Research map / Label-efficient and robust learning / Recognition and long-tail
SDBF: Steep-Decision-Boundary Fingerprinting for Hard-Label Tampering Detection of DNN Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SDBF, a lightweight hard-label fingerprinting method that perturbs inputs to sit near a steep decision boundary (maximizing logit L2 norm while minimizing variance) plus MBCS for diverse multi-sample probing, to detect DNN model tampering.
Problem
Detecting subtle tampering (harmful behavior injection or compression) of DNN models deployed in the cloud under black-box, hard-label access, where existing fingerprinting methods are either insufficiently sensitive or computationally expensive.
Approach
Place fingerprint samples near a steep decision boundary, where logit norm and its gradient with respect to weights are high, so that tampering-induced shifts are amplified by softmax; generate samples by PGD minimizing a variance-minus-logit-norm objective, and diversify multi-sample probes with a Max Boundary Coverage Strategy.
Key results
- On CIFAR10 with K=10 single-sample detection of last-layer fine-tuning at 1e-5 learning rate, SDBF reaches 62.8% vs. 49.4% for IBSF (K=10) and up to 16.9% above MiSentry.
- MBCS raises multi-sample detection for SDBF from 68.3% to 84.5% at M=2 and from 79.1% to 97.5% at M=3 (K=2).
- SDBF generation takes 0.20s/0.2GB on CIFAR-10 versus 1641.43s/9.4GB for MiSentry, on a single RTX 3090Ti.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use SDBF with K = 10 instead of MiSentry for single-sample detection | CIFAR10, ResNet20 · CIFAR10, FTLast-5 | tampering detection rate (%): 45.9 -> 62.8 | Helped |
| Use SDBF with K = 10 instead of the strongest baseline, IBSF, for single-sample detection | GTSRB, GoogLeNet · GTSRB, FTLast-5 | tampering detection rate (%): 42.8 -> 57.1 | Helped |
| Add Max Boundary Coverage Strategy (MBCS) (ablation) | SDBF, K = 2, CIFAR10 · CIFAR10, FTLast-5, M = 2 | tampering detection rate (%): 68.3% -> 84.5% | Helped |
| Add Max Boundary Coverage Strategy (MBCS) (ablation) | SDBF, K = 2, CIFAR10 · CIFAR10, FTLast-5, M = 3 | tampering detection rate (%): 79.1% -> 97.5% | Helped |
| Use SDBF instead of IBSF for fingerprint generation | CIFAR10, K = 2 · CIFAR10 fingerprint generation | generation time (seconds): 0.19s -> 0.20s | Hurt |
| Use SDBF instead of IBSF for fingerprint generation | ImageNet, K = 2 · ImageNet fingerprint generation | generation time (seconds): 8.44s -> 8.48s | Hurt |
Surprising findings
- MiSentry outperforms SDBF at K=2 for single-sample detection on several tampering types, attributed to its meta-learned tampering model zoo.
- Adaptive attacks with leaked fingerprints drop their detection rate to 0%, though unleaked fingerprint detection stays relatively high.
Limitations
- SDBF is weaker than MiSentry at single-sample detection (K=2) for some tampering types.
- Adversarial training slightly reduces SDBF performance at K=2.
- Leaked fingerprints enable adaptive attacks that substantially reduce detection of leaked samples.
Experimental setup
Datasets: CIFAR10 GTSRB ImageNet BIVBench
Benchmarks: CIFAR10 GTSRB ImageNet
Metrics: tampering detection rate generation computational cost (seconds/GB) output confidence naturalness
Baselines: SSF PublicCheck IBSF MiSentry
Builds on: IBSF SSF PublicCheck MiSentry projected gradient descent
Closest papers by meaning
- Intersecting-Boundary-Sensitive Fingerprinting for Tampering Detection of DNN Models (ICML 2024 · similarity 0.94)
- United We Stand, Divided We Fall: Fingerprinting Deep Neural Networks via Adversarial Trajectories (NeurIPS 2024 · similarity 0.87)
- Fingerprinting Denoising Diffusion Probabilistic Models (CVPR 2025 · similarity 0.85)
- Queries, Representation & Detection: The Next 100 Model Fingerprinting Schemes (AAAI 2025 · similarity 0.84)
- IPRemover: A Generative Model Inversion Attack against Deep Neural Network Fingerprinting and Watermarking (AAAI 2024 · similarity 0.84)
- Scalable Fingerprinting of Large Language Models (NeurIPS 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.