Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

IrisFP: Adversarial-Example-based Model Fingerprinting with Enhanced Uniqueness and Robustness

Ziye Geng, Guang Yang, Yihang Chen, Changqing Luo

Abstract

We propose IrisFP, a novel adversarial-example-based model fingerprinting framework that enhances both uniqueness and robustness by leveraging multi-boundary characteristics, multi-sample behaviors, and fingerprint discriminative power assessment to generate composite-sample fingerprints. Three key innovations make IrisFP outstanding: 1) It positions fingerprints near the intersection of all decision boundaries - unlike prior methods that target a single boundary - thus increasing the prediction margin without placing fingerprints deep inside target class regions, enhancing both robustness and uniqueness; 2) It constructs composite-sample fingerprints, each comprising multiple samples close to the multi-boundary intersection, to exploit collective behavior patterns and further boost uniqueness; and 3) It assesses the discriminative power of generated fingerprints using statistical separability metrics developed based on two reference model sets, respectively, for pirated and independently-trained models, retains the fingerprints with high discriminative power, and assigns fingerprint-specific thresholds to such retained fingerprints. Extensive experiments show that IrisFP consistently outperforms state-of-the-art methods, achieving reliable ownership verification by enhancing both robustness and uniqueness.

IrisFP: Adversarial-Example-based Model Fingerprinting with Enhanced Uniqueness and Robustness

Abstract

We propose IrisFP, a novel adversarial-example-based model fingerprinting framework that enhances both uniqueness and robustness by leveraging multi-boundary characteristics, multi-sample behaviors, and fingerprint discriminative power assessment to generate composite-sample fingerprints. Three key innovations make IrisFP outstanding: 1) It positions fingerprints near the intersection of all decision boundaries - unlike prior methods that target a single boundary - thus increasing the prediction margin without placing fingerprints deep inside target class regions, enhancing both robustness and uniqueness; 2) It constructs composite-sample fingerprints, each comprising multiple samples close to the multi-boundary intersection, to exploit collective behavior patterns and further boost uniqueness; and 3) It assesses the discriminative power of generated fingerprints using statistical separability metrics developed based on two reference model sets, respectively, for pirated and independently-trained models, retains the fingerprints with high discriminative power, and assigns fingerprint-specific thresholds to such retained fingerprints. Extensive experiments show that IrisFP consistently outperforms state-of-the-art methods, achieving reliable ownership verification by enhancing both robustness and uniqueness.

Paper Structure

This paper contains 40 sections, 5 equations, 12 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Our Answer
  3. Preliminary
  4. Model Fingerprinting
  5. Model Modification Attacks
  6. Methodology
  7. Overview
  8. The Fingerprint Generation Process
  9. Phase I: Initializing Fingerprint Seeds
  10. Phase II: Generating Composite-sample Fingerprints
  11. Phase III: Refining Fingerprints
  12. The Ownership Verification Process
  13. Step 1: Ownership matching.
  14. Step 2: Decision aggregation.
  15. Experiments
  16. ...and 25 more sections

Figures (12)

  • Figure 1: The uniqueness and robustness achieved by prior adversarial-example-based fingerprinting methods.
  • Figure 2: (a): The placement of input samples $s_1$ and $s_2$ in a region; (b): The prediction margin $pm_1$ of fingerprint $s_1$; and (c): The prediction margin $pm_2$ of fingerprint $s_2$.
  • Figure 3: The overview of IrisFP.
  • Figure 4: (a) The ROC curve and (b) the distribution of verification score on the protected model with ResNet-18 architecture trained on Fashion-MNIST.
  • Figure 5: TNR-FNR and TPR-FPR curves on the protected models with ResNet-18 architecture trained on CIFAR-10 ((a) and (f)), CIFAR-100 ((b) and (g)), Fashion-MNIST ((c) and (h)), MNIST ((d) and (i)), and Tiny-ImageNet ((e) and (j)).
  • ...and 7 more figures