Queries, Representation & Detection: The Next 100 Model Fingerprinting Schemes

Augustin Godinot; Camilla Penzo; Erwan Le Merrer; Fran\c{c}ois Ta\"iani; Gilles Tr\'edan

REVIEW 2 major objections 6 minor 45 references

Queries, Representation & Detection: The Next 100 Model Fingerprinting Schemes

T0 review · 2 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a simple label-agreement baseline, the Anna Karenina Heuristic (AKH), matches or beats state-of-the-art model fingerprinting schemes on the ModelReuse and SACBench benchmarks, and that current benchmarks therefore do…

desk verdict Useful baseline and taxonomy, but the 'on par with state-of-the-art' headline only covers four reimplemented fingerprints, and that scope gap should be fixed before the paper ships. read the letter →

arxiv 2412.13021 v1 pith:IB2PABTH submitted 2024-12-17 cs.LG cs.CR

Augustin Godinot , Erwan Le Merrer , Camilla Penzo , François Taïani , Gilles Trédan This is my paper · ORCID

classification cs.LGcs.CR

keywords modelfingerprintingstealingdetectionAnnaKareninaheuristicnegativesamplingbenchmarkevaluationpropertytestingdeepneuralnetworks

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Model fingerprinting aims to detect when a deployed machine learning model has been stolen by checking whether a suspected model behaves like the victim's. The paper's central claim is that the simplest conceivable test — sample an input the victim model misclassifies, then flag the suspect as stolen if it makes the same mistake — matches or outperforms four published fingerprinting schemes (IPGuard, ModelDiff, SAC, ZestOfLIME) on the ModelReuse and SACBench benchmarks. If correct, this means the benchmarks are not measuring hard detection: most stealing/obfuscation tasks they contain are already solved by almost any method, and the baseline solves the remaining model-extraction tasks as well as the complex schemes. The paper then introduces the QuRD decomposition (Query, Representation, Detection) to explain the result, generates roughly one hundred previously unexplored scheme combinations, and proposes metrics for building harder, more representative benchmarks. A sympathetic reader would take away a call for simple baselines and harder benchmarks in model stealing detection research.

What carries the argument

Two named mechanisms carry the argument. The Anna Karenina Heuristic (AKH) is the baseline: a label-agreement test performed on the victim's own misclassifications (negative sampling), whose guarantee is Proposition 1's lower bound on the true-negative rate; repeating the one-query test with majority vote drives the false-negative rate down exponentially. The Query, Representation, Detection (QuRD) decomposition is the structural tool: it splits any fingerprint into a query sampler (uniform, adversarial, negative, or subsampling), a representation of the collected outputs (raw labels/logits, pairwise, or listwise correlation), and a detection rule (distance threshold or learned classifier). The paper reimplements IPGuard, ModelDiff, SAC and ZestOfLIME under QuRD, mixes their components to form roughly one hundred new schemes, and uses the decomposition to show that negative sampling consistently matches or beats adversarial sampling while using fewer queries.

What would settle it

Build a benchmark whose negative pairs are genuinely unrelated models that share systematic errors — for example, the same architecture trained independently on the same dataset with different random seeds — and measure AKH's false-positive rate; if it exceeds 5%, the negative-sampling premise fails. Alternatively, fine-tune a stolen model on a few dozen of the victim's misclassified inputs so those errors disappear, and check whether AKH's true-positive rate collapses below the published fingerprints.

Watch

Extended reading notes

Core claim

On the paper's own terms, the contribution is the Anna Karenina Heuristic (AKH): a property test that draws one input $x \sim \mathcal{D}$ such that the victim model errs, $h(x) \neq c(x)$, and returns 'stolen' iff the suspected model agrees with the victim on that input, $h'(x) = h(x)$. Proposition 1 shows AKH has one-sided error: if $h' = h$ it always flags, and if $h' \neq h$ its true-negative rate is $\delta_C \geq (\delta - (1 - \alpha')) / (1 - \alpha)$, where $\delta$ is the Hamming distance between the models and $\alpha, \alpha'$ their accuracies. Empirically, the authors report TPR@5% for AKH that is at least as good as IPGuard, ModelDiff, SAC and ZestOfLIME on ModelReuse (Flower102 and SDog120) and SACBench, and better on Flower102. Because this baseline needs only label query access and no gradient computation, the result is presented as an evaluation artifact: the benchmarks are either non-discriminative or already solved, and the QuRD framework is offered as a systematic way to design and compare the next generation of fingerprinting schemes and benchmarks.

