Pith. sign in

REVIEW 4 major objections 5 minor 51 references

CHIP: Chameleon Hash-based Irreversible Passport for Robust Deep Model Ownership Verification and Active Usage Control

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Chameleon hash binds many user keys to one immutable model signature.

desk verdict The chameleon-hash trick is genuinely new and the fidelity work is solid, but offline active control rests on an untested adversary—fine-tuning the TLP to a forged passport—so the paper is a conditional at best. read the letter →

arxiv 2505.24536 v1 pith:VUFEGOFR submitted 2025-05-30 cs.CR cs.AI

Chaohui Xu , Qi Cui , Chip-Hong Chang This is my paper
classification cs.CRcs.AI
keywords deepneuralnetworkIPprotectionchameleonhashpassport-basedwatermarkingactiveusagecontroltraitortracingambiguityattackmodelownershipverificationMLaaSaccess
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

CHIP claims that one watermarked model can be the root of many user-specific copies, each bound to a unique passport and certificate, while all of them share a single immutable signature produced by a chameleon hash. The paper's goal is to give a model owner, at the same time, ownership proof that resists ambiguity attacks, per-user active usage control in offline distribution, and traitor tracing, plus an online MLaaS mode where access is checked by hashing the user's passport and certificate. This matters because earlier passport-based methods either cannot tie a distributed model to one specific user offline or require a full retraining per user. CHIP reports that minting a new user only requires fine-tuning the small two-layer perceptron attached to a passport-aware branch, and that a mismatched passport drops accuracy to near-random.

What carries the argument

Chameleon hash: a trapdoor hash in which finding collisions is intractable using only the public key $PK$, but easy with the secret key $SK$ via a collision algorithm. In CHIP the hash binds the owner passport digest $m_o = \mathrm{Hash}(p_o^\gamma)$ and the licensor certificate $r_o$ to the immutable signature $\xi$, and the trapdoor property lets the owner mint user certificates that collide to the same $\xi$. The other load-bearing mechanism is the modified passport layer: a skip connection $\gamma_1 = \mathrm{Ada}(p_o^\gamma) + \mathrm{TLP}(w_{p_o^\gamma})$ together with a balance loss $L_{\mathrm{bal}}$ makes the affine factors depend sharply on the exact passport, so a mismatched passport destroys utility.

What would settle it

Run the oracle-passport ambiguity attack with the TLP layer free to be fine-tuned together with the forged passport on 30% of the training data, exactly as the owner does in Eq. (13); if the forged passport keeps accuracy near the clean model while both the signature detection and passport hashing accuracies exceed their thresholds, the central claim collapses.

Watch

Extended reading notes

Core claim

On its own terms, CHIP's discovery is that the chameleon hash's trapdoor-collision property lets many distinct user passports and licensee certificates hash to the same immutable signature $\xi = \mathrm{SGN}(\mathrm{CH}(PK, m_o, r_o))$, so the owner can generate $N$ user triplets $\{M_u^j, p_u^j, r_u^j\}$ from one master model without retraining. A user passport is created by perturbing the owner passport under a distance constraint, and the user certificate is a trapdoor collision $r_u^j = \mathrm{Col}(SK, m_o, r_o, m_u^j)$, so Eq. (14) holds for every user and the ownership signature stays fixed. The paper argues this yields strong ownership proof (only the licensor certificate decodes to meaningful text), active offline control (a model is unusable with any passport but its own, enforced by a skip connection that makes the affine factors sharply passport-dependent), and tracing (the culprit's passport passes the fidelity test), while a master model deployed as MLaaS admits only tuples that collide to $\xi$.

Load-bearing premise

The load-bearing premise is that a user who steals a distributed model cannot adapt its tiny TLP layer to a forged passport while keeping accuracy, so only the owner can mint a working passport-model pair.

