mlsanityData to 14 Oct 2026

FBI: Fingerprinting models with Benign Inputs

arXiv 2208.03169 ↗First posted 5 Aug 2022cs.CR cs.LGcited by 1

Not on the map. Why?

Abstract (arXiv)

Recent advances in the fingerprinting of deep neural networks detect instances of models, placed in a black-box interaction scheme. Inputs used by the fingerprinting protocols are specifically crafted for each precise model to be checked for. While efficient in such a scenario, this nevertheless results in a lack of guarantee after a mere modification (like retraining, quantization) of a model. This paper tackles the challenges to propose i) fingerprinting schemes that are resilient to significant modifications of the models, by generalizing to the notion of model families and their variants, ii) an extension of the fingerprinting task encompassing scenarios where one wants to fingerprint not only a precise model (previously referred to as a detection task) but also to identify which model family is in the black-box (identification task). We achieve both goals by demonstrating that benign inputs, that are unmodified images, for instance, are sufficient material for both tasks. We leverage an information-theoretic scheme for the identification task. We devise a greedy discrimination algorithm for the detection task. Both approaches are experimentally validated over an unprecedented set of more than 1,000 networks.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 22 of its 48 references that are in the map. First posted on arXiv 5 Aug 2022.

Builds on

22 of 48 references.

References · 22

  1. 2015Domain-Adversarial Training of Neural Networkscited by 3,044
  2. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  3. 2015Deep Compression: Compressing Deep Neural Networks with Pruning, Trained Quantization and Huffman Codingcited by 2,329
  4. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  5. 2016Pruning Filters for Efficient ConvNetscited by 1,143
  6. 2017Countering Adversarial Images using Input Transformationscited by 520
  7. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  8. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
  9. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 357
  10. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 269
  11. 2017Embedding Watermarks into Deep Neural Networkscited by 248
  12. 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 118
10 more
  1. 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 93
  2. 2018Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compressioncited by 74
  3. 2021A survey of deep neural network watermarking techniquescited by 73
  4. 2019IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundarycited by 70
  5. 2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 61
  6. 2019Model Similarity Mitigates Test Set Overusecited by 38
  7. 2019Walking on the Edge: Fast, Low-Distortion Adversarial Examplescited by 18
  8. 2018Defending against Adversarial Images using Basis Functions Transformationscited by 11
  9. 2022Randomized Smoothing under Attack: How Good is it in Pratice?cited by 7
  10. 2019TamperNN: Efficient Tampering Detection of Deployed Neural Netscited by 2

Built on by

Cited by year

Citing papers per year: 2023: 1.

1 paper.

  1. 2023How to choose your best allies for a transferable attack?cited by 1

Similar, not cited

Close in wording, no citation either way

  1. 2021Fingerprinting Multi-exit Deep Neural Network Models via Inference Time
  2. 2024Fingerprint Vector: Enabling Scalable and Efficient Model Fingerprint Transfer via Vector Addition
  3. 2023Deep Image Fingerprint: Towards Low Budget Synthetic Image Detection and Model Lineage Analysis
  4. 2025FPEdit: Robust LLM Fingerprinting through Localized Parameter Editing
  5. 2025LLM Fingerprinting via Semantically Conditioned Watermarks
  6. 2022DeepTaster: Adversarial Perturbation-Based Fingerprinting to Identify Proprietary Dataset Use in Deep Neural Networks
  7. 2026SIF: Semantically In-Distribution Fingerprints for Large Vision-Language Models
  8. 2022On the Robustness of Dataset Inference