Adversarial-example-based fingerprinting approaches, which leverage the decision boundary characteristics of deep neural networks (DNNs) to craft fingerprints, have proven effective for model ownership protection. However, a fundamental challenge remains unresolved: how far a fingerprint should be placed from the decision boundary to simultaneously satisfy two essential properties, i.e., robustness and uniqueness, for effective and reliable ownership protection. Despite the importance of the fingerprint-to-boundary distance, existing works lack a theoretical solution and instead rely on empirical heuristics, which may violate either robustness or uniqueness properties. We propose AnaFP, an analytical fingerprinting scheme that constructs fingerprints under theoretical guidance. Specifically, we formulate fingerprint generation as controlling the fingerprint-to-boundary distance through a tunable stretch factor. To ensure both robustness and uniqueness, we mathematically formalize these properties that determine the lower and upper bounds of the stretch factor. These bounds jointly define an admissible interval within which the stretch factor must lie, thereby establishing a theoretical connection between the two constraints and the fingerprint-to-boundary distance. To enable practical fingerprint generation, we approximate the original (infinite) sets of pirated and independently trained models using two finite surrogate model pools and employ a quantile-based relaxation strategy to relax the derived bounds. Due to the circular dependency between the lower bound and the stretch factor, we apply grid search over the admissible interval to determine the most feasible stretch factor. Extensive experimental results show that AnaFP consistently outperforms prior methods, achieving effective ownership verification across diverse model architectures and model modification attacks.
Figures & tables
Figure 1: A typical model fingerprinting scenario.
Figure 2: The pipeline of fingerprint generation and ownership verification.
Method
CNN (CIFAR-10)
CNN (CIFAR-100)
MLP (MNIST)
GNN (PROTEINS)
AnaFP (ours)
0.957 ± 0.002
0.893 ± 0.005
0.963 ± 0.002
0.926 ± 0.005
UAP
0.850 ± 0.010
0.806 ± 0.021
0.906 ± 0.004
–
IPGuard
0.715 ± 0.075
0.725 ± 0.090
0.873 ± 0.018
0.636 ± 0.067
MarginFinger
0.671 ± 0.064
0.630 ± 0.072
0.653 ± 0.051
–
AKH
0.723 ± 0.016
0.802 ± 0.019
0.851 ± 0.013
0.854 ± 0.021
ADV-TRA
0.878 ± 0.012
0.850 ± 0.024
0.887 ± 0.005
–
Table 1: AUCs achieved by different approaches across DNN models and datasets.
Figure 3: (a) The ROC curve and (b) the matching rate distribution.
Method
Pruning
Fine-tuning
KD
AT
N-finetune
P-finetune
Prune-KD
AnaFP (ours)
1.000 ± 0.000
0.979 ± 0.008
0.756 ± 0.023
0.983 ± 0.015
0.978 ± 0.010
0.989 ± 0.007
0.689 ± 0.031
UAP
1.000 ± 0.000
0.868 ± 0.023
0.679 ± 0.013
0.783 ± 0.041
0.870 ± 0.021
0.876 ± 0.022
0.625 ± 0.026
IPGuard
0.999 ± 0.002
0.741 ± 0.113
0.559 ± 0.105
0.616 ± 0.026
0.679 ± 0.104
0.671 ± 0.106
0.596 ± 0.079
MarginFinger
1.000 ± 0.000
0.658 ± 0.119
0.554 ± 0.083
0.672 ± 0.087
0.586 ± 0.064
0.638 ± 0.115
0.543 ± 0.088
AKH
0.999 ± 0.001
0.848 ± 0.016
0.616 ± 0.054
0.627 ± 0.122
0.716 ± 0.039
0.701 ± 0.052
0.636 ± 0.047
ADV-TRA
1.000 ± 0.000
0.923 ± 0.010
0.660 ± 0.025
0.742 ± 0.036
0.895 ± 0.032
0.857 ± 0.013
0.633 ± 0.035
Table 2: AUCs under various performance-preserving model modifications.
Figure 4: Line plot (top axis): effect of surrogate pool size; Bar plot (bottom axis): effect of surrogate pool diversity.
qmargin/qlip
0.1/0.9
0.2/0.8
0.3/0.7
0.4/0.6
0.5/0.5
0.6/0.4
0.7/0.3
0.8/0.2
0.9/0.1
Valid Fingerprints
0
0
11
33
56
103
228
428
1158
AUC
–
–
0.848
0.906
0.957
0.959
0.951
0.938
0.896
Table 3: Effect of the quantile thresholds.
