Fingerprinting Deep Neural Networks for Ownership Protection: An Analytical Approach

Guang Yang; Ziye Geng; Yihang Chen; Changqing Luo

cs.CRMar 22, 2026

Fingerprinting Deep Neural Networks for Ownership Protection: An Analytical Approach

Authors: Guang Yang, Ziye Geng, Yihang Chen, Changqing Luo

Organizations: Virginia Commonwealth University · University of Houston

Abstract

Adversarial-example-based fingerprinting approaches, which leverage the decision boundary characteristics of deep neural networks (DNNs) to craft fingerprints, have proven effective for model ownership protection. However, a fundamental challenge remains unresolved: how far a fingerprint should be placed from the decision boundary to simultaneously satisfy two essential properties, i.e., robustness and uniqueness, for effective and reliable ownership protection. Despite the importance of the fingerprint-to-boundary distance, existing works lack a theoretical solution and instead rely on empirical heuristics, which may violate either robustness or uniqueness properties. We propose AnaFP, an analytical fingerprinting scheme that constructs fingerprints under theoretical guidance. Specifically, we formulate fingerprint generation as controlling the fingerprint-to-boundary distance through a tunable stretch factor. To ensure both robustness and uniqueness, we mathematically formalize these properties that determine the lower and upper bounds of the stretch factor. These bounds jointly define an admissible interval within which the stretch factor must lie, thereby establishing a theoretical connection between the two constraints and the fingerprint-to-boundary distance. To enable practical fingerprint generation, we approximate the original (infinite) sets of pirated and independently trained models using two finite surrogate model pools and employ a quantile-based relaxation strategy to relax the derived bounds. Due to the circular dependency between the lower bound and the stretch factor, we apply grid search over the admissible interval to determine the most feasible stretch factor. Extensive experimental results show that AnaFP consistently outperforms prior methods, achieving effective ownership verification across diverse model architectures and model modification attacks.

Figures & tables

Figure 1: A typical model fingerprinting scenario.

Figure 2: The pipeline of fingerprint generation and ownership verification.

Method	CNN (CIFAR-10)	CNN (CIFAR-100)	MLP (MNIST)	GNN (PROTEINS)
AnaFP (ours)	0.957 $\pm$ 0.002	0.893 $\pm$ 0.005	0.963 $\pm$ 0.002	0.926 $\pm$ 0.005
UAP	0.850 $\pm$ 0.010	0.806 $\pm$ 0.021	0.906 $\pm$ 0.004	–
IPGuard	0.715 $\pm$ 0.075	0.725 $\pm$ 0.090	0.873 $\pm$ 0.018	0.636 $\pm$ 0.067
MarginFinger	0.671 $\pm$ 0.064	0.630 $\pm$ 0.072	0.653 $\pm$ 0.051	–
AKH	0.723 $\pm$ 0.016	0.802 $\pm$ 0.019	0.851 $\pm$ 0.013	0.854 $\pm$ 0.021
ADV-TRA	0.878 $\pm$ 0.012	0.850 $\pm$ 0.024	0.887 $\pm$ 0.005	–

Table 1: AUCs achieved by different approaches across DNN models and datasets.

Figure 3: (a) The ROC curve and (b) the matching rate distribution.

Method	Pruning	Fine-tuning	KD	AT	N-finetune	P-finetune	Prune-KD
AnaFP (ours)	1.000 $\pm$ 0.000	0.979 $\pm$ 0.008	0.756 $\pm$ 0.023	0.983 $\pm$ 0.015	0.978 $\pm$ 0.010	0.989 $\pm$ 0.007	0.689 $\pm$ 0.031
UAP	1.000 $\pm$ 0.000	0.868 $\pm$ 0.023	0.679 $\pm$ 0.013	0.783 $\pm$ 0.041	0.870 $\pm$ 0.021	0.876 $\pm$ 0.022	0.625 $\pm$ 0.026
IPGuard	0.999 $\pm$ 0.002	0.741 $\pm$ 0.113	0.559 $\pm$ 0.105	0.616 $\pm$ 0.026	0.679 $\pm$ 0.104	0.671 $\pm$ 0.106	0.596 $\pm$ 0.079
MarginFinger	1.000 $\pm$ 0.000	0.658 $\pm$ 0.119	0.554 $\pm$ 0.083	0.672 $\pm$ 0.087	0.586 $\pm$ 0.064	0.638 $\pm$ 0.115	0.543 $\pm$ 0.088
AKH	0.999 $\pm$ 0.001	0.848 $\pm$ 0.016	0.616 $\pm$ 0.054	0.627 $\pm$ 0.122	0.716 $\pm$ 0.039	0.701 $\pm$ 0.052	0.636 $\pm$ 0.047
ADV-TRA	1.000 $\pm$ 0.000	0.923 $\pm$ 0.010	0.660 $\pm$ 0.025	0.742 $\pm$ 0.036	0.895 $\pm$ 0.032	0.857 $\pm$ 0.013	0.633 $\pm$ 0.035

Table 2: AUCs under various performance-preserving model modifications.