Load-bearing premise

Everything rests on the assumption that a stolen model reproduces the victim's mistakes on the selected hard inputs, while an unrelated model disagrees with the victim often enough on those inputs; the paper's own lower bound for the true-negative rate can be close to zero, so this separation is not guaranteed.

Editorial extensions

If this is right

New fingerprinting papers should be required to compare against a negative-sampling label baseline such as AKH; without it, a reported win over prior art may be a win over nothing.
On the tasks the paper classifies as solved (model leak with identical, quantized, fine-tuned, transferred or pruned weights), a simple label test suffices, and complex fingerprint computations add no measurable detection power at TPR@5%.
Benchmark design should separate per-task results rather than report aggregated scores, because SACBench's low diversity in positive/negative pair generation overestimates fingerprint performance.
For these benchmarks there is an optimal query budget around 50–100 queries, independent of the fingerprinting scheme; extra queries do not help and can even hurt pairwise/listwise representations.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Inference: AKH's success depends on unrelated models disagreeing with the victim on the victim's mistakes; a natural stress test is to build negative pairs from models trained independently on the same data with different seeds, which would share many systematic errors and could drive AKH's false-positive rate above 5%.
Inference: The paper's argument implies that adaptive adversaries could defeat AKH by fine-tuning a stolen model on a few of the victim's misclassified inputs so that it no longer reproduces those errors; measuring this drop in true-positive rate would quantify the baseline's robustness ceiling.
Inference: The query-budget plateau suggests a design heuristic beyond the paper's scope: future fingerprinting schemes should target the 50–100 query regime rather than the thousands-of-queries regime, since queries beyond that range add cost without detection gain.
Inference: A logit-extension of AKH — comparing full prediction vectors on negative inputs instead of only argmax labels — is a natural untested variant that could keep the baseline strong even when stolen models disagree on the hard-label choice but share soft prediction structure.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Bottom line: this is a useful, thought-provoking paper, and the AKH baseline deserves to become a standard point of comparison. But the claim that it performs on par with existing state-of-the-art fingerprints is only established against four reimplemented methods, and that scope matters.

What is genuinely new: the Anna Karenina Heuristic is simple, query the suspected model on inputs the victim misclassifies and flag on label agreement. It is a simplification of negative-sampling ideas already present in SAC and SSF, but naming it and testing it as a baseline is overdue. The QuRD decomposition (Query, Representation, Detection) is a clean way to organize the design space, and the ~100 mixtures plus the open-source toolbox are a real service to the community. The per-task breakdown in Table 3 is also valuable; it shows most model-leak tasks are solved, while model extraction remains the hard subproblem.

Soft spots. The biggest is the generality gap. The abstract says "existing state-of-the-art fingerprints," but the evaluation only includes IPGuard, ModelDiff, SAC, and ZestOfLIME. Table 1 itself lists DeepJudge, MetaV, FBI, SSF, ModelGiF, TAFA, and AFA as prior work, several with available code. If any of those beats AKH on the same pairs, the conclusion that the benchmarks are solved by a simple baseline does not hold as stated. The authors should either add those comparisons or carefully justify the exclusion. Proposition 1 is honest but weak: the lower bound on the true-negative rate can be negative or small, and it does not directly bound TPR@5% as evaluated. That is not fatal for a baseline paper, but the "first theoretical analysis of a fingerprinting scheme" claim is likely overbroad given earlier analyses of watermarking and property testing. The figures would also be easier to read with error bars; the table reports them, so this is a presentation gap, not missing evidence.

The central message stands well enough on its own: on these two benchmarks, a trivial label-agreement test is competitive with much more elaborate fingerprints. That is worth saying and worth publishing after the comparison is broadened. The stress-test concern is legitimate and should be addressed head-on.