Editorial extensions

If this is right

  • Owners can distribute many individually traceable copies from one master model; minting a new user costs minutes of TLP fine-tuning instead of a full retraining.
  • An offline copy is useless to anyone except its registered user, because only the designated passport keeps accuracy near the clean model.
  • An ownership claim must pass four tests — fidelity, signature detection, passport hashing, and licensor decoding — and a legitimate user's triplet passes the first three but not the licensor test.
  • In MLaaS, issuing or revoking a user's passport is an efficient chameleon hash computation, so ad hoc subscription and withdrawal need no model change.
  • The reported removal experiments show the signature surviving fine-tuning, transfer learning, and pruning, with accuracy degrading before the signature disappears.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the decisive un-tested attack is to run the paper's own user-triplet optimization from the attacker's side, jointly fine-tuning the TLP and forging a passport on a stolen model; if that preserves accuracy and lifts the passport hashing accuracy, offline active control and tracing both break.
  • Editorial inference: since user models differ only in the small TLP and the passport, an attacker with two legitimately purchased copies could compare them to separate shared master weights from user-specific ones, which may ease watermark removal or passport synthesis.
  • Editorial inference: the entire scheme leans on the chameleon hash secret key staying secret; if an attacker obtains it, they can mint unlimited colliding passports and pass the verification tests.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes CHIP, a DNN IP protection framework that combines passport-based watermarking with the Krawczyk-Rabin chameleon hash. The owner trains a master model whose passport-aware layers embed an immutable chameleon-hash signature derived from an owner passport and a licensor certificate; user-specific models are then produced by optimizing the small TLP layers and copies of the owner passport so that each user passport and licensee certificate collide to the same signature. This is claimed to deliver joint ownership verification, multi-user active usage control in both offline and online deployment, and traitor tracing without per-user retraining. The authors evaluate fidelity, active-control confusion matrices, robustness against ambiguity and removal attacks, cloud-token authentication, and graph-classification generalization. The cryptographic construction is plausible, but the offline active-control guarantee rests on an unverified assumption about whether an attacker can adapt the TLP to a forged passport while preserving utility.

Significance. If the central claim holds, CHIP is a meaningful step beyond prior passport-based methods: it is the first scheme in this line to combine passive ownership proof with offline multi-user active control and user tracing in a single model, and it does so using an independent cryptographic primitive rather than relying on the authors' earlier SteP construction. Concrete strengths include released code, extensive experiments across four image datasets, two architectures, two normalization types, and graph classification, as well as a data-free user-triplet generation procedure that is orders of magnitude cheaper than retraining. The main caveat is that the load-bearing active-control claim is currently demonstrated only against a restricted adversary; the experiments do not test the natural adaptation attack that the paper's own Definition 2 suggests.