Figure 5: The AUCs achieved by AnaFP and three variants.
Appendix figures & tables7 assets
Supplementary material from the paper’s appendix.
Appendix
Method
Pruning
Finetuning
KD
AT
N-finetune
P-finetune
Prune-KD
AnaFP (ours)
0.963 ± 0.002
0.954 ± 0.004
0.596 ± 0.009
0.930 ± 0.007
0.957 ± 0.005
0.956 ± 0.004
0.574 ± 0.013
UAP
0.897 ± 0.015
0.852 ± 0.022
0.598 ± 0.018
0.802 ± 0.027
0.852 ± 0.022
0.859 ± 0.021
0.583 ± 0.019
IPGuard
0.845 ± 0.086
0.811 ± 0.092
0.461 ± 0.096
0.721 ± 0.080
0.763 ± 0.088
0.750 ± 0.098
0.496 ± 0.078
MarginFinger
0.737 ± 0.076
0.667 ± 0.092
0.519 ± 0.026
0.679 ± 0.092
0.653 ± 0.089
0.553 ± 0.058
0.488 ± 0.026
AKH
0.915 ± 0.007
0.838 ± 0.032
0.592 ± 0.034
0.762 ± 0.076
0.829 ± 0.040
0.878 ± 0.044
0.601 ± 0.041
ADV-TRA
0.953 ± 0.007
0.904 ± 0.024
0.561 ± 0.011
0.886 ± 0.035
0.901 ± 0.017
0.898 ± 0.031
0.544 ± 0.030
Appendix
Table 4: AUCs under various performance-preserving model modifications on CNN models trained on CIFAR100.
Method
Pruning
Finetuning
KD
AT
N-finetune
P-finetune
Prune-KD
AnaFP (ours)
1.000 ± 0.000
1.000 ± 0.000
0.792 ± 0.002
0.987 ± 0.005
1.000 ± 0.000
0.999 ± 0.000
0.788 ± 0.006
UAP
0.981 ± 0.001
0.969 ± 0.006
0.635 ± 0.002
0.931 ± 0.010
0.968 ± 0.007
0.976 ± 0.003
0.610 ± 0.005
IPGuard
0.924 ± 0.042
0.983 ± 0.007
0.535 ± 0.036
0.902 ± 0.029
0.938 ± 0.008
0.922 ± 0.037
0.517 ± 0.029
MarginFinger
0.708 ± 0.130
0.750 ± 0.145
0.572 ± 0.041
0.762 ± 0.149
0.759 ± 0.146
0.586 ± 0.090
0.570 ± 0.034
AKH
0.849 ± 0.017
0.870 ± 0.023
0.765 ± 0.008
0.897 ± 0.026
0.864 ± 0.025
0.777 ± 0.009
0.759 ± 0.011
ADV-TRA
0.971 ± 0.010
0.964 ± 0.007
0.596 ± 0.011
0.907 ± 0.005
0.922 ± 0.004
0.953 ± 0.001
0.602 ± 0.005
Appendix
Table 5: AUCs under various performance-preserving model modifications on MLP models.
Method
Pruning
Finetuning
KD
AT
N-finetune
P-finetune
Prune-KD
AnaFP (ours)
0.933 ± 0.002
0.971 ± 0.007
0.806 ± 0.002
0.970 ± 0.012
0.962 ± 0.013
0.913 ± 0.006
0.736 ± 0.015
IPGuard
0.806 ± 0.051
0.668 ± 0.053
0.529 ± 0.330
0.612 ± 0.122
0669 ± 0.027
0.551 ± 0.074
0.571 ± 0.174
AKH
0.859 ± 0.011
0.831 ± 0.043
0.790 ± 0.021
0.869 ± 0.045
0.838 ± 0.041
0.849 ± 0.038
0.719 ± 0.036
Appendix
Table 6: AUCs under various performance-preserving model modifications on GNN models.
Method
TPR
FPR
TNR
FNR
AnaFP (ours)
0.80
0.22
0.78
0.20
UAP
0.73
0.30
0.70
0.27
IPGuard
0.58
0.46
0.54
0.42
MarginFinger
0.57
0.47
0.53
0.43
AKH
0.63
0.40
0.60
0.37
ADV-TRA
0.75
0.27
0.73
0.25
Appendix
Table 7: Detection performance under the KD attack for CNN/CIFAR10.
