Fingerprinting Deep Neural Networks for Ownership Protection: An Analytical Approach

1. Problem Statement

Deep Neural Networks (DNNs) are increasingly vulnerable to model piracy, where adversaries steal a model, apply performance-preserving modifications (e.g., fine-tuning, pruning, knowledge distillation) to evade detection, and redistribute it as a black-box service.

• Existing Solutions: Current fingerprinting methods often rely on adversarial examples to create unique identifiers based on a model's decision boundaries. However, they suffer from a fundamental unresolved challenge: how to determine the optimal distance of a fingerprint from the decision boundary.
• The Trade-off:
  • Uniqueness: Requires fingerprints to be close to the decision boundary to ensure independent models (trained from scratch) do not predict the correct label.
  • Robustness: Requires fingerprints to be far from the decision boundary to withstand shifts caused by model modification attacks.
• The Gap: Existing works use empirical heuristics to select this distance, lacking theoretical guidance. This often leads to fingerprints that fail either robustness or uniqueness, or both.

2. Methodology: AnaFP

The authors propose AnaFP, an analytical fingerprinting scheme that mathematically formalizes the constraints for robustness and uniqueness to derive a theoretical "admissible interval" for the fingerprint generation process. The pipeline consists of four main steps:

Step 1: Selecting High-Confidence Anchors

• The system selects high-confidence samples (anchors) from the training dataset where the protected model $P$ has a large logit margin.
• Goal: Ensure that independently trained models also predict these anchors correctly with high probability, serving as a baseline for uniqueness.

Step 2: Computing Minimal Decision-Altering Perturbations

• For each anchor, the system computes a minimal perturbation $\delta^*$ (using the Carlini & Wagner $\ell_2$ attack) that pushes the input across the decision boundary of the protected model $P$.
• The resulting point $q = x_a + \delta^*$ lies exactly on the decision boundary.

Step 3: Searching for the Stretch Factor ($\tau$)

This is the core theoretical contribution. The final fingerprint is generated by scaling the perturbation: $x^* = x_a + \tau \delta^*$. The goal is to find a stretch factor $\tau$ that satisfies both constraints.

• Theoretical Bounds: The authors derive a lower bound ($\tau_{lower}$) for robustness and an upper bound ($\tau_{upper}$) for uniqueness.
  • $\tau_{lower}$ ensures the fingerprint remains on the correct side of the boundary even after an attack (robustness).
  • $\tau_{upper}$ ensures the fingerprint remains on the wrong side of the boundary for independent models (uniqueness).
• Surrogate Model Pools: Since the true sets of pirated and independent models are infinite, AnaFP approximates them using finite surrogate pools (simulated pirated models and independently trained models).
• Quantile-Based Relaxation: To avoid overly conservative bounds (which might leave no valid $\tau$), the system estimates parameters (logit margins, Lipschitz constants, logit shifts) using quantiles (e.g., the 50th percentile) rather than worst-case extremes.
• Grid Search: Because $\tau_{lower}$ depends implicitly on $\tau$ (due to the non-linearity of the logit shift at the new point), a direct solution is difficult. AnaFP employs a grid search over the admissible interval $(1, \tau_{upper}]$ to find the most feasible $\tau$ that maximizes the slack to both bounds.

Step 4: Fingerprint Construction & Verification

• Fingerprints are generated by applying the optimal $\tau$ to the anchors.
• Verification: A suspect model is queried with the fingerprint set. If the matching rate (proportion of correct predictions) exceeds a threshold, the model is flagged as pirated.

3. Key Contributions

1. Theoretical Framework: First to mathematically formalize the trade-off between robustness and uniqueness in adversarial-example-based fingerprinting, deriving explicit lower and upper bounds for the fingerprint-to-boundary distance.
2. Analytical Solution (AnaFP): Proposes a method to determine the stretch factor $\tau$ theoretically rather than heuristically, using a grid search within a derived admissible interval.
3. Practical Approximation Strategies: Introduces surrogate model pools to approximate infinite model sets and quantile-based relaxation to handle estimation errors and ensure feasible fingerprint generation.
4. Robustness to Circular Dependency: Solves the circular dependency between the lower bound and the stretch factor via a grid search strategy.

4. Experimental Results

The authors evaluated AnaFP across diverse architectures (ResNet-18, ResMLP, GAT) and datasets (CIFAR-10/100, MNIST, PROTEINS) against seven state-of-the-art baselines (UAP, IPGuard, MarginFinger, etc.).

• Overall Performance: AnaFP consistently achieved the highest Area Under the Curve (AUC) across all datasets and architectures (e.g., 0.957 on CIFAR-10, 0.963 on MNIST), significantly outperforming baselines.
• Robustness to Attacks: AnaFP demonstrated superior resilience against various performance-preserving attacks:
  • Fine-tuning, Pruning, Adversarial Training: Achieved near-perfect AUCs (>0.97).
  • Knowledge Distillation (KD) & Composite Attacks: While KD is notoriously difficult for fingerprinting, AnaFP maintained a leading AUC (0.756 on KD for CNNs), outperforming all baselines.
• Sensitivity Analysis:
  • Surrogate Pools: Performance stabilized with as few as 6 surrogate models and remained robust even with low diversity in the surrogate pool.
  • Quantile Thresholds: The method is not highly sensitive to specific quantile choices; moderate relaxation yields high-quality fingerprints.
• Ablation Study: Removing the grid search (fixing $\tau$ to bounds or a fixed margin) significantly degraded performance, confirming the necessity of searching the admissible interval.

5. Significance

• Shift from Heuristic to Analytical: AnaFP moves the field of model fingerprinting from empirical trial-and-error to a theoretically grounded approach, providing guarantees on the placement of fingerprints relative to decision boundaries.
• Reliability: By mathematically balancing robustness and uniqueness, AnaFP reduces false positives (attacking independent models) and false negatives (failing to detect pirated models), making it a more reliable tool for IP protection.
• Generalizability: The framework is applicable to various data modalities (images, vectors, graphs) and model types, addressing a critical need for protecting AI assets in real-world deployments where models are frequently modified.

In conclusion, AnaFP provides a rigorous, analytical solution to the long-standing challenge of determining the optimal fingerprint distance, offering a robust and unique mechanism for DNN ownership verification.