Research map / Adversarial robustness and security / Attacks on text and graphs
Steganographic Passport: An Owner and User Verifiable Credential for Deep Model IP Protection Without Retraining
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Steganographic Passport, which uses a key-based invertible steganographic network (ISN/HiNet) to hide user ID images into an owner-side passport and an activation-level obfuscated dual-branch passport model, enabling license verification without retraining.
Problem
Passport-based model IP protection needs retraining for every new licensed user and is vulnerable to Expanded Residual Block (ERB) ambiguity attacks, limiting agile licensing and accountability of deployed deep models.
Approach
Decouple license verification from ownership verification by hiding each user's ID image into the owner-side passport via an invertible steganographic network (keyed reveal), while SHA-512 hashing of the owner passport yields the model signature and an activation-level obfuscation plus balance loss tightly couples the verification and deployment branches.
Key results
- Ours achieves AD of 0.00% on ResNet-18 and 0.01% on AlexNet for ownership integrity verification, with 100% sign agreement across settings.
- Under ERB ambiguity attack with BN, ResNet-18 mean AD of 16.20 for the proposed method vs 9.51 for TdN; AlexNet mean AD 52.66 vs 44.81 for TdN.
- License verification reveals genuine user ID image with PSNR 41.47 while forged keys give PSNR 15.48 (noise passport) and 32.56 (random key).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Steganographic Passport instead of PAN | ResNet-18 passport protection · CIFAR-10, CIFAR-100, Caltech-101, Caltech-256 (mean) | deployment accuracy (%): 72.34 -> 71.73 | Hurt |
| Use Steganographic Passport instead of TdN | AlexNet passport protection · CIFAR-10, CIFAR-100, Caltech-101, Caltech-256 (mean) | deployment accuracy (%): 67.64 -> 67.50 | No clear effect |
| Use Steganographic Passport instead of TdN | passport-protected models · ERB ambiguity attack, ResNet-18-BN (mean) | verification accuracy (%): 65.01 -> 57.91 | Hurt |
| Use Steganographic Passport instead of TdN | passport-protected models · ERB ambiguity attack, AlexNet-BN (mean) | verification accuracy (%): 23.07 -> 14.48 | Hurt |
| Add TLP (ablation) | Steganographic Passport on ResNet-18-BN · CIFAR-10, CIFAR-100, Caltech-101, Caltech-256 | inference accuracy: Without TLP: 94.47 / 94.47; 75.19 / 75.20; 71.53 / 71.53; 50.46 / 50.46 | No clear effect |
| Add TLP (ablation) | Steganographic Passport on AlexNet-BN · CIFAR-10, CIFAR-100, Caltech-101, Caltech-256 | AD (%): 0.23 | Helped |
| Replace ReLU with Sigmoid (ablation) | Steganographic Passport, ResNet-18-BN · CIFAR-10 | AD under ERB attack (%): 2.53 -> 76.73 | Helped |
| Replace ReLU with LeakyReLU (ablation) | Steganographic Passport, ResNet-18-BN · CIFAR-10 | AD under ERB attack (%): 76.73 -> 2.53 | Hurt |
Surprising findings
- Under fine-tuning attacks, the proposed method has the lowest average deployment performance (67.28%) but the signature accuracy remains 97.03% on average.
- The method achieves ERB resistance even though ERB attacks on TdN and the proposed method yield 100% forged signature accuracy in only a few cases.
Limitations
- Slight drop in deployment/verification accuracy compared with TdN and PAN on several settings.
- Fine-tuning attack and ERB resistance depend on tuned thresholds (e.g., tamper threshold tau_d adapted per activation function).
- Evaluated only on small image classification models and datasets (AlexNet, ResNet-18 on CIFAR and Caltech).
Experimental setup
Datasets: CIFAR-10 CIFAR-100 Caltech-101 Caltech-256 DIV2K COCO DTD
Benchmarks: CIFAR-10 CIFAR-100 Caltech-101 Caltech-256
Metrics: accuracy absolute difference (AD) sign agreement PSNR forged signature accuracy bit difference rate
Baselines: DeepIPR PAN TdN
Builds on: DeepIPR Passport-aware normalization Trapdoor normalization HiNet Invertible steganographic network
Closest papers by meaning
- EncryIP: A Practical Encryption-Based Framework for Model Intellectual Property Protection (AAAI 2024 · similarity 0.83)
- Safe and Robust Watermark Injection with a Single OoD Image (ICLR 2024 · similarity 0.83)
- MAP: MAsk-Pruning for Source-Free Model Intellectual Property Protection (CVPR 2024 · similarity 0.83)
- IPRemover: A Generative Model Inversion Attack against Deep Neural Network Fingerprinting and Watermarking (AAAI 2024 · similarity 0.82)
- SIF: Semantically In-Distribution Fingerprints for Large Vision-Language Models (CVPR 2026 · similarity 0.82)
- Robust Secure Swap: Responsible Face Swap With Persons of Interest Redaction and Provenance Traceability (ICML 2025 · similarity 0.81)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.