major comments (4)
  1. [Sec. V-D, Definition 2 (Eq. 13)] The robustness evaluation does not exercise the adversary who fine-tunes the TLP to a forged passport. Equation (13) shows that the owner's own user-triplet generation optimizes exactly the TLP and a passport copy to maintain utility, and a malicious registered user holding a stolen user model can run the same data-free or low-data optimization to fit a forged passport p^f without needing to satisfy the diversification constraint. The attacks reported in Sec. V-D (Definition 1, Eq. 7, and Table III) keep the TLP fixed and only optimize the passport, and Fig. 7 likewise varies the signature while leaving the TLP unchanged. If TLP adaptation restores accuracy for p^f, the owner cannot restrict usage to the designated user and p^f will not appear in the owner's repository, breaking both offline active control and traitor tracing. Please add an experiment in which an attacker with white-box access to a user model optimizes the TLP (and any other passport-aware parameters) toward a forged passport, with and without a small amount of training data, and report accuracy, SDA, and PHA; the central claim should be revised depending on the outcome.
  2. [Sec. IV-D, Eq. (15)] The fidelity threshold tau_fidelity is never defined, yet it is the threshold that decides whether V_F passes and therefore whether a forged passport is rejected. The text in Sec. V-D says that forged passports cause false claims to "fail V_F in certain cases," but without a concrete threshold and without reporting accuracy distributions around it, the reader cannot tell whether the rejection is robust or tuned to the specific results. Please define tau_fidelity, state the value used, and report the accuracy distributions (e.g., over random and oracle passports, and over TLP-adaptation attacks) relative to that threshold.
  3. [Sec. V-D, Table IV] The transfer-learning comparison is made on different attack surfaces: for the four baselines the optimized model is the passport-free branch, while for CHIP it is the passport-aware model, as the note under Table IV states. Higher SDA for CHIP may therefore reflect a different starting point rather than stronger watermark persistence. Please run transfer learning on the same branch type for all methods, or report both branches, and discuss how the choice affects the comparison.
  4. [Sec. V-C, Fig. 5] The active-control confusion matrix in Fig. 5(a) tests only cross-user passport swaps on fixed user models. It does not test whether the underlying model can be re-optimized toward a new passport, which is the attack most directly suggested by Eq. (13). The claimed property that "a user model can only be normally used by the unique user who holds the designated paired passport" is therefore stronger than what the current experiments establish; please either add the TLP-adaptation experiment or weaken the claim accordingly.
minor comments (5)
  1. [Sec. IV-D, Eq. (18)] The licensor test is written as "V D ⇐ ⇒ Dec(r)"; this should be "V L ⇐ ⇒ Dec(r)" to match the test labels.
  2. [Sec. V-B and Sec. V-D] There are typos in the prose: "which which" in the second paragraph of Sec. V-B and "dose not imply" in Sec. V-D should be corrected.
  3. [Sec. V, Tables II and III] The main accuracy and robustness tables report single runs without standard deviations or multiple seeds. Given that several fidelity differences are smaller than 1%, error bars or multiple-seed averages would materially strengthen the claims.
  4. [Sec. IV-D, Eqs. (16) and (17)] The notation "ξ∗ ∧ ξ" is not defined; if it denotes a bitwise XNOR or equiparison on ±1 strings, please state this explicitly to avoid confusion with a logical AND.
  5. [Sec. V-A] Please state explicitly how many random seeds are used for the training of the master models and for the user-triplet generation, since the claimed stability of the approach would be better supported by reporting variance across seeds.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: Eq. (14) follows from the external chameleon-hash trapdoor property, and active control is empirically established; the untested TLP-adaptation adversary is a robustness gap, not a circular reduction.

full rationale

The derivation core of CHIP is Eq. (14): every user pair (p_u^j, r_u^j) maps to the same chameleon-hash signature as the owner pair because r_u^j = Col(SK, m_o, r_o, m_u^j) (Sec. IV-C). This is a genuine theorem of the external Krawczyk-Rabin chameleon hash [41], not a redescription of the paper's own outputs: the owner signature xi is not fitted to the user models, and the user models are not fitted to xi. The active-control claim (a user model works only with its designated passport) is argued from the skip connection (Eq. 10) and established empirically with a negative control (without the skip connection control fails, Fig. 10(b)); it is not defined into existence. Near-misses that are not circularity: (1) the 100% SDA and matched-triplet PHA figures are largely enforced by the signature loss Ls and by the hash-collision equality themselves, but the paper transparently states V_D can be trivially bypassed (Sec. V-D) and uses the figures as implementation sanity checks; (2) Table III tests only the Definition 1 passport-only adversary with a fixed TLP, so the summary 'CHIP is verified to be robust against various ambiguity attacks' (Sec. V-D) is overbroad - a coverage/correctness gap, not a circular reduction, since the owner's own user-triplet procedure (Eq. 13) fine-tunes the TLP exactly as an adaptive adversary would; the threat model even admits a malicious user may 'counterfeit the passport' (Sec. III-A), yet that adversary is never evaluated. Self-citations: [23] SteP (co-authored) defines the offline-control gap and serves as a baseline, and [29]/[10] appear in related work; none carries the chameleon-hash derivation, which rests on an external 1998 primitive and on comparisons against four independently re-implemented baselines with released code. No fitted parameter is renamed as a prediction, and no uniqueness theorem is imported from the authors' prior work. Overall, the central claims have independent cryptographic and empirical content; score 2 reflects only the framing role of the co-authored SteP baseline and the construction-enforced verification metrics.

