Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprint

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that model fingerprinting can be made resistant to false ownership claims by replacing untargeted similarity comparisons with a registered targeted signature, and backs this with two black-box methods that verify all…

desk verdict Targeted fingerprinting is a real idea, but the paper's headline security claim rests on a circular probability argument and a possibly in-sample conferrability test. read the letter →

arxiv 2501.15509 v5 pith:3YHEZQO7 submitted 2025-01-26 cs.CR cs.AIcs.LG

Shuo Shao , Haozhe Zhu , Yiming Li , Hongwei Yao , Tianwei Zhang , Zhan Qin This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords modelfingerprintingownershipverificationfalseclaimattacktargetedfingerprintblack-boxreusedetectionfeatureattributionbiterrorrate
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Model fingerprinting lets an owner detect when an open-source model has been reused, but this paper argues that existing fingerprint methods have a flaw: they compare outputs of arbitrary samples between models, so an adversary can craft 'easy' samples that behave alike on any model and register them to claim unrelated models. FIT-Print is the proposed fix: instead of comparing models directly, the owner optimizes test inputs so that the model's behavior lands near a fixed, registered reference signature, and verification asks whether a suspicious model also lands there. The paper reports that with this targeted design, two black-box instantiations (FIT-ModelDiff and FIT-LIME) verify every reused model across copying, fine-tuning, pruning, extraction, and transfer learning, while flagging none of 144 independent models and resisting adaptive false claims. If the results hold, ownership disputes over open-source models could be resolved without modifying the protected model and without innocent models being falsely accused.

What carries the argument

The mechanism is the targeted fingerprint: a fixed binary vector $F \in \{-1,1\}^k$ that stands in for the model. A hinge-like loss drives the mapping output on perturbed test samples toward matching the sign pattern of $F$, while $\ell_2$ regularization and augmented reused models in the optimization give the signature conferrability. Verification uses bit error rate against $F$, with a threshold set by a binomial tail bound (Proposition 1) so random matches are bounded by a security parameter $\kappa$. Two mapping functions instantiate the paradigm: FIT-ModelDiff, which uses cosine similarity between logits of perturbed and benign inputs minus a bias (the decision distance vector), and FIT-LIME, which uses entropy-weighted feature attributions from masked superpixel samples as a list-wise signature.

What would settle it

Run a false claim attack against FIT-Print using stronger transferable targeted perturbations, for example samples optimized to transfer across a pool of several models simultaneously, and test them on independent models never seen during optimization; if any such model yields a BER below the registered threshold $\tau$, the claimed 100% defense success rate is falsified.

Watch

Extended reading notes

Core claim

Existing testing-based fingerprinting is vulnerable to false claim attacks because it is untargeted: the distance function compares outputs of chosen inputs on source and suspicious models, so an adversary can construct transferable 'inverse adversarial' samples whose outputs are similar on independent models and register those as a fingerprint. FIT-Print replaces that comparison with a targeted one: a binary target fingerprint $F$ is fixed and registered, and test samples are optimized so that the fingerprint vector extracted from the protected model (and from augmented reused models) is close to $F$; a suspicious model is declared a copy when the bit error rate between its extracted vector and $F$ falls below a threshold. The paper's claim is that this shrinks the fingerprint space so much that transferable false fingerprints become impractical, and it reports 100% ownership verification across five reuse techniques, 0.0% false alarms on 144 independent models, and BERs below threshold for all tested reuse settings.

Load-bearing premise

The load-bearing premise is that an adversary cannot craft transferable samples that make an independent model's fingerprint match the registered target significantly better than random; the proof only assumes each fingerprint bit is an independent fair coin flip, and the paper states it has no formal proof of resistance.

