CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attacks

Bolin Shen; Zhan Cheng; Neil Zhenqiang Gong; Fan Yao; Yushun Dong

cs.LGFeb 23, 2026

CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attacks

Authors: Bolin Shen, Zhan Cheng, Neil Zhenqiang Gong, Fan Yao, Yushun Dong

Organizations: Department of Computer Science, Florida State University, Tallahassee, Florida, United States · Department of Mathematics, University of Wisconsin, Madison, Wisconsin, United States · Department of Computer Science, Duke University, Durham, North Carolina, United States · Department of Statistics and Operations Research, University of North Carolina at Chapel Hill, Chapel Hill, North Carolina, United States

Abstract

Machine Learning as a Service (MLaaS) has emerged as a widely adopted paradigm for providing access to deep neural network (DNN) models, enabling users to conveniently leverage these models through standardized APIs. However, such services are highly vulnerable to Model Extraction Attacks (MEAs), where an adversary repeatedly queries a target model to collect input-output pairs and uses them to train a surrogate model that closely replicates its functionality. While numerous defense strategies have been proposed, verifying the ownership of a suspicious model with strict theoretical guarantees remains a challenging task. To address this gap, we introduce CREDIT, a certified ownership verification against MEAs. Specifically, we employ mutual information to quantify the similarity between DNN models, propose a practical verification threshold, and provide rigorous theoretical guarantees for ownership verification based on this threshold. We extensively evaluate our approach on several mainstream datasets across different domains and tasks, achieving state-of-the-art performance. Our implementation is publicly available at: https://github.com/LabRAI/CREDIT.

Figures & tables

Dataset	Backbone	Vanilla	Backdooring	EWE	IPGuard	UAP	CREDIT
CIFAR-10	ResNet	$95.70\pm 0.03$	$78.10\pm 2.18$	$90.25\pm 0.02$	$91.08\pm 0.00$	$84.73\pm 2.26$	$\mathbf{94.67\pm 0.22}$
	VGG	$92.18\pm 0.01$	$77.60\pm 2.76$	$88.82\pm 0.03$	$89.80\pm 0.02$	$82.91\pm 2.63$	$\mathbf{91.68\pm 0.17}$
	DenseNet	$93.33\pm 0.07$	$60.45\pm 3.67$	$86.22\pm 0.10$	$89.41\pm 0.00$	$74.82\pm 4.50$	$\mathbf{92.58\pm 0.15}$
	GoogLeNet	$94.90\pm 0.04$	$89.31\pm 1.38$	$93.58\pm 0.03$	$92.98\pm 0.19$	$91.84\pm 0.92$	$\mathbf{94.67\pm 0.11}$
CIFAR-100	ResNet	$80.48\pm 0.11$	$74.43\pm 0.17$	$75.85\pm 0.07$	$77.54\pm 0.05$	$64.30\pm 4.14$	$\mathbf{79.90\pm 0.21}$
	VGG	$77.41\pm 0.09$	$73.76\pm 0.29$	$74.48\pm 0.03$	$76.22\pm 0.01$	$71.10\pm 1.58$	$\mathbf{76.71\pm 0.20}$

Table 1: Evaluation of all defense methods on downstream tasks in terms of utility performance. All results are reported as accuracy, with the best performance highlighted in bold .

Method	ResNet	VGG	DenseNet	GoogLeNet
Backdooring	58.64	51.85	74.07	80.25
EWE	51.24	62.96	48.77	62.35
IPGuard	40.74	61.11	67.90	50.62
UAP	52.47	67.28	72.22	79.63
Our	$\mathbf{100.0}$	$\mathbf{100.0}$	$\mathbf{100.0}$	$\mathbf{100.0}$

Table 2: Evaluation of defense methods on ownership verification after MEAs. Results are reported as AUC, with the best performance highlighted in bold .

Panel of Figure 1 — Figure 1: Analysis of the reliability of certification under different choices of $\sigma$ .

Method	VGG-16 (15M)		ResNet-50 (25.6M)
Method	Preparation(s)	Verification(s)	Preparation(s)	Verification(s)
Backdooring	0.594 $\pm$ 0.11	83.10 $\pm$ 0.85	0.399 $\pm$ 0.09	188.8 $\pm$ 0.40
EWE	0.279 $\pm$ 0.00	73.40 $\pm$ 0.13	0.199 $\pm$ 0.02	189.0 $\pm$ 0.76
IPGuard	1.783 $\pm$ 0.00	73.94 $\pm$ 0.23	4.319 $\pm$ 0.00	189.0 $\pm$ 0.41
UAP	5.587 $\pm$ 0.13	72.74 $\pm$ 0.08	5.722 $\pm$ 0.14	180.3 $\pm$ 0.32
Our	$\mathbf{0.001\pm 0.00}$	$\mathbf{22.23\pm 0.07}$	$\mathbf{0.001\pm 0.00}$	$\mathbf{22.62\pm 0.36}$

Table 3: Efficiency of ownership verification methods in both the preparation and verification stages across backbone models with different parameter sizes. Results are reported in seconds, with the best performance highlighted in bold .

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Classes	#Images	Train / Test Split	Resolution
CIFAR-10	10	60,000	50,000 / 10,000	$32\times 32$ RGB
CIFAR-100	100	60,000	50,000 / 10,000	$32\times 32$ RGB

Appendix

Table 4: Statistics of commonly used real-world image classification datasets.