Assumptions & free parameters 4 free parameters · 7 assumptions · 0 invented entities

The central claim rests on the security of the chameleon hash, an independent primitive, on the passport-layer training assumption inherited from prior work, and on two CHIP-specific assumptions: the skip connection makes affine factors strongly passport-dependent, and the data-free balance-loss objective preserves user model fidelity. These last two are empirically evaluated but not proven. The threat model also assumes the owner keeps the secret key and master model private, and it does not explicitly test whether a user can adapt the TLP layer to a forged passport.

free parameters (4)
  • τfidelity
    Threshold for the fidelity test VF in Eq. (15). The paper never assigns a numerical value, so claims that ambiguity attacks fail the fidelity test cannot be checked independently.
  • τerror = 5%
    Error tolerance in Eqs. (16) and (17), chosen by hand. It governs whether SDA and PHA pass verification, and no sensitivity analysis is reported.
  • τ = 0.1
    Margin in the signature loss, Eq. (5), inherited from DeepIPR. It controls how strongly sign bits are held and is not tuned in this paper.
  • Balance loss weight = implied 1.0
    Ltotal in Eq. (12) uses equal implicit weights for Lf, La, Ls, and Lbal without stating them. The strength of Lbal is a design choice that affects fidelity and active control.
assumptions (7)
  • standard math Chameleon hash schemes provide collision resistance without the secret key and efficient trapdoor collisions with it.
    Invoked in Sec. III-B and used to bind all user passports to one signature in Eq. (14). If the concrete instance is insecure, the VH test fails as a security check.
  • standard math SHA-512 is one-way and collision-resistant.
    Used to compute mo = Hash(poγ) in Eq. (9); the signature's security depends on this one-wayness.
  • domain assumption Signs of wpγ can carry a C-bit signature that survives inference.
    Inherited from DeepIPR and TdN, used in Eq. (5) and the VD test. It is an empirical property of passport layers, not a proven guarantee.
  • ad hoc to paper The skip connection makes affine factors so passport-dependent that a mismatched passport collapses accuracy.
    Introduced in Eq. (10) and central to active control. Supported by experiments in Fig. 10 but not proven for all architectures and datasets.
  • ad hoc to paper Minimizing Lbal on affine factors without data preserves user model accuracy.
    User triplet generation in Eq. (13) is data-free; fidelity is assumed to follow from matching γ and β between branches. Empirical evidence covers the evaluated settings only.
  • domain assumption The attacker does not or cannot fine-tune the TLP layer to a new passport.
    Implicit in the threat model in Sec. III-A and the robustness evaluation in Sec. V-D. It is not stated or tested, and it is the weakest security assumption.
  • domain assumption The owner keeps the chameleon secret key and the master model private.
    Required by Eqs. (9) and (14). If SK leaks, any passport and certificate collision can be forged, and VH loses its meaning.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CHIP: Chameleon Hash-based Irreversible Passport for Robust Deep Model Ownership Verification and Active Usage Control." pith.science (2026). https://pith.science/paper/VUFEGOFR

@misc{pith2026250524536,
  author       = {Pith},
  title        = {Pith review of: CHIP: Chameleon Hash-based Irreversible Passport for Robust Deep Model Ownership Verification and Active Usage Control},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VUFEGOFR}},
  note         = {Machine review of arXiv:2505.24536}
}
read the original abstract

The pervasion of large-scale Deep Neural Networks (DNNs) and their enormous training costs make their intellectual property (IP) protection of paramount importance. Recently introduced passport-based methods attempt to steer DNN watermarking towards strengthening ownership verification against ambiguity attacks by modulating the affine parameters of normalization layers. Unfortunately, neither watermarking nor passport-based methods provide a holistic protection with robust ownership proof, high fidelity, active usage authorization and user traceability for offline access distributed models and multi-user Machine-Learning as a Service (MLaaS) cloud model. In this paper, we propose a Chameleon Hash-based Irreversible Passport (CHIP) protection framework that utilizes the cryptographic chameleon hash function to achieve all these goals. The collision-resistant property of chameleon hash allows for strong model ownership claim upon IP infringement and liable user traceability, while the trapdoor-collision property enables hashing of multiple user passports and licensee certificates to the same immutable signature to realize active usage control. Using the owner passport as an oracle, multiple user-specific triplets, each contains a passport-aware user model, a user passport, and a licensee certificate can be created for secure offline distribution. The watermarked master model can also be deployed for MLaaS with usage permission verifiable by the provision of any trapdoor-colliding user passports. CHIP is extensively evaluated on four datasets and two architectures to demonstrate its protection versatility and robustness. Our code is released at https://github.com/Dshm212/CHIP.