Figure 4: Line plot (top axis): effect of surrogate pool size; Bar plot (bottom axis): effect of surrogate pool diversity.

$q_{\mathrm{margin}}/q_{\mathrm{lip}}$	$0.1/0.9$	$0.2/0.8$	$0.3/0.7$	$0.4/0.6$	$0.5/0.5$	$0.6/0.4$	$0.7/0.3$	$0.8/0.2$	$0.9/0.1$
Valid Fingerprints	0	0	11	33	56	103	228	428	1158
AUC	–	–	0.848	0.906	0.957	0.959	0.951	0.938	0.896

Table 3: Effect of the quantile thresholds.

Figure 5: The AUCs achieved by AnaFP and three variants.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Method	Pruning	Finetuning	KD	AT	N-finetune	P-finetune	Prune-KD
AnaFP (ours)	0.963 $\pm$ 0.002	0.954 $\pm$ 0.004	0.596 $\pm$ 0.009	0.930 $\pm$ 0.007	0.957 $\pm$ 0.005	0.956 $\pm$ 0.004	0.574 $\pm$ 0.013
UAP	0.897 $\pm$ 0.015	0.852 $\pm$ 0.022	0.598 $\pm$ 0.018	0.802 $\pm$ 0.027	0.852 $\pm$ 0.022	0.859 $\pm$ 0.021	0.583 $\pm$ 0.019
IPGuard	0.845 $\pm$ 0.086	0.811 $\pm$ 0.092	0.461 $\pm$ 0.096	0.721 $\pm$ 0.080	0.763 $\pm$ 0.088	0.750 $\pm$ 0.098	0.496 $\pm$ 0.078
MarginFinger	0.737 $\pm$ 0.076	0.667 $\pm$ 0.092	0.519 $\pm$ 0.026	0.679 $\pm$ 0.092	0.653 $\pm$ 0.089	0.553 $\pm$ 0.058	0.488 $\pm$ 0.026
AKH	0.915 $\pm$ 0.007	0.838 $\pm$ 0.032	0.592 $\pm$ 0.034	0.762 $\pm$ 0.076	0.829 $\pm$ 0.040	0.878 $\pm$ 0.044	0.601 $\pm$ 0.041
ADV-TRA	0.953 $\pm$ 0.007	0.904 $\pm$ 0.024	0.561 $\pm$ 0.011	0.886 $\pm$ 0.035	0.901 $\pm$ 0.017	0.898 $\pm$ 0.031	0.544 $\pm$ 0.030

Appendix

Table 4: AUCs under various performance-preserving model modifications on CNN models trained on CIFAR100.

Method	Pruning	Finetuning	KD	AT	N-finetune	P-finetune	Prune-KD
AnaFP (ours)	1.000 $\pm$ 0.000	1.000 $\pm$ 0.000	0.792 $\pm$ 0.002	0.987 $\pm$ 0.005	1.000 $\pm$ 0.000	0.999 $\pm$ 0.000	0.788 $\pm$ 0.006
UAP	0.981 $\pm$ 0.001	0.969 $\pm$ 0.006	0.635 $\pm$ 0.002	0.931 $\pm$ 0.010	0.968 $\pm$ 0.007	0.976 $\pm$ 0.003	0.610 $\pm$ 0.005
IPGuard	0.924 $\pm$ 0.042	0.983 $\pm$ 0.007	0.535 $\pm$ 0.036	0.902 $\pm$ 0.029	0.938 $\pm$ 0.008	0.922 $\pm$ 0.037	0.517 $\pm$ 0.029
MarginFinger	0.708 $\pm$ 0.130	0.750 $\pm$ 0.145	0.572 $\pm$ 0.041	0.762 $\pm$ 0.149	0.759 $\pm$ 0.146	0.586 $\pm$ 0.090	0.570 $\pm$ 0.034
AKH	0.849 $\pm$ 0.017	0.870 $\pm$ 0.023	0.765 $\pm$ 0.008	0.897 $\pm$ 0.026	0.864 $\pm$ 0.025	0.777 $\pm$ 0.009	0.759 $\pm$ 0.011
ADV-TRA	0.971 $\pm$ 0.010	0.964 $\pm$ 0.007	0.596 $\pm$ 0.011	0.907 $\pm$ 0.005	0.922 $\pm$ 0.004	0.953 $\pm$ 0.001	0.602 $\pm$ 0.005

Appendix

Table 5: AUCs under various performance-preserving model modifications on MLP models.

