REVIEW 3 major objections 5 minor 15 references
Ownership Verification of DNN Models Using White-Box Adversarial Attacks with Specified Probability Manipulation
T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash
Pith's one-line read The paper proposes I-FDGSM, a white-box attack that pins a target class's output probability to a specified value, and uses that pinned probability to certify whether a cloud model is the original model.
desk verdict A modest but real algorithmic contribution—dual-gradient probability-controlled adversarial images—that cleanly separates exact copies from other models, but whose central identity claim is only tested for exact-weight copies, not the fine-tuned or pruned copies the paper itself says should work. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is I-FDGSM (Iterative-Fast Dual Gradient Sign Method), an update rule that moves the image at each step by a common step size $\alpha_{\mathrm{com}}$ in the direction of the sign of a weighted sum of the loss gradients for the true class $c$ and the target class $c'$: $x^{\mathrm{adv}}_{N+1} = \mathrm{Clip}_{x,\varepsilon}\left( x^{\mathrm{adv}}_N - \alpha_{\mathrm{com}}\,\mathrm{sign}\left( \beta_c \nabla_x C(x^{\mathrm{adv}}_N,c) + \beta_{c'} \nabla_x C(x^{\mathrm{adv}}_N,c')\right)\right)$. The accompanying procedure (Algorithm 1) periodically compares a running mean of $\tilde{p}_{c'}$ with $p^{\mathrm{target}}_{c'}$, increases $\beta_{c'}$ if the probability is below tolerance, increases $\beta_c$ otherwise, and halves $\alpha_{\mathrm{com}}$ once the mean is within tolerance, stopping when $\alpha_{\mathrm{com}}$ is below $10^{-10}$. This weighted dual-gradient loop is what turns probability control into an identity signal: it tunes the final image so precisely to $M$ that the desired probability does not transfer to other models.
What would settle it
Train or obtain a second ResNet50-v1 that was initialized from a different random seed (or fine-tuned from the original), run the I-FDGSM verification protocol on 100 images, and check whether $D_{\mathrm{prob}}$ stays near 0 for the non-identical copy. If it does, the proposed test would certify a model that is not the original, and the separation claim fails.
Extended reading notes
Core claim
The paper's central claim is that precise probability control is model-specific. Given a source image, a target class $c'$, and a target probability $p^{\mathrm{target}}_{c'}$, I-FDGSM produces an adversarial image $x^{\mathrm{adv}}$ such that on the original model $M$ the output probability $\tilde{p}_{c'}$ is within tolerance $T_{\mathrm{diff}}$ of the target and $c = \arg\max_i \tilde{p}_i$ remains the dominant class. The ownership test then submits $x^{\mathrm{adv}}$ to the cloud model $M_{\mathrm{copy}}$ and computes $D_{\mathrm{prob}}(p^{\mathrm{target}}_{c'}, \tilde{p}^{\mathrm{copy}}_{c'}) = |p^{\mathrm{target}}_{c'} - \tilde{p}^{\mathrm{copy}}_{c'}| / p^{\mathrm{target}}_{c'}$. The paper reports $D_{\mathrm{prob}} \approx 0$ when $M_{\mathrm{copy}} = M$ and $D_{\mathrm{prob}} \approx 1$ when $M_{\mathrm{copy}}$ differs, across a cross-product of ResNet and VGG pairs, and interprets a near-zero value as proof that the suspected model is the original.
Load-bearing premise
The claim rests on the premise that a perturbation tuned on the original model to hit one probability will not also hit that probability on any other model, including an independently trained copy of the same architecture; the paper does not test that closest case.
Editorial extensions
If this is right
- An owner can verify a suspected cloud model by generating an adversarial image locally and querying only the probability vector, without revealing model weights.
- A third party can issue a challenge (any image, any target class, any probability) and accept the owner's response as proof of possession, because black-box attackers cannot reliably pin probabilities.
- The true class staying the argmax and SSIM $\geq 0.9875$ mean verification queries look like ordinary inputs, reducing the chance that the unauthorized user detects and blocks the test.
- The $D_{\mathrm{prob}}$ relative-error threshold gives a simple, protocol-friendly criterion that separated identity from non-identity for every ResNet/VGG pair tested.