Who it is for: anyone building or evaluating model stealing detection. I would bring it to reading group and would cite the QuRD taxonomy. It deserves a serious referee, with the omitted-methods comparison as the main required revision.

Referee Report

2 major / 6 minor

Summary. The paper addresses model fingerprinting for image classifiers: deciding whether a suspected model h' is a stolen copy of a victim model h. Its first contribution is the Anna Karenina Heuristic (AKH), which samples inputs that the victim model misclassifies and flags the suspect whenever it reproduces the victim's (wrong) labels on those inputs; Proposition 1 gives a one-sided-error property-test bound for this rule. The authors report that AKH matches or beats four reimplemented state-of-the-art fingerprints (IPGuard, ModelDiff, SAC, ZestOfLIME) on ModelReuse (Flower102, SDog120) and SACBench (CIFAR10) at TPR@5%, conclude that current benchmarks are largely solved or non-discriminative, and support this conclusion with a Query-Representation-Detection (QuRD) decomposition that yields roughly 100 new fingerprint variants, a per-task breakdown of detection performance (Table 3), and a benchmark-difficulty analysis based on conditioned Hamming distance. The paper closes with a released toolbox and recommendations for harder benchmarks.

Significance. If the empirical claims hold, the paper delivers a field-relevant negative result: on the two most-used model-fingerprinting benchmarks, the simple AKH baseline is competitive with substantially more complex fingerprints, and the hard remaining subtask is label-only model extraction rather than model leak or probit extraction. The QuRD decomposition is a genuinely useful organizing device that makes the design space and its unexplored combinations explicit, and the task-disaggregated results of Table 3 together with the conditioned-Hamming-distance diagnostic of Figure 3 are concrete tools the community can reuse. The paper is also commendable for open-sourcing the toolbox, reporting five seeded runs, and stating its limitations (adaptive adversaries, non-image modalities) explicitly. The main caveat is that the negative result is a claim about state-of-the-art fingerprints as a class, so its strength depends on the completeness of the reimplemented comparison set, which is the subject of major comment 1.

major comments (2)

[Evaluation Setup / Table 1 / Figure 1] The central negative result—that AKH performs on par with 'existing state-of-the-art fingerprints' and that ModelReuse and SACBench are therefore 'either not discriminative or solved'—is established only against four reimplemented schemes (IPGuard, ModelDiff, SAC, ZestOfLIME; see Evaluation Setup). This scoping conflicts with the abstract and with the paper's own Table 1, which catalogs at least nine additional existing fingerprints (DeepJudge, FCAE, FUAP, MetaV, FBI, SSF, ModelGiF, TAFA, AFA) that are never evaluated. Because the roughly 100 QuRD mixtures are assembled solely from components of the four reimplemented schemes, they cannot cover detection paradigms such as learned meta-verifiers (MetaV) or mutual-information comparisons (FBI). If any omitted fingerprint attains a materially higher TPR@5% on the same positive/negative pairs, the inference that complex schemes add no measurable value on these benchmarks is false. I request either that the omitted schemes with available or describable implementations be evaluated, or that all claims be explicitly restricted to the four reimplemented fingerprints.
[Proposition 1 / Eq. (2) / Algorithm 1] Contribution 1 overstates the theoretical support for AKH. Eq. (1) is tautological (identical models agree on every input) and does not address the robustness regime h' approximately equal to h. Eq. (2) lower-bounds the true-negative rate of a single-query test by (delta - (1 - alpha')) / (1 - alpha), which is vacuous whenever the bound is negative or small, so it does not establish the separation between positive and negative pairs reported in Figures 1, 3, and 4 and Table 3; it only supports the heuristic 'when to expect gains' reading that the text itself partially acknowledges. Moreover, the experimental AKH is a multi-query score thresholded at FPR = 5%, whereas Proposition 1 analyzes a one-shot test and an unconditional true-negative rate; no argument connects delta_C or the agreement count on misclassified inputs to the TPR@5% statistic used throughout the evaluation. The theory should either be extended to the thresholded multi-query protocol or be presented as heuristic motivation rather than as a guarantee.

minor comments (6)

