":[{"why":"Introduced the original SAC method for fingerprinting deep networks; this paper extends it to face recognition and JPEG compression.","marker":"[26]"},{"why":"Defines the CAE conferrable-adversarial-example baseline that SAC-JC is compared against and whose paradigm the paper argues is fragile.","marker":"[4]"},{"why":"Provides the IPGuard boundary-fingerprinting baseline that SAC-JC must beat.","marker":"[20]"},{"why":"Provides the EWE watermarking baseline; the paper notes EWE degrades source accuracy and fails on verification/no-label tasks.","marker":"[2]"},{"why":"Supplies the set of fourteen image corruptions from which JPEG compression is selected as SAC-JC's augmentation.","marker":"[27]"},{"why":"Gives the correlation-congruence formulation used to define the pairwise output correlation matrix.","marker":"[38]"},{"why":"Supplies the threshold-selection rule (worst irrelevant model) used for F1-score evaluation.","marker":"[21]"}],"fun_headline_variants":["Correlation fingerprints catch stolen face models","JPEG-triggered correlations fingerprint stolen face models","Sample correlation beats transfer-learning defenses in model theft","SAC-JC: 0.97 AUC detects face-model stealing via correlations","Stolen models? Their pairwise output correlations give away"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"A stolen model retains the pairwise correlation pattern of its outputs on JPEG-compressed images, and no independently trained model shares that pattern, even when the model is heavily fine-tuned or distilled.","fun_headline_variants_meta":{"raw":{"variants":["Correlation fingerprints catch stolen face models","JPEG-triggered correlations fingerprint stolen face models","Sample correlation beats transfer-learning defenses in model theft","SAC-JC: 0.97 AUC detects face-model stealing via correlations","Stolen models? Their pairwise output correlations give away"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00032,"raw_usage":{"total_tokens":1847,"prompt_tokens":1035,"completion_tokens":812,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":651,"completion_tokens_details":{"reasoning_tokens":733}},"tokens_in":651,"tokens_out":812,"duration_ms":8237,"temperature":1.0,"reasoning_tokens":733,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T23:11:46.294697+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A decisive test: fine-tune the source model on a disjoint dataset until the SAC-JC distance to the source exceeds the calibrated threshold while verification accuracy stays high. If such a model exists, the central claim fails; equivalently, if an independently trained model of a new architecture falls below the threshold on a fresh reference set, false positives appear.","supporting_citations":[{"cited_title":"Are you stealing my model? sample correlation for finger- printing deep neural networks","cited_arxiv_id":null,"evidence_quote":"Introduced the original SAC method for fingerprinting deep networks; this paper extends it to face recognition and JPEG compression."},{"cited_title":"Deep neural network fingerprinting by conferrable adversarial examples","cited_arxiv_id":null,"evidence_quote":"Defines the CAE conferrable-adversarial-example baseline that SAC-JC is compared against and whose paradigm the paper argues is fragile."},{"cited_title":"Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary","cited_arxiv_id":null,"evidence_quote":"Provides the IPGuard boundary-fingerprinting baseline that SAC-JC must beat."},{"cited_title":"Entangled watermarks as a defense against model extraction","cited_arxiv_id":null,"evidence_quote":"Provides the EWE watermarking baseline; the paper notes EWE degrades source accuracy and fails on verification/no-label tasks."},{"cited_title":"Benchmark- ing neural network robustness to common corrup- tions and perturbations","cited_arxiv_id":null,"evidence_quote":"Supplies the set of fourteen image corruptions from which JPEG compression is selected as SAC-JC's augmentation."},{"cited_title":"Correlation congruence for knowledge distillation","cited_arxiv_id":null,"evidence_quote":"Gives the correlation-congruence formulation used to define the pairwise output correlation matrix."},{"cited_title":"Modeldiff: testing-based dnn sim- ilarity comparison for model reuse detection","cited_arxiv_id":null,"evidence_quote":"Supplies the threshold-selection rule (worst irrelevant model) used for F1-score evaluation."}],"review_version":1}