Reading between the lines
- The paper does not test the closest realistic copy: a second ResNet50-v1 retrained from a different random seed, or a fine-tuned version of the original. If I-FDGSM perturbations transfer to such a near-copy, $D_{\mathrm{prob}} \approx 0$ could be produced by a model that is not identical, and the test's meaning would need re-calibration.
- The conclusion's own expectation that adversarial transferability keeps the method working on retrained or pruned models is in tension with the separation result used for ownership; a natural next experiment is to measure $D_{\mathrm{prob}}$ on lightly modified copies to map where verification turns into false identity.
- Because the owner can answer arbitrary (image, class, probability) challenges on the spot, the scheme acts as an interactive proof of possession, not just a fixed fingerprint, which is stronger than trigger-set watermarking against replay attacks.
- One could extend the scheme to hide a secret in the target probability value itself, making the requested $p^{\mathrm{target}}_{c'}$ a challenge that only someone with full access to $M$ can satisfy.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes an ownership verification framework for DNN classifiers that does not require revealing the original model. The owner uses a proposed white-box attack called I-FDGSM, an iterative FGSM variant that simultaneously considers gradients of the true class and a target class, to craft an adversarial image x_adv from a given input x such that the output probability of a specified target class c' equals a user-chosen value p_target while the true class remains the argmax. The owner or a third party then queries the suspect cloud model M_copy with x_adv and computes D_prob, the relative error between p_target and the observed probability of c'. The central claim is that D_prob is approximately 0 only when M_copy equals the original model M, and approximately 1 otherwise. Experiments on ImageNet with pretrained ResNet and VGG models show this separation for exact weight copies versus other pretrained models, with SSIM above 0.9875.
Significance. If the central separation claim holds, the framework offers a lightweight, watermark-free way to prove model identity to third parties without exposing the model, and it avoids the fixed-trigger and detectability problems of backdoor watermarks. The evaluation is reasonably honest in its scope: it uses standard pretrained models, 100 images per configuration, and reports the visual quality of perturbations. The method itself is simple and reproducible in principle. However, the paper's main claim is broader than what the experiments establish: the threat model explicitly includes copied models that may be retrained, fine-tuned, or pruned, yet no such modified copy is ever tested. The only same-architecture non-identical model tested is ResNet50-v2, which is not an independently trained version of the same model but a different PyTorch checkpoint with a different training recipe. The paper also provides no statistical characterization of the D_prob distributions, no decision threshold, and no false-positive or false-negative analysis, which are essential for a verification method.
major comments (3)
- [Section IV-B2 and Conclusion] The central claim that D_prob ≈ 0 only when M_copy equals M is not tested for the modified-copy case that the threat model in Section II-A identifies as the realistic theft scenario. A thief who steals the weights can fine-tune, prune, or retrain the model before deployment, and the paper's conclusion explicitly states that robustness to such modifications is left for future work. The only non-identical same-architecture model tested is ResNet50-v2, which is a different PyTorch checkpoint and not an independently trained ResNet50-v1; it therefore does not establish behavior under fine-tuning or pruning. Without experiments on fine-tuned or pruned copies, the paper cannot support the stronger conclusion that the test verifies exact identity rather than mere derivation. This is the central separation result and needs to be addressed directly, for example by evaluating D_prob for models obtained by fine-tuning M on a subset of ImageNet, by pruning M, or by retraining from a different seed.
- [Section IV-B2, Figs. 4 and 5] The paper reports D_prob ≈ 0 for identical models and D_prob ≈ 1 for different models, but it provides no error bars, confidence intervals, or threshold analysis. Fig. 4 shows distributions for 100 images, yet the text does not report the mean, median, minimum, maximum, or any separation margin between the blue and red histograms. Since the decision rule in Section III-C relies on D_prob being 'sufficiently small,' the absence of a threshold and of false-positive/false-negative rates makes the verification criterion ambiguous. For instance, a non-identical model that happens to output a probability close to p_target for some input would produce a small D_prob and cause a false identity decision. The authors should report the full distribution statistics and evaluate the sensitivity of the decision to the choice of threshold.