[Proof of Proposition 1 (appendix)] In the appendix proof, the under/over-brace annotations in the displayed equation are ambiguous (the 'delta', '<= 1 - alpha'', and '1 - alpha' labels appear attached to the wrong sub-expressions); please reformat the derivation so that each annotation is unambiguously tied to its intended sub-expression.
[Fingerprint evaluation] The procedure for fixing the detection threshold at FPR <= 5% is not fully specified: the paper explains how TPR and FPR are aggregated (Eqs. 10-11) but not whether the threshold is calibrated on a separate pool of negative pairs or on the same U(h) used for evaluation; this should be stated explicitly since TPR@5% is the paper's headline metric.
[Comparing apples to apples (Figure 4)] The explanation for the TPR@5% drop of ModelDiff and SAC between 100 and 400 queries is explicitly speculative ('We believe that when the number of query points is increased, the self-correlation increases'); a small diagnostic plot of the positive/negative distance gap versus query budget would turn this into an evidence-based claim.
[Table 1] The encoding of model access (four text decorations) and representation type (three text emphases) in Table 1 is extremely difficult to read; using separate columns or a legend matrix for access and representation would make the taxonomy actually usable.
[Problem setting] The property-testing statement defines the two cases as h = h' versus h != h' with probability thresholds of 2/3, but the surrounding requirements (Robustness) and the experiments concern h' approximately equal to h under extraction, fine-tuning, and pruning; aligning the formal definition with the approximate-copy regime would improve precision.
[The majority of benchmarked tasks are solved] In the sentence 'these two objectives differ in difficulty ... but they also differ greatly in the efforts the adversary has to consent to in order to reach the same accuracy', the phrase 'consent to' appears to be a translation artifact and should be rephrased (e.g., 'the effort the adversary must expend').

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: AKH is an independently evaluated baseline and QuRD is a taxonomy, not a self-referential derivation.

full rationale

The paper's central derivation is Proposition 1, a direct probability inequality over the definitions of alpha, alpha-prime, delta, and delta_C; it does not assume the conclusion that AKH matches state-of-the-art fingerprints. The h = h' case of Algorithm 1 is a stated tautology (identical models agree on every input), not a fitted result or a disguised prediction. The empirical claim that AKH is on par with IPGuard, ModelDiff, SAC, and ZestOfLIME is tested against external benchmarks (ModelReuse and SACBench) using released model weights; no parameter is fit to a subset of the data and then renamed a prediction. The QuRD decomposition is a taxonomy applied to existing schemes, and the ~100 combinations are constructed from reimplemented components rather than being derived from QuRD by definition. Self-citations (Le Merrer et al. 2020; Le Merrer and Tredan 2019; Maho, Furon, and Le Merrer 2023) appear in background and related-work contexts and are not load-bearing: the decision-boundary intuition, tampering detection, and benign-input techniques are cited as prior art, not as proof of the paper's own claims. The omission of some state-of-the-art fingerprints (e.g., DeepJudge, MetaV, FBI) is a completeness or correctness concern, not a circularity concern, because the paper's comparison is explicitly scoped to the four reimplemented schemes. The appended proof and evaluation-setup sections contain no assertion that a missing reference or circular step is required. No step in the derivation chain reduces to its own inputs, so no circular step can be quoted.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The central claim rests on standard assumptions of the property-testing setting, on the victim's ability to know ground-truth labels for query inputs, and on the representativeness of the ModelReuse and SACBench positive and negative pairs. No free parameters are fitted to make AKH's Proposition 1 work; the only tuned quantity is the FPR 5% detection threshold used for evaluation, which is calibrated on each benchmark's negative pool. No invented entities are introduced.

free parameters (1)

Detection threshold per fingerprint = Calibrated per benchmark to achieve FPR=5%
All TPR@5% results require each fingerprint's decision threshold to be set on the benchmark's negative model pool. This is standard ROC calibration rather than a parameter of AKH's Proposition 1, but it means the reported TPR numbers are conditional on fitting to the test benchmark.

