💻 computer science

IrisFP: Adversarial-Example-based Model Fingerprinting with Enhanced Uniqueness and Robustness

The paper proposes IrisFP, a novel adversarial-example-based model fingerprinting framework that enhances both uniqueness and robustness by generating composite-sample fingerprints positioned near multi-boundary intersections and employing statistical metrics to select highly discriminative fingerprints for reliable ownership verification.

Original authors: Ziye Geng, Guang Yang, Yihang Chen, Changqing Luo

Published 2026-03-27

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Ziye Geng, Guang Yang, Yihang Chen, Changqing Luo

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a famous chef who has spent years perfecting a secret recipe for a delicious soup. You want to sell this recipe as a digital product, but you're worried someone will steal it, tweak the ingredients slightly, and claim it's their own. How do you prove, "This soup is mine!" without revealing the secret recipe itself?

In the world of Artificial Intelligence (AI), this is the problem of Model Fingerprinting. AI models (like the soup recipe) are valuable, but they are easy to copy. Researchers have tried to leave "digital fingerprints" on these models to prove ownership, but previous methods had a major flaw: they were either too easy to wash off (not robust) or too easy to fake (not unique).

Enter IrisFP, a new method proposed by researchers from the University of Houston and Virginia Commonwealth University. Think of IrisFP as a super-advanced, invisible security ink that is incredibly hard to remove and impossible to forge.

Here is how IrisFP works, broken down into simple concepts:

1. The Problem with Old Fingerprints

Imagine you try to leave a fingerprint on a wall.

Old Method: You press your finger right against a single crack in the wall. If someone paints over that crack (a "model modification attack"), your fingerprint disappears. If they just move the wall slightly, your print looks like everyone else's.
The Dilemma: If you press your finger deep inside a solid part of the wall to avoid the cracks, it's hard to remove, but now it looks like a normal handprint, and you can't prove it's yours specifically.

2. The IrisFP Solution: The "Intersection" Strategy

IrisFP changes the game by not pressing the finger against just one crack. Instead, it places the fingerprint right at the intersection where all the cracks meet.

The Analogy: Imagine a busy city intersection where four roads meet. If you stand right in the middle of that intersection, you are close to every road.
Why it works:
- Robustness (Hard to remove): If a thief tries to "paint over" one road (change one part of the AI), you are still standing near the other three. Your position remains stable because you are surrounded by the structure of the model, not just one edge.
- Uniqueness (Hard to fake): Because you are standing in this specific, complex middle spot, only your specific model reacts to you in a unique way. Other models (the "independent" ones) will look at that spot and see something totally different.

3. The "Composite" Fingerprint: A Group Photo

Previous methods left a single fingerprint (one photo). IrisFP leaves a composite fingerprint, which is like a group photo or a team.

How it works: Instead of just one "seed" sample, IrisFP creates a small team of 5 slightly different variations of that sample.
The Magic: When you ask the "stolen" model to identify this team, the real owner's model will recognize the whole group perfectly. A thief's model, even if it's a copy, will get confused by the subtle differences in the group and fail to recognize them all. It's like a security guard who recognizes a whole family; a thief might recognize the dad, but they won't know the mom and kids, so the whole group gets flagged as "suspicious."

4. The Quality Control: The "Talent Scout"

Not every fingerprint is good. Some might be too blurry or too easy to guess. IrisFP has a built-in Talent Scout.

The Process: Before finalizing the fingerprints, the system tests them against a "pirate" model (a stolen version) and a "clean" model (a totally new, independent one).
The Selection: It keeps only the fingerprints that create the biggest difference between the two. It's like a casting director who only hires actors who can clearly distinguish between a hero and a villain. It also gives each fingerprint its own specific "passing grade" (threshold), so the system doesn't rely on a one-size-fits-all rule.

5. The Final Verdict: The "Voting System"

When the model owner wants to check if a suspicious AI is a thief, they don't just ask one question. They run the composite group of fingerprints through the suspect model.

The Vote: Each member of the fingerprint group votes: "Does this look like my owner's model?"
The Decision: If enough of the group votes "Yes" (crossing a specific threshold), the system declares, "This is a stolen model!" If the votes are mixed or mostly "No," it's likely an innocent, independently trained model.

Summary

IrisFP is like a high-tech security system that:

Hides in plain sight at the complex center of the model's decision-making (the intersection), making it hard to erase.
Uses a team of related samples instead of a single one, making it hard to forge.
Selects only the best samples that clearly tell the difference between a thief and an innocent person.
Uses a voting system to make a final, reliable decision.

The result? A way to protect AI intellectual property that is both tough to break (robust) and impossible to fake (unique).

1. Problem Statement

Deep Neural Networks (DNNs) are valuable intellectual property (IP), yet they are vulnerable to theft and unauthorized replication. Model fingerprinting is a technique used to verify ownership by embedding unique, model-specific signatures (fingerprints) into the model's behavior.

The paper identifies a critical trade-off in existing adversarial-example-based fingerprinting methods:

Uniqueness vs. Robustness: Current methods typically place fingerprints near a single decision boundary to capture model-specific behavior (high uniqueness). However, these fingerprints are fragile; model modification attacks (e.g., fine-tuning, pruning) can shift decision boundaries, rendering the fingerprints invalid (low robustness).
The Dilemma: Conversely, placing fingerprints deep inside target class regions improves robustness against boundary shifts but reduces uniqueness, as these samples become less sensitive to the specific model's decision logic.
Goal: The authors aim to design a fingerprinting framework that simultaneously achieves high uniqueness (distinguishing the protected model from independently trained ones) and high robustness (surviving model modification attacks).