Figures

Figures reproduced from arXiv: 2505.24536 by the authors.

Figure 1
Figure 1. Structures of (a) a typical convolutional block, and (b) [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Passport layers of (a) PAN and (b) TdN. 3) Trapdoor Normalization (TdN) [22]: However, both DeepIPR and PAN remain vulnerable to ambiguity attacks with oracle passports. Due to the large parameter space of the passport, it is feasible for the adversary to generate forged passports that differ largely from the original one, while still matching the signature and retaining the target model’s utility. Definition 1 (Amb… view at source ↗
Figure 3
Figure 3. The proposed method contains three main stages: (a) Master model watermarking; (b) User triplet generation and [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Passport layer of CHIP. The signature is created by [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 6
Figure 6. Figure 6: Performance of protected models under random pass [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 5
Figure 5. Figure 5: (a) Confusion matrix for the performance evaluation of [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 7
Figure 7. Figure 7: Inference accuracy (%), SDA (%), and PHA (%) [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 9
Figure 9. Figure 9: Inference accuracy (%) and SDA (%) after random [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: Inference accuracy confusion matrices measured on [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

51 extracted references · 42 canonical work pages

  1. [1]

    Gpt-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat et al. , “Gpt-4 technical report,” arXiv preprint arXiv:2303.08774 , 2023. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 13

    arXiv 2023

  2. [2]

    Qwen technical report,

    J. Bai, S. Bai, Y . Chu, Z. Cui, K. Dang, X. Deng, Y . Fan, W. Ge, Y . Han, F. Huang et al. , “Qwen technical report,” arXiv preprint arXiv:2309.16609, 2023

    arXiv 2023

  3. [3]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozi `ere, N. Goyal, E. Hambro, F. Azhar et al. , “Llama: Open and efficient foundation language models,” arXiv preprint arXiv:2302.13971, 2023

    arXiv 2023

  4. [4]

    Stealing machine learning models via prediction apis,

    F. Tram `er et al., “Stealing machine learning models via prediction apis,” in Proc. USENIX Secur. Symp. , 2016, pp. 601–618

    work page 2016

  5. [5]

    Deepem: Deep neural networks model recovery through em side-channel information leakage,

    H. Yu, H. Ma, K. Yang, Y . Zhao, and Y . Jin, “Deepem: Deep neural networks model recovery through em side-channel information leakage,” in Proc. IEEE Int. Symp. Hardw. Oriented Secur. Trust . IEEE, 2020, pp. 209–218

    work page 2020

  6. [6]

    Generative adversarial networks for black-box api attacks with limited training data,

    Y . Shi, Y . E. Sagduyu, K. Davaslioglu, and J. H. Li, “Generative adversarial networks for black-box api attacks with limited training data,” in Proc. IEEE Int. Symp. Signal Process. Inf. Technol. IEEE, 2018, pp. 453–458

    work page 2018

  7. [7]

    Knockoff nets: Stealing func- tionality of black-box models,

    T. Orekondy, B. Schiele, and M. Fritz, “Knockoff nets: Stealing func- tionality of black-box models,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit., 2019, pp. 4954–4963

    work page 2019

  8. [8]

    Maze: Data-free model stealing attack using zeroth-order gradient estimation,

    S. Kariyappa, A. Prakash, and M. K. Qureshi, “Maze: Data-free model stealing attack using zeroth-order gradient estimation,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. , 2021, pp. 13 814– 13 823

    work page 2021

Show all 51 references
  1. [9]

    Too hot to handle: Novel thermal side-channel in power attack- protected intel processors,

    N. Mishra, T. L. Dutta, S. Shukla, A. Chakraborty, and D. Mukhopad- hyay, “Too hot to handle: Novel thermal side-channel in power attack- protected intel processors,” in Proc. IEEE Int. Symp. Hardw. Oriented Secur. Trust. IEEE, 2024, pp. 378–382