Method	Pruning	Finetuning	KD	AT	N-finetune	P-finetune	Prune-KD
AnaFP (ours)	0.933 $\pm$ 0.002	0.971 $\pm$ 0.007	0.806 $\pm$ 0.002	0.970 $\pm$ 0.012	0.962 $\pm$ 0.013	0.913 $\pm$ 0.006	0.736 $\pm$ 0.015
IPGuard	0.806 $\pm$ 0.051	0.668 $\pm$ 0.053	0.529 $\pm$ 0.330	0.612 $\pm$ 0.122	0669 $\pm$ 0.027	0.551 $\pm$ 0.074	0.571 $\pm$ 0.174
AKH	0.859 $\pm$ 0.011	0.831 $\pm$ 0.043	0.790 $\pm$ 0.021	0.869 $\pm$ 0.045	0.838 $\pm$ 0.041	0.849 $\pm$ 0.038	0.719 $\pm$ 0.036

Appendix

Table 6: AUCs under various performance-preserving model modifications on GNN models.

Method	TPR	FPR	TNR	FNR
AnaFP (ours)	0.80	0.22	0.78	0.20
UAP	0.73	0.30	0.70	0.27
IPGuard	0.58	0.46	0.54	0.42
MarginFinger	0.57	0.47	0.53	0.43
AKH	0.63	0.40	0.60	0.37
ADV-TRA	0.75	0.27	0.73	0.25

Appendix

Table 7: Detection performance under the KD attack for CNN/CIFAR10.

	ResNet-18		ViT-S/16
	Time	Memory	Time	Memory
AnaFP (ours)	33 m 8 s	13 GB	1 h 26 m	40 GB
UAP	4 h 55 m	4 GB	8 h 10 m	10 GB
IPGuard	1 m 6 s	1 GB	1 m 41 s	3 GB
MarginFinger	51 m 18 s	4 GB	1 h 14 m	10 GB
AKH	20 s	1 GB	1 m 10 s	3 GB

Appendix

Table 8: Time cost and peak GPU memory consumption of different fingerprinting methods under two representative protected models.

Protected Model	Surrogate pool size	Step 1	Step 2	Step 3
ViT-S/16	4	63s	3856s	1276s
ResNet18	4	8s	1004s	976s
ViT-S/16	8	61s	3855s	2121s
ResNet18	8	8s	997s	1419s

Appendix

Table 9: Time cost for the three fingerprint-generation steps: Step 1 (anchor selection), Step 2 (adversarial perturbation generation), and Step 3 (

\tau

search).

Protected Model	Surrogates	Step 2	Step 3
ViT-S/16	4	40G	3G
ResNet18	4	13G	1G
ViT-S/16	8	41G	3.2G
ResNet18	8	13G	1.1G

Appendix

Table 10: Peak memory consumption for Step 2 (adversarial perturbation generation) and Step 3 (grid search).

A Robust Watermark-based Fingerprint Framework for GNNs Ownership Verification
Sep 4, 2026Han Zhang, Yan Wang, Guanfeng Liu +3Graph Neural Networks Robust Watermarking
Macquarie University, Sydney, Australia · Nanyang Technological University, Singapore
From Construction to Injection: Edit-Based Fingerprints for Large Language Models
Sep 3, 2025Yue Li, Xin Yi, Dongsheng Shi +3Language Model Fingerprinting LLM Security
East China Normal University · Hasso Plattner Institute/University of Potsdam
Hey, That's My Model! Introducing Chain & Hash, An LLM Fingerprinting Technique
Jul 15, 2024Mark Russinovich, Yanan Cai, Ahmed SalemLanguage Model Fingerprinting
Microsoft

Sep 4, 2026J/K move · Enter open · S save

A Robust Watermark-based Fingerprint Framework for GNNs Ownership Verification

Han Zhang, Yan Wang, Guanfeng Liu, Pengfei Ding+2

Macquarie University, Sydney, Australia · Nanyang Technological University, Singapore

Graph Neural Networks Robust Watermarking

Open paper AskPDF arXiv

The high training cost of Graph Neural Networks (GNNs) has raised growing concerns regarding model ownership infringement, such as model stealing and unauthorized misuse. To verify model ownership and prevent significant economic losses, two groups of GNN Ownership Verification (OV) methods have been proposed: watermark-based methods and fingerprint-based methods. However, these methods typically face three limitations: (1) the performance degradation of protected models caused by out-of-distribution (OOD) watermark graphs with respect to the training set; (2) the unrealistic assumption that surrogate models have been trained on a watermark-containing training set; and (3) over-reliance on specific output levels for fingerprint extraction. In this paper, we propose a Robust watErMArk-based fingeRprint frameworK for GNNs, named REMARK. REMARK first generates carefully crafted in-distribution watermark graphs that maximize output differences between GNN models, thus mitigating OOD-induced performance degradation. REMARK then extracts robust fingerprints from these output differences to verify GNN ownership, thereby removing the assumptions that surrogate models must be trained on a watermark-containing dataset or expose specific output levels. Extensive experiments across widely used real-world datasets and GNN architectures demonstrate that REMARK achieves state-of-the-art OV accuracy and robustness while preserving the utility of protected models.

Abstract

Explore similar work

A Robust Watermark-based Fingerprint Framework for GNNs Ownership Verification

From Construction to Injection: Edit-Based Fingerprints for Large Language Models

Hey, That's My Model! Introducing Chain & Hash, An LLM Fingerprinting Technique