🤖 machine learning

COPYCOP: Ownership Verification for Graph Neural Networks

The paper introduces CopyCop, a robust algorithm with theoretical guarantees that verifies ownership of Graph Neural Networks by detecting whether two models with different architectures, weights, or embedding dimensions were trained independently or if one is an adversarial copycat, outperforming existing watermarking and fingerprinting methods across 14 datasets.

Original authors: Rahul Nandakumar, Deepayan Chakrabarti

Published 2026-05-08

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Rahul Nandakumar, Deepayan Chakrabarti

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a master chef who has developed a secret, signature sauce. You sell this sauce to restaurants as a service: they send you a list of ingredients (a graph), and you send back a unique flavor profile (an embedding) that they can use to make their own dishes.

The problem? A sneaky competitor might try to steal your recipe. They don't need to break into your kitchen; they just order a thousand samples of your sauce, taste them, and then try to cook up their own version that tastes exactly the same. To make it even harder to catch them, they might change the color of the sauce, serve it in a different bowl, or even dilute it slightly, hoping you won't realize it's a copy.

This is the problem COPYCOP solves. It is a new "forensic tool" designed to catch these copycat chefs (or in the tech world, "surrogate" AI models) even when they try to disguise their theft.

Here is how it works, broken down into simple concepts:

1. The Old Ways Didn't Work

Previously, people tried to catch thieves in two ways, both of which had flaws:

The "Watermark" Method: The chef secretly adds a tiny, invisible speck of glitter to the sauce. If the competitor's sauce has the glitter, they are caught.
- The Flaw: The thief can just order the sauce, taste it, and recreate the flavor without the glitter. They ignore the secret speck entirely.
The "Fingerprint" Method: The chef compares the texture of the victim's sauce to the suspect's sauce.
- The Flaw: If the thief pours the sauce into a different-shaped bowl or changes the temperature, the texture looks different, even if the taste is the same. The old tools couldn't tell the difference between a real change and a fake disguise.

2. The COPYCOP Solution: Finding the "Still Points"

COPYCOP takes a completely different approach. Instead of looking at the sauce itself (the output), it looks at how the sauce reacts when you poke it.

Imagine you have a ball of dough (the AI model). If you push it gently in one direction, it might squish and change shape. But, there are certain specific spots on the dough where, if you push them, nothing happens at all. The dough doesn't move. These are called "Stationary Points."

The Magic Insight: The paper proves that these "still points" are like the DNA of the recipe. Even if the thief changes the bowl, the temperature, or the color of the sauce (transformations), the location of these "still points" remains exactly the same.
The Test:
1. COPYCOP asks the victim chef (the original model) to find these "still points" in their dough.
2. It then asks the suspect chef (the model in question) to find the "still points" in their dough.
3. The Verdict: If the suspect's "still points" match the victim's perfectly, the suspect is a copycat. If the points are in different places, the suspect is likely an independent chef who just happened to make a similar-tasting sauce by accident.

3. Why It's So Good at Catching Thieves

The paper claims COPYCOP is incredibly robust because:

It ignores the disguise: Whether the thief rotates the sauce, scales it up, or changes the dimensions of the bowl, the "still points" stay put.
It doesn't need to see the kitchen: You don't need to see the thief's secret recipe (weights or architecture). You only need to see what comes out of their pot.
It works even if they try to hide: The thief can't easily fake these points. To do so, they would have to perfectly mimic the victim's reaction to every possible "poke," which is mathematically impossible unless they actually stole the recipe.

4. The Results

The researchers tested this "forensic tool" on 14 different types of data (like social networks, molecules, and financial records) and 5 different types of AI models.

Accuracy: It correctly identified copycats almost 100% of the time, even when the thieves tried to rotate, scale, or distort their models.
Comparison: It crushed the old "watermark" methods, which failed when the thief simply ignored the secret glitter. It also beat the old "fingerprint" methods, which got confused by simple changes like rotation.

Summary

Think of COPYCOP as a detective who doesn't look at the suspect's clothes (which can be changed) or their voice (which can be disguised). Instead, the detective asks the suspect to stand on a specific, invisible spot on the floor. If they stand on the exact same invisible spot as the original owner, no matter how they are dressed, they are guilty of copying. If they stand somewhere else, they are innocent.

This method allows owners of AI models to prove their ownership and catch thieves, even when those thieves try to completely disguise their stolen work.

Technical Summary: COPYCOP – Ownership Verification for Graph Neural Networks

1. Problem Statement

The paper addresses the critical issue of ownership verification for Graph Neural Networks (GNNs) deployed as "Embeddings-as-a-Service." In this setting, a victim model $M$ provides node embeddings for downstream tasks. An adversary can perform a model extraction attack by querying $M$ on numerous graphs, collecting input-output pairs, and training a surrogate model $Z$ to mimic these embeddings.

The core challenge is distinguishing whether a candidate GNN $Z$ was trained independently or is a surrogate derived from $M$ . This is complicated by the fact that an adversary can apply various transformations to the surrogate's output embeddings (e.g., rotation, scaling, permutation, or changing embedding dimensions) and use different architectures or weights. Existing methods fail under these conditions:

Watermarking: Methods that embed special signals (e.g., backdoors) into the victim model are vulnerable because an adversary training on ordinary query data need not reproduce these specific watermarked behaviors.
Fingerprinting: Existing embedding-based fingerprints often rely on direct similarity comparisons, which are easily broken by linear or non-linear transformations that alter the embedding space while preserving downstream utility.