    2024

  2. [10]

    An overview of trustworthy ai: Advances in ip protection, privacy-preserving federated learning, security verification, and gai safety alignment,

    Y . Zheng, C.-H. Chang, S.-H. Huang, P.-Y . Chen, and S. Picek, “An overview of trustworthy ai: Advances in ip protection, privacy-preserving federated learning, security verification, and gai safety alignment,” IEEE J. Emerg. Sel. Topics Circuit Syst. , 2024

    2024

  3. [11]

    Embedding water- marks into deep neural networks,

    Y . Uchida, Y . Nagai, S. Sakazawa, and S. Satoh, “Embedding water- marks into deep neural networks,” in Proc. ACM Int. Conf. Multimedia Retrieval, 2017, pp. 269–277

    2017

  4. [12]

    Deepmarks: A secure fingerprinting framework for digital rights management of deep learning models,

    H. Chen et al. , “Deepmarks: A secure fingerprinting framework for digital rights management of deep learning models,” in Proc. ACM Int. Conf. Multimedia Retrieval , 2019, pp. 105–113

    2019

  5. [13]

    Deep model intellectual prop- erty protection with compression-resistant model watermarking,

    H. Nie, S. Lu, J. Wu, and J. Zhu, “Deep model intellectual prop- erty protection with compression-resistant model watermarking,” IEEE Transactions Artif. Intell., vol. 5, no. 7, pp. 3362–3373, 2024

    2024

  6. [14]

    A robustness-assured white-box watermark in neural networks,

    P. Lv, P. Li, S. Zhang, K. Chen, R. Liang, H. Ma, Y . Zhao, and Y . Li, “A robustness-assured white-box watermark in neural networks,” IEEE Trans. Dependable Secure Comput., vol. 20, no. 6, pp. 5214–5229, 2023

    2023

  7. [15]

    Riga: Covert and robust white-box watermarking of deep neural networks,

    T. Wang and F. Kerschbaum, “Riga: Covert and robust white-box watermarking of deep neural networks,” in Proc. Web Conf., 2021, pp. 993–1004

    2021

  8. [16]

    Free fine-tuning: A plug-and-play watermarking scheme for deep neural networks,

    R. Wang et al., “Free fine-tuning: A plug-and-play watermarking scheme for deep neural networks,” in Proc. ACM Int Conf. Multimedia , 2023, pp. 8463–8474

    2023

  9. [17]

    Turning your weakness into a strength: Watermarking deep neural networks by backdooring,

    Y . Adi et al. , “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” in Proc. USENIX Secur. Symp., 2018, pp. 1615–1631

    2018

  10. [18]

    Protecting intellectual property of deep neural networks with watermarking,

    J. Zhang et al., “Protecting intellectual property of deep neural networks with watermarking,” in Proc. ACM Asia Conf. Comput. Commun. Secur., 2018, pp. 159–172

    2018

  11. [19]

    Rethinking deep neural network ownership verification: Embedding passports to defeat ambiguity at- tacks,

    L. Fan, K. W. Ng, and C. S. Chan, “Rethinking deep neural network ownership verification: Embedding passports to defeat ambiguity at- tacks,” Proc. Adv. Neural Inform. Process. Syst. , vol. 32, 2019

    2019

  12. [20]

    Deepipr: Deep neural network ownership verification with passports,

    L. Fan, K. W. Ng, C. S. Chan, and Q. Yang, “Deepipr: Deep neural network ownership verification with passports,” IEEE Trans. Pattern Anal. Mach. Intell. , vol. 44, no. 10, pp. 6122–6139, 2021

    2021

  13. [21]

    Passport- aware normalization for deep model protection,

    J. Zhang, D. Chen, J. Liao, W. Zhang, G. Hua, and N. Yu, “Passport- aware normalization for deep model protection,” Proc. Adv. Neural Inform. Process. Syst. , vol. 33, pp. 22 619–22 628, 2020

    2020

  14. [22]