Editorial extensions

If this is right

  • Existing black-box fingerprinting methods (ModelDiff, Zest, SAC) can be defeated by the paper's simple FGSM-based inverse adversarial samples, which make independent models look as close to the source as reused models.
  • FIT-ModelDiff and FIT-LIME verify 100% of reused models produced by copying, fine-tuning, pruning, model extraction, and transfer learning, with all measured BERs below the chosen threshold.
  • Independent models are never flagged: 0 of 144 independent models are claimed as reused by either FIT method, in contrast to baselines with false-positive rates up to 39.6%.
  • Adaptive false claim attacks that optimize test samples against independent augmented models still cannot push independent-model BERs below the threshold, so the targeted signature is not transferable in the tested settings.
  • Overwriting and unlearning attacks, where a reuser fine-tunes to embed a different target or erase the registered one, do not remove the fingerprint; the largest post-attack BER (0.149) stays below the 0.316 threshold.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The security argument is statistical: Proposition 1 assumes the fingerprint of an independent model is a uniformly random binary vector, so the paper's 100% defense rate is empirical rather than certified; a transferable targeted attack would break the claim even though the binomial bound stays true.
  • Because conferred fingerprints survive fine-tuning, pruning, and extraction, the targeted-signature idea could be reused as a general model-inheritance audit: register a signature, then test any downstream model against it before deployment, without needing a court to arbitrate.
  • The same optimization over discrete inputs suggests a direct extension to generative and text models; the paper's own case study on GPT-2 and BERT already shows low BERs, so the paradigm is not restricted to image classifiers.
  • A stress test that would go beyond the paper: mount false claim attacks with ensemble-based targeted transferable adversarial perturbations across many architectures; if any independent model yields BER below the threshold, the practical resistance claim would need revision.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes FIT-Print, a targeted model fingerprinting paradigm intended to resist false claim attacks, in which a malicious developer registers a fingerprint that transfers to independent models. The authors first demonstrate that existing testing-based fingerprinting methods (ModelDiff, Zest, SAC) are vulnerable to a simple FGSM-based false claim attack in Section II-C. They then define a targeted verification criterion (Definition 4), formulate testing-sample extraction as an optimization problem (Eqs. (6)-(8)), and instantiate the paradigm in two black-box methods, FIT-ModelDiff (bit-wise, based on decision distance vectors) and FIT-LIME (list-wise, based on LIME feature attributions). The central security claim, repeated in the abstract, is that FIT-Print 'perfectly neutralizes false claim attacks (100% defense success rate)' and 'eliminates false alarms on independent models (0.0%)' while maintaining 100% ownership verification under diverse model reuse techniques. This claim rests on Proposition 1 (Section III-D and Appendix A), which bounds the probability of a false alarm/false claim by a binomial tail, and on the adaptive attack experiment in Section IV-D.

Significance. If the claimed guarantee were established, FIT-Print would be a practically valuable contribution: it offers a simple, black-box, non-invasive alternative to watermarking, with promising empirical separation between reused and independent models, and the paper includes a thoughtful analysis of why untargeted fingerprinting is vulnerable to false claims. The authors also provide useful experimental breadth, including five reuse techniques, several architectures, an ablation study, a label-only extension, a text-model case study, and complexity estimates. However, the paper's headline contribution is the false-claim resistance guarantee, and that guarantee is not established: the formal proof assumes away the adversarial transferability that the attack is designed to exploit, and the only adaptive-attack experiment tests a single, weak attack instantiation. The significance of the work is therefore conditional on a substantially stronger security analysis, which the paper itself acknowledges is absent (Section V-D).

