Research map / Adversarial robustness and security / Attacks on text and graphs

IPRemover: A Generative Model Inversion Attack against Deep Neural Network Fingerprinting and Watermarking

AAAI 2024 · Adversarial robustness and security › Attacks on text and graphs · approach: Neural network watermarking · 7 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes IPRemover, a data-free model inversion attack that trains a generator to invert data from a victim DNN and then distills a stolen model with a virtual-ensemble KD loss, evading both fingerprinting and watermarking defenses.

Problem

DNN IP protection via fingerprinting and watermarking can be evaded by a stealing adversary; no prior attack has been shown to defeat both kinds of defenses, especially in a data-free setting.

Approach

Invert training data from the white-box victim with a generator trained from scratch per batch (fixed random latent z, random per-layer BN loss weights), train a stolen model on that data, and apply Virtual Ensemble KD where the stolen model itself acts as a virtual teacher to reduce resemblance to the victim.

Key results

• Data-free IPRemover stolen model reaches 82.98% accuracy on CIFAR10 vs 90.92% for the victim, and evades MetaFinger detection (query accuracy 44.33% vs 62% threshold).
• Against IPGuard, DeepJudge, Jia, FS and CosWM on CIFAR10 and GTSRB, stolen models fall below detection thresholds, with the paper concluding all defenses were bypassed on CIFAR10 and GTSRB.
• Without KD (epsilon=0), models trained on IPRemover-generated data achieve about 10% higher accuracy than those trained on CMI-generated data.

Measured effects reported in the paper

Surprising findings

• Untargeted adversarial examples from PGD with few iterations transfer highly to independently trained models, making DeepJudge thresholds close to 0.
• Adding more labeled training data reduced the stolen model's query-set accuracy, suggesting it resembles the victim less.

Limitations

• Only evaluated on image classification with CIFAR10 and GTSRB.
• Reported accuracies use shared hyperparameters and represent lower bounds; defense-specific tuning not explored.
• Some GTSRB classes had low generation success, so fewer than 600 images were generated for them.

Experimental setup

Datasets: CIFAR10 GTSRB CIFAR100

Benchmarks: CIFAR10 GTSRB

Metrics: accuracy fingerprint detection metric (RobD, JSD, query accuracy) watermark accuracy

Baselines: MetaFinger IPGuard DeepJudge Jia CosWM Adversarial Frontier Stitching CMI

Builds on: Contrastive Model Inversion (CMI) Hinton knowledge distillation teacher-free knowledge distillation batch normalization regularization (DeepInversion)

Closest papers by meaning

• Effective Ambiguity Attack Against Passport-Based DNN Intellectual Property Protection Schemes Through Fully Connected Layer Substitution (CVPR 2023 · similarity 0.88)
• Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbations (CVPR 2022 · similarity 0.87)
• Safe and Robust Watermark Injection with a Single OoD Image (ICLR 2024 · similarity 0.87)
• United We Stand, Divided We Fall: Fingerprinting Deep Neural Networks via Adversarial Trajectories (NeurIPS 2024 · similarity 0.84)
• SDBF: Steep-Decision-Boundary Fingerprinting for Hard-Label Tampering Detection of DNN Models (CVPR 2025 · similarity 0.84)
• Fingerprinting Denoising Diffusion Probabilistic Models (CVPR 2025 · similarity 0.84)