{"id":"e52e911e-8f19-49e8-95ad-b026579e6d22","arxiv_id":"2501.15509","paper_version":5,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":7,"one_line_summary":"A targeted fingerprinting method for AI models claims to prevent false ownership claims by making fingerprints match a specific reference pattern, unlike untargeted methods.","lead":"This paper proposes a new way to prove ownership of an AI model without changing it: a targeted fingerprint that only the model and its copied versions match. The authors claim it stops attackers from falsely claiming other people's models, a weakness of earlier fingerprinting methods.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Proposition 1's security proof assumes the adversary's crafted samples yield uniformly random bits on independent models—exactly the property a false-claim attack tries to break—so the 100% defense claim is not proven.","rationale":"Good-faith reading: FIT-Print is a plausible targeted-fingerprinting framework. The optimization in Eq. (8) is a reasonable mechanism for making fingerprints conferrable to reused models, the two instantiations (DDV cosine similarity and LIME attribution) are concrete, and the experiments, including ablations and a text case study, show the methods work on the tested models. The central advertised claim, however, is perfect resistance to false claim attacks. For that claim to hold, an adversary who can craft transferable targeted samples must not be able to produce, on an independent model, a fingerprint with BER below the threshold. Proposition 1 is intended to establish this, but its proof assumes exactly that the adversary's samples do not shift the bit distribution away from uniform. That assumption is the attack target; it cannot be assumed. The paper's own limitation section admits the absence of a formal guarantee. The empirical adaptive attack in Section IV-D is narrow: it uses the same optimization objective as the defender and a limited set of augmented independent models, and it does not exercise known techniques for improving targeted transferability. Thus the '100% defense success rate' is not established by the evidence. A secondary concern, also present, is that the evaluation reused models may overlap with the augmented models used in optimizing Eq. (8), weakening the 100% ownership verification rate; but the false-claim security gap is the load-bearing issue because it targets the paper's core novelty. I agree with the reader's weakest-assumption identification. The appropriate verdict remains REJECT (UNCHANGED): the central claim is unsupported, although the targeted fingerprinting direction is worth pursuing with a stronger attack evaluation and a formal transferability model.","tokens_in":19094,"tokens_out":6416,"duration_ms":60933,"concrete_test":"Run a dedicated false-claim attack against FIT-ModelDiff and FIT-LIME using an ensemble of 50 ImageNet-pretrained models (disjoint from the 144 independent evaluation models) as augmented models in Eq. (8), combined with a transferable targeted perturbation method such as momentum iterative FGSM with ensemble gradients to craft \\bar X_T. Then compute the BER of the crafted samples on the held-out 144 independent models. If any independent model yields BER <= tau = 0.316, the claimed 100% defense success is falsified; if all BERs remain above 0.45 with confidence intervals, the concern is mitigated for this attack family.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Proposition 1 (Appendix A) is the only theoretical basis for the advertised perfect false-claim resistance. Its proof bounds the probability that BER(F_bar, F_breve) <= tau by a binomial tail under the assumption that, for the adversary's crafted testing samples \\bar X_T, each bit of \\bar F = sign(M_I(\\bar X_T)) matches the adversary's target with probability 1/2. This is the very assumption a false-claim attack is designed to violate: the adversary chooses \\bar X_T specifically to make independent models produce outputs aligned with the target, and targeted adversarial perturbations are known to transfer across models, even if less easily than untargeted ones (the paper itself cites [37], [38] on lower targeted transferability, not on impossibility). The main-text version of Proposition 1 only covers 'random testing samples'; the appendix silently re-uses it for adversarially chosen samples without a new argument. The paper explicitly concedes in Section V-D that it provides no formal proof of resistance to false claim attacks. The only empirical support, Section IV-D, tests a single attack instantiation—optimizing Eq. (8) with some independent augmented models—and does not exercise stronger transferable targeted attack techniques. The reported 0.0% false-alarm rate on unoptimized independent models is expected by construction and does not address crafted transferable samples. Consequently, the central claim of 100% defense success against false claim attacks is unsupported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FIT-Print, a targeted model fingerprinting paradigm intended to resist false claim attacks, in which a malicious developer registers a fingerprint that transfers to independent models. The authors first demonstrate that existing testing-based fingerprinting methods (ModelDiff, Zest, SAC) are vulnerable to a simple FGSM-based false claim attack in Section II-C. They then define a targeted verification criterion (Definition 4), formulate testing-sample