- [Algorithm 1 and Section IV-A] The adaptive schedule in Algorithm 1 is underspecified, which weakens the reproducibility of the 'specified probability manipulation' claim. The pseudocode does not list N_max as an input, even though the experiments use N_max = 1000. The updates of beta_c and beta_c' are unbounded increments, and the else branch at lines 9-10 increments beta_c not only when the target probability is undershot but also when it is overshot, which is not explained. The convergence criterion alpha_com < 10^-10 depends on repeated halving, but no final values of alpha_com, beta_c, or beta_c' are reported, and no convergence analysis is given. Because the method's core purpose is to make the target probability equal to a specified value, the precise procedure and its convergence behavior should be documented, and the accuracy of the final achieved probability should be reported separately from the identity test.
minor comments (5)
- [Section III-C] The phrase 'sufficiently small' for D_prob is never quantified; the authors should define a concrete decision threshold and justify it in Section IV-B2.
- [Eq. (3)] The relative error D_prob is undefined when p_target = 0 and can become very large for small p_target; the paper should state that p_target is always positive and discuss the behavior as p_target approaches zero.
- [Section IV-B1] The use of ResNet50-v2 as the non-identical same-architecture model should be clarified: it is a different PyTorch model version with a different training pipeline, not a same-seed retraining of ResNet50-v1, so it does not fully isolate the effect of independent training.
- [Algorithm 1] The notation in Eq. (1) uses x_adv_{N+1} with N starting at 0, while Algorithm 1 iterates N from 1; this is confusing and should be aligned.
- [Fig. 5] The heatmap's axes and color scale are not described in the text; the authors should specify which model is M and which is M_copy and provide a colorbar or numerical values so the average D_prob can be interpreted.
Circularity Check
No significant circularity: the identical-model case is true by construction, but the load-bearing separation claim against non-identical models is measured empirically, not assumed.
full rationale
The paper's derivation chain is self-contained. I-FDGSM optimizes an adversarial perturbation on the known model M so that the targeted class probability matches a user-specified value; therefore Dprob ≈ 0 when M_copy = M is an expected consequence of the construction, not a fitted prediction. The central empirical claim is the separation property: for non-identical models, Dprob ≈ 1, meaning the probability-controlled perturbation does not transfer. This is tested against ResNet50-v2 and the full cross-architecture heatmap in Fig. 5, so the decisive part of the claim is measured rather than assumed. The hyperparameters in Algorithm 1 and Table I are selected for convergence of the generation procedure, not fitted to the verification outcome, so no fitted input is renamed as a prediction. There are no load-bearing self-citations, no imported uniqueness theorems, and no known result merely renamed. The acknowledged limitation that fine-tuned or pruned copies are not tested is a threat-model and robustness gap, not a circularity. Accordingly, the paper warrants a circularity score of 0.
Assumptions & free parameters
free parameters (4)
- alpha_com (I-FDGSM step size) =
1e-3
- epsilon (perturbation bound) =
5e-2
- l (averaging interval) =
5
- T_diff (probability tolerance) =
5e-3
assumptions (4)
- domain assumption The cloud service returns the full per-class probability vector exactly, without rounding, temperature scaling, or truncation to top-k.
- domain assumption An adversarial sample that drives M to output ptarget will not produce the same probability on any other model, so Dprob is near 1 for non-identical models.
- domain assumption The iterative beta-increment and alpha-halving schedule in Algorithm 1 converges to the specified probability while keeping argmax at c for any target class and probability.
- ad hoc to paper Dprob near 0 is a reliable identity test with no explicit threshold or false-positive analysis.
Cite this review
Pith. "Pith review of Ownership Verification of DNN Models Using White-Box Adversarial Attacks with Specified Probability Manipulation." pith.science (2026). https://pith.science/paper/HSLY2JSI
@misc{pith2026250517579,
author = {Pith},
title = {Pith review of: Ownership Verification of DNN Models Using White-Box Adversarial Attacks with Specified Probability Manipulation},
year = {2026},
howpublished = {\url{https://pith.science/paper/HSLY2JSI}},
note = {Machine review of arXiv:2505.17579}
}
read the original abstract
In this paper, we propose a novel framework for ownership verification of deep neural network (DNN) models for image classification tasks. It allows verification of model identity by both the rightful owner and third party without presenting the original model. We assume a gray-box scenario where an unauthorized user owns a model that is illegally copied from the original model, provides services in a cloud environment, and the user throws images and receives the classification results as a probability distribution of output classes. The framework applies a white-box adversarial attack to align the output probability of a specific class to a designated value. Due to the knowledge of original model, it enables the owner to generate such adversarial examples. We propose a simple but effective adversarial attack method based on the iterative Fast Gradient Sign Method (FGSM) by introducing control parameters. Experimental results confirm the effectiveness of the identification of DNN models using adversarial attack.
