mlsanityData to 7 Oct 2026

MOVE: Effective and Harmless Ownership Verification via Embedded External Features

arXiv 2208.02820 ↗First posted 4 Aug 2022cs.CR cs.AI cs.CVcited by 20

Not on the map. Why?

Abstract (arXiv)

Currently, deep neural networks (DNNs) are widely adopted in different applications. Despite its commercial values, training a well-performing DNN is resource-consuming. Accordingly, the well-trained model is valuable intellectual property for its owner. However, recent studies revealed the threats of model stealing, where the adversaries can obtain a function-similar copy of the victim model, even when they can only query the model. In this paper, we propose an effective and harmless model ownership verification (MOVE) to defend against different types of model stealing simultaneously, without introducing new security risks. In general, we conduct the ownership verification by verifying whether a suspicious model contains the knowledge of defender-specified external features. Specifically, we embed the external features by modifying a few training samples with style transfer. We then train a meta-classifier to determine whether a model is stolen from the victim. This approach is inspired by the understanding that the stolen models should contain the knowledge of features learned by the victim model. In particular, revisionwe develop our MOVE method under both white-box and black-box settings and analyze its theoretical foundation to provide comprehensive model protection. Extensive experiments on benchmark datasets verify the effectiveness of our method and its resistance to potential adaptive attacks. The codes for reproducing the main experiments of our method are available at https://github.com/THUYimingLi/MOVE.

Key facts. Cited by 20 papers in the map (data through 7 Oct 2026). Builds on 47 of its 78 references that are in the map. First posted on arXiv 4 Aug 2022.

Builds on

47 of 78 references.

References · 47

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  5. 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 4,993
  6. 2016Overcoming catastrophic forgetting in neural networkscited by 4,718
  7. 2016Wide Residual Networkscited by 3,057
  8. 2016Perceptual Losses for Real-Time Style Transfer and Super-Resolutioncited by 2,678
  9. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  10. 2017Arbitrary Style Transfer in Real-time with Adaptive Instance Normalizationcited by 1,998
  11. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
  12. 2016Practical Black-Box Attacks against Machine Learningcited by 893
35 more
  1. 2016Universal adversarial perturbationscited by 774
  2. 2020Image Segmentation Using Deep Learning: A Surveycited by 659
  3. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  4. 2020Backdoor Learning: A Surveycited by 412
  5. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  6. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  7. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  8. 2020Large image datasets: A pyrrhic win for computer vision?cited by 237
  9. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  10. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 168
  11. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  12. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
  13. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  14. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
  15. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
  16. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  17. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 115
  18. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
  19. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 93
  20. 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 90
  21. 2019Data-Free Adversarial Distillationcited by 90
  22. 2018Exploring Connections Between Active Learning and Model Extractioncited by 84
  23. 2021Practical Blind Membership Inference Attack via Differential Comparisonscited by 73
  24. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
  25. 2019Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networkscited by 66
  26. 2020Backdoor Attack against Speaker Verificationcited by 62
  27. 2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 58
  28. 2019Defending Against Model Stealing Attacks with Adaptive Misinformationcited by 55
  29. 2019NeuronInspect: Detecting Backdoors in Neural Networks via Output Explanationscited by 49
  30. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
  31. 2017Model Extraction Warning in MLaaS Paradigmcited by 39
  32. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
  33. 2020Optical Flow Distillation: Towards Efficient and Stable Video Style Transfercited by 34
  34. 2020Open-sourced Dataset Protection via Backdoor Watermarkingcited by 30
  35. 2020A Performance-Sensitive Malware Detection System Using Deep Learning on Mobile Devicescited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 3; 2024: 4; 2025: 9; 2026: 4.

20 papers.

Sort:

By area:

  1. 2023Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Modelscited by 42
  2. 2024Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attributioncited by 35
  3. 2023HuRef: HUman-REadable Fingerprint for Large Language Modelscited by 32
  4. 2025Rethinking Data Protection in the (Generative) Artificial Intelligence Eracited by 17
  5. 2023Deep Intellectual Property Protection: A Surveycited by 16
  6. 2024SoK: Dataset Copyright Auditing in Machine Learning Systemscited by 14
  7. 2025SoK: Large Language Model Copyright Auditing via Fingerprintingcited by 14
  8. 2025FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprintcited by 8
  9. 2025Protecting Your Video Content: Disrupting Automated Video-based LLM Annotationscited by 5
  10. 2024DeepEclipse: How to Break White-Box DNN-Watermarking Schemescited by 4
  11. 2025Cert-SSBD: Certified Backdoor Defense with Sample-Specific Smoothing Noisescited by 4
  12. 2025CBW: Towards Dataset Ownership Verification for Speaker Verification via Clustering-based Backdoor Watermarkingcited by 3
8 more
  1. 2025SWAP: Towards Copyright Auditing of Soft Prompts via Sequential Watermarkingcited by 3
  2. 2026Cert-LAS: Toward Certified Model Ownership Verification for Text-to-Image Diffusion Models via Layer-Adaptive Smoothingcited by 3
  3. 2024Revisiting Black-Box Model Ownership Verification through Information Theorycited by 2
  4. 2025Holmes: Towards Effective and Harmless Model Ownership Verification to Personalized Large Vision Models via Decoupling Common Featurescited by 2
  5. 2026Echoes within the Reasoning: Stealthy and Effective Watermarking via Chain of Thoughtcited by 2
  6. 2026LoRA-Key: User-Centric LoRA Watermarking for Text-to-Image Diffusion Modelscited by 1
  7. 2025CertDW: Towards Certified Dataset Ownership Verification via Conformal Calibrationcited by 0
  8. 2026ArmSSL: Adversarial Robust Black-Box Watermarking for Self-Supervised Learning Pre-trained Encoderscited by 0