assumptions (5)

domain assumption The victim can identify points x such that h(x) != c(x), meaning it has access to ground-truth labels for sampled inputs.
Used in Algorithm 1 line 1 to build the negative input distribution D_h and implicit in Eq. (5) for negative sampling. If labels are unavailable, AKH cannot be constructed.
domain assumption The suspected model h' answers label queries that can be directly compared with h's labels.
Algorithm 1 step 2 compares h(x) and h'(x), so the query interface must return comparable labels or scores.
standard math Models h and h' are classifiers over the same input and label space, with accuracy and Hamming distance defined with respect to the same data distribution D.
Proposition 1 assumes this setting to define alpha, alpha', delta, and delta_C.
domain assumption The positive and negative model pairs in ModelReuse and SACBench are representative of real model theft and benign models.
The benchmark comparison and the conclusion that the benchmarks are too easy depend on this representativeness. The paper itself notes that SACBench pairs may lack diversity in the section 'Why does SACBench look so easy?'
standard math Goldreich's property-testing framework, including one-sided error and majority-vote amplification, applies to the fingerprinting problem.
Used in the problem setting and to justify running AKH multiple times to reduce false negatives.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Queries, Representation & Detection: The Next 100 Model Fingerprinting Schemes." pith.science (2026). https://pith.science/paper/IB2PABTH

@misc{pith2026241213021,
  author       = {Pith},
  title        = {Pith review of: Queries, Representation & Detection: The Next 100 Model Fingerprinting Schemes},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IB2PABTH}},
  note         = {Machine review of arXiv:2412.13021}
}

abstract

The deployment of machine learning models in operational contexts represents a significant investment for any organisation. Consequently, the risk of these models being misappropriated by competitors needs to be addressed. In recent years, numerous proposals have been put forth to detect instances of model stealing. However, these proposals operate under implicit and disparate data and model access assumptions; as a consequence, it remains unclear how they can be effectively compared to one another. Our evaluation shows that a simple baseline that we introduce performs on par with existing state-of-the-art fingerprints, which, on the other hand, are much more complex. To uncover the reasons behind this intriguing result, this paper introduces a systematic approach to both the creation of model fingerprinting schemes and their evaluation benchmarks. By dividing model fingerprinting into three core components -- Query, Representation and Detection (QuRD) -- we are able to identify $\sim100$ previously unexplored QuRD combinations and gain insights into their performance. Finally, we introduce a set of metrics to compare and guide the creation of more representative model stealing detection benchmarks. Our approach reveals the need for more challenging benchmarks and a sound comparison with baselines. To foster the creation of new fingerprinting schemes and benchmarks, we open-source our fingerprinting toolbox.

Figures

Figures reproduced from arXiv: 2412.13021 by the authors.

**Figure 1.** The TPR@5% of most of the fingerprinting schemes proposed in the literature is at best as good as the simple baseline we introduce. Each colored dot represents the performance of an existing fingerprinting scheme evaluated on a given benchmark. The gray dots are fingerprinting schemes we created using our Query, Representation and Detection (QuRD) decomposition. have not yet been proven secure. Therefore, in addit… view at source ↗

**Figure 2.** TPR@5% gains on ModelReuse obtained by modifying the sampler of existing fingerprints. The sampler can be modified in two ways: drawing seed queries from the train vs test set (materialized as circles vs crosses) or using a different queries sampler (materialized as a different color). Selecting negative seed inputs for adversarial generation instead of the original seeds can lead to improvements on the order of … view at source ↗

**Figure 3.** Distribution of the conditioned Hamming distance [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: The effect of the query budget s on the Efficiency and Robustness of existing fingerprints, as measured by TPR@5%. increases from 100 to 400 queries. This phenomenon is observable only for schemes whose representations are based on a pairwise or a listwise comparison.…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 41 canonical work pages

[1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...
[3]

Ben-Sasson , H.; and Tzadik, S. 2024. Isolation or Hallucination ? Hacking AI Infrastructure Providers for Fun and Weights

work page 2024
[4]

Boenisch, F. 2021. A Systematic Review on Model Watermarking for Neural Networks . Frontiers in Big Data, 4: 729663

work page 2021
[5]