    Trapdoor normalization with irreversible ownership verification,

    H. Liu, Z. Weng, Y . Zhu, and Y . Mu, “Trapdoor normalization with irreversible ownership verification,” in Proc. Int. Conf. Mach. Learn. PMLR, 2023, pp. 22 177–22 187

    2023

  15. [23]

    Steganographic passport: An owner and user verifiable credential for deep model ip protection without retraining,

    Q. Cui, R. Meng, C. Xu, and C.-H. Chang, “Steganographic passport: An owner and user verifiable credential for deep model ip protection without retraining,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. , 2024, pp. 12 302–12 311

    2024

  16. [24]

    Proof-of-learning: Definitions and practice,

    H. Jia et al., “Proof-of-learning: Definitions and practice,” in Proc. IEEE Symp. Secur. Privacy. IEEE, 2021, pp. 1039–1056

    2021

  17. [25]

    Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary,

    X. Cao, J. Jia, and N. Z. Gong, “Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary,” in Proc. ACM Asia Conf. Comput. Commun. Secur. , 2021, pp. 14–25

    2021

  18. [26]

    Metav: A meta-verifier approach to task-agnostic model fingerprinting,

    X. Pan, Y . Yan, M. Zhang, and M. Yang, “Metav: A meta-verifier approach to task-agnostic model fingerprinting,” in Proc. ACM SIGKDD Conference Knowl. Discovery Data Mining , 2022, pp. 1327–1336

    2022

  19. [27]

    Ganfinger: Gan-based fingerprint generation for deep neural network ownership verification,

    H. Ren, A. Yan, X. Ren, P.-G. Ye, C.-z. Gao, Z. Zhou, and J. Li, “Ganfinger: Gan-based fingerprint generation for deep neural network ownership verification,” arXiv preprint arXiv:2312.15617 , 2023

    2023 arXiv

  20. [28]

    Deepreg: A trustworthy and privacy-friendly ownership regulatory framework for deep learning models,

    X. Zhuang, L. Zhang, C. Tang, and Y . Li, “Deepreg: A trustworthy and privacy-friendly ownership regulatory framework for deep learning models,” IEEE Trans. Inform. Forensics Secur., 2024

    2024

  21. [29]

    A dnn fingerprint for non- repudiable model ownership identification and piracy detection,

    Y . Zheng, S. Wang, and C.-H. Chang, “A dnn fingerprint for non- repudiable model ownership identification and piracy detection,” IEEE Trans. Inform. Forensics Secur., vol. 17, pp. 2977–2989, 2022

    2022

  22. [30]

    Hardware-assisted intellectual property protection of deep learning models,

    A. Chakraborty, A. Mondai, and A. Srivastava, “Hardware-assisted intellectual property protection of deep learning models,” in Proc. ACM/IEEE Des. Automat. Conf. IEEE, 2020, pp. 1–6

    2020

  23. [31]

    Older and wiser: The marriage of device aging and intellectual property protection of deep neural networks,

    N. Lin, S. Wang, Y . Zhang, Y . He, K. Wong, A. Basu, D. Shang, X. Chen, and Z. Wang, “Older and wiser: The marriage of device aging and intellectual property protection of deep neural networks,” arXiv preprint arXiv:2406.14863, 2024

    2024 arXiv

  24. [32]

    Chaotic weights: A novel approach to protect intellectual property of deep neural networks,

    N. Lin, X. Chen, H. Lu, and X. Li, “Chaotic weights: A novel approach to protect intellectual property of deep neural networks,” IEEE Trans. Computer-Aided Des. Integr. Circuits Syst. , vol. 40, no. 7, pp. 1327– 1339, 2020

    2020

  25. [33]

    Nnsplitter: an active defense solution for dnn model via automated weight obfuscation,

    T. Zhou, Y . Luo, S. Ren, and X. Xu, “Nnsplitter: an active defense solution for dnn model via automated weight obfuscation,” in Proc. Int. Conf. Mach. Learn. PMLR, 2023, pp. 42 614–42 624

    2023

  26. [34]

    Snngx: Securing spiking neural networks with ge- netic xor encryption on rram-based neuromorphic accelerator,

