mlsanityData to 14 Oct 2026

ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detection

arXiv 2106.08890 ↗First posted 11 Jun 2021cs.LG cs.AI cs.SEcited by 33

Not on the map. Why?

Abstract (arXiv)

The knowledge of a deep learning model may be transferred to a student model, leading to intellectual property infringement or vulnerability propagation. Detecting such knowledge reuse is nontrivial because the suspect models may not be white-box accessible and/or may serve different tasks. In this paper, we propose ModelDiff, a testing-based approach to deep learning model similarity comparison. Instead of directly comparing the weights, activations, or outputs of two models, we compare their behavioral patterns on the same set of test inputs. Specifically, the behavioral pattern of a model is represented as a decision distance vector (DDV), in which each element is the distance between the model's reactions to a pair of inputs. The knowledge similarity between two models is measured with the cosine similarity between their DDVs. To evaluate ModelDiff, we created a benchmark that contains 144 pairs of models that cover most popular model reuse methods, including transfer learning, model compression, and model stealing. Our method achieved 91.7% correctness on the benchmark, which demonstrates the effectiveness of using ModelDiff for model reuse detection. A study on mobile deep learning apps has shown the feasibility of ModelDiff on real-world models.

Key facts. Cited by 33 papers in the map (data through 14 Oct 2026). Builds on 36 of its 82 references that are in the map. First posted on arXiv 11 Jun 2021.

Builds on

36 of 82 references.

References · 36

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2015Distilling the Knowledge in a Neural Networkcited by 10,324
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2013Intriguing properties of neural networkscited by 5,155
  6. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
  7. 2015Deep Compression: Compressing Deep Neural Networks with Pruning, Trained Quantization and Huffman Codingcited by 2,329
  8. 2015Learning both Weights and Connections for Efficient Neural Networkscited by 2,031
  9. 2019Similarity of Neural Network Representations Revisitedcited by 1,755
  10. 2016Pruning Filters for Efficient ConvNetscited by 1,143
  11. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  12. 2016Stealing Machine Learning Models via Prediction APIscited by 619
24 more
  1. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  2. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 357
  3. 2018Insights on representational similarity in neural networks with canonical correlationcited by 324
  4. 2017DeepXplore: Automated Whitebox Testing of Deep Learning Systemscited by 311
  5. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
  6. 2017DeepTest: Automated Testing of Deep-Neural-Network-driven Autonomous Carscited by 251
  7. 2019Simple Black-box Adversarial Attackscited by 251
  8. 2017Embedding Watermarks into Deep Neural Networkscited by 248
  9. 2019Machine Learning Testing: Survey, Landscapes and Horizonscited by 218
  10. 2018DeepGauge: Multi-Granularity Testing Criteria for Deep Learning Systemscited by 147
  11. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 140
  12. 2018Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardwarecited by 102
  13. 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 93
  14. 2019[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attackscited by 88
  15. 2019IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundarycited by 70
  16. 2018TensorFuzz: Debugging Neural Networks with Coverage-Guided Fuzzingcited by 68
  17. 2017Neural Network-based Graph Embedding for Cross-Platform Binary Code Similarity Detectioncited by 65
  18. 2021DeepPayload: Black-box Backdoor Attack on Deep Learning Models through Neural Payload Injectioncited by 44
  19. 2020Neural Network Laundering: Removing Black-Box Backdoor Watermarks from Deep Neural Networkscited by 27
  20. 2019A Survey of Binary Code Similaritycited by 19
  21. 2019Testing DNN Image Classifiers for Confusion & Bias Errorscited by 18
  22. 2020Dynamic Slicing for Deep Neural Networkscited by 16
  23. 2019A Target-Agnostic Attack on Deep Models: Exploiting Security Vulnerabilities of Transfer Learningcited by 15
  24. 2019DeepSmartFuzzer: Reward Guided Test Generation For Deep Learningcited by 7

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 3; 2023: 10; 2024: 11; 2025: 6; 2026: 3.

33 papers.