Cao, X.; Jia, J.; and Gong, N. Z. 2021. IPGuard : Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundary . In Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security , ASIA CCS '21, 14--25. New York, NY, USA: Association for Computing Machinery. ISBN 978-1-4503-8287-8

work page 2021
[6]

D.; Steinke, T.; Hayase, J.; Cooper, A

Carlini, N.; Paleka, D.; Dvijotham, K. D.; Steinke, T.; Hayase, J.; Cooper, A. F.; Lee, K.; Jagielski, M.; Nasr, M.; Conmy, A.; Wallace, E.; Rolnick, D.; and Tram \`e r, F. 2024. Stealing Part of a Production Language Model . arXiv:2403.06634

arXiv 2024
[7]

Chen, J.; Wang, J.; Peng, T.; Sun, Y.; Cheng, P.; Ji, S.; Ma, X.; Li, B.; and Song, D. 2022. Copy, Right ? A Testing Framework for Copyright Protection of Deep Learning Models . In 2022 IEEE Symposium on Security and Privacy ( SP ) , 824--841

work page 2022
[8]

Cohen, J.; Rosenfeld, E.; and Kolter, Z. 2019. Certified Adversarial Robustness via Randomized Smoothing . In Proceedings of the 36th International Conference on Machine Learning , 1310--1320. PMLR

work page 2019

Show all 45 references

[9]

Franzen, C. 2024. Mistral CEO Confirms `Leak' of New Open Source AI Model Nearing GPT-4 Performance

2024
[10]

Goldreich, O. 2017. Introduction to Property Testing . Cambridge University Press, 1 edition. ISBN 978-1-107-19405-2 978-1-108-13525-2

2017
[11]

Gu, T.; Dolan-Gavitt , B.; and Garg, S. 2019. BadNets : Identifying Vulnerabilities in the Machine Learning Model Supply Chain . arXiv:1708.06733

2019 arXiv
[12]

Guan, J.; Liang, J.; and He, R. 2022. Are You Stealing My Model ? Sample Correlation for Fingerprinting Deep Neural Networks . In Advances in Neural Information Processing Systems , volume 35, 36571--36584

2022
[13]

He, Z.; Zhang, T.; and Lee, R. 2019. Sensitive- Sample Fingerprinting of Deep Neural Networks . In 2019 IEEE / CVF Conference on Computer Vision and Pattern Recognition ( CVPR ) , 4724--4732

2019
[14]

Jagielski, M.; Carlini, N.; Berthelot, D.; Kurakin, A.; and Papernot, N. 2020. High Accuracy and High Fidelity Extraction of Neural Networks . In 29th USENIX Security Symposium ( USENIX Security 20) , 1345--1362. ISBN 978-1-939133-17-5

2020
[15]

S.; and Papernot, N

Jia, H.; Chen, H.; Guan, J.; Shamsabadi, A. S.; and Papernot, N. 2022. A Zest of LIME : Towards Architecture-Independent Model Distances . In International Conference on Learning Representations

2022
[16]

Khosla, A.; Jayadevaprakash, N.; Yao, B.; and Fei-Fei , L. 2011. Novel Dataset for Fine-Grained Image Categorization. In First Workshop on Fine-Grained Visual Categorization, IEEE Conference on Computer Vision and Pattern Recognition . Colorado Springs, CO

2011
[17]

Krizhevsky, A. 2009. Learning Multiple Layers of Features from Tiny Images . Technical report, University of Toronto

2009
[18]

Le Merrer, E.; P \'e rez, P.; and Tr \'e dan, G. 2020. Adversarial Frontier Stitching for Remote Neural Network Watermarking. Neural Computing and Applications, 32(13): 9233--9244

2020
[19]

Le Merrer, E.; and Tr \'e dan, G. 2019. TamperNN : Efficient Tampering Detection of Deployed Neural Nets . In 2019 IEEE 30th International Symposium on Software Reliability Engineering ( ISSRE ) , 424--434

2019
[20]

Lee, T.; Edwards, B.; Molloy, I.; and Su, D. 2019. Defending Against Neural Network Model Stealing Attacks Using Deceptive Perturbations . In 2019 IEEE Security and Privacy Workshops ( SPW ) , 43--49

2019
[21]

Li, H.; Kadav, A.; Durdanovic, I.; Samet, H.; and Graf, H. P. 2017. Pruning Filters for Efficient ConvNets . In International Conference on Learning Representations

2017
[22]

Li, Y.; Zhang, Z.; Liu, B.; Yang, Z.; and Liu, Y. 2021. ModelDiff : Testing-Based DNN Similarity Comparison for Model Reuse Detection. In Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis , ISSTA 2021, 139--151. New York, NY, USA: Ass...