extraction as an optimization problem (Eqs. (6)-(8)), and instantiate the paradigm in two black-box methods, FIT-ModelDiff (bit-wise, based on decision distance vectors) and FIT-LIME (list-wise, based on LIME feature attributions). The central security claim, repeated in the abstract, is that FIT-Print 'perfectly neutralizes false claim attacks (100% defense success rate)' and 'eliminates false alarms on independent models (0.0%)' while maintaining 100% ownership verification under diverse model reuse techniques. This claim rests on Proposition 1 (Section III-D and Appendix A), which bounds the probability of a false alarm/false claim by a binomial tail, and on the adaptive attack experiment in Section IV-D.","tokens_in":19271,"tokens_out":3360,"duration_ms":33636,"significance":"If the claimed guarantee were established, FIT-Print would be a practically valuable contribution: it offers a simple, black-box, non-invasive alternative to watermarking, with promising empirical separation between reused and independent models, and the paper includes a thoughtful analysis of why untargeted fingerprinting is vulnerable to false claims. The authors also provide useful experimental breadth, including five reuse techniques, several architectures, an ablation study, a label-only extension, a text-model case study, and complexity estimates. However, the paper's headline contribution is the false-claim resistance guarantee, and that guarantee is not established: the formal proof assumes away the adversarial transferability that the attack is designed to exploit, and the only adaptive-attack experiment tests a single, weak attack instantiation. The significance of the work is therefore conditional on a substantially stronger security analysis, which the paper itself acknowledges is absent (Section V-D).","major_comments":[{"comment":"The proof of Proposition 1 is circular with respect to the false-claim threat model. It assumes that for the adversary's crafted testing samples \\bar X_T, the extracted bits \\bar F = sign(M_I(\\bar X_T)) match the adversary's target \\breve F independently with probability 1/2, because 'the adversary has no knowledge of the independent model M_I'. But the entire purpose of a false claim attack is to choose \\bar X_T so that independent models produce outputs aligned with the target, and the paper itself cites evidence that targeted adversarial perturbations transfer across models (references [37], [38], which the paper reads as lower transferability, not zero transferability). The binomial bound in Eq. (3) therefore computes the probability of success under a model in which success is defined to be extremely unlikely; it does not prove resistance to an adversary who crafts transferable targeted samples. Section V-D explicitly concedes that the paper provides no formal proof of resistance to false claim attacks. This is the load-bearing step for the abstract's '100% defense success rate' claim.","section":"Appendix A (proof of Proposition 1)"},{"comment":"The empirical adaptive attack evaluation tests only one attack strategy: the adversary optimizes Eq. (8) using some independent augmented models. This is insufficient to support the claim of resistance to adaptive false claim attacks. The adversary in the threat model (Section II-C) is assumed to have adequate computational resources and datasets, and the literature on transferable targeted adversarial examples contains stronger techniques such as ensemble-based optimization, input transformations, and iterative attacks; none of these are evaluated. The experiment in Fig. 9 shows that this particular instantiation does not transfer, but it does not address whether a more powerful adversary can craft samples whose targeted signature transfers to independent models. The reported 0.0% false-alarm rate on unoptimized independent models is expected from the construction and does not measure resistance to crafted transferable fingerprints.","section":"Section IV-D (adaptive false claim attack)"},{"comment":"There is a scope mismatch between the statement and proof of Proposition 1. In the main text, Proposition 1 states that the probability of a false alarm 'with random testing samples' is less than κ, and Eq. (11) is a binomial tail. In Appendix A, the same proposition is restated as bounding the probability of a successful false claim attack 'with the adversaries testing samples', and the proof silently replaces random testing samples with adversarially chosen ones. No argument is provided that the adversarial distribution is dominated by the uniform random distribution, and in fact the adversary is explicitly optimizing samples to make the extracted fingerprint match the target. This conflation means the main-text threshold selection (τ = 0.316 with κ = 10^{-9}) is not justified for the false-claim setting.","section":"Section III-D and Appendix A, Proposition 1 (scope mismatch)"},{"comment":"The abstract's '100% defense success rate against false claim attacks' is not directly measured. Table II reports the ownership verification rate on reused models and the false positive rate on independent models; the Independent row shows 0.0% for FIT-Print, which is a false-alarm rate, not a defense-success rate against an adversary who has optimized a fingerprint. The only direct false-claim experiment is Section IV-D, which, as noted above, tests a single attack. The claims in the abstract therefore outrun the evidence presented in the