LiteGuard: Efficient Task-Agnostic Model Fingerprinting with Enhanced Generalization

1. Problem Statement

Model Fingerprinting is a technique used to protect the intellectual property (IP) of Deep Neural Networks (DNNs) by generating unique input-output pairs (fingerprints) that verify ownership. While effective, existing methods face two major challenges:

• Task Specificity: Most methods are tailored to specific tasks (e.g., classification) or architectures, limiting their applicability across diverse domains.
• Generalization vs. Efficiency Trade-off: The current state-of-the-art task-agnostic method, MetaV, relies on jointly training a set of fingerprints and a single global verifier using large, diverse sets of "pirated" (protected model + variants) and "independent" models.
  • The Bottleneck: In real-world scenarios, acquiring large numbers of diverse models is computationally expensive and often impossible due to data scarcity.
  • The Consequence: Reducing the number of training models to save costs leads to severe overfitting in MetaV. Because all fingerprints and the global verifier are entangled in a single training process, the system fails to generalize to unseen models when the training set is small.

2. Methodology: LiteGuard

The authors propose LiteGuard, a framework designed to achieve high generalization with minimal computational cost. It introduces two core innovations:

A. Checkpoint-Based Model Set Augmentation

Instead of training a large number of distinct models to create diverse datasets, LiteGuard leverages intermediate checkpoints (snapshots saved during the training process) of a single protected model and a single independent model.

• Mechanism: During the training of the base models, snapshots are captured at specific intervals (starting from a specific epoch $e_s$ and selecting every $l$ epochs).
• Benefit: These checkpoints represent diverse decision behaviors and stages of convergence, effectively enriching the diversity of the "piracy set" and "independence set" without the computational overhead of training multiple full models from scratch.

B. Local Verifier Architecture (Decoupled Training)

LiteGuard replaces MetaV's single global verifier with a modular, local verifier architecture.

• Structure: The system consists of $N$ pairs, where each pair contains one fingerprint ($x$) and one lightweight local verifier ($v$).
• Training: Unlike MetaV, where all fingerprints and one global verifier are trained jointly (entangled), LiteGuard optimizes each fingerprint-verifier pair independently.
• Verifier Design: Each local verifier is a simple linear layer followed by a sigmoid activation, mapping the model's output for a specific fingerprint to a confidence score.
• Inference: During verification, the suspect model processes all fingerprints. Each local verifier produces a confidence score, and the final decision is made by averaging these scores against a threshold.

3. Key Contributions

1. Efficient Task-Agnostic Framework: LiteGuard is the first method to significantly reduce computational costs while maintaining (and improving) generalization across diverse tasks (classification, regression, generation) and architectures (CNNs, MLPs, GNNs, RNNs).
2. Checkpoint Augmentation Strategy: A principled method to synthesize diverse model behaviors from a single training run, solving the data scarcity problem in model fingerprinting.
3. Decoupled Parameter Complexity: By moving from an entangled global verifier to independent local verifiers, LiteGuard reduces the parameter complexity from $O(N \cdot (F + O \cdot H))$ (in MetaV) to $O(F + O)$, effectively eliminating the overfitting risk associated with large fingerprint sets and small training datasets.
4. Robustness: The method demonstrates superior robustness against various ownership obfuscation techniques, including pruning, fine-tuning, knowledge distillation, and adversarial fine-tuning.

4. Experimental Results

The authors evaluated LiteGuard on five representative tasks (Image Classification, Protein Regression, Tabular Generation, Molecular Prediction, Time-Series Generation) and compared it against MetaV and several task-specific baselines (UAP, IPGuard, etc.).

• Generalization Performance:
  • LiteGuard achieved State-of-the-Art (SOTA) performance across all five tasks.
  • In the most constrained setting (using only 1 protected and 1 independent model for training, augmented with checkpoints), LiteGuard significantly outperformed MetaV.
  • AUC Improvements: LiteGuard improved AUC by 34.5% (Image Classification), 9.5% (Protein Regression), 24.9% (Tabular), 34.3% (Molecular), and 13.7% (Time-Series) over MetaV.
• Computational Efficiency:
  • LiteGuard achieved comparable or better performance than MetaV using 5x to 10x fewer trained models.
  • For example, on the molecular prediction task, LiteGuard with 2 trained models outperformed MetaV with 10 trained models.
• Robustness to Obfuscation:
  • LiteGuard maintained high AUC scores (often >0.95) even when the suspect models were subjected to aggressive obfuscation (e.g., pruning, fine-tuning), whereas MetaV and task-specific methods saw significant performance drops.
• Ablation Studies:
  • Checkpoint Selection: Optimal performance was found when selecting checkpoints from the middle-to-late stages of training, avoiding early random noise and late-stage convergence redundancy.
  • Verifier Design: Replacing LiteGuard's local verifiers with MetaV's global verifier caused a significant drop in performance, confirming the necessity of the decoupled architecture.
  • Fingerprint Count: LiteGuard's performance monotonically improved with more fingerprints, whereas MetaV's performance fluctuated and degraded due to overfitting.

5. Significance

LiteGuard addresses a critical barrier in the practical deployment of model fingerprinting: the high cost of data and computation required for training robust verification systems.

• Practicality: It enables IP protection in domains where acquiring large datasets of diverse models is infeasible.
• Scalability: The decoupled architecture ensures that adding more fingerprints does not exponentially increase the risk of overfitting or computational burden.
• Universality: By being truly task-agnostic and robust against obfuscation, LiteGuard offers a universal solution for protecting DNN ownership in an era of increasing model theft and redistribution.

In summary, LiteGuard shifts the paradigm from "training more models to get better verification" to "extracting more diversity from fewer models and optimizing verification architecture," offering a highly efficient and generalizable solution for model IP protection.