mlsanityData to 7 Oct 2026

NaturalFinger: Generating Natural Fingerprint with Generative Adversarial Networks

arXiv 2305.17868 ↗First posted 29 May 2023cs.CV cs.CRcited by 2

Not on the map. Why?

Abstract (arXiv)

Deep neural network (DNN) models have become a critical asset of the model owner as training them requires a large amount of resource (i.e. labeled data). Therefore, many fingerprinting schemes have been proposed to safeguard the intellectual property (IP) of the model owner against model extraction and illegal redistribution. However, previous schemes adopt unnatural images as the fingerprint, such as adversarial examples and noisy images, which can be easily perceived and rejected by the adversary. In this paper, we propose NaturalFinger which generates natural fingerprint with generative adversarial networks (GANs). Besides, our proposed NaturalFinger fingerprints the decision difference areas rather than the decision boundary, which is more robust. The application of GAN not only allows us to generate more imperceptible samples, but also enables us to generate unrestricted samples to explore the decision boundary.To demonstrate the effectiveness of our fingerprint approach, we evaluate our approach against four model modification attacks including adversarial training and two model extraction attacks. Experiments show that our approach achieves 0.91 ARUC value on the FingerBench dataset (154 models), exceeding the optimal baseline (MetaV) over 17%.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 24 of its 43 references that are in the map. First posted on arXiv 29 May 2023.

Builds on

24 of 43 references.

References · 24

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  7. 2017Squeeze-and-Excitation Networkscited by 4,763
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2016Xception: Deep Learning with Depthwise Separable Convolutionscited by 2,320
  10. 2017Improved Training of Wasserstein GANscited by 2,223
  11. 2015Learning both Weights and Connections for Efficient Neural Networkscited by 1,998
  12. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
12 more
  1. 2018Self-Attention Generative Adversarial Networkscited by 809
  2. 2016Universal adversarial perturbationscited by 774
  3. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  4. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  5. 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 90
  6. 2019IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundarycited by 68
  7. 2020Improved Consistency Regularization for GANscited by 67
  8. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 67
  9. 2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 58
  10. 2021Rebooting ACGAN: Auxiliary Classifier GANs with Stable Trainingcited by 57
  11. 2019LOGAN: Latent Optimisation for Generative Adversarial Networkscited by 42
  12. 2022MetaV: A Meta-Verifier Approach to Task-Agnostic Model Fingerprintingcited by 16

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Fingerprinting Deep Neural Networks for Ownership Protection: An Analytical Approachcited by 1
  2. 2026Targeted Counterfactual Fingerprinting for Black-Box LLM Ownership Verificationcited by 1