2021
[23]

Liu, K.; Dolan-Gavitt , B.; and Garg, S. 2018. Fine- Pruning : Defending Against Backdooring Attacks on Deep Neural Networks . In Bailey, M.; Holz, T.; Stamatogiannakis, M.; and Ioannidis, S., eds., Research in Attacks , Intrusions , and Defenses , 273--294. Cham: Springer Int...

2018
[24]

Lukas, N.; Zhang, Y.; and Kerschbaum, F. 2020. Deep Neural Network Fingerprinting by Conferrable Adversarial Examples . In International Conference on Learning Representations

2020
[25]

Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks . In International Conference on Learning Representations

2018
[26]

Maho, T.; Furon, T.; and Le Merrer, E. 2023. Fingerprinting Classifiers With Benign Inputs . IEEE Transactions on Information Forensics and Security, 18: 5459--5472

2023
[27]

Moosavi-Dezfooli , S.-M.; Fawzi, A.; and Frossard, P. 2016. DeepFool : A Simple and Accurate Method to Fool Deep Neural Networks . In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2574--2582

2016
[28]

Nair, R.; Mattetti, M.; Daly, E.; Wei, D.; Alkan, O.; and Zhang, Y. 2021. What Changed ? Interpretable Model Comparison . In Twenty- Ninth International Joint Conference on Artificial Intelligence , volume 3, 2855--2861

2021
[29]

Nilsback, M.-E.; and Zisserman, A. 2008. Automated Flower Classification over a Large Number of Classes . In 2008 Sixth Indian Conference on Computer Vision , Graphics & Image Processing , 722--729

2008
[30]

J.; Augustin, M.; Fritz, M.; and Schiele, B

Oh, S. J.; Augustin, M.; Fritz, M.; and Schiele, B. 2018. Towards Reverse-Engineering Black-Box Neural Networks . In International Conference on Learning Representations

2018
[31]

Ojha, U.; Li, Y.; and Lee, Y. J. 2023. Towards Universal Fake Image Detectors That Generalize Across Generative Models . In Proceedings of the IEEE / CVF Conference on Computer Vision and Pattern Recognition , 24480--24489

2023
[32]

Oliynyk, D.; Mayer, R.; and Rauber, A. 2023. I Know What You Trained Last Summer : A Survey on Stealing Machine Learning Models and Defences . ACM Computing Surveys, 55(14s): 324:1--324:41

2023
[33]

Orekondy, T.; Schiele, B.; and Fritz, M. 2019. Prediction Poisoning : Towards Defenses Against DNN Model Stealing Attacks . In International Conference on Learning Representations

2019
[34]

Pan, X.; Yan, Y.; Zhang, M.; and Yang, M. 2022. MetaV : A Meta-Verifier Approach to Task-Agnostic Model Fingerprinting . In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , KDD '22, 1327--1336. New York, NY, USA: Association for Computing ...

2022
[35]

Pan, X.; Zhang, M.; Lu, Y.; and Yang, M. 2021. TAFA : A Task-Agnostic Fingerprinting Algorithm for Neural Networks . In Bertino, E.; Shulman, H.; and Waidner, M., eds., Computer Security -- ESORICS 2021 , 542--562. Cham: Springer International Publishing. ISBN 978-3-030-88418-5

2021
[36]

Peng, Z.; Li, S.; Chen, G.; Zhang, C.; Zhu, H.; and Xue, M. 2022. Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbations . In Proceedings of the IEEE / CVF Conference on Computer Vision and Pattern Recognition , 13430--13439

2022
[37]

Regazzoni, F.; Palmieri, P.; Smailbegovic, F.; Cammarota, R.; and Polian, I. 2021. Protecting Artificial Intelligence IPs : A Survey of Watermarking and Fingerprinting for Machine Learning. CAAI Transactions on Intelligence Technology, 6(2): 180--191

2021
[38]

Why Should I Trust You ?