Sort:

By area:

  1. 2023Similarity of Neural Network Models: A Survey of Functional and Representational Measurescited by 131
  2. 2023Recent Advances on Federated Learning: A Systematic Surveycited by 41
  3. 2022GEMEL: Model Merging for Memory-Efficient, Real-Time Video Analytics at the Edgecited by 32
  4. 2022Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networkscited by 21
  5. 2025SoK: Large Language Model Copyright Auditing via Fingerprintingcited by 15
  6. 2024Beyond Benchmarks: Evaluating Embedding Model Similarity for Retrieval Augmented Generation Systemscited by 12
  7. 2025FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprintcited by 10
  8. 2023FedZKP: Federated Model Ownership Verification with Zero-knowledge Proofcited by 9
  9. 2024PeaTMOSS: A Dataset and Initial Analysis of Pre-Trained Models in Open-Source Softwarecited by 9
  10. 2024Neural Lineagecited by 9
  11. 2023Reusing Deep Neural Network Models through Model Re-engineeringcited by 6
  12. 2024A Large-Scale Study of Model Integration in ML-Enabled Software Systemscited by 6
21 more
  1. 2023A Plot is Worth a Thousand Words: Model Information Stealing Attacks via Scientific Plotscited by 5
  2. 2023ModelGiF: Gradient Fields for Model Functional Distancecited by 5
  3. 2022Similarity of Neural Architectures using Adversarial Attack Transferabilitycited by 4
  4. 2023Modularizing while Training: A New Paradigm for Modularizing DNN Modelscited by 4
  5. 2023RemovalNet: DNN Fingerprint Removal Attackscited by 4
  6. 2024IDEA: An Inverse Domain Expert Adaptation Based Active DNN IP Protection Methodcited by 2
  7. 2024Sample Correlation for Fingerprinting Deep Face Recognitioncited by 2
  8. 2025Task complexity shapes internal representations and robustness in neural networkscited by 2
  9. 2025Model Correlation Detection via Random Selection Probingcited by 2
  10. 2026Fingerprinting Deep Neural Networks for Ownership Protection: An Analytical Approachcited by 2
  11. 2023PeaTMOSS: Mining Pre-Trained Models in Open-Source Softwarecited by 1
  12. 2023GIST: Generated Inputs Sets Transferability in Deep Learningcited by 1
  13. 2024Protecting Deep Learning Model Copyrights with Adversarial Example-Free Reuse Detectioncited by 1
  14. 2024Characterizing Disparity Between Edge Models and High-Accuracy Base Models for Vision Taskscited by 1
  15. 2024Bias Similarity Measurement: A Black-Box Audit of Fairness Across LLMscited by 1
  16. 2025Backdoor Detection through Replicated Execution of Outsourced Trainingcited by 1
  17. 2024DiffGAN: A Test Generation Approach for Differential Testing of Deep Neural Networks for Image Analysiscited by 0
  18. 2024DeepCore: Simple Fingerprint Construction for Differentiating Homologous and Piracy Modelscited by 0
  19. 2025Towards Understanding Deep Learning Model in Image Recognition via Coverage Testcited by 0
  20. 2026Detecting Semantic Backdoors in a Mystery Shopping Scenariocited by 0
  21. 2026TP-CRIV: A Framework for Third-Party Challenge-Response Identity Verification of AI Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Cross-Architecture Model Diffing with Crosscoders: Unsupervised Discovery of Differences Between LLMs
  2. 2021Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Models
  3. 2023False Claims against Model Ownership Resolution
  4. 2023FAST: Feature Aware Similarity Thresholding for Weak Unlearning in Black-Box Generative Models
  5. 2021Similarity Transfer for Knowledge Distillation
  6. 2023VeriDIP: Verifying Ownership of Deep Neural Networks through Privacy Leakage Fingerprints
  7. 2026Combining Trained Models in Reinforcement Learning
  8. 2026The Triangle of Similarity: A Multi-Faceted Framework for Comparing Neural Network Representations