High-Robustness, Low-Transferability Fingerprinting of Neural Networks

TL;DR

This paper introduces a new fingerprinting method for neural networks that balances robustness against model modifications and low transferability to unrelated models, using characteristic examples and a novel metric.

Contribution

It proposes three types of characteristic examples and a Uniqueness Score to improve neural network fingerprinting by balancing robustness and transferability.

Findings

Characteristic examples are effective for fingerprinting.

The Uniqueness Score quantifies robustness-transferability trade-off.

The method reduces false positives in neural network identification.

Abstract

This paper proposes Characteristic Examples for effectively fingerprinting deep neural networks, featuring high-robustness to the base model against model pruning as well as low-transferability to unassociated models. This is the first work taking both robustness and transferability into consideration for generating realistic fingerprints, whereas current methods lack practical assumptions and may incur large false positive rates. To achieve better trade-off between robustness and transferability, we propose three kinds of characteristic examples: vanilla C-examples, RC-examples, and LTRC-example, to derive fingerprints from the original base model. To fairly characterize the trade-off between robustness and transferability, we propose Uniqueness Score, a comprehensive metric that measures the difference between robustness and transferability, which also serves as an indicator to the false alarm problem.