Fingerprinting Deep Neural Networks for Ownership Protection: An Analytical Approach

• URL: http://arxiv.org/abs/2603.21411v1
• Date: Sun, 22 Mar 2026 21:31:11 GMT
• Title: Fingerprinting Deep Neural Networks for Ownership Protection: An Analytical Approach
• Abstract summary: AnaFP is an analytical fingerprinting scheme that constructs fingerprints under theoretical guidance.<n>We formalize properties that determine the lower and upper bounds of the stretch factor.<n>Experiments show that AnaFP consistently outperforms prior methods.
• Score: 9.981615514164469
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Adversarial-example-based fingerprinting approaches, which leverage the decision boundary characteristics of deep neural networks (DNNs) to craft fingerprints, have proven effective for model ownership protection. However, a fundamental challenge remains unresolved: how far a fingerprint should be placed from the decision boundary to simultaneously satisfy two essential properties, i.e., robustness and uniqueness, for effective and reliable ownership protection. Despite the importance of the fingerprint-to-boundary distance, existing works lack a theoretical solution and instead rely on empirical heuristics, which may violate either robustness or uniqueness properties. We propose AnaFP, an analytical fingerprinting scheme that constructs fingerprints under theoretical guidance. Specifically, we formulate fingerprint generation as controlling the fingerprint-to-boundary distance through a tunable stretch factor. To ensure both robustness and uniqueness, we mathematically formalize these properties that determine the lower and upper bounds of the stretch factor. These bounds jointly define an admissible interval within which the stretch factor must lie, thereby establishing a theoretical connection between the two constraints and the fingerprint-to-boundary distance. To enable practical fingerprint generation, we approximate the original (infinite) sets of pirated and independently trained models using two finite surrogate model pools and employ a quantile-based relaxation strategy to relax the derived bounds. Due to the circular dependency between the lower bound and the stretch factor, we apply grid search over the admissible interval to determine the most feasible stretch factor. Extensive experimental results show that AnaFP consistently outperforms prior methods, achieving effective ownership verification across diverse model architectures and model modification attacks.

Related papers

• Efficient, Robust, and Anti-Collusion Fingerprinting of Image Diffusion Models [99.66311024852651]
  Existing model fingerprinting methods lack robustness against collusion attacks.<n>We propose a robust fingerprinting method for T2I models with anti-collusion capabilities.<n>Our method achieves high fidelity and robustness across multiple T2I image generation and editing tasks, with fingerprint extraction accuracy exceeding 99.5%.
  arXiv  Detail & Related papers  (2026-06-11T07:12:13Z)
• IrisFP: Adversarial-Example-based Model Fingerprinting with Enhanced Uniqueness and Robustness [9.981615514164469]
  IrisFP is a novel adversarial-example-based model fingerprinting framework.<n>It positions fingerprints near the intersection of all decision boundaries.<n>It constructs composite-sample fingerprints, each comprising multiple samples close to the multi-boundary intersection.<n>It assesses the discriminative power of generated fingerprints using statistical separability metrics.
  arXiv  Detail & Related papers  (2026-03-26T03:39:29Z)
• A Behavioral Fingerprint for Large Language Models: Provenance Tracking via Refusal Vectors [43.11304710234668]
  We introduce a novel fingerprinting framework that leverages the behavioral patterns induced by safety alignment.<n>In a large-scale identification task across 76 offspring models, our method achieves 100% accuracy in identifying the correct base model family.<n>We propose a theoretical framework to transform this private fingerprint into a publicly verifiable, privacy-preserving artifact.
  arXiv  Detail & Related papers  (2026-02-10T05:57:35Z)
• Antidistillation Fingerprinting [119.66677613290359]
  We introduce antidistillation fingerprinting (ADFP), a principled approach that aligns the fingerprinting objective with the student's learning dynamics.<n>ADFP achieves a significant improvement over state-of-the-art baselines, stronger detection confidence with minimal impact on utility, even when the student model's architecture is unknown.
  arXiv  Detail & Related papers  (2026-02-03T18:15:50Z)
• SELF: A Robust Singular Value and Eigenvalue Approach for LLM Fingerprinting [4.335948336782789]
  We propose a novel intrinsic weight-based fingerprinting scheme that eliminates dependency on input and inherently resists false claims.<n> SELF achieves robust IP protection through two key innovations: 1) unique, scalable and transformation-invariant fingerprint extraction via singular value and eigenvalue decomposition of LLM attention weights, and 2) effective neural network-based fingerprint similarity comparison based on few-shot learning and data augmentation.
  arXiv  Detail & Related papers  (2025-12-03T09:53:47Z)
• Deep Learning Models for Robust Facial Liveness Detection [56.08694048252482]
  This study introduces a robust solution through novel deep learning models addressing the deficiencies in contemporary anti-spoofing techniques.<n>By innovatively integrating texture analysis and reflective properties associated with genuine human traits, our models distinguish authentic presence from replicas with remarkable precision.
  arXiv  Detail & Related papers  (2025-08-12T17:19:20Z)
• RouteMark: A Fingerprint for Intellectual Property Attribution in Routing-based Model Merging [69.2230254959204]
  We propose RouteMark, a framework for IP protection in merged MoE models.<n>Our key insight is that task-specific experts exhibit stable and distinctive routing behaviors under probing inputs.<n>For attribution and tampering detection, we introduce a similarity-based matching algorithm.
  arXiv  Detail & Related papers  (2025-08-03T14:51:58Z)
• ImF: Implicit Fingerprint for Large Language Models [14.580290415247385]
  We introduce a novel adversarial attack named Generation Revision Intervention (GRI) attack.<n>GRI exploits the semantic fragility of current fingerprinting methods, effectively erasing fingerprints.<n>We propose a novel model fingerprint paradigm called Implicit Fingerprints (ImF)
  arXiv  Detail & Related papers  (2025-03-25T05:47:34Z)
• NaturalFinger: Generating Natural Fingerprint with Generative Adversarial Networks [4.536351805614037]
  We propose NaturalFinger which generates natural fingerprint with generative adversarial networks (GANs) Our approach achieves 0.91 ARUC value on the FingerBench dataset (154 models), exceeding the optimal baseline (MetaV) over 17%.
  arXiv  Detail & Related papers  (2023-05-29T03:17:03Z)
• High-Robustness, Low-Transferability Fingerprinting of Neural Networks [78.2527498858308]
  This paper proposes Characteristic Examples for effectively fingerprinting deep neural networks. It features high-robustness to the base model against model pruning as well as low-transferability to unassociated models.
  arXiv  Detail & Related papers  (2021-05-14T21:48:23Z)
• Latent Fingerprint Registration via Matching Densely Sampled Points [100.53031290339483]
  Existing latent fingerprint registration approaches are mainly based on establishing correspondences between minutiae. We propose a non-minutia latent fingerprint registration method which estimates the spatial transformation between a pair of fingerprints. The proposed method achieves the state-of-the-art registration performance, especially under challenging conditions.
  arXiv  Detail & Related papers  (2020-05-12T15:51:59Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.