paper.","section":"Abstract and Table II"}],"minor_comments":[{"comment":"The default threshold τ is stated as 0.316 in Section IV-A, but Section V-B states that the text-generation BERs are all below 'the threshold τ = 0.227'; the threshold value in Section V-B appears to be an error or refers to a different setting that is not explained.","section":"Section IV-A and Section V-B"},{"comment":"The manuscript uses inconsistent spellings 'conferrability', 'conferrability', and 'conferable' (e.g., Section III-A, Section IV-B, Section IV-C.4); these should be unified to a single spelling.","section":"Throughout"},{"comment":"The sentence 'the adversary needs to craft the testing samples \\bar X_T which can transfered to independent models in advance' contains a grammatical error ('transfered' should be 'be transferred'), and the conceptual point that the adversary crafts samples before seeing the independent model should be stated more precisely.","section":"Appendix A"},{"comment":"The text refers to 'Appendix V-A' for a broader discussion of other fingerprinting methods, but the appendix in the paper is numbered A and contains only the proof of Proposition 1; the cross-reference should be corrected.","section":"Section V-A"}],"recommendation":"reject","confidential_remarks":"The paper has a solid empirical core and a clear motivating attack on existing methods, but the central security claim of false-claim resistance is not established. The formal proof in Appendix A assumes exactly the property that a false claim attack seeks to violate, and the empirical adaptive evaluation in Section IV-D is too narrow to compensate. In my view, revising the paper to fix this would require either a fundamentally different security argument or a substantial reduction in the claims; as written, the advertised 100% defense success rate is not supported. I would be open to reconsidering a substantially revised version that either proves a non-trivial bound under a well-motivated adversarial model or carefully restricts the claims to the tested attack class."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Let me give you the short version: this paper has a genuinely new idea—targeted fingerprinting—and the experiments are carefully done, but the paper's advertising claim of perfect false-claim resistance is not supported. The proof of Proposition 1 assumes away exactly what an adaptive adversary would try to exploit, and the conferrability evaluation may be in-sample.\n\nWhat's new: previous testing-based fingerprinting compares outputs of chosen samples across models; FIT-Print instead optimizes perturbations so that model outputs on those samples match a fixed target signature. That's a meaningful shift and it does shrink the space of usable transferable fingerprints. The two instantiations, FIT-ModelDiff and FIT-LIME, are reasonable representatives of bit-wise and list-wise approaches, and the demonstration that simple FGSM-style inverse examples break ModelDiff, Zest, and SAC is a useful negative result in itself.\n\nWhat's done well: the empirical study is broad—five reuse categories, multiple models and datasets, ablation on fingerprint length, target choice, lambda, number of augmented models, plus a text-generation case study. Ownership verification rates on the five reuse categories are strong. The authors also explicitly list limitations, including the absence of a formal false-claim-resistance proof, which is honest.\n\nThe soft spots are load-bearing, not cosmetic. Proposition 1 bounds the false-alarm probability for random testing samples, but the appendix re-uses it for adversarially crafted samples by assuming each bit of the extracted fingerprint on an independent model is fair-coin equally likely. That is precisely the assumption a false-claim attack tries to violate; targeted adversarial perturbations transfer across models, less easily than untargeted ones but not impossibly. The paper concedes no formal proof exists. The empirical adaptive attack in Section IV-D tests one attack instantiation—optimizing Eq. (8) with independent augmented models—and doesn't exercise stronger transferable targeted attacks. And I worry the conferrability numbers are in-sample: the augmented models used during optimization are drawn from the same pool as the reused models in evaluation, and the paper never states they are disjoint. If they overlap, the 100% verification rate is partly a self-fulfilling result.\n\nBottom line: this is a promising direction and a serious research artifact, but the advertised security guarantee is not established. I'd send it to a good venue's review cycle; the authors need to either prove the resistance claim under a more reasonable adversary model, or rewrite the claims to match what the evidence supports.","headline":"Targeted fingerprinting is a real idea, but the paper's headline security claim rests on a circular probability argument and a possibly in-sample conferrability test.","tokens_in":19941,"tokens_out":2491,"would_cite":true,"duration_ms":22309,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that model fingerprinting can be made resistant to false ownership claims by replacing untargeted similarity comparisons with a registered targeted signature, and backs this with two black-box methods that verify all…","keywords":["model fingerprinting","ownership verification","false claim attack","targeted fingerprint","black-box model verification","model reuse detection","feature