# Passport-aware Normalization for Deep Model Protection

arXiv: https://arxiv.org/abs/2010.15824 · HTML: https://mlsanity.com/paper/2010.15824/

## Key facts

- Cited by 43 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Oct 2020.

## Built on by (most cited first, 30 of 43)

- [Deep Model Intellectual Property Protection via Deep Watermarking](https://mlsanity.com/paper/2103.04980/) (2021)
- [Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attack](https://mlsanity.com/paper/2102.04362/) (2021)
- [Defending against Model Stealing via Verifying Embedded External Features](https://mlsanity.com/paper/2112.03476/) (2021)
- [Undistillable: Making A Nasty Teacher That CANNOT teach students](https://mlsanity.com/paper/2105.07381/) (2021)
- [FedIPR: Ownership Verification for Federated Deep Neural Network Models](https://mlsanity.com/paper/2109.13236/) (2021)
- [Why Batch Normalization Damage Federated Learning on Non-IID Data?](https://mlsanity.com/paper/2301.02982/) (2023)
- [Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networks](https://mlsanity.com/paper/2210.15427/) (2022)
- [Rethinking White-Box Watermarks on Deep Learning Models under Neural Structural Obfuscation](https://mlsanity.com/paper/2303.09732/) (2023)
- [Task-Specific Normalization for Continual Learning of Blind Image Quality Models](https://mlsanity.com/paper/2107.13429/) (2021)
- [You are caught stealing my winning lottery ticket! Making a lottery ticket claim its ownership](https://mlsanity.com/paper/2111.00162/) (2021)
- [Functional Invariants to Watermark Large Transformers](https://mlsanity.com/paper/2310.11446/) (2023)
- [Federated Deep Learning with Bayesian Privacy](https://mlsanity.com/paper/2109.13012/) (2021)
- [Wide Flat Minimum Watermarking for Robust Ownership Verification of GANs](https://mlsanity.com/paper/2310.16919/) (2023)
- [FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprint](https://mlsanity.com/paper/2501.15509/) (2025)
- [FedZKP: Federated Model Ownership Verification with Zero-knowledge Proof](https://mlsanity.com/paper/2305.04507/) (2023)
- [Sandwich Batch Normalization: A Drop-In Replacement for Feature Distribution Heterogeneity](https://mlsanity.com/paper/2102.11382/) (2021)
- [When Federated Learning meets Watermarking: A Comprehensive Overview of Techniques for Intellectual Property Protection](https://mlsanity.com/paper/2308.03573/) (2023)
- [Cracking White-box DNN Watermarks via Invariant Neuron Transforms](https://mlsanity.com/paper/2205.00199/) (2022)
- [Robust Retraining-free GAN Fingerprinting via Personalized Normalization](https://mlsanity.com/paper/2311.05478/) (2023)
- [DeepEclipse: How to Break White-Box DNN-Watermarking Schemes](https://mlsanity.com/paper/2403.03590/) (2024)
- [Steganographic Passport: An Owner and User Verifiable Credential for Deep Model IP Protection Without Retraining](https://mlsanity.com/paper/2404.02889/) (2024)
- [Anti-Neuron Watermarking: Protecting Personal Data Against Unauthorized Neural Networks](https://mlsanity.com/paper/2109.09023/) (2021)
- [Distilling the Undistillable: Learning from a Nasty Teacher](https://mlsanity.com/paper/2210.11728/) (2022)
- [FedSOV: Federated Model Secure Ownership Verification with Unforgeable Signature](https://mlsanity.com/paper/2305.06085/) (2023)
- [Towards Open Federated Learning Platforms: Survey and Vision from Technical and Legal Perspectives](https://mlsanity.com/paper/2307.02140/) (2023)
- [Performance-lossless Black-box Model Watermarking](https://mlsanity.com/paper/2312.06488/) (2023)
- [EncryIP: A Practical Encryption-Based Framework for Model Intellectual Property Protection](https://mlsanity.com/paper/2312.12049/) (2023)
- [Adversarial Sparse Teacher: Defense Against Distillation-Based Model Stealing Attacks Using Adversarial Examples](https://mlsanity.com/paper/2403.05181/) (2024)
- [IDEA: An Inverse Domain Expert Adaptation Based Active DNN IP Protection Method](https://mlsanity.com/paper/2410.00059/) (2024)
- [Sample Correlation for Fingerprinting Deep Face Recognition](https://mlsanity.com/paper/2412.20768/) (2024)

## Abstract (arXiv)

Despite tremendous success in many application scenarios, deep learning faces serious intellectual property (IP) infringement threats. Considering the cost of designing and training a good model, infringements will significantly infringe the interests of the original model owner. Recently, many impressive works have emerged for deep model IP protection. However, they either are vulnerable to ambiguity attacks, or require changes in the target network structure by replacing its original normalization layers and hence cause significant performance drops. To this end, we propose a new passport-aware normalization formulation, which is generally applicable to most existing normalization layers and only needs to add another passport-aware branch for IP protection. This new branch is jointly trained with the target model but discarded in the inference stage. Therefore it causes no structure change in the target model. Only when the model IP is suspected to be stolen by someone, the private passport-aware branch is added back for ownership verification. Through extensive experiments, we verify its effectiveness in both image and 3D point recognition models. It is demonstrated to be robust not only to common attack techniques like fine-tuning and model compression, but also to ambiguity attacks. By further combining it with trigger-set based methods, both black-box and white-box verification can be achieved for enhanced security of deep learning models deployed in real systems. Code can be found at https://github.com/ZJZAC/Passport-aware-Normalization.