major comments (4)
  1. [Appendix A (proof of Proposition 1)] The proof of Proposition 1 is circular with respect to the false-claim threat model. It assumes that for the adversary's crafted testing samples \bar X_T, the extracted bits \bar F = sign(M_I(\bar X_T)) match the adversary's target \breve F independently with probability 1/2, because 'the adversary has no knowledge of the independent model M_I'. But the entire purpose of a false claim attack is to choose \bar X_T so that independent models produce outputs aligned with the target, and the paper itself cites evidence that targeted adversarial perturbations transfer across models (references [37], [38], which the paper reads as lower transferability, not zero transferability). The binomial bound in Eq. (3) therefore computes the probability of success under a model in which success is defined to be extremely unlikely; it does not prove resistance to an adversary who crafts transferable targeted samples. Section V-D explicitly concedes that the paper provides no formal proof of resistance to false claim attacks. This is the load-bearing step for the abstract's '100% defense success rate' claim.
  2. [Section IV-D (adaptive false claim attack)] The empirical adaptive attack evaluation tests only one attack strategy: the adversary optimizes Eq. (8) using some independent augmented models. This is insufficient to support the claim of resistance to adaptive false claim attacks. The adversary in the threat model (Section II-C) is assumed to have adequate computational resources and datasets, and the literature on transferable targeted adversarial examples contains stronger techniques such as ensemble-based optimization, input transformations, and iterative attacks; none of these are evaluated. The experiment in Fig. 9 shows that this particular instantiation does not transfer, but it does not address whether a more powerful adversary can craft samples whose targeted signature transfers to independent models. The reported 0.0% false-alarm rate on unoptimized independent models is expected from the construction and does not measure resistance to crafted transferable fingerprints.
  3. [Section III-D and Appendix A, Proposition 1 (scope mismatch)] There is a scope mismatch between the statement and proof of Proposition 1. In the main text, Proposition 1 states that the probability of a false alarm 'with random testing samples' is less than κ, and Eq. (11) is a binomial tail. In Appendix A, the same proposition is restated as bounding the probability of a successful false claim attack 'with the adversaries testing samples', and the proof silently replaces random testing samples with adversarially chosen ones. No argument is provided that the adversarial distribution is dominated by the uniform random distribution, and in fact the adversary is explicitly optimizing samples to make the extracted fingerprint match the target. This conflation means the main-text threshold selection (τ = 0.316 with κ = 10^{-9}) is not justified for the false-claim setting.
  4. [Abstract and Table II] The abstract's '100% defense success rate against false claim attacks' is not directly measured. Table II reports the ownership verification rate on reused models and the false positive rate on independent models; the Independent row shows 0.0% for FIT-Print, which is a false-alarm rate, not a defense-success rate against an adversary who has optimized a fingerprint. The only direct false-claim experiment is Section IV-D, which, as noted above, tests a single attack. The claims in the abstract therefore outrun the evidence presented in the paper.
minor comments (4)
  1. [Section IV-A and Section V-B] The default threshold τ is stated as 0.316 in Section IV-A, but Section V-B states that the text-generation BERs are all below 'the threshold τ = 0.227'; the threshold value in Section V-B appears to be an error or refers to a different setting that is not explained.
  2. [Throughout] The manuscript uses inconsistent spellings 'conferrability', 'conferrability', and 'conferable' (e.g., Section III-A, Section IV-B, Section IV-C.4); these should be unified to a single spelling.
  3. [Appendix A] The sentence 'the adversary needs to craft the testing samples \bar X_T which can transfered to independent models in advance' contains a grammatical error ('transfered' should be 'be transferred'), and the conceptual point that the adversary crafts samples before seeing the independent model should be stated more precisely.
  4. [Section V-A] The text refers to 'Appendix V-A' for a broader discussion of other fingerprinting methods, but the appendix in the paper is numbered A and contains only the proof of Proposition 1; the cross-reference should be corrected.

Circularity Check

2 steps flagged · score 6.0 of 10

Proposition 1 assumes the no-transferability property that false-claim attacks are designed to break, and the conferrability evaluation tests the same augmented/reused models used in the Eq. (8) objective; the core 100% claims are partly by assumption/construction.

  1. other [Appendix A, proof of Proposition 1 (Eqs. (2)-(3)); main text Section III-D Eq. (11)]
    "We assume that ¯F ∈ {−1, 1}k is a k-bit binary vector and the adversary has no knowledge of the independent model MI, the probability of any bit in ¯F to match the corresponding bit in ˘F is 1/2. Thus, to satisfy Eq. (5) in Definition 4, i.e., making the BER between ¯F and ˘F less than τ, there needs to have at least k − ⌊τ · k⌋ bits in ¯F match ˘F ."

    The proposition is advertised as bounding the success of a false claim attack, where the adversary crafts samples so independent models extract a fingerprint close to the attacker's target. The proof's only substantive step asserts that, for the adversary's crafted samples on an independent model, each extracted bit matches the target with probability 1/2. That is exactly the absence of targeted transferability the attack tries to violate; no argument connects the adversary's optimization (Eq. 8) to this uniform-random model.

  2. fitted input called prediction [Section III-C Eq. (8); Section IV-A (reused model construction); Section IV-C (augmented-model discussion)]
    "inspired by the insight of [19], we craft some augmented models by applying model reuse techniques (e.g., fine-tuning, pruning, or transfer learning) and exploit them to extract the fingerprint to improve the conferrability of FIT-Print. ... In the testing sample extraction stage, FIT-Print utilizes the reused models as augmented models. ... These 12 models constitute the set of reused models."

    Eq. (8) minimizes the fingerprint loss over the augmented/reused models, so those models are forced to low BER against the target. The evaluation then reports 100% ownership verification and Table II states 'the BERs of FIT-Print are all 0.0%' on the reused models, which are the same reuse-technique-derived models used as augmentation during optimization. No held-out split between augmented and evaluated reused models is reported, so the headline conferrability rate is a fit to the training objective rather than a prediction on unseen reused models. The 0.0% false-alarm rate on independent models is a genuine external check, but it does not rescue the in-sample conferrability claim.

