Research map / Adversarial robustness and security / Attacks on text and graphs
United We Stand, Divided We Fall: Fingerprinting Deep Neural Networks via Adversarial Trajectories
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ADV-TRA, a DNN fingerprinting scheme that verifies model ownership with adversarial trajectories (chains of progressively adversarial samples with adaptively optimized step sizes, connected into a multi-class surface trajectory) to resist removal attacks and reduce false positives.
Problem
Single-point adversarial fingerprints are fragile under decision-boundary changes caused by removal attacks (fine-tuning, pruning, adversarial training, model extraction) and yield high false positives on innocent models that share local boundary resemblance.
Approach
Replace independent single-point fingerprints with a surface trajectory: a chain of progressively adversarial samples of fixed length per class pair, with step sizes optimized via brake and forward losses plus length control, bilateralized and connected across multiple classes; verification uses the mutation rate of the trajectory samples.
Key results
- On CIFAR-10, ADV-TRA achieves AUC 1.0 with T1%F 1.00, while the best baseline UAP reaches AUC 0.91 and T1%F 0.76.
- On ImageNet, ADV-TRA achieves T1%F 0.88 and AUC 0.96 versus UAP's 0.46 T1%F and 0.85 AUC.
- Under model extraction (PRADA, Knockoff, HL) on CIFAR-100, ADV-TRA's F1-score is 0.90, 0.93, and 0.67, outperforming the other fingerprinting baselines.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use ADV-TRA instead of UAP fingerprints | Model fingerprinting · CIFAR-10 | AUC: 0.91 -> 1.00 | Helped |
| Use ADV-TRA instead of UAP fingerprints | Model fingerprinting · CIFAR-100 | AUC: 0.92 -> 1.00 | Helped |
| Use ADV-TRA instead of UAP fingerprints | Model fingerprinting · ImageNet | AUC: 0.85 -> 0.96 | Helped |
| Use ADV-TRA instead of UAP fingerprints | Model extraction fingerprint verification · PRADA, CIFAR-100 | F1-score: 0.85 -> 0.90 | Helped |
| Use ADV-TRA instead of UAP fingerprints | Model extraction fingerprint verification · PRADA, ImageNet | F1-score: 0.72 -> 0.83 | Helped |
| Use ADV-TRA instead of UAP fingerprints | Model extraction fingerprint verification · Knockoff, CIFAR-100 | F1-score: 0.87 -> 0.93 | Helped |
| Use ADV-TRA instead of UAP fingerprints | Model extraction fingerprint verification · Knockoff, ImageNet | F1-score: 0.75 -> 0.86 | Helped |
| Use ADV-TRA instead of UAP fingerprints | Model extraction fingerprint verification · HL, CIFAR-100 | F1-score: 0.51 -> 0.67 | Helped |
| Use ADV-TRA instead of UAP fingerprints | Model extraction fingerprint verification · HL, ImageNet | F1-score: 0.44 -> 0.58 | Helped |
| Span multiple classes rather than only two with the trajectory (ablation) | ADV-TRA · CIFAR-10, CIFAR-100, ImageNet | T1%F and T10%F | Helped |
| Set trajectory length from 10 toward 80 samples (ablation) | ADV-TRA · CIFAR-100 and ImageNet | AUC: 1.0 | Helped |
| Increase trajectory length to 320 samples (ablation) | ADV-TRA · CIFAR-100 and ImageNet | AUC: 0.942 | Hurt |
Surprising findings
- Adversarial training with a moderate budget (epsilon 0.01) renders a larger share of fingerprints invalid than the largest budget tested, so the detection rate is non-monotonic in epsilon.
- A trajectory spanning only two classes (bilateral trajectory) can perform worse than single-point baselines; multi-class spanning is needed for low false positives.
Limitations
- ImageNet results are notably weaker, with the authors attributing this to more complex decision boundaries among 1000 classes.
- Trajectory generation is substantially more expensive than single-point fingerprinting (e.g., 27m13s vs 2m55s for PGD on ImageNet).
- Performance degrades for very long trajectories (length 320), where gradient-based optimization gets trapped in local optima.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNet
Benchmarks: CIFAR-10 CIFAR-100 ImageNet
Metrics: fingerprint detection rate AUC T1%F T10%F F1-score accuracy
Baselines: CoRt IPGuard CAE UAP PRADA Knockoff HL
Builds on: Basic Iterative Method IPGuard CAE UAP
Closest papers by meaning
- SDBF: Steep-Decision-Boundary Fingerprinting for Hard-Label Tampering Detection of DNN Models (CVPR 2025 · similarity 0.87)
- IPRemover: A Generative Model Inversion Attack against Deep Neural Network Fingerprinting and Watermarking (AAAI 2024 · similarity 0.84)
- Fingerprinting Denoising Diffusion Probabilistic Models (CVPR 2025 · similarity 0.84)
- Intersecting-Boundary-Sensitive Fingerprinting for Tampering Detection of DNN Models (ICML 2024 · similarity 0.84)
- Queries, Representation & Detection: The Next 100 Model Fingerprinting Schemes (AAAI 2025 · similarity 0.82)
- Adversarial Backdoor Attack by Naturalistic Data Poisoning on Trajectory Prediction in Autonomous Driving (CVPR 2024 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.