    K. Wong et al. , “Snngx: Securing spiking neural networks with ge- netic xor encryption on rram-based neuromorphic accelerator,” in Proc. IEEE/ACM Int. Conf. Computer-Aided Des. , 2024, pp. 1–9

    2024

  27. [35]

    Non-transferable learning: A new approach for model ownership verification and applicability authorization,

    L. Wang et al., “Non-transferable learning: A new approach for model ownership verification and applicability authorization,” arXiv preprint arXiv:2106.06916, 2021

    2021 arXiv

  28. [36]

    Protecting intellectual property with reliable availability of learning models in ai-based cybersecurity services,

    G. Ren et al., “Protecting intellectual property with reliable availability of learning models in ai-based cybersecurity services,” IEEE Trans. Dependable Secure Comput. , vol. 21, no. 2, pp. 600–617, 2022

    2022

  29. [37]

    Deep serial number: Computational watermark for dnn intellectual property protection,

    R. Tang, M. Du, and X. Hu, “Deep serial number: Computational watermark for dnn intellectual property protection,” in Prof. Joint Eur. Conf. Mach. Learn. Knowl. Discovery Databases . Springer, 2023, pp. 157–173

    2023

  30. [38]

    Securenet: Proactive intellectual property protection and model security defense for dnns based on backdoor learning,

    P. Li, J. Huang, H. Wu, Z. Zhang, and C. Qi, “Securenet: Proactive intellectual property protection and model security defense for dnns based on backdoor learning,” Neural Networks , vol. 174, p. 106199, 2024

    2024

  31. [39]

    The md5 message-digest algorithm,

    R. Rivest, “The md5 message-digest algorithm,” Tech. Rep., 1992

    1992

  32. [40]

    Us secure hash algorithm 1 (sha1),

    D. Eastlake 3rd and P. Jones, “Us secure hash algorithm 1 (sha1),” Tech. Rep., 2001

    2001

  33. [41]

    Chameleon hashing and signatures,

    H. Krawczyk and T. Rabin, “Chameleon hashing and signatures,” Cryptology ePrint Archive , 1998

    1998

  34. [42]

    The discrete logarithm problem,

    K. S. McCurley, “The discrete logarithm problem,” in Proc. of Symp. in Applied Math, vol. 42. USA, 1990, pp. 49–74

    1990

  35. [43]

    Batch normalization: Accelerating deep network training by reducing internal covariate shift,

    S. Ioffe, “Batch normalization: Accelerating deep network training by reducing internal covariate shift,” arXiv preprint arXiv:1502.03167 , 2015

    2015 arXiv

  36. [44]

    Group normalization,

    Y . Wu and K. He, “Group normalization,” in Proc. Eur. Conf. Comput. Vis., 2018, pp. 3–19

    2018

  37. [45]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” 2009

    2009

  38. [46]

    Learning generative visual models from few training examples: An incremental bayesian approach tested on 101 object categories,

    L. Fei-Fei, R. Fergus, and P. Perona, “Learning generative visual models from few training examples: An incremental bayesian approach tested on 101 object categories,” Comput. Vision Pattern Recognit. Workshop , 2004

    2004

  39. [47]

    Imagenet classification with deep convolutional neural networks,

    A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” Proc. Adv. Neural Inform. Process. Syst., vol. 25, 2012

    2012

  40. [48]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., 2016, pp. 770–778

    2016

  41. [49]

    Sok: How robust is image classification deep neural network watermarking?

    N. Lukas, E. Jiang, X. Li, and F. Kerschbaum, “Sok: How robust is image classification deep neural network watermarking?” in Proc. IEEE Symp. Secur. Privacy. IEEE, 2022, pp. 787–804

    2022

  42. [50]

    How powerful are graph neural networks?

    K. Xu, W. Hu, J. Leskovec, and S. Jegelka, “How powerful are graph neural networks?” in Proc. Int. Conf. Learn. Representations

  43. [51]

    The network data repository with interactive graph analytics and visualization,

    R. A. Rossi and N. K. Ahmed, “The network data repository with interactive graph analytics and visualization,” in Proc. AAAI Conf. Artif. Intell., vol. 29, no. 1, 2015

    2015

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.