TP-CRIV: A Framework for Third-Party Challenge-Response Identity Verification of AI Models

arXiv 2609.29264 ↗First posted 24 Sep 2026cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Artificial intelligence (AI) models are increasingly deployed through remote services, making model misappropriation a growing concern. Existing approaches, including watermarking, fingerprinting, and model similarity analysis, primarily rely on predefined evidence or direct behavioral comparison and do not explicitly evaluate whether the claimant currently possesses and can utilize model-dependent information relevant to the claimed model identity. In this paper, we propose Third-Party Challenge-Response Identity Verification (TP-CRIV) for AI models. TP-CRIV targets a third-party verification setting in which the verifier has neither white-box nor API access to the claimant's model, can interact with the suspicious deployed service only through its ordinary black-box inference interface, and does not require protocol-specific cooperation from the service provider. Under these constraints, the framework enables the verifier to obtain empirical evidence as to whether the claimant locally possesses a model satisfying a predeclared identity relative to the deployed model. Verification is conducted under fresh, previously undisclosed requirements and network isolation, so that the demonstrated capability cannot rely on online external assistance after challenge disclosure. The resulting evidence is interpreted relative to independently specified and calibrated matching and non-matching operating situations and is statistical rather than cryptographic. We instantiate TP-CRIV for CNN image classifiers using probability-control-based witness generation. Experiments on ten ImageNet-pretrained TorchVision models demonstrate clear same/cross-model separation and finite-challenge verification using independently calibrated thresholds.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 31 of its 42 references that are in the map. First posted on arXiv 24 Sep 2026.

Builds on

31 of 42 references.

References · 31

2015Deep Residual Learning for Image Recognitioncited by 52,096
2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
2015Distilling the Knowledge in a Neural Networkcited by 10,324
2014Explaining and Harnessing Adversarial Examplescited by 7,364
2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
2015Learning both Weights and Connections for Efficient Neural Networkscited by 2,031
2016Adversarial examples in the physical worldcited by 1,769
2017Quantization and Training of Neural Networks for Efficient Integer-Arithmetic-Only Inferencecited by 1,593
2014How transferable are features in deep neural networks?cited by 1,225
2016Stealing Machine Learning Models via Prediction APIscited by 619

19 more

2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 357
2023The Stable Signature: Rooting Watermarks in Latent Diffusion Modelscited by 304
2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 118
2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 93
2023REMARK-LLM: A Robust and Efficient Watermarking Framework for Generative Large Language Modelscited by 78
2021A survey of deep neural network watermarking techniquescited by 73
2019IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundarycited by 70
2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 61
2017SafetyNets: Verifiable Execution of Deep Neural Networks on an Untrusted Cloudcited by 50
2021Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Modelscited by 46
2024TRAP: Targeted Random Adversarial Prompt Honeypot for Black-Box Identificationcited by 36
2021ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detectioncited by 33
2023Deep Intellectual Property Protection: A Surveycited by 17
2025Model Provenance Testing for Large Language Modelscited by 15
2024Neural Lineagecited by 9
2024Queries, Representation & Detection: The Next 100 Model Fingerprinting Schemescited by 5
2024Lazy Layers to Make Fine-Tuned Diffusion Models More Traceablecited by 2
2025Ownership Verification of DNN Models Using White-Box Adversarial Attacks with Specified Probability Manipulationcited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way