mlsanityData to 14 Oct 2026

CHIP: Chameleon Hash-based Irreversible Passport for Robust Deep Model Ownership Verification and Active Usage Control

arXiv 2505.24536 ↗First posted 30 May 2025cs.CR cs.AIcited by 0

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

The pervasion of large-scale Deep Neural Networks (DNNs) and their enormous training costs make their intellectual property (IP) protection of paramount importance. Recently introduced passport-based methods attempt to steer DNN watermarking towards strengthening ownership verification against ambiguity attacks by modulating the affine parameters of normalization layers. Unfortunately, neither watermarking nor passport-based methods provide a holistic protection with robust ownership proof, high fidelity, active usage authorization and user traceability for offline access distributed models and multi-user Machine-Learning as a Service (MLaaS) cloud model. In this paper, we propose a Chameleon Hash-based Irreversible Passport (CHIP) protection framework that utilizes the cryptographic chameleon hash function to achieve all these goals. The collision-resistant property of chameleon hash allows for strong model ownership claim upon IP infringement and liable user traceability, while the trapdoor-collision property enables hashing of multiple user passports and licensee certificates to the same immutable signature to realize active usage control. Using the owner passport as an oracle, multiple user-specific triplets, each contains a passport-aware user model, a user passport, and a licensee certificate can be created for secure offline distribution. The watermarked master model can also be deployed for MLaaS with usage permission verifiable by the provision of any trapdoor-colliding user passports. CHIP is extensively evaluated on four datasets and two architectures to demonstrate its protection versatility and robustness. Our code is released at https://github.com/Dshm212/CHIP.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 26 of its 52 references that are in the map. First posted on arXiv 30 May 2025.

Builds on

26 of 52 references.

Closest ancestors · 2

Same direction, newest first

  1. 2023NNSplitter: An Active Defense Solution for DNN Model via Automated Weight Obfuscation28 Apr
  2. 2021Non-Transferable Learning: A New Approach for Model Ownership Verification and Applicability Authorization13 Jun

Other references · 24

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2023GPT-4 Technical Reportcited by 18,396
  3. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  4. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 7,005
  5. 2018How Powerful are Graph Neural Networks?cited by 4,393
  6. 2023Qwen Technical Reportcited by 3,344
  7. 2018Group Normalizationcited by 1,524
  8. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  9. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 357
  10. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
  11. 2020MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimationcited by 99
  12. 2019[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attackscited by 88
12 more
  1. 2021Proof-of-Learning: Definitions and Practicecited by 84
  2. 2019IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundarycited by 70
  3. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 69
  4. 2020Passport-aware Normalization for Deep Model Protectioncited by 43
  5. 2022MetaV: A Meta-Verifier Approach to Task-Agnostic Model Fingerprintingcited by 16
  6. 2022Free Fine-tuning: A Plug-and-Play Watermarking Scheme for Deep Neural Networkscited by 15
  7. 2019Generative Adversarial Networks for Black-Box API Attacks with Limited Training Datacited by 8
  8. 2020Deep Serial Number: Computational Watermarking for DNN Intellectual Property Protectioncited by 5
  9. 2024Steganographic Passport: An Owner and User Verifiable Credential for Deep Model IP Protection Without Retrainingcited by 5
  10. 2023GanFinger: GAN-Based Fingerprint Generation for Deep Neural Network Ownership Verificationcited by 3
  11. 2024SNNGX: Securing Spiking Neural Networks with Genetic XOR Encryption on RRAM-based Neuromorphic Acceleratorcited by 2
  12. 2024Older and Wiser: The Marriage of Device Aging and Intellectual Property Protection of Deep Neural Networkscited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2023Effective Ambiguity Attack Against Passport-based DNN Intellectual Property Protection Schemes through Fully Connected Layer Substitution
  2. 2023Deep Intellectual Property Protection: A Survey
  3. 2021ActiveGuard: An Active DNN IP Protection Technique via Adversarial Examples
  4. 2023Turn Passive to Active: A Survey on Active Intellectual Property Protection of Deep Learning Models
  5. 2023OVLA: Neural Network Ownership Verification using Latent Watermarks
  6. 2025Authority Backdoor: A Certifiable Backdoor Mechanism for Authoring DNNs
  7. 2021Ownership Verification of DNN Architectures via Hardware Cache Side Channels
  8. 2025NWaaS: A Non-Intrusive and Privacy-Preserving Watermarking-as-a-Service System with Adaptive Resource Scheduling