2. Methodology: COPYCOP

COPYCOP proposes a fingerprinting method that does not modify the victim model. Instead, it relies on the stationary points of the embedding function as intrinsic, transformation-invariant fingerprints.

Core Concept:
A node's embedding $h_i(X)$ is a function of the graph structure and node features. A stationary point is defined as a tuple $(G, X, i, w)$ where perturbing the node features $x_i$ in a direction $w$ results in no first-order change to the embedding (i.e., the directional derivative $\nabla_w h_i(X) = 0$ ).

Theoretical Basis:

Invariance: If a surrogate model $Z$ outputs embeddings $h'_i = \phi(h_i)$ where $\phi$ is a locally invertible transformation (Assumption 3.4), the stationary points of $h_i$ are also stationary points of $h'_i$ . This is because if the gradient of $h_i$ is zero, the gradient of $\phi(h_i)$ must also be zero (Lemma 3.6).
Uniqueness: The authors assume that independently trained models converge to different local optima, meaning their sets of stationary points $S(M)$ and $S(I)$ are largely disjoint (Assumption 3.7).

Algorithm (General Case):
Since exact stationary points may not exist or be computable in the general case (due to reconstruction errors or non-differentiability), COPYCOP uses an approximation metric $\beta_F$ :

Sampling: The algorithm samples tuples from the victim model's stationary points $S(M)$ and from a random distribution over the query space.
Metric Calculation: For a candidate model $Z$ , it computes $q_Z(t)$ , the normalized magnitude of embedding change when features are perturbed. It then calculates $\beta_Z$ , the ratio of expected $q_Z$ near stationary points versus random points.
Decision:
- If $Z$ is the victim or a surrogate, $\beta_Z$ is small (close to 0) because the stationary points of $M$ remain "stationary" for $Z$ .
- If $Z$ is an independent model, $\beta_Z$ is significantly larger because $Z$ does not share $M$ 's stationary points.
- The algorithm classifies $Z$ as a surrogate if $\hat{\beta}_Z \leq \theta$ (Algorithm 2).

Implementation Details:

Sampling Stationary Points: The method uses an optimization solver (without requiring gradient access to the model) to find feature vectors $X$ that minimize the normalized directional derivative, regularized to stay close to realistic data distributions.
Robustness: The method is architecture-agnostic and handles changes in embedding dimensions. It generates new query graphs dynamically, preventing leakage from compromising future verifications.

3. Key Contributions

Novel Fingerprinting Mechanism: COPYCOP is the first fingerprinting method for GNN embeddings that is robust to a broad class of adversarial transformations (rotation, scaling, dimensionality changes) and works across different GNN architectures.
Theoretical Guarantees: The paper provides formal proofs (Theorems 3.8 and 3.15) demonstrating that the method can distinguish surrogates from independent models with high probability under reasonable assumptions about the transformation functions and stationary point distributions.
No Watermarking Required: Unlike prior work, COPYCOP does not require modifying the victim model's training process, avoiding performance degradation and vulnerability to extraction attacks that ignore special inputs.
Randomized Fingerprints: The fingerprints are randomized and can be regenerated, ensuring that leaked queries do not permanently compromise the verification system.

4. Experimental Results

The authors evaluated COPYCOP on 14 datasets (covering molecules, citations, social networks, etc.) and 5 GNN architectures (GCN, GIN, GraphSage, ARMA, MixHop).

Model Extraction Accuracy: COPYCOP achieved perfect or near-perfect Area Under the Curve (AUC) scores (e.g., AUC=1.00 for GCN, 0.99 for MixHop) in detecting surrogates trained via model extraction. It significantly outperformed the watermarking method PreGIP (by 17–48% across architectures) and the fingerprinting method GrOVe. PreGIP's performance occasionally dropped below random chance when the surrogate was trained only on ordinary data.
Robustness to Transformations: COPYCOP remained robust (0% error rate) against rotation, scaling, and projection to higher dimensions. While performance dipped slightly under extreme non-linear transformations (e.g., exponentiation), it remained far superior to PreGIP and GrOVe. Notably, GrOVe failed entirely when embedding dimensions changed.
Adversarial Attacks:
- Pruning: COPYCOP remained robust up to 40% weight pruning (stable for GIN up to 70%).
- Fine-tuning: Detection accuracy remained stable even after the surrogate was fine-tuned on a small labeled dataset.
Efficiency: The method requires only 20–40 stationary points to reach near-maximum AUC.

5. Significance and Claims

The paper claims that COPYCOP solves a fundamental gap in the security of GNN-as-a-Service. By leveraging the mathematical invariance of stationary points, it provides a reliable mechanism for ownership verification that survives the "cosmetic" changes adversaries use to obscure model theft.

The authors emphasize that their approach is modest in its assumptions (e.g., requiring only local invertibility of transformations) but strong in its empirical performance. They acknowledge limitations, such as the need for further validation of assumptions regarding transformation distributions and the computational cost of finding stationary points for very large graphs or high-dimensional embeddings. However, they assert that COPYCOP offers a practical, robust, and theoretically grounded solution where existing watermarking and fingerprinting techniques fail.