🤖 AI

FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprint

The paper introduces FIT-Print, a targeted model fingerprinting framework that effectively neutralizes false-claim attacks and eliminates false alarms on independent models while maintaining 100% ownership verification accuracy against diverse reuse techniques.

Original authors: Shuo Shao, Haozhe Zhu, Yiming Li, Hongwei Yao, Tianwei Zhang, Zhan Qin

Published 2026-06-09

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Shuo Shao, Haozhe Zhu, Yiming Li, Hongwei Yao, Tianwei Zhang, Zhan Qin

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The Problem with Digital "Fingerprints"

Imagine you are a chef who spent years developing a secret, delicious recipe (a Deep Learning Model). You decide to share the recipe with the world so others can learn from it. However, you worry that someone might steal your recipe, tweak it slightly, and sell it as their own.

To stop this, you need a way to prove, "Hey, this dish tastes exactly like my secret recipe!"

In the world of AI, this proof is called Model Fingerprinting. It's like leaving a unique mark on your recipe so you can identify it later.

The Flaw in Old Methods:
The paper argues that current fingerprinting methods are like a blindfolded taste test.

How it works now: You give a taster (the verifier) a random spoonful of soup from your recipe and a random spoonful from the suspect's recipe. If they taste similar, you assume the suspect stole your recipe.
The Loophole: A clever thief can cook a "fake" spoonful of soup that happens to taste exactly like your random spoonful, even though their whole pot of soup is completely different. They can trick the taster into thinking they stole your recipe when they didn't. This is called a "False Claim Attack."

The Solution: FIT-Print (The "Targeted" Fingerprint)

The authors introduce a new system called FIT-Print. Instead of a blindfolded taste test, they use a Targeted Signature.

The Analogy: The Secret Handshake
Imagine you don't just ask, "Does this soup taste like mine?" Instead, you say, "Does this soup taste exactly like this specific, complex flavor pattern I invented?"

The Target: You create a specific "Target Fingerprint" (like a secret handshake or a specific logo).
The Optimization: You don't just pick random soup samples. You mathematically tweak your ingredients (the testing samples) until they produce exactly that specific flavor pattern when cooked in your pot.
The Test: When you check a suspect's pot, you ask: "Does your soup produce that exact same specific flavor pattern?"

Why this stops the thieves:

Old Way: It's easy to find a random spoonful that accidentally tastes like mine.
New Way (FIT-Print): It is incredibly difficult for a thief to cook a completely different recipe that accidentally produces your specific, complex, pre-defined flavor pattern. The "space" for a thief to cheat is shrunk down to almost zero.

How They Did It (The Two Methods)

The paper proposes two specific ways to create this "Targeted Signature":

FIT-ModelDiff (The "Bit-by-Bit" Detective):
- This method looks at the model's output one tiny piece at a time (like checking individual letters in a word).
- It measures the distance between how the model reacts to a normal image versus a slightly tweaked image.
- It forces these reactions to match a specific binary code (a string of 1s and -1s) that acts as your signature.
FIT-LIME (The "Feature Map" Detective):
- This method looks at the whole picture at once.
- It uses a technique called LIME (which highlights which parts of an image are most important for a decision).
- It creates a "heat map" of importance and forces this map to look exactly like your target signature.

The Results: Did It Work?

The authors tested their system against many different scenarios, including:

Copying: Someone just copying the code.
Fine-tuning: Someone taking your model and training it a bit more.
Pruning: Someone cutting parts of your model out to make it smaller.
Extraction: Someone trying to rebuild your model by asking it questions.

The Scorecard:

Defending against False Claims: When a thief tried to fake ownership of a model they didn't own, FIT-Print caught them 100% of the time. The false alarm rate was 0%.
Protecting Real Owners: When the real owner checked their own stolen/reused model, FIT-Print confirmed it 100% of the time.
Resisting Attacks: Even when the thieves tried to be "smart" and specifically train their models to break the fingerprint, FIT-Print still held up.

The "Label-Only" Scenario

The paper also tested a harder situation where the verifier can only see the final answer (e.g., "This is a dog") but not the internal confidence scores. Even with this limited view, FIT-Print still worked perfectly, distinguishing real owners from fake claimants.

Summary

The paper claims that old AI fingerprinting methods are too loose and can be tricked by clever thieves. FIT-Print fixes this by forcing the AI to produce a very specific, pre-defined "signature" rather than just a general similarity. This makes it mathematically nearly impossible for a thief to fake ownership of a model they didn't create, while still allowing the real owner to prove their rights easily.

The authors also showed this works on different types of models (like text generators) and different sizes, proving it's a flexible solution for the future of AI copyright.

Technical Summary: FIT-Print

Problem Statement

The paper addresses a critical vulnerability in existing model fingerprinting techniques used for safeguarding the intellectual property rights (IPR) of open-source deep learning models. While model fingerprinting offers a non-intrusive method to verify ownership without modifying model parameters, the authors demonstrate that current methods are fundamentally susceptible to false claim attacks.