Dataset	#Graphs	Avg. #Nodes	Avg. #Edges	#Features	#Classes
ENZYMES	600	$\sim$ 32.6	$\sim$ 124.3	3	6
PROTEINS	1,113	$\sim$ 39.1	$\sim$ 145.6	3	2

Appendix

Table 5: Statistics of commonly used real-world graph classification datasets.

$k$	MI (mean $\pm$ std)
3	$0.0492\pm 0.0028$
5	$0.0422\pm 0.0021$
7	$0.0402\pm 0.0026$
10	$0.0470\pm 0.0025$

Appendix

Table 7

Repeat $m$	Distinct Query Ratio	Surrogate Test Acc
1	0.1000	0.7303
2	0.0500	0.5125
4	0.0250	0.2833
8	0.0125	0.1997
10	0.0100	0.1720

Appendix

Table 6: Effect of repeated queries under a fixed total query budget

q

. Increasing

m

reduces the number of distinct queries and significantly degrades the utility of the extracted surrogate.

Method	ResNet	VGG	DenseNet	GoogLeNet
Backdooring	58.64	51.85	74.07	80.25
EWE	51.24	62.96	48.77	62.35
IPGuard	40.74	61.11	67.90	50.62
UAP	52.47	67.28	72.22	79.63
MiSentry	47.30	54.88	59.20	61.44
CREDIT (ours)	100.0	100.0	100.0	100.0

Appendix

Table 7: Ownership verification AUC under the model extraction setting.

Attack Type	Utility Budget $\delta$	Test Acc	MI	Verification AUC
None	$0\%$	0.7322	2.2887	1.0000
Decorrelation	$3\%$	0.7301	2.2611	1.0000
Decorrelation	$5\%$	0.7182	2.2498	1.0000
Decorrelation	$10\%$	0.6947	2.2023	1.0000

Appendix

Table 8: Worst-case decorrelation attacks under bounded utility loss.

Model	MI	Verification AUC
Word2Vec	1.2331	1.0000

Appendix

Table 9: Ownership verification results on a Word2Vec model trained on STSb.

Explore similar work

CITED: A Decision Boundary-Aware Signature for GNNs Towards Model Extraction Defense
Feb 23, 2026Bolin Shen, Md Shamim Seraj, Zhan Cheng +2Model Extraction Attacks Graph Neural Networks
Department of Computer Science, Florida State University, Tallahassee, Florida, United States · Department of Mathematics, University of Wisconsin, Madison, Wisconsin, United States
AI Model Extraction Attacks: Bypassing Single-Client Assumptions in Defenses
Jun 2, 2026Maxime Schwarzer, Johannes F. Loevenich, Gustavo Sánchez +5Model Extraction Attacks
CortAIx Labs, Thales Deutschland, Ditzingen, Germany · Department of Mathematics/Computer Science, University of Osnabrück, Osnabrück, Germany · Institute for Automation and Applied Informatics (IAI), Karlsruhe Institute of Technology (KIT), Karlsruhe, Germany +2
CertDW: Towards Certified Dataset Ownership Verification via Conformal Calibration
Jun 16, 2025Ting Qiao, Yiming Li, Jianbin Li +5Dataset Watermarking Robust Watermarking
School of Control and Computer Engineering, North China Electric Power University, Beijing,102206, China · College of Computing and Data Science, Nanyang Technological University, Singapore, 639798, Singapore · School of Cybersecurity, Northwestern Polytechnical University, Xi’an, 710072, China +2

Feb 23, 2026J/K move · Enter open · S save

CITED: A Decision Boundary-Aware Signature for GNNs Towards Model Extraction Defense

Bolin Shen, Md Shamim Seraj, Zhan Cheng, Shayok Chakraborty+1

Department of Computer Science, Florida State University, Tallahassee, Florida, United States · Department of Mathematics, University of Wisconsin, Madison, Wisconsin, United States

Model Extraction Attacks Graph Neural Networks

Open paper AskPDF arXiv

Graph neural networks (GNNs) have demonstrated superior performance in various applications, such as recommendation systems and financial risk management. However, deploying large-scale GNN models locally is particularly challenging for users, as it requires significant computational resources and extensive property data. Consequently, Machine Learning as a Service (MLaaS) has become increasingly popular, offering a convenient way to deploy and access various models, including GNNs. However, an emerging threat known as Model Extraction Attacks (MEAs) presents significant risks, as adversaries can readily obtain surrogate GNN models exhibiting similar functionality. Specifically, attackers repeatedly query the target model using subgraph inputs to collect corresponding responses. These input-output pairs are subsequently utilized to train their own surrogate models at minimal cost. Many techniques have been proposed to defend against MEAs, but most are limited to specific output levels (e.g., embedding or label) and suffer from inherent technical drawbacks. To address these limitations, we propose a novel ownership verification framework CITED which is a first-of-its-kind method to achieve ownership verification on both embedding and label levels. Moreover, CITED is a novel signature-based method that neither harms downstream performance nor introduces auxiliary models that reduce efficiency, while still outperforming all watermarking and fingerprinting approaches. Extensive experiments demonstrate the effectiveness and robustness of our CITED framework. Code is available at: https://github.com/LabRAI/CITED.

Abstract

Explore similar work

CITED: A Decision Boundary-Aware Signature for GNNs Towards Model Extraction Defense

AI Model Extraction Attacks: Bypassing Single-Client Assumptions in Defenses

CertDW: Towards Certified Dataset Ownership Verification via Conformal Calibration