attribution","bit error rate"],"falsifier":"Run a false claim attack against FIT-Print using stronger transferable targeted perturbations, for example samples optimized to transfer across a pool of several models simultaneously, and test them on independent models never seen during optimization; if any such model yields a BER below the registered threshold $\\tau$, the claimed 100% defense success rate is falsified.","tokens_in":18737,"feed_emoji":"🔐","tokens_out":5279,"duration_ms":48251,"temperature":0.7,"pith_summary":"Model fingerprinting lets an owner detect when an open-source model has been reused, but this paper argues that existing fingerprint methods have a flaw: they compare outputs of arbitrary samples between models, so an adversary can craft 'easy' samples that behave alike on any model and register them to claim unrelated models. FIT-Print is the proposed fix: instead of comparing models directly, the owner optimizes test inputs so that the model's behavior lands near a fixed, registered reference signature, and verification asks whether a suspicious model also lands there. The paper reports that with this targeted design, two black-box instantiations (FIT-ModelDiff and FIT-LIME) verify every reused model across copying, fine-tuning, pruning, extraction, and transfer learning, while flagging none of 144 independent models and resisting adaptive false claims. If the results hold, ownership disputes over open-source models could be resolved without modifying the protected model and without innocent models being falsely accused.","feed_headline":"FIT-Print stops false ownership claims on reused AI models","feed_subtitle":"Model owners can verify 100% of reused models while innocent models stay unclaimed.","key_machinery":"The mechanism is the targeted fingerprint: a fixed binary vector $F \\in \\{-1,1\\}^k$ that stands in for the model. A hinge-like loss drives the mapping output on perturbed test samples toward matching the sign pattern of $F$, while $\\ell_2$ regularization and augmented reused models in the optimization give the signature conferrability. Verification uses bit error rate against $F$, with a threshold set by a binomial tail bound (Proposition 1) so random matches are bounded by a security parameter $\\kappa$. Two mapping functions instantiate the paradigm: FIT-ModelDiff, which uses cosine similarity between logits of perturbed and benign inputs minus a bias (the decision distance vector), and FIT-LIME, which uses entropy-weighted feature attributions from masked superpixel samples as a list-wise signature.","core_discovery":"Existing testing-based fingerprinting is vulnerable to false claim attacks because it is untargeted: the distance function compares outputs of chosen inputs on source and suspicious models, so an adversary can construct transferable 'inverse adversarial' samples whose outputs are similar on independent models and register those as a fingerprint. FIT-Print replaces that comparison with a targeted one: a binary target fingerprint $F$ is fixed and registered, and test samples are optimized so that the fingerprint vector extracted from the protected model (and from augmented reused models) is close to $F$; a suspicious model is declared a copy when the bit error rate between its extracted vector and $F$ falls below a threshold. The paper's claim is that this shrinks the fingerprint space so much that transferable false fingerprints become impractical, and it reports 100% ownership verification across five reuse techniques, 0.0% false alarms on 144 independent models, and BERs below threshold for all tested reuse settings.","pith_inferences":["The security argument is statistical: Proposition 1 assumes the fingerprint of an independent model is a uniformly random binary vector, so the paper's 100% defense rate is empirical rather than certified; a transferable targeted attack would break the claim even though the binomial bound stays true.","Because conferred fingerprints survive fine-tuning, pruning, and extraction, the targeted-signature idea could be reused as a general model-inheritance audit: register a signature, then test any downstream model against it before deployment, without needing a court to arbitrate.","The same optimization over discrete inputs suggests a direct extension to generative and text models; the paper's own case study on GPT-2 and BERT already shows low BERs, so the paradigm is not restricted to image classifiers.","A stress test that would go beyond the paper: mount false claim attacks with ensemble-based targeted transferable adversarial perturbations across many architectures; if any independent model yields BER below the threshold, the practical resistance claim would need revision."],"forward_implications":["Existing black-box fingerprinting methods (ModelDiff, Zest, SAC) can be defeated by the paper's simple FGSM-based inverse adversarial samples, which make independent models look as close to the source as reused models.","FIT-ModelDiff and FIT-LIME verify 100% of reused models produced by copying, fine-tuning, pruning, model extraction, and transfer learning, with all measured BERs below the chosen threshold.","Independent models are never flagged: 0 of 144 independent models are claimed as reused by either FIT method, in contrast to baselines with false-positive rates up to 39.6%.","Adaptive false claim attacks that optimize test samples against independent augmented models still cannot push independent-model BERs below the