2. Methodology: IrisFP

The authors propose IrisFP (UnIque and robust composite-sample Fingerprinting), a framework that leverages multi-boundary characteristics, multi-sample behaviors, and statistical quality assessment. The process consists of two main stages: Fingerprint Generation and Ownership Verification.

A. Fingerprint Generation (Three Phases)

Phase I: Initializing Fingerprint Seeds (Multi-Boundary Strategy)
- Unlike prior methods that target a single boundary, IrisFP generates "seed" samples positioned near the intersection of all decision boundaries of the protected model.
- Mechanism: For a clean input, a perturbation is optimized to make the model output a target class with high confidence while distributing the remaining probability almost evenly across other classes.
- Benefit: This positioning creates a large prediction margin (confidence gap between top classes). It ensures the sample is close enough to boundaries to be unique but far enough from any single boundary to remain robust against shifts caused by attacks like pruning or fine-tuning.
Phase II: Generating Composite-Sample Fingerprints
- To further enhance uniqueness, each seed is expanded into a composite-sample fingerprint consisting of multiple variants.
- Mechanism: The seed is perturbed by small, diverse, trainable perturbations to generate $T$ variants. Each variant is optimized to elicit a different specific response from the protected model while maintaining consistency with the protected model's unique behavior.
- Benefit: Independently trained models (even with similar architectures) will likely fail to replicate this specific pattern of diverse responses across the composite set, creating a clear behavioral gap.
Phase III: Refining Fingerprints (Quality Assessment)
- Not all generated fingerprints are equally effective. IrisFP employs a refinement strategy using two reference sets: a Pirated Model Set (modified versions of the protected model) and an Independent Model Set (models trained from scratch).
- Selection: It calculates the Cohen's $d$ effect size for each fingerprint, measuring the statistical separation between the matching rates of pirated vs. independent models. Only the top- $K$ fingerprints with the highest discriminative power are retained.
- Thresholding: Instead of a global threshold, IrisFP assigns a fingerprint-specific threshold ( $\theta_i$ ) to each retained fingerprint based on the weighted average of the mean matching rates of the pirated and independent sets. This adapts the verification criteria to the specific quality of each fingerprint.

B. Ownership Verification

Step 1 (Matching): The target model is queried with the composite samples. A matching rate is calculated for each fingerprint and compared against its specific threshold.
Step 2 (Aggregation): The matching decisions are aggregated. If the proportion of matched fingerprints exceeds a global decision threshold ( $\alpha$ ), the target model is declared pirated.

3. Key Contributions

Multi-Boundary Intersection Strategy: The paper introduces a novel positioning strategy where fingerprints are placed at the intersection of multiple decision boundaries. This increases the prediction margin without sacrificing model-specific sensitivity, solving the uniqueness-robustness trade-off.
Composite-Sample Fingerprints: The framework moves beyond single-sample fingerprints to composite sets. By leveraging collective behavior patterns across multiple diverse variants, it significantly boosts the ability to distinguish protected models from independent ones.
Statistical Refinement & Adaptive Thresholding: IrisFP introduces a rigorous selection process using statistical separability metrics (Cohen's $d$ ) and assigns individual thresholds to fingerprints, ensuring that only high-quality, discriminative signatures are used for verification.
Comprehensive Evaluation: The method is validated against state-of-the-art baselines (IPGuard, UAP, ADV-TRA, AKH) across five datasets (CIFAR-10/100, Fashion-MNIST, MNIST, Tiny-ImageNet) and three architectures (ResNet-18, MobileNet-V2, ViT-B/16).

4. Experimental Results

Extensive experiments demonstrate that IrisFP consistently outperforms existing methods:

Performance Metrics: IrisFP achieves the highest Area Under the Curve (AUC) across all datasets and architectures. For example, on CIFAR-100 with ResNet-18, IrisFP achieved an AUC of 0.916, a 13.7% improvement over the best baseline.
Uniqueness (TNR): IrisFP maintains high True Negative Rates (correctly identifying independent models as non-pirated) even at low False Negative Rates, outperforming baselines that often misclassify independent models.
Robustness (TPR): Under six types of model modification attacks (Fine-tuning, Pruning, Knowledge Distillation, Adversarial Training, Prune-then-Tune, Noise Injection), IrisFP consistently maintains high True Positive Rates. For instance, it achieved near-perfect AUCs (0.95–1.00) against Fine-tuning and Pruning attacks on multiple datasets.
Ablation Studies: Removing any component (seed initialization, composite generation, or specific thresholds) significantly degrades performance, confirming the necessity of the full framework.

5. Significance

Solving the Core Trade-off: IrisFP successfully breaks the inherent trade-off between uniqueness and robustness in model fingerprinting, a problem that has limited the practical deployment of previous methods.
Practical Applicability: The method is effective against a wide range of real-world attacks (including fine-tuning and pruning) and works on both lightweight (MobileNet) and large-scale (ViT) models.
Scalability: The computational overhead is manageable (e.g., ~1 hour for ViT models), making it feasible for real-world IP protection scenarios.
Future Direction: The work establishes a new paradigm for model fingerprinting by utilizing multi-boundary intersections and composite samples, suggesting a path forward for more resilient IP protection mechanisms in deep learning.