Research map / Label-efficient and robust learning / Recognition and long-tail
Intersecting-Boundary-Sensitive Fingerprinting for Tampering Detection of DNN Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IBSF, a white-box-generated, black-box-verified fingerprinting method that perturbs inputs to lie near K-intersecting decision boundaries by maximizing partial Shannon entropy, detecting DNN tampering from top-1 labels.
Problem
Detecting tampering (backdoors, Trojans, bit-flips, compression, degradation, targeted attacks) in deployed DNN models via black-box queries that return only top-1 labels, where fingerprint samples must be highly sensitive to model changes.
Approach
Generate fingerprint samples near decision boundaries where a chosen subset of K categories intersect, by maximizing the partial Shannon entropy over that subset; theory shows expected tampering sensitivity grows with K under isotropic boundary shifts.
Key results
- On CIFAR10 targeted attacks, IBSF's single-sample detection rate rises from 35.7% at K=2 to 65.2% at K=10.
- At K=10, IBSF improves over PublicCheck on targeted attacks by 1.32x (CIFAR10), 0.89x (GTSRB), and 0.47x (ImageNet).
- With 5 fingerprint samples and sufficiently large K, IBSF achieves perfect detection across all cases (K>8 for CIFAR10 and GTSRB, K>6 for ImageNet).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Increase the intersecting-boundary cardinality from K=2 to K=10 | IBSF · CIFAR10 targeted attacks | detection rate using 1 fingerprint sample: 35.7% -> 65.2% | Helped |
| Use larger K-intersecting boundaries | IBSF · CIFAR10, GTSRB, and ImageNet tampering detection | detection rate | Helped |
| Use IBSF at K=2 instead of SSF | CIFAR10 Trojan attack detection · CIFAR10 | detection rate using 1 fingerprint sample: 3.7% lower | Hurt |
| Use IBSF at K=2 instead of SSF | GTSRB Trojan attack detection · GTSRB | detection rate using 1 fingerprint sample: 2.1% lower | Hurt |
| Increase K to 10 rather than use SSF | IBSF · CIFAR10 and GTSRB Trojan attack detection | detection rate: up to 16.7% on CIFAR10 and 18.5% on GTSRB | Helped |
| Use IBSF at K=10 rather than PublicCheck | IBSF · CIFAR10, GTSRB, and ImageNet targeted attack detection | detection rate: 1.32ˆ, 0.89ˆ, and 0.47ˆ | Mixed |
| Use 5 fingerprint samples and sufficiently large K | IBSF · CIFAR10, GTSRB, and ImageNet tampering detection | detection rate | Helped |
| Train adaptive attacks using leaked IBSF fingerprints | IBSF · CIFAR10 BadNets and degradation attacks | detection rate on validation set: approximately 10% | Hurt |
Surprising findings
- At K=2, IBSF is slightly below SSF on Trojan attacks (3.7% lower on CIFAR10, 2.1% lower on GTSRB) due to SSF's sensitivity to last FC layer modifications.
- Adaptive attacks drive detection on the tamper set to 0%, yet validation-set detection drops only about 10%, suggesting source-sample diversity limits adaptive evasion.
Limitations
- Generation requires white-box access to the target model, unlike black-box PublicCheck.
- Sample-level manipulation attacks (degradation, targeted) remain harder to detect at small K with a single sample.
Experimental setup
Datasets: CIFAR10 GTSRB ImageNet
Benchmarks: CIFAR10 GTSRB ImageNet
Metrics: tampering detection rate generation time per sample GPU memory utilization
Baselines: SSF PublicCheck AID DBFW
Builds on: Sensitive-Sample Fingerprinting PublicCheck targeted adversarial attacks (PGD)
Closest papers by meaning
- SDBF: Steep-Decision-Boundary Fingerprinting for Hard-Label Tampering Detection of DNN Models (CVPR 2025 · similarity 0.94)
- Fingerprinting Denoising Diffusion Probabilistic Models (CVPR 2025 · similarity 0.85)
- Queries, Representation & Detection: The Next 100 Model Fingerprinting Schemes (AAAI 2025 · similarity 0.85)
- Scalable Fingerprinting of Large Language Models (NeurIPS 2025 · similarity 0.85)
- IPRemover: A Generative Model Inversion Attack against Deep Neural Network Fingerprinting and Watermarking (AAAI 2024 · similarity 0.84)
- United We Stand, Divided We Fall: Fingerprinting Deep Neural Networks via Adversarial Trajectories (NeurIPS 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.