full rationale

Two load-bearing reductions are present. First, the only theoretical basis for the advertised perfect false-claim resistance, Proposition 1, proves a binomial bound by assuming that the adversary's crafted samples extract uniformly random bits from an independent model; that is the no-targeted-transferability claim the attack is meant to defeat, and Section V-D explicitly states no formal proof is provided. Second, the conferrability/effectiveness evaluation is in-sample: the augmented models used in the Eq. (8) optimization loss are the same models reported as successfully verified reused models, so the 100% rate is partly by construction. I do not count the paper's citations of [37] and [38] for lower targeted adversarial transferability as circular, since they are external empirical results, and the self-citation of [36] for a hyperparameter is not load-bearing. The independent-model false-alarm measurement at 0.0% and the adaptive-attack experiment are real external observations, which prevents the whole paper from being fully circular. Overall, partial circularity in two central claims warrants a score of 6.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The central claim rests on several domain assumptions: a trusted timestamping verifier, black-box access, and the empirical non-transferability of targeted fingerprints. The security proof in Proposition 1 is circular because it assumes the adversary-crafted fingerprint on an independent model is random. The method also depends on hand-chosen hyperparameters (kappa, alpha, epsilon, lambda, k, number of augmented models) and on the unspecified overlap between augmented and evaluation models.

free parameters (7)
  • Security parameter kappa = 1e-9
    Hand-chosen; sets threshold tau = 0.316 through Eq. (11). The choice is arbitrary and directly controls the verification threshold and the claimed false-alarm probability.
  • Bias parameter alpha (FIT-ModelDiff) = 7*pi/8
    Hand-chosen in Eq. (13) to shift the cosine similarity DDV into positive and negative ranges. Affects fingerprint bit extraction.
  • Hinge-loss control parameter epsilon = 0.01
    Taken from prior work [36]; used in Eq. (7). Controls how strongly signs of v must match F.
  • Regularization coefficient lambda = not stated for main experiments
    In Eq. (6) and Eq. (8), lambda balances fingerprint alignment vs perturbation size. Ablation Table III varies it, but the default value used in main experiments is not clearly specified.
  • Fingerprint length k = 256
    Hand-chosen; sets the number of bits and the threshold via binomial tail. Ablation tests other lengths.
  • Number of augmented models = 10 (default)
    Used in Eq. (8) to improve conferrability. Composition and overlap with evaluation reused models is not specified.
  • FIT-LIME LIME parameters (number of masks c, superpixel grid) = not specified
    Section III-E.2 describes generating c masks and dividing the image into k superpixels, but c and the grid layout are not given, preventing exact reproduction.
assumptions (5)
  • domain assumption A trustworthy third-party verifier exists and timestamps registered fingerprints.
    Section II-A assumes registration with a trusted verifier; Section V-D admits this institution is not currently established. Without it, the timestamp-based defense against later false claims does not exist.
  • ad hoc to paper An independent model's fingerprint on adversary-crafted samples is a uniformly random bit string independent of the target F.
    Used in Proposition 1 (Appendix A) to bound false-claim probability. This is exactly the property that an adversary would try to break, so the proof assumes the conclusion.
  • domain assumption Targeted adversarial examples transfer less than untargeted ones.
    Section III-B and IV-D rely on this empirical property from prior adversarial-example literature to argue targeted fingerprints are hard to transfer.
  • domain assumption Augmented models (reuse-transformed versions of the source) have fingerprints similar to the source model.
    Eq. (8) optimizes testing samples to match F on augmented models; conferrability on actual reused models is assumed to transfer.
  • domain assumption The verifier has black-box access to the suspicious model and can obtain output logits (or top-1 labels).
    Threat model in Section II-A; label-only scenario in Section IV-F limits detectable reuse types.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprint." pith.science (2026). https://pith.science/paper/3YHEZQO7

@misc{pith2026250115509,
  author       = {Pith},
  title        = {Pith review of: FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprint},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3YHEZQO7}},
  note         = {Machine review of arXiv:2501.15509}
}
read the original abstract

Model fingerprinting has emerged as a crucial mechanism for safeguarding the intellectual property of open-source models, offering a non-intrusive approach that requires no modifications to the protected model. However, our analysis reveals that existing fingerprinting techniques are fundamentally vulnerable to false claim attacks, wherein adversaries can fraudulently assert ownership over independent third-party models. We demonstrate that this vulnerability stems from the untargeted nature of current methods, which evaluate model similarity based on arbitrary sample outputs rather than alignment with a specific, predefined reference. To mitigate this vulnerability, we introduce FIT-Print, a targeted fingerprinting paradigm that actively counters false claim attacks. Specifically, FIT-Print leverages optimization to transform the fingerprint into a verifiable, targeted signature. Building upon this foundation, we propose two black-box fingerprinting methods, the bit-wise FIT-ModelDiff and the list-wise FIT-LIME, which utilize output distances and feature attributions as robust model signatures, respectively. Extensive evaluations across benchmark models and datasets show that our framework perfectly neutralizes false claim attacks (100% defense success rate) and eliminates false alarms on independent models (0.0%), all while maintaining a 100% ownership verification rate against diverse model reuse techniques.