threshold, so the targeted signature is not transferable in the tested settings.","Overwriting and unlearning attacks, where a reuser fine-tunes to embed a different target or erase the registered one, do not remove the fingerprint; the largest post-attack BER (0.149) stays below the 0.316 threshold."],"supporting_citations":[{"why":"ModelDiff: the bit-wise testing-based baseline whose untargeted comparison is shown vulnerable in Section II-C and whose formulation FIT-ModelDiff turns into a targeted one.","marker":"[15]"},{"why":"Zest: the list-wise LIME-based baseline that the paper's false claim attack defeats and that FIT-LIME adapts into a targeted signature.","marker":"[16]"},{"why":"Introduces false claim attacks against model ownership, the attack the paper aims to resist and whose definition FIT-Print builds on.","marker":"[18]"},{"why":"SAC: the third testing-based baseline in Table I, showing the false claim vulnerability extends across testing-based methods.","marker":"[23]"},{"why":"FGSM: supplies the inverse-gradient update used to craft transferable 'easy' samples for the false claim attack.","marker":"[25]"},{"why":"LIME: provides the feature-attribution mapping function that FIT-LIME modifies to use entropy-weighted superpixel explanations.","marker":"[27]"},{"why":"Confers the augmented-model technique that FIT-Print uses during testing-sample extraction to make fingerprints conferrable to reused models.","marker":"[19]"},{"why":"Cited for the empirical phenomenon that targeted adversarial examples transfer less than untargeted ones, supporting the core design insight.","marker":"[38]"}],"fun_headline_variants":["Targeted fingerprinting neutralizes false AI ownership claims","FIT-Print: targeted fingerprint blocks false ownership attacks","False-claim-resistant ownership via targeted fingerprint","Model ownership verified without false claims using FIT-Print"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that an adversary cannot craft transferable samples that make an independent model's fingerprint match the registered target significantly better than random; the proof only assumes each fingerprint bit is an independent fair coin flip, and the paper states it has no formal proof of resistance.","fun_headline_variants_meta":{"raw":{"variants":["Targeted fingerprinting neutralizes false AI ownership claims","FIT-Print: targeted fingerprint blocks false ownership attacks","False-claim-resistant ownership via targeted fingerprint","Model ownership verified without false claims using FIT-Print"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000853,"raw_usage":{"total_tokens":3707,"prompt_tokens":945,"completion_tokens":2762,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":561,"completion_tokens_details":{"reasoning_tokens":2700}},"tokens_in":561,"tokens_out":2762,"duration_ms":20121,"temperature":1.0,"reasoning_tokens":2700,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T14:13:27.460813+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a false claim attack against FIT-Print using stronger transferable targeted perturbations, for example samples optimized to transfer across a pool of several models simultaneously, and test them on independent models never seen during optimization; if any such model yields a BER below the registered threshold $\\tau$, the claimed 100% defense success rate is falsified.","supporting_citations":[{"cited_title":"ModelDiff: Testing- based DNN similarity comparison for model reuse detection,","cited_arxiv_id":null,"evidence_quote":"ModelDiff: the bit-wise testing-based baseline whose untargeted comparison is shown vulnerable in Section II-C and whose formulation FIT-ModelDiff turns into a targeted one."},{"cited_title":"A Zest of LIME: Towards Architecture-Independent Model Distances,","cited_arxiv_id":null,"evidence_quote":"Zest: the list-wise LIME-based baseline that the paper's false claim attack defeats and that FIT-LIME adapts into a targeted signature."},{"cited_title":"False claims against model ownership resolution,","cited_arxiv_id":null,"evidence_quote":"Introduces false claim attacks against model ownership, the attack the paper aims to resist and whose definition FIT-Print builds on."},{"cited_title":"Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networks,","cited_arxiv_id":null,"evidence_quote":"SAC: the third testing-based baseline in Table I, showing the false claim vulnerability extends across testing-based methods."},{"cited_title":"Explaining and harnessing adversarial examples,","cited_arxiv_id":null,"evidence_quote":"FGSM: supplies the inverse-gradient update used to craft transferable 'easy' samples for the false claim attack."},{"cited_title":"Why should i trust you? explaining the predictions of any classifier,","cited_arxiv_id":null,"evidence_quote":"LIME: provides the feature-attribution mapping function that FIT-LIME modifies to use entropy-weighted superpixel explanations."},{"cited_title":"Deep Neural Network Fingerprinting by Conferrable Adversarial Examples,","cited_arxiv_id":null,"evidence_quote":"Confers the augmented-model technique that FIT-Print uses during testing-sample extraction to make fingerprints conferrable to reused models."},{"cited_title":"Towards transferable targeted adversarial examples,","cited_arxiv_id":null,"evidence_quote":"Cited for the empirical phenomenon that targeted adversarial examples transfer less than untargeted ones, supporting the core design insight."}],"review_version":1}