Research map / Detection and segmentation / Open-set and few-shot detection
Queries, Representation & Detection: The Next 100 Model Fingerprinting Schemes
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces the Anna Karenina Heuristic baseline and a Query-Representation-Detection (QuRD) decomposition of model fingerprinting, showing that simple baselines match state-of-the-art fingerprints and that existing benchmarks are too easy.
Problem
Model fingerprinting schemes for detecting model stealing are proposed under disparate assumptions and are hard to compare; existing benchmarks may not discriminate between them.
Approach
A simple baseline (AKH) queries the suspected model on points the victim misclassifies, with a one-sided error guarantee; a QuRD decomposition (query sampling, representation, detection) is used to systematically generate ~100 new fingerprint combinations and to analyze benchmarks.
Key results
- The simple AKH baseline performs on par with or better than existing state-of-the-art fingerprints on ModelReuse and SACBench, with a +14% (about 10 points) TPR gain for IPGuard from switching to negative seed samples.
- Most benchmark tasks (same, quantize, finetune, transfer) are fully solved (TPR 1.0) by nearly all fingerprints; model extraction without obfuscation is the hard subtask.
- Adversarial label extraction is detected by negative-sampling fingerprints (SAC 1.0 TPR) but not by adversarial-sampling schemes like ModelDiff (0.16) or IPGuard (0.02) at 100 queries.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use AKH instead of existing fingerprints | Model fingerprinting · ModelReuse SDog120 and SACBench | TPR | No clear effect |
| Use AKH instead of existing fingerprints | Model fingerprinting · ModelReuse Flower102 | TPR | Helped |
| Use negative seed samples to initialize adversarial query generation | IPGuard on ModelReuse · ModelReuse | TPR: +10 points (+14%) | Helped |
| Use negative sampling rather than adversarial sampling | Fingerprint schemes · ModelReuse and SACBench | TPR | Helped |
| Increase the query budget from 100 to 400 | ModelDiff and SAC · ModelReuse and SACBench | TPR | Hurt |
| Increase the query budget up to 50 on ModelReuse or 100 on SACBench | Most fingerprint schemes · ModelReuse and SACBench | TPR | Helped |
| Use a query budget beyond 50 on ModelReuse or 100 on SACBench | Most fingerprint schemes · ModelReuse and SACBench | TPR | No clear effect |
| Use negative sampling rather than adversarial sampling | Fingerprint schemes · SACBench | TPR variance | Helped |
| Use adversarial rather than natural-image queries | Model fingerprinting schemes · Image classification | TPR robustness | Hurt |
Surprising findings
- A simple baseline that queries only misclassified victim points matches complex state-of-the-art fingerprints.
- Benchmarks such as SACBench are too easy: positive and negative pairs are well separated and model diversity is low.
Limitations
- Evaluation restricted to image classification and two benchmarks.
- No guarantees on false alarm rate for fingerprinting; robustness to adaptive adversaries not studied.
Experimental setup
Datasets: Stanford Dogs Oxford Flowers CIFAR10
Benchmarks: ModelReuse (Flower102) ModelReuse (SDog120) SACBench (CIFAR10)
Metrics: TPR@5% FPR ROC curve
Baselines: IPGuard ModelDiff SAC ZestOfLIME Random Sampling FBI
Builds on: IPGuard ModelDiff SAC ZestOfLIME FBI
Closest papers by meaning
- Scalable Fingerprinting of Large Language Models (NeurIPS 2025 · similarity 0.89)
- Intersecting-Boundary-Sensitive Fingerprinting for Tampering Detection of DNN Models (ICML 2024 · similarity 0.85)
- Fingerprinting Inference Systems of Large Language Models (NeurIPS 2026 · similarity 0.85)
- Stealix: Model Stealing via Prompt Evolution (ICML 2025 · similarity 0.85)
- Defense against Model Extraction Attack by Bayesian Active Watermarking (ICML 2024 · similarity 0.84)
- SDBF: Steep-Decision-Boundary Fingerprinting for Hard-Label Tampering Detection of DNN Models (CVPR 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.