Figures

Figures reproduced from arXiv: 2501.15509 by the authors.

Figure 1
Figure 1. The comparison of untargeted and targeted fingerprinting paradigms. Untargeted methods generally compare the output [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The threat models and detailed processes of model fingerprinting and false claim attacks. In model fingerprinting, the [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The pipeline of FIT-Print. In testing sample extraction, FIT-Print optimizes the perturbations to turn the fingerprint [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: The BERs of different source models and their reused models with FIT-ModelDiff and FIT-LIME. The BERs are all less [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: The BERs of the reused models and independent models with different lengths of fingerprint. As the length increases, [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: The BERs of the reused models and independent models with different target fingerprints. Regardless of the target [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: The visualization of the targeted fingerprints. We utilize [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: The BERs of the reused models with different numbers of augmented models. As shown in this figure, as we expected, [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 9
Figure 9. Figure 9: The BERs of the independent models while conducting adaptive false claim attacks using different numbers of independent [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Rethinking Data Protection in the (Generative) Artificial Intelligence Era

    cs.LG 2025-07 conditional novelty 5.0 of 10

    The paper organizes data protection in generative AI into a four-level hierarchy covering non-usability, privacy preservation, traceability, and deletability, and maps techniques and regulations onto it.

Reference graph

Works this paper leans on

58 extracted references · 52 canonical work pages · cited by 1 Pith paper

  1. [37]

    LFAA: Crafting Transferable Targeted Adversarial Examples with Low-Frequency Perturbations

    K. Wang, J. Shi, and W. Wang, “Lfaa: Crafting transferable targeted adversarial examples with low-frequency perturbations,” arXiv preprint arXiv:2310.20175, 2023

    work page Pith review arXiv 2023

  2. [38]

    Towards transferable targeted adversarial examples,

    Z. Wang, H. Yang, Y . Feng, P. Sun, H. Guo, Z. Zhang, and K. Ren, “Towards transferable targeted adversarial examples,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 20 534–20 543

    work page 2023

  3. [1]

    Diagnosis: Detecting unauthorized data usages in text-to-image diffusion models,

    Z. Wang, C. Chen, L. Lyu, D. N. Metaxas, and S. Ma, “Diagnosis: Detecting unauthorized data usages in text-to-image diffusion models,” in International Conference on Learning Representations , 2024

    work page 2024

  4. [2]

    Deepreg: A trustworthy and privacy-friendly ownership regulatory framework for deep learning models,

    X. Zhuang, L. Zhang, C. Tang, and Y . Li, “Deepreg: A trustworthy and privacy-friendly ownership regulatory framework for deep learning models,” IEEE Transactions on Information Forensics and Security, 2024

    work page 2024

  5. [3]

    Smartguard: Leveraging large language models for network attack detection through audit log analysis and summarization,

    H. Zhang, S. Shao, S. Li, Z. Zhong, Y . Liu, Z. Qin, and K. Ren, “Smartguard: Leveraging large language models for network attack detection through audit log analysis and summarization,” arXiv preprint arXiv:2506.16981, 2025

    work page arXiv 2025

  6. [4]

    Fine-pruning: Defending against backdooring attacks on deep neural networks,

    K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in International Symposium on Research in Attacks, Intrusions, and Defenses , 2018

    work page 2018

  7. [5]

    A comprehensive survey on transfer learning,

    F. Zhuang, Z. Qi, K. Duan, D. Xi, Y . Zhu, H. Zhu, H. Xiong, and Q. He, “A comprehensive survey on transfer learning,” Proceedings of the IEEE , vol. 109, no. 1, pp. 43–76, 2020

    work page 2020

  8. [6]

    Protecting deep learning model copyrights with adversarial example-free reuse detection,

    X. Luan, X. Zhang, J. Wang, and M. Sun, “Protecting deep learning model copyrights with adversarial example-free reuse detection,” IEEE Transactions on Neural Networks and Learning Systems , 2025

    work page 2025

Show all 58 references
  1. [7]

    Pointncbw: Towards dataset ownership verification for point clouds via negative clean-label backdoor watermark,

