# DeepMarks: A Digital Fingerprinting Framework for Deep Neural Networks

arXiv: https://arxiv.org/abs/1804.03648 · HTML: https://mlsanity.com/paper/1804.03648/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Apr 2018.

## Built on by (most cited first, 26 of 26)

- [SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)](https://mlsanity.com/paper/2108.04974/) (2021)
- [Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attack](https://mlsanity.com/paper/2102.04362/) (2021)
- [FedIPR: Ownership Verification for Federated Deep Neural Network Models](https://mlsanity.com/paper/2109.13236/) (2021)
- [Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networks](https://mlsanity.com/paper/2210.15427/) (2022)
- [Ten Challenging Problems in Federated Foundation Models](https://mlsanity.com/paper/2502.12176/) (2025)
- [A Protection Method of Trained CNN Model with Secret Key from Unauthorized Access](https://mlsanity.com/paper/2105.14756/) (2021)
- [FedCIP: Federated Client Intellectual Property Protection with Traitor Tracking](https://mlsanity.com/paper/2306.01356/) (2023)
- [Piracy-Resistant DNN Watermarking by Block-Wise Image Transformation with Secret Key](https://mlsanity.com/paper/2104.04241/) (2021)
- [FedZKP: Federated Model Ownership Verification with Zero-knowledge Proof](https://mlsanity.com/paper/2305.04507/) (2023)
- [Towards Reliable Forgetting: A Survey on Machine Unlearning Verification](https://mlsanity.com/paper/2506.15115/) (2025)
- [ZKROWNN: Zero Knowledge Right of Ownership for Neural Networks](https://mlsanity.com/paper/2309.06779/) (2023)
- [A Protection Method of Trained CNN Model Using Feature Maps Transformed With Secret Key From Unauthorized Access](https://mlsanity.com/paper/2109.00224/) (2021)
- [FedSOV: Federated Model Secure Ownership Verification with Unforgeable Signature](https://mlsanity.com/paper/2305.06085/) (2023)
- [SPRINT: Robust Model Attribution of Generated Images via Secret Pixel Reconstruction](https://mlsanity.com/paper/2508.05691/) (2025)
- [Adversarial Machine Learning Threat Analysis and Remediation in Open Radio Access Network (O-RAN)](https://mlsanity.com/paper/2201.06093/) (2022)
- [DeepTaster: Adversarial Perturbation-Based Fingerprinting to Identify Proprietary Dataset Use in Deep Neural Networks](https://mlsanity.com/paper/2211.13535/) (2022)
- [Not Just Change the Labels, Learn the Features: Watermarking Deep Neural Networks with Multi-View Data](https://mlsanity.com/paper/2403.10663/) (2024)
- [Sample Correlation for Fingerprinting Deep Face Recognition](https://mlsanity.com/paper/2412.20768/) (2024)
- [Transfer Learning-Based Model Protection With Secret Key](https://mlsanity.com/paper/2103.03525/) (2021)
- [LDPKiT: Superimposing Remote Queries for Privacy-Preserving Distillation](https://mlsanity.com/paper/2405.16361/) (2024)
- [Protecting Intellectual Property of EEG-based Neural Networks with Watermarking](https://mlsanity.com/paper/2502.05931/) (2025)
- [A Survey of Adversarial Defenses in Vision-based Systems: Categorization, Methods and Challenges](https://mlsanity.com/paper/2503.00384/) (2025)
- [Optimizing Privacy-Preserving Primitives to Support LLM-Scale Applications](https://mlsanity.com/paper/2509.25072/) (2025)
- [Protecting Deep Neural Network Intellectual Property with Chaos-Based White-Box Watermarking](https://mlsanity.com/paper/2512.16658/) (2025)
- [Privacy protection based on mask template](https://mlsanity.com/paper/2202.06250/) (2022)
- [Deep Learning model integrity checking mechanism using watermarking technique](https://mlsanity.com/paper/2301.12333/) (2023)

## Abstract (arXiv)

This paper proposes DeepMarks, a novel end-to-end framework for systematic fingerprinting in the context of Deep Learning (DL). Remarkable progress has been made in the area of deep learning. Sharing the trained DL models has become a trend that is ubiquitous in various fields ranging from biomedical diagnosis to stock prediction. As the availability and popularity of pre-trained models are increasing, it is critical to protect the Intellectual Property (IP) of the model owner. DeepMarks introduces the first fingerprinting methodology that enables the model owner to embed unique fingerprints within the parameters (weights) of her model and later identify undesired usages of her distributed models. The proposed framework embeds the fingerprints in the Probability Density Function (pdf) of trainable weights by leveraging the extra capacity available in contemporary DL models. DeepMarks is robust against fingerprints collusion as well as network transformation attacks, including model compression and model fine-tuning. Extensive proof-of-concept evaluations on MNIST and CIFAR10 datasets, as well as a wide variety of deep neural networks architectures such as Wide Residual Networks (WRNs) and Convolutional Neural Networks (CNNs), corroborate the effectiveness and robustness of DeepMarks framework.