Research map / Adversarial robustness and security / Attacks on text and graphs
Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use passport layers whose scale and bias depend on the presented passport | AlexNet_p and ResNet_p-18 · CIFAR10 and CIFAR100 | classification accuracy: 10% accuracy | Hurt |
| Use reverse-engineered counterfeit passports | AlexNet_p and ResNet_p-18 · CIFAR10 | classification accuracy: 84% accuracy on AlexNet_p and 70% accuracy on ResNet_p-18 | Hurt |
| Use reverse-engineered counterfeit passports | AlexNet_p and ResNet_p-18 · CIFAR100 | classification accuracy: 44% accuracy for AlexNet_p and 35% accuracy for ResNet_p-18 | Hurt |
| Embed passports and a trigger set using V3 rather than private passports alone with V2 | AlexNet_p and ResNet_p-18 · CIFAR10 and CIFAR100 | classification accuracy: AlexNet_p CIFAR10: 89.44 to 89.15; ResNet_p-18 CIFAR10: 93.41 to 93.26; AlexNet_p CIFAR100: 64.09 to 63.67; ResNet_p-18 | Mixed |
| Use group normalization rather than batch normalization for multi-task learning | AlexNet_p and ResNet_p-18 · CIFAR10 and CIFAR100 | classification accuracy: AlexNet CIFAR10: 91.12 to 90.88; ResNet CIFAR10: 94.85 to 93.65; AlexNet CIFAR100: 68.26 to 65.09; ResNet CIFAR100: 76.2 | Hurt |
| Use a partially incorrect signature instead of the correct signature (ablation) | AlexNet_p · CIFAR10 | classification accuracy: 90.89 to 82.83 | Hurt |
| Use a totally wrong signature instead of the correct signature (ablation) | AlexNet_p · CIFAR10 | classification accuracy: 90.89 to 11.44 | Hurt |
| Flip signs of at least 50% of scale factors (ablation) | Passport-embedded AlexNet_p and ResNet_p-18 · CIFAR10 and CIFAR100 | classification accuracy: about 10% and 1% | Hurt |
| Fine-tune passport models for a new classification task | AlexNet_p and ResNet_p-18 · CIFAR10/CIFAR100 to Caltech-101 | passport signature detection accuracy: 100 | Helped |
| Prune model parameters | Passport-based DNN models · CIFAR10 and CIFAR100 | passport signature detection accuracy: near to 100% | No clear effect |
Closest papers by meaning
- ZeroMark: Towards Dataset Ownership Verification without Disclosing Watermark (NeurIPS 2024 · similarity 0.90)
- Revisiting the Information Capacity of Neural Network Watermarks: Upper Bound Estimation and Beyond (AAAI 2024 · similarity 0.88)
- Steganographic Passport: An Owner and User Verifiable Credential for Deep Model IP Protection Without Retraining (CVPR 2024 · similarity 0.87)
- EntropyMark: Towards More Harmless Backdoor Watermark via Entropy-based Constraint for Open-source Dataset Copyright Protection (CVPR 2025 · similarity 0.86)
- IPRemover: A Generative Model Inversion Attack against Deep Neural Network Fingerprinting and Watermarking (AAAI 2024 · similarity 0.86)
- Safe and Robust Watermark Injection with a Single OoD Image (ICLR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.