mlsanityData to 14 Oct 2026

Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbations

arXiv 2202.08602 ↗First posted 17 Feb 2022cs.CR cs.AIcited by 61

Not on the map. Why?

Abstract (arXiv)

In this paper, we propose a novel and practical mechanism which enables the service provider to verify whether a suspect model is stolen from the victim model via model extraction attacks. Our key insight is that the profile of a DNN model's decision boundary can be uniquely characterized by its Universal Adversarial Perturbations (UAPs). UAPs belong to a low-dimensional subspace and piracy models' subspaces are more consistent with victim model's subspace compared with non-piracy model. Based on this, we propose a UAP fingerprinting method for DNN models and train an encoder via contrastive learning that takes fingerprint as inputs, outputs a similarity score. Extensive studies show that our framework can detect model IP breaches with confidence > 99.99 within only 20 fingerprints of the suspect model. It has good generalizability across different model architectures and is robust against post-modifications on stolen models.

Key facts. Cited by 61 papers in the map (data through 14 Oct 2026). Builds on 36 of its 43 references that are in the map. First posted on arXiv 17 Feb 2022.

Builds on

36 of 43 references.

References · 36

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 12,049
  4. 2016Densely Connected Convolutional Networkscited by 6,720
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  6. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,349
  7. 2014Going Deeper with Convolutionscited by 4,241
  8. 2020Supervised Contrastive Learningcited by 2,829
  9. 2015Deep Compression: Compressing Deep Neural Networks with Pruning, Trained Quantization and Huffman Codingcited by 2,329
  10. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  11. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  12. 2016Universal adversarial perturbationscited by 784
24 more
  1. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  2. 2017To prune, or not to prune: exploring the efficacy of pruning for model compressioncited by 603
  3. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  4. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 357
  5. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 214
  6. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 165
  7. 2017The Space of Transferable Adversarial Examplescited by 158
  8. 2020Entangled Watermarks as a Defense against Model Extractioncited by 149
  9. 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 118
  10. 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 100
  11. 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 93
  12. 2018Exploring Connections Between Active Learning and Model Extractioncited by 85
  13. 2021Proof-of-Learning: Definitions and Practicecited by 84
  14. 2019Reverse-Engineering Deep ReLU Networkscited by 83
  15. 2019IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundarycited by 70
  16. 2020Cryptanalytic Extraction of Neural Network Modelscited by 68
  17. 2017Art of singular vectors and universal adversarial perturbationscited by 49
  18. 2021Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attackcited by 46
  19. 2020Hermes Attack: Steal DNN Models with Lossless Inference Accuracycited by 41
  20. 2021Knowledge Enhanced Machine Learning Pipeline against Diverse Adversarial Attackscited by 24
  21. 2020AI-GAN: Attack-Inspired Generation of Adversarial Examplescited by 22
  22. 2018Have You Stolen My Model? Evasion Attacks Against Deep Neural Network Watermarking Techniquescited by 10
  23. 2021SoK: Machine Learning Governancecited by 10
  24. 2021Progressive-Scale Boundary Blackbox Attack via Projective Gradient Estimationcited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 3; 2023: 14; 2024: 15; 2025: 12; 2026: 17.

61 papers.

Sort:

By area:

  1. 2024Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attributioncited by 40
  2. 2023HuRef: HUman-REadable Fingerprint for Large Language Modelscited by 34
  3. 2023Downstream-agnostic Adversarial Examplescited by 32
  4. 2023Enhancing Generalization of Universal Adversarial Perturbation through Gradient Aggregationcited by 22
  5. 2022MOVE: Effective and Harmless Ownership Verification via Embedded External Featurescited by 21
  6. 2022Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networkscited by 21
  7. 2025Copyright Protection for Large Language Models: A Survey of Methods, Challenges, and Trendscited by 20
  8. 2024NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectorscited by 17
  9. 2023GrOVe: Ownership Verification of Graph Neural Networks using Embeddingscited by 16
  10. 2025Model Provenance Testing for Large Language Modelscited by 15
  11. 2023Securing Deep Generative Models with Universal Adversarial Signaturecited by 14
  12. 2025DOGe: Defensive Output Generation for LLM Protection Against Knowledge Distillationcited by 14
38 more
  1. 2023What can Discriminator do? Towards Box-free Ownership Verification of Generative Adversarial Networkcited by 10
  2. 2024Neural Lineagecited by 9
  3. 2024QUEEN: Query Unlearning against Model Extractioncited by 9
  4. 2024Cross-Task Attack: A Self-Supervision Generative Framework Based on Attention Shiftcited by 9
  5. 2025Are Robust LLM Fingerprints Adversarially Robust?cited by 8
  6. 2023SoK: Unintended Interactions among Machine Learning Defenses and Riskscited by 6
  7. 2024Steganographic Passport: An Owner and User Verifiable Credential for Deep Model IP Protection Without Retrainingcited by 5
  8. 2026Towards Distillation-Resistant Large Language Models: An Information-Theoretic Perspectivecited by 5
  9. 2026CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attackscited by 5
  10. 2023RemovalNet: DNN Fingerprint Removal Attackscited by 4
  11. 2024MAP: MAsk-Pruning for Source-Free Model Intellectual Property Protectioncited by 4
  12. 2023GanFinger: GAN-Based Fingerprint Generation for Deep Neural Network Ownership Verificationcited by 3
  13. 2025Vision-Language Model IP Protection via Prompt-based Learningcited by 3
  14. 2025AWM: Accurate Weight-Matrix Fingerprint for Large Language Modelscited by 3
  15. 2025SWAP: Towards Copyright Auditing of Soft Prompts via Sequential Watermarkingcited by 3
  16. 2026FLIPS: Instance-Fingerprinting for LLMs via Pseudo-random Sequencescited by 3
  17. 2023NaturalFinger: Generating Natural Fingerprint with Generative Adversarial Networkscited by 2
  18. 2023FLARE: Fingerprinting Deep Reinforcement Learning Agents using Universal Adversarial Maskscited by 2
  19. 2024Lazy Layers to Make Fine-Tuned Diffusion Models More Traceablecited by 2
  20. 2024Proactive Schemes: A Survey of Adversarial Attacks for Social Goodcited by 2
  21. 2024Combining Machine Learning Defenses without Conflictscited by 2
  22. 2024Sample Correlation for Fingerprinting Deep Face Recognitioncited by 2
  23. 2025AGATE: Stealthy Black-box Watermarking for Multimodal Model Copyright Protectioncited by 2
  24. 2025Holmes: Towards Effective and Harmless Model Ownership Verification to Personalized Large Vision Models via Decoupling Common Featurescited by 2
  25. 2026Fingerprinting Deep Neural Networks for Ownership Protection: An Analytical Approachcited by 2
  26. 2026SIF: Semantically In-Distribution Fingerprints for Large Vision-Language Modelscited by 2
  27. 2026Towards Backdoor-Based Ownership Verification for Vision-Language-Action Modelscited by 2
  28. 2026Steal the Patch Size: Adversarially Manipulate Vision-Language Modelscited by 2
  29. 2022FBI: Fingerprinting models with Benign Inputscited by 1
  30. 2023How to choose your best allies for a transferable attack?cited by 1
  31. 2023SSL-Auth: An Authentication Framework by Fragile Watermarking for Pre-trained Encoders in Self-supervised Learningcited by 1
  32. 2024Protecting Deep Learning Model Copyrights with Adversarial Example-Free Reuse Detectioncited by 1
  33. 2025Protecting Intellectual Property of EEG-based Neural Networks with Watermarkingcited by 1
  34. 2026Attesting Model Lineage by Consisted Knowledge Evolution with Fine-Tuning Trajectorycited by 1
  35. 2026BlackCATT: Black-box Collusion Aware Traitor Tracing in Federated Learningcited by 1
  36. 2026Targeted Counterfactual Fingerprinting for Black-Box LLM Ownership Verificationcited by 1
  37. 2023Decision-BADGE: Decision-based Adversarial Batch Attack with Directional Gradient Estimationcited by 0
  38. 2024A2-DIDM: Privacy-preserving Accumulator-enabled Auditing for Distributed Identity of DNN Modelcited by 0

50 most cited of 61 All 61 (JSON)