Figures
Figures from the paper (2 more)
Reference graph
Works this paper leans on
-
[2]
Deep intellectual property protection: A survey,
Y . Sun, T. Liu, P. Hu, Q. Liao, S. Fu, N. Yu, D. Guo, Y . Liu, and L. Liu, “Deep intellectual property protection: A survey,” arXiv preprint arXiv:2304.14613 , 2023. [Online]. Available: https://arxiv.org/abs/2304.14613
arXiv 2023
-
[3]
Adversarial examples in the physical world,
A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” arXiv preprint arXiv:1607.02533 , 2016
arXiv 2016
-
[4]
Customized Watermarking for Deep Neural Networks via Label Distribution Perturbation
X. Wang, X. Li, W. Zhang, C. Guo, J. Yan, and Z. Zhang, “Customized watermarking for deep neural networks via label distribution perturbation,” arXiv preprint , vol. 2208.05477, 2022. [Online]. Available: https://arxiv.org/abs/2208.05477
work page Pith review arXiv 2022
-
[5]
Turning your weakness into a strength: Watermarking deep neural networks by backdooring,
Y . Adi, C. Baum, M. Ciss ´e, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” in Proceedings of the 27th USENIX Security Symposium , 2018, pp. 1615–1631
work page 2018
-
[6]
Aeva: Black-box backdoor detection using adversarial extreme value analysis,
B. Chen, L. Xie, Y . Rong, and L. Huang, “Aeva: Black-box backdoor detection using adversarial extreme value analysis,” arXiv preprint arXiv:2110.14880, 2021
arXiv 2021
-
[7]
Y . Yu, S. Hu, Y . Xiao, J. Chen, Y . Chen, S. Ma, and X. Zhang, “Scale- up: Scalable black-box input-level backdoor detection via analyzing predictions across scales,” arXiv preprint arXiv:2302.03251 , 2023
arXiv 2023
-
[8]
X. Cao, J. Jia, and N. Z. Gong, “IPGuard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary,” in Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security (AsiaCCS) . ACM, 2021, pp. 14–25. [Online]. Available: https://arxiv.org/abs/1910.12903
arXiv 2021
-
[9]
Explaining and harnessing adversarial examples,
I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2015
arXiv 2015
Show all 15 references
-
[10]
Imagenet: A large-scale hierarchical image database,
J. Deng, W. Dong, R. Socher, L. J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE Conference on Computer Vision and Pattern Recognition , 2009, pp. 248–255
2009
-
[11]
Deep residual learning for image recognition,
K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778
2016
-
[12]
Pytorch: An imperative style, high-performance deep learning library,
A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, and S. Chintala, “Pytorch: An imperative style, high-performance deep learning library,” Advances in Neural Information Processing Systems , vol. 32, 2019
2019
-
[13]
Image quality assessment: From error visibility to structural similarity,
Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli, “Image quality assessment: From error visibility to structural similarity,” IEEE Transactions on Image Processing , vol. 13, no. 4, pp. 600–612, 2004
2004
-
[14]
Very deep convolutional networks for large-scale image recognition,
K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556 , 2014. [Online]. Available: https://arxiv.org/abs/1409.1556
2014 arXiv
-
[15]
ADV oIP: Adver- sarial detection of encrypted and concealed voip,
P. Addesso, M. Cirillo, M. D. Mauro, and V . Matta, “ADV oIP: Adver- sarial detection of encrypted and concealed voip,” IEEE Transactions on Information Forensics and Security , vol. 15, pp. 3342–3357, 2020
2020
-
[2021]
Available: https://arxiv.org/abs/2103.09274
[Online]. Available: https://arxiv.org/abs/2103.09274
Reviewed August 7, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.