    C. Wei, Y . Wang, K. Gao, S. Shao, Y . Li, Z. Wang, and Z. Qin, “Pointncbw: Towards dataset ownership verification for point clouds via negative clean-label backdoor watermark,” IEEE Transactions on Information Forensics and Security , 2024

    2024

  2. [8]

    Queries, representation & detection: The next 100 model fingerprinting schemes,

    A. Godinot, E. Le Merrer, C. Penzo, F. Taïani, and G. Trédan, “Queries, representation & detection: The next 100 model fingerprinting schemes,” in AAAI Conference on Artificial Intelligence , vol. 39, no. 16, 2025, pp. 16 817–16 825

    2025

  3. [9]

    Passport- aware normalization for deep model protection,

    J. Zhang, D. Chen, J. Liao, W. Zhang, G. Hua, and N. Yu, “Passport- aware normalization for deep model protection,” in Annual Conference on Neural Information Processing Systems , 2020

    2020

  4. [10]

    Deep intellectual property: A survey,

    Y . Sun, T. Liu, P. Hu, Q. Liao, S. Ji, N. Yu, D. Guo, and L. Liu, “Deep intellectual property: A survey,” arXiv preprint arXiv:2304.14613 , 2023

    2023 arXiv

  5. [11]

    Move: Effective and harmless ownership verification via embedded external features,

    Y . Li, L. Zhu, X. Jia, Y . Bai, Y . Jiang, S.-T. Xia, X. Cao, and K. Ren, “Move: Effective and harmless ownership verification via embedded external features,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025. PREPRINT 13

    2025

  6. [12]

    Turning your weakness into a strength: Watermarking deep neural networks by backdooring,

    Y . Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” in USENIX Security Symposium , 2018

    2018

  7. [13]

    Fedtracker: Furnishing ownership verification and traceability for fed- erated learning model,

    S. Shao, W. Yang, H. Gu, Z. Qin, L. Fan, Q. Yang, and K. Ren, “Fedtracker: Furnishing ownership verification and traceability for fed- erated learning model,” IEEE Transactions on Dependable and Secure Computing, vol. 22, no. 1, pp. 114–131, 2024

    2024

  8. [14]

    Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary,

    X. Cao, J. Jia, and N. Z. Gong, “Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary,” in ACM ASIA Conference on Computer and Communications Security , 2021

    2021

  9. [15]

    ModelDiff: Testing- based DNN similarity comparison for model reuse detection,

    Y . Li, Z. Zhang, B. Liu, Z. Yang, and Y . Liu, “ModelDiff: Testing- based DNN similarity comparison for model reuse detection,” in ACM SIGSOFT International Symposium on Software Testing and Analysis , 2021

    2021

  10. [16]

    A Zest of LIME: Towards Architecture-Independent Model Distances,

    H. Jia, H. Chen, J. Guan, A. S. Shamsabadi, and N. Papernot, “A Zest of LIME: Towards Architecture-Independent Model Distances,” in International Conference on Learning Representations , 2022

    2022

  11. [17]

    Metafinger: Fingerprinting the deep neural networks with meta-training,

    K. Yang, R. Wang, and L. Wang, “Metafinger: Fingerprinting the deep neural networks with meta-training,” in International Joint Conference on Artificial Intelligence , 2022

    2022

  12. [18]

    False claims against model ownership resolution,

    J. Liu, R. Zhang, S. Szyller, K. Ren, and N. Asokan, “False claims against model ownership resolution,” in USENIX Security Symposium , 2024

    2024

  13. [19]

    Deep Neural Network Fingerprinting by Conferrable Adversarial Examples,

    N. Lukas, Y . Zhang, and F. Kerschbaum, “Deep Neural Network Fingerprinting by Conferrable Adversarial Examples,” in International Conference on Learning Representations , 2021

    2021

  14. [20]

    Probabilistically robust watermarking of neural networks,

    M. Pautov, N. Bogdanov, S. Pyatkin, O. Rogov, and I. Oseledets, “Probabilistically robust watermarking of neural networks,” arXiv preprint arXiv:2401.08261, 2024

    2024 arXiv

  15. [21]

    Adversarial attacks and defenses in deep learning,

    K. Ren, T. Zheng, Z. Qin, and X. Liu, “Adversarial attacks and defenses in deep learning,” Engineering, vol. 6, no. 3, pp. 346–360, 2020

    2020

  16. [22]

    Feature importance-aware transferable adversarial attacks,

    Z. Wang, H. Guo, Z. Zhang, W. Liu, Z. Qin, and K. Ren, “Feature importance-aware transferable adversarial attacks,” in IEEE/CVF Inter- national Conference on Computer Vision , 2021

    2021

  17. [23]

    Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networks,

    J. Guan, J. Liang, and R. He, “Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networks,” in Annual Conference on Neural Information Processing Systems , 2022

    2022

  18. [24]

    Databench: Evaluating dataset auditing in deep learning from an adversarial perspective,

    S. Shao, Y . Li, M. Zheng, Z. Hu, Y . Chen, B. Li, Y . He, J. Guo, T. Zhang, D. Tao, and Z. Qin, “Databench: Evaluating dataset auditing in deep learning from an adversarial perspective,” arXiv preprint arXiv:2507.05622, 2025

    2025

  19. [25]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in International Conference on Learning Repre- sentations, 2015

    2015

  20. [26]

    Rethinking deep neural network ownership verification: Embedding passports to defeat ambiguity attacks,

    L. Fan, K. W. Ng, and C. S. Chan, “Rethinking deep neural network ownership verification: Embedding passports to defeat ambiguity attacks,” in Annual Conference on Neural Information Processing Systems , 2019

    2019

  21. [27]

    Why should i trust you? explaining the predictions of any classifier,

    M. T. Ribeiro, S. Singh, and C. Guestrin, “Why should i trust you? explaining the predictions of any classifier,” in ACM SIGKDD Conference on Knowledge Discovery and Data Mining , 2016

    2016

  22. [28]

    Mobilenetv2: Inverted residuals and linear bottlenecks,

    M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen, “Mobilenetv2: Inverted residuals and linear bottlenecks,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2018

    2018

  23. [29]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2016

    2016

  24. [30]

    Automated flower classification over a large number of classes,

    M.-E. Nilsback and A. Zisserman, “Automated flower classification over a large number of classes,” in Indian Conference on Computer Vision, Graphics & Image Processing , 2008

    2008

  25. [31]

    Novel dataset for fine-grained image categorization,

    A. Khosla, N. Jayadevaprakash, B. Yao, and F.-F. Li, “Novel dataset for fine-grained image categorization,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshop , 2011

    2011

  26. [32]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and F.-F. Li, “Imagenet: A large-scale hierarchical image database,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2009

    2009

  27. [33]

    Metav: A meta-verifier approach to task-agnostic model fingerprinting,

    X. Pan, Y . Yan, M. Zhang, and M. Yang, “Metav: A meta-verifier approach to task-agnostic model fingerprinting,” in ACM SIGKDD Conference on Knowledge Discovery and Data Mining , 2022

    2022

  28. [34]

    Modelgif: Gradient fields for model functional distance,

    J. Song, Z. Xu, S. Wu, G. Chen, and M. Song, “Modelgif: Gradient fields for model functional distance,” in IEEE/CVF International Conference on Computer Vision , 2023

    2023

  29. [35]

    Sgdr: Stochastic gradient descent with warm restarts,

    I. Loshchilov and F. Hutter, “Sgdr: Stochastic gradient descent with warm restarts,” in International Conference on Learning Representations , 2016

    2016

  30. [36]

    Explanation as a watermark: Towards harmless and multi-bit model ownership verification via watermarking feature attribution,

    S. Shao, Y . Li, H. Yao, Y . He, Z. Qin, and K. Ren, “Explanation as a watermark: Towards harmless and multi-bit model ownership verification via watermarking feature attribution,” in Network and Distributed System Security Symposium, 2025

    2025

  31. [39]

    Removalnet: Dnn fingerprint removal attacks,

    H. Yao, Z. Li, K. Huang, J. Lou, Z. Qin, and K. Ren, “Removalnet: Dnn fingerprint removal attacks,” IEEE Transactions on Dependable and Secure Computing, 2023

    2023

  32. [40]

    Proof-of-learning: Definitions and practice,

    H. Jia, M. Yaghini, C. A. Choquette-Choo, N. Dullerud, A. Thudi, V . Chandrasekaran, and N. Papernot, “Proof-of-learning: Definitions and practice,” in IEEE Symposium on Security and Privacy , 2021

    2021

  33. [41]

    A dnn fingerprint for non- repudiable model ownership identification and piracy detection,

    Y . Zheng, S. Wang, and C.-H. Chang, “A dnn fingerprint for non- repudiable model ownership identification and piracy detection,” IEEE Transactions on Information Forensics and Security , vol. 17, pp. 2977– 2989, 2022

    2022

  34. [42]

    Neural network model protection with piracy identification and tampering localization capability,

    C. Xiong, G. Feng, X. Li, X. Zhang, and C. Qin, “Neural network model protection with piracy identification and tampering localization capability,” in ACM International Conference on Multimedia , 2022