Ribeiro, M. T.; Singh, S.; and Guestrin, C. 2016. " Why Should I Trust You ?": Explaining the Predictions of Any Classifier . In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , KDD '16, 1135--1144. New York, NY, USA: Associa...

2016
[39]

Rida, A.; Lesot, M.-J.; Renard, X.; and Marsala, C. 2023. Dynamic Interpretability for Model Comparison via Decision Rules . arXiv:2309.17095

2023 arXiv
[40]

Song, J.; Xu, Z.; Wu, S.; Chen, G.; and Song, M. 2023. ModelGiF : Gradient Fields for Model Functional Distance . In Proceedings of the IEEE / CVF International Conference on Computer Vision , 6125--6135

2023
[41]

Z.; and Chen, Y

Tang, M.; Dai, A.; DiValentin, L.; Ding, A.; Hass, A.; Gong, N. Z.; and Chen, Y. 2024. MODELGUARD : Information-Theoretic Defense Against Model Extraction Attacks . In 33rd USENIX Security Symposium ( USENIX Security 24) . Philadelphia, PA: USENIX Association

2024
[42]

J.; and Papernot, N

Truong, J.-B.; Maini, P.; Walls, R. J.; and Papernot, N. 2021. Data- Free Model Extraction . In Proceedings of the IEEE / CVF Conference on Computer Vision and Pattern Recognition , 4771--4780

2021
[43]

Wang, B.; and Gong, N. Z. 2018. Stealing Hyperparameters in Machine Learning . In 2018 IEEE Symposium on Security and Privacy ( SP ) , 36--52. IEEE Computer Society. ISBN 978-1-5386-4353-2

2018
[44]

Wang, S.; and Chang, C.-H. 2021. Fingerprinting Deep Neural Networks - a DeepFool Approach . In 2021 IEEE International Symposium on Circuits and Systems ( ISCAS ) , 1--5

2021
[45]

Zhao, J.; Hu, Q.; Liu, G.; Ma, X.; Chen, F.; and Hassan, M. M. 2020. AFA : Adversarial Fingerprinting Authentication for Deep Neural Networks. Computer Communications, 150: 488--497

2020

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

[3] [3]

Ben-Sasson , H.; and Tzadik, S. 2024. Isolation or Hallucination ? Hacking AI Infrastructure Providers for Fun and Weights

work page 2024

[4] [4]

Boenisch, F. 2021. A Systematic Review on Model Watermarking for Neural Networks . Frontiers in Big Data, 4: 729663

work page 2021

[5] [5]

Cao, X.; Jia, J.; and Gong, N. Z. 2021. IPGuard : Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundary . In Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security , ASIA CCS '21, 14--25. New York, NY, USA: Association for Computing Machinery. ISBN 978-1-4503-8287-8

work page 2021

[6] [6]

D.; Steinke, T.; Hayase, J.; Cooper, A

Carlini, N.; Paleka, D.; Dvijotham, K. D.; Steinke, T.; Hayase, J.; Cooper, A. F.; Lee, K.; Jagielski, M.; Nasr, M.; Conmy, A.; Wallace, E.; Rolnick, D.; and Tram \`e r, F. 2024. Stealing Part of a Production Language Model . arXiv:2403.06634

arXiv 2024

[7] [7]

Chen, J.; Wang, J.; Peng, T.; Sun, Y.; Cheng, P.; Ji, S.; Ma, X.; Li, B.; and Song, D. 2022. Copy, Right ? A Testing Framework for Copyright Protection of Deep Learning Models . In 2022 IEEE Symposium on Security and Privacy ( SP ) , 824--841

work page 2022

[8] [8]

Cohen, J.; Rosenfeld, E.; and Kolter, Z. 2019. Certified Adversarial Robustness via Randomized Smoothing . In Proceedings of the 36th International Conference on Machine Learning , 1310--1320. PMLR

work page 2019