Research map / Adversarial robustness and security / Attacks on text and graphs
Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbations
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use UAP-based rather than local adversarial perturbation fingerprints (ablation) | model ownership verification · FashionMNIST | fingerprint similarity separation | Helped |
| add supervised contrastive learning to encoder training (ablation) | UAP fingerprinting encoder · FashionMNIST | piracy-versus-homologous separation | Helped |
| increase the number of fingerprint datapoints (ablation) | UAP fingerprinting · FashionMNIST | similarity gap: 70 datapoints | Helped |
| use more returned confidence values, from hard labels toward top-3 (ablation) | UAP fingerprinting with limited suspect-model outputs · FashionMNIST | similarity gap: 3 | Helped |
| reduce extraction recovery rate (ablation) | UAP fingerprinting · FashionMNIST, recovery rate 0.78 | similarity: 0.88 | Hurt |
| fine-tune, prune, or quantize the stolen model (ablation) | UAP fingerprinting · FashionMNIST | similarity: > 0.88 | No clear effect |
| apply adversarial training to the stolen model (ablation) | UAP fingerprinting · FashionMNIST | similarity: 0.99 to 0.89 | Hurt |
| apply 270 adversarial training iterations (ablation) | stolen model under UAP fingerprinting · FashionMNIST | similarity gap: 270; 0.17 | Hurt |
| increase overlap between victim and homologous training datasets (ablation) | UAP fingerprinting · FashionMNIST | homologous-model similarity: 0 to 0.9 | No clear effect |
| use an encoder trained for an independent victim model (ablation) | UAP fingerprinting · FashionMNIST | cosine similarity: 0.85; 0.33 | Mixed |
Closest papers by meaning
- United We Stand, Divided We Fall: Fingerprinting Deep Neural Networks via Adversarial Trajectories (NeurIPS 2024 · similarity 0.90)
- SDBF: Steep-Decision-Boundary Fingerprinting for Hard-Label Tampering Detection of DNN Models (CVPR 2025 · similarity 0.88)
- IPRemover: A Generative Model Inversion Attack against Deep Neural Network Fingerprinting and Watermarking (AAAI 2024 · similarity 0.87)
- Intersecting-Boundary-Sensitive Fingerprinting for Tampering Detection of DNN Models (ICML 2024 · similarity 0.87)
- Data-Free Universal Attack by Exploiting the Intrinsic Vulnerability of Deep Models (AAAI 2025 · similarity 0.86)
- Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimization (AAAI 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.