    2022

  35. [43]

    Copy, right? a testing framework for copyright protection of deep learning models,

    J. Chen, J. Wang, T. Peng, Y . Sun, P. Cheng, S. Ji, X. Ma, B. Li, and D. Song, “Copy, right? a testing framework for copyright protection of deep learning models,” in IEEE Symposium on Security and Privacy , 2022

    2022

  36. [44]

    Characteristic examples: High-robustness, low-transferability fingerprinting of neural networks,

    S. Wang, X. Wang, P.-Y . Chen, P. Zhao, and X. Lin, “Characteristic examples: High-robustness, low-transferability fingerprinting of neural networks,” in International Joint Conference on Artificial Intelligence , 2021

    2021

  37. [45]

    Teacher model fingerprinting attacks against transfer learning,

    Y . Chen, C. Shen, C. Wang, and Y . Zhang, “Teacher model fingerprinting attacks against transfer learning,” in USENIX Security Symposium , 2022

    2022

  38. [46]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” in Annual Conference on Neural Information Processing Systems , vol. 30, 2017

    2017

  39. [47]

    Gradient-based adversarial attacks against text transformers,

    C. Guo, A. Sablayrolles, H. Jégou, and D. Kiela, “Gradient-based adversarial attacks against text transformers,” in Conference on Empirical Methods in Natural Language Processing , 2021, pp. 5747–5757

    2021

  40. [48]

    Promptcare: Prompt copyright protection by watermark injection and verification,

    H. Yao, J. Lou, K. Ren, and Z. Qin, “Promptcare: Prompt copyright protection by watermark injection and verification,” in IEEE Symposium on Security and Privacy , 2024

    2024

  41. [49]

    Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery,

    Y . Wen, N. Jain, J. Kirchenbauer, M. Goldblum, J. Geiping, and T. Gold- stein, “Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery,” in Annual Conference on Neural Information Processing Systems , 2024

    2024

  42. [50]

    On benchmarking code llms for android malware analysis,

    Y . He, H. She, X. Qian, X. Zheng, Z. Chen, Z. Qin, and L. Cavallaro, “On benchmarking code llms for android malware analysis,” in ACM SIGSOFT International Symposium on Software Testing and Analysis Workshop, 2025

    2025

  43. [51]

    Modelshield: Adaptive and robust watermark against model extraction attack,

    K. Pang, T. Qi, C. Wu, M. Bai, M. Jiang, and Y . Huang, “Modelshield: Adaptive and robust watermark against model extraction attack,” IEEE Transactions on Information Forensics and Security , 2025

    2025

  44. [52]

    Sample correlation for fingerprinting deep face recognition,

    J. Guan, J. Liang, Y . Wang, and R. He, “Sample correlation for fingerprinting deep face recognition,” International Journal of Computer Vision, pp. 1–15, 2024

    2024

  45. [53]

    Language models are unsupervised multitask learners,

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever et al., “Language models are unsupervised multitask learners,” OpenAI Blog, 2019

    2019

  46. [54]

    Bert: Pre-training of deep bidirectional transformers for language understanding,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” in Conference of the North American Chapter of the Association for Computational Linguistics, 2018

    2018

  47. [55]

    Building a large annotated corpus of English: The Penn Treebank,

    M. P. Marcus, B. Santorini, and M. A. Marcinkiewicz, “Building a large annotated corpus of English: The Penn Treebank,” Computational Linguistics, vol. 19, no. 2, pp. 313–330, 1993

    1993

  48. [56]

    The lambada dataset: Word prediction requiring a broad discourse context,

    D. Paperno, G. Kruszewski, A. Lazaridou, Q. N. Pham, R. Bernardi, S. Pezzelle, M. Baroni, G. Boleda, and R. Fernández, “The lambada dataset: Word prediction requiring a broad discourse context,” arXiv preprint arXiv:1606.06031, 2016

    2016 arXiv

  49. [57]

    Rethinking data protection in the (generative) artificial intelligence era,

    Y . Li, S. Shao, Y . He, J. Guo, T. Zhang, Z. Qin, P.-Y . Chen, M. Backes, P. Torr, D. Tao, and K. Ren, “Rethinking data protection in the (generative) artificial intelligence era,” arXiv preprint arXiv:2507.03034 , 2025

    2025 arXiv

  50. [58]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” in Annual Conference on Neural Information Processing Systems, vol. 33, 2020, pp. 6840–6851. PREPRINT 14 APPENDIX A. The Proof of Proposition 1 Proposition 1. Given the security parameter κ and the fing...

    2020

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.