In these attacks, malicious developers can fraudulently assert ownership over independent third-party models. The authors identify that this vulnerability stems from the untargeted nature of existing fingerprinting methods. Current approaches (both bit-wise and list-wise) typically evaluate model similarity based on the outputs of arbitrary testing samples. This untargeted approach creates a large "fingerprint space," allowing adversaries to craft "transferable" samples (specifically, "easy" samples that yield high-confidence correct classifications) that produce similar outputs across diverse, independent models. Consequently, independent models can be misjudged as reused versions of a source model, leading to false alarms and fraudulent ownership claims.

Methodology: FIT-Print

To mitigate this vulnerability, the authors propose FIT-Print (False-claIm-resistant Targeted model fingerPrinting), a new paradigm that shifts ownership verification from passive feature extraction to active signature alignment.

Core Insight

Instead of comparing arbitrary outputs, FIT-Print restricts the fingerprint space by optimizing testing samples to produce outputs that align with a specific, predefined target fingerprint (e.g., a specific binary vector or image pattern). This targeted approach significantly reduces the probability of an adversary finding transferable samples that satisfy the verification criteria for an independent model.

Framework Pipeline

The FIT-Print framework operates in two stages:

Testing Sample Extraction: The model developer optimizes perturbations on initial testing images to ensure that the output of the mapping function $f(\cdot)$ on the source model $M_o$ closely aligns with a pre-defined target fingerprint $F$ . This is formulated as an optimization problem minimizing the distance between the generated fingerprint vector and the target, while regularizing the perturbation magnitude. To enhance conferrability (the ability of the fingerprint to transfer to reused models), the optimization utilizes a set of "augmented models" (created via fine-tuning, pruning, etc.) during the sample generation process.
Ownership Verification: When verifying a suspicious model $M_s$ , the system extracts the fingerprint using the optimized testing samples and compares it to the registered target fingerprint $F$ . Verification is successful if the Bit Error Rate (BER) between the extracted fingerprint and $F$ is below a calculated threshold $\tau$ .

Proposed Methods

Based on the FIT-Print paradigm, the authors develop two black-box methods:

FIT-ModelDiff (Bit-wise): This method extracts the fingerprint bit by bit. It utilizes the Decision Distance Vector (DDV), which measures the cosine similarity between the logits of a perturbed sample and its benign counterpart. The sign of the distance relative to a bias parameter determines the fingerprint bits.
FIT-LIME (List-wise): This method extracts the fingerprint as a complete list. It leverages LIME (Local Interpretable Model-agnostic Explanations) to generate feature attribution scores. The method calculates the entropy of model outputs on masked samples to derive an importance score vector, which serves as the fingerprint.

Key Contributions

Vulnerability Analysis: The paper formally reveals that existing model fingerprinting methods are vulnerable to false claim attacks due to their untargeted nature, demonstrating that adversaries can construct transferable samples to falsely claim ownership of independent models.
New Paradigm: It introduces FIT-Print, a targeted fingerprinting paradigm that uses a specific reference signature to restrict the fingerprint space and counter false claims.
Algorithm Design: It designs two specific black-box methods, FIT-ModelDiff and FIT-LIME, representing bit-wise and list-wise approaches, respectively.
Comprehensive Evaluation: The authors conduct extensive experiments on benchmark datasets (Flowers102, SDogs120) and models (MobileNetV2, ResNet18, ViT, etc.) to validate effectiveness, conferrability, and resistance to attacks.

Experimental Results

The evaluation demonstrates that FIT-Print achieves superior performance compared to existing state-of-the-art methods (including IPGuard, MetaV, ModelDiff, Zest, SAC, and ModelGiF):

Defense Success: FIT-Print achieves a 100% defense success rate against false claim attacks, effectively neutralizing attempts by malicious developers to falsely claim ownership.
False Alarm Elimination: The methods achieve a 0.0% false positive rate on independent models, meaning no independent models are misidentified as reused.
Ownership Verification: FIT-Print maintains a 100% ownership verification rate across diverse model reuse techniques, including copying, fine-tuning, pruning, model extraction, and transfer learning.
Robustness: The framework remains effective against adaptive attacks, including "overwriting" (where an attacker tries to overwrite the fingerprint) and "unlearning" (where an attacker tries to remove the fingerprint), even when the attacker has partial knowledge of the target fingerprint.
Generalizability: The methods are shown to be effective across different model architectures (CNNs, Transformers) and data formats (images, text generation models like GPT-2 and BERT).

Significance and Claims

The paper claims that FIT-Print offers a new perspective on model fingerprinting by addressing the fundamental flaw of untargeted verification. By transforming the fingerprint into a verifiable, targeted signature, the framework provides a robust mechanism for protecting model IPR in the open-source ecosystem.

The authors emphasize that their approach is practical for real-world deployment as it requires no modification to the model's parameters or structure (black-box setting). They acknowledge potential limitations, such as the current lack of mature legal provisions for third-party fingerprint registration and the difficulty of providing formal proofs of robustness for deep neural networks. However, they posit that the establishment of trusted registrars (e.g., Intellectual Property Offices or AI Regulators) is a foreseeable necessity for the widespread adoption of such verification systems. Ultimately, FIT-Print aims to facilitate more secure and trustworthy model sharing and trading by eliminating the risk of false ownership claims.