Research map / Graph learning / Graph self-supervised learning
Graph-Embedded Structure-Aware Perceptual Hashing for Neural Network Protection and Piracy Detection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a structure-aware perceptual hash for DNN copyright protection that converts model architectures into DAGs, embeds them with a GIN, and fuses the result with a parameter-based dual-branch hash to cut false positives on non-pirated models.
Problem
Model perceptual hashing for detecting pirated neural networks suffers from high false positives on structurally different non-pirated models, which also enables authentication evasion.
Approach
Encodes model architecture (not just parameters) into the perceptual hash by converting layers into a three-group DAG (avoiding multi-edges and cycles) and learning structural features with a graph isomorphism network pre-trained on MUTAG and fine-tuned with contrastive loss, then fusing with a parameter hash into a 100-bit model hash.
Key results
- Non-pirated model false alarm rate of 2.69% at T=0.1 versus 9.50% for the baseline, with 97.31% identification accuracy.
- Pirated model detection reaches 100% accuracy at T=0.1 for fine-tuning, L1 pruning and random pruning, versus 96.88%/96.35%/95.50% for the baseline.
- Under tampering, the proposed method keeps accuracy above 90% at T=0.5 across tampering rates and noise levels.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add structural hashing to parameter hashing | Model perceptual hashing · Non-pirated model identification, T=0.1 | false alarm rate: 9.50% -> 2.69% | Helped |
| add structural hashing to parameter hashing | Model perceptual hashing · Non-pirated model identification, T=0.5 | false alarm rate: 17.46% -> 10.45% | Helped |
| add structural hashing to parameter hashing | Model perceptual hashing · Fine-tuning piracy detection, T=0.1 | accuracy: 96.88% -> 100.00% | Helped |
| add structural hashing to parameter hashing | Model perceptual hashing · L1 pruning piracy detection, T=0.1 | accuracy: 96.35% -> 100.00% | Helped |
| add structural hashing to parameter hashing | Model perceptual hashing · Random pruning piracy detection, T=0.1 | accuracy: 95.50% -> 100.00% | Helped |
| replace neural hash fusion with direct concatenation (ablation) | Model perceptual hashing · L1 pruning piracy detection, T=0.1 | accuracy: 100.00% -> 62.44% | Hurt |
| replace graph learning with hard-coded structural hashes (ablation) | Model perceptual hashing · Non-pirated model identification, T=0.5 | accuracy: 89.55% -> 53.19% | Hurt |
| use a 50-bit merged hash instead of a 100-bit hash (ablation) | Model perceptual hashing · Non-pirated model identification, T=0.5 | accuracy: 89.50% -> 89.78% | No clear effect |
| use a 75-bit merged hash instead of a 100-bit hash (ablation) | Model perceptual hashing · Non-pirated model identification, T=0.5 | accuracy: 89.50% -> 82.26% | Hurt |
| use a 32-bit structure hash instead of a 128-bit structure hash (ablation) | Structure hash generator · Structure hash graph recognition | accuracy: 97.37% -> 92.11% | Hurt |
| use a 64-bit structure hash instead of a 128-bit structure hash (ablation) | Structure hash generator · Structure hash graph recognition | accuracy: 97.37% -> 89.47% | Hurt |
Surprising findings
- Hard-coded structural hashes dominate less, and the ablation shows that graph learning is needed to balance parameter and structure hashes.
Limitations
- Evaluation limited to CNN models (ResNet, VGG, ShuffleNet, MobileNetV2) and TIMM vision models; LLMs left to future work.
- Structure hash relies on fine-tuning with a small subset of TIMM graphs (30%).
Experimental setup
Datasets: MUTAG CIFAR-10 CIFAR-100 MNIST FashionMNIST TIMM models
Benchmarks: TIMM-derived model pool (2,569 models)
Metrics: false alarm rate identification accuracy rate hash distance
Baselines: Xiong et al. dual-branch model hashing Chen et al. NTS-based hashing
Builds on: Xiong et al. dual-branch model hashing Chen et al. normal test statistics model hashing graph isomorphism network
Closest papers by meaning
- GraphIP–Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It? (NeurIPS 2026 · similarity 0.84)
- Intersecting-Boundary-Sensitive Fingerprinting for Tampering Detection of DNN Models (ICML 2024 · similarity 0.82)
- Vision-Language Model IP Protection via Prompt-based Learning (CVPR 2025 · similarity 0.82)
- SDBF: Steep-Decision-Boundary Fingerprinting for Hard-Label Tampering Detection of DNN Models (CVPR 2025 · similarity 0.81)
- MAP: MAsk-Pruning for Source-Free Model Intellectual Property Protection (CVPR 2024 · similarity 0.81)
- Provably Powerful Graph Neural Networks for Directed Multigraphs (AAAI 2024 · similarity 0.81)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.