ResNet-18
ViT-S/16
Time
Memory
Time
Memory
AnaFP (ours)
33 m 8 s
13 GB
1 h 26 m
40 GB
UAP
4 h 55 m
4 GB
8 h 10 m
10 GB
IPGuard
1 m 6 s
1 GB
1 m 41 s
3 GB
MarginFinger
51 m 18 s
4 GB
1 h 14 m
10 GB
AKH
20 s
1 GB
1 m 10 s
3 GB
Appendix
Table 8: Time cost and peak GPU memory consumption of different fingerprinting methods under two representative protected models.
Protected Model
Surrogate pool size
Step 1
Step 2
Step 3
ViT-S/16
4
63s
3856s
1276s
ResNet18
4
8s
1004s
976s
ViT-S/16
8
61s
3855s
2121s
ResNet18
8
8s
997s
1419s
Appendix
Table 9: Time cost for the three fingerprint-generation steps: Step 1 (anchor selection), Step 2 (adversarial perturbation generation), and Step 3 ( τ search).
Protected Model
Surrogates
Step 2
Step 3
ViT-S/16
4
40G
3G
ResNet18
4
13G
1G
ViT-S/16
8
41G
3.2G
ResNet18
8
13G
1.1G
Appendix
Table 10: Peak memory consumption for Step 2 (adversarial perturbation generation) and Step 3 (grid search).
The high training cost of Graph Neural Networks (GNNs) has raised growing concerns regarding model ownership infringement, such as model stealing and unauthorized misuse. To verify model ownership and prevent significant economic losses, two groups of GNN Ownership Verification (OV) methods have been proposed: watermark-based methods and fingerprint-based methods. However, these methods typically face three limitations: (1) the performance degradation of protected models caused by out-of-distribution (OOD) watermark graphs with respect to the training set; (2) the unrealistic assumption that surrogate models have been trained on a watermark-containing training set; and (3) over-reliance on specific output levels for fingerprint extraction. In this paper, we propose a Robust watErMArk-based fingeRprint frameworK for GNNs, named REMARK. REMARK first generates carefully crafted in-distribution watermark graphs that maximize output differences between GNN models, thus mitigating OOD-induced performance degradation. REMARK then extracts robust fingerprints from these output differences to verify GNN ownership, thereby removing the assumptions that surrogate models must be trained on a watermark-containing dataset or expose specific output levels. Extensive experiments across widely used real-world datasets and GNN architectures demonstrate that REMARK achieves state-of-the-art OV accuracy and robustness while preserving the utility of protected models.
Han Zhang, Yan Wang, Guanfeng Liu +3
Macquarie University, Sydney, Australia · Nanyang Technological University, Singapore
Reliable model fingerprints are essential for protecting large language models (LLMs) against unauthorized redistribution and commercial misuse. In black-box deployment, verification is hindered by defensive filtering of suspected fingerprint queries, as well as by downstream model modifications that may weaken embedded ownership evidence. These risks require fingerprints to be robust in both construction and injection. For construction, prior paradigms face an imperceptibility trade-off: natural-language fingerprints may be accidentally activated, whereas garbled fingerprints are statistically exposed and easier to filter. For injection, existing methods struggle to preserve persistent trigger--target behaviors under model modification. We propose an end-to-end injected fingerprinting framework to address these challenges. Code-mixing Fingerprints (CF) use lowest-perplexity code-mixing under a high-complexity constraint to mitigate this two-sided imperceptibility trade-off. Multi-Candidate Editing (MCEdit) constructs structurally redundant, margin-separated trigger--target mappings to enable graceful degradation under model modification. Extensive evaluations on imperceptibility, detectability, and harmlessness demonstrate robust ownership verification with negligible impact on utility.
Yue Li, Xin Yi, Dongsheng Shi +3
East China Normal University · Hasso Plattner Institute/University of Potsdam
Growing concerns over the theft and misuse of Large Language Models (LLMs) underscore the need for effective fingerprinting to link a model to its original version and detect misuse. We define five essential properties for a successful fingerprint: Transparency, Efficiency, Persistence, Robustness, and Unforgeability. We present a novel fingerprinting framework that provides verifiable proof of ownership while preserving fingerprint integrity. Our approach makes two main contributions. First, a chain and hash technique that cryptographically binds fingerprint prompts to their responses, preventing collisions and enabling irrefutable ownership claims. Second, we address a realistic threat model in which instruction-tuned models' output distribution can be significantly altered through meta-prompts. By incorporating random padding and varied meta-prompt configurations during training, our method maintains robustness even under significant output style changes. Experiments show that our framework securely proves ownership, resists both benign transformations (e.g., fine-tuning) and adversarial fingerprint removal, and extends to fingerprinting LoRA adapters\footnote{We release our code at: https://github.com/microsoft/Chain-Hash.