{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,29]],"date-time":"2026-09-29T05:37:46Z","timestamp":1790660266023,"version":"4.1.0"},"publisher-location":"Cham","reference-count":46,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030884178","type":"print"},{"value":"9783030884185","type":"electronic"}],"license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2021]]},"DOI":"10.1007\/978-3-030-88418-5_26","type":"book-chapter","created":{"date-parts":[[2021,9,29]],"date-time":"2021-09-29T17:04:30Z","timestamp":1632935070000},"page":"542-562","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":12,"title":["TAFA: A Task-Agnostic Fingerprinting Algorithm for Neural Networks"],"prefix":"10.1007","author":[{"given":"Xudong","family":"Pan","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mi","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yifan","family":"Lu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Min","family":"Yang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2021,9,30]]},"reference":[{"key":"26_CR1","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., et al.: Deep residual learning for image recognition. In: CVPR, pp. 770\u2013778 (2016)","DOI":"10.1109\/CVPR.2016.90"},{"key":"26_CR2","doi-asserted-by":"crossref","unstructured":"Devlin, J., Chang, M.W., et al.: Bert: pre-training of deep bidirectional transformers for language understanding. In: NAACL-HLT (2019)","DOI":"10.18653\/v1\/N19-1423"},{"key":"26_CR3","doi-asserted-by":"crossref","unstructured":"Cao, Y., Xiao, C., et al.: Adversarial sensor attack on lidar-based perception in autonomous driving. In: CCS (2019)","DOI":"10.1145\/3319535.3339815"},{"key":"26_CR4","doi-asserted-by":"crossref","unstructured":"Heaton, J.B., Polson, N.G., et al.: Deep learning for finance: Deep portfolios. iN: Econometric Modeling: Capital Markets - Portfolio Theory eJournal (2016)","DOI":"10.2139\/ssrn.2838013"},{"key":"26_CR5","doi-asserted-by":"crossref","unstructured":"Esteva, A., Kuprel, B., et al.: Dermatologist-level classification of skin cancer with deep neural networks. In: Nature (2017)","DOI":"10.1038\/nature21056"},{"key":"26_CR6","doi-asserted-by":"crossref","unstructured":"Wenskay, D.L.: Intellectual property protection for neural networks. In: Neural Networks (1990)","DOI":"10.1016\/0893-6080(90)90092-Y"},{"key":"26_CR7","doi-asserted-by":"crossref","unstructured":"Uchida, Y., Nagai, Y., et al.: Embedding watermarks into deep neural networks. In: ICMR (2017)","DOI":"10.1145\/3078971.3078974"},{"key":"26_CR8","unstructured":"Adi, Y., Baum, C., et al.: Turning your weakness into a strength: watermarking deep neural networks by backdooring. In: USENIX Security Symposium (2018)"},{"key":"26_CR9","doi-asserted-by":"crossref","unstructured":"Cao, X., Jia, J., et al.: Ipguard: protecting the intellectual property of deep neural networks via fingerprinting the classification boundary. In: AsiaCCS (2021)","DOI":"10.1145\/3433210.3437526"},{"key":"26_CR10","unstructured":"Cox, I., Miller, M., et al.: Digital watermarking. In: Lecture Notes in Computer Science (2003)"},{"key":"26_CR11","unstructured":"Wang, J., Wu, H., et al.: Watermarking in deep neural networks via error back-propagation. In: Electronic Imaging (2020)"},{"key":"26_CR12","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., et al.: Intriguing properties of neural networks. ArXiv (2014)"},{"key":"26_CR13","unstructured":"Lukas, N., Zhang, Y., et al.: Deep neural network fingerprinting by conferrable adversarial examples. ArXiv (2019)"},{"key":"26_CR14","doi-asserted-by":"publisher","first-page":"488","DOI":"10.1016\/j.comcom.2019.12.016","volume":"150","author":"J Zhao","year":"2020","unstructured":"Zhao, J., Qingyue, H., et al.: Afa: adversarial fingerprinting authentication for deep neural networks. Comput. Commun. 150, 488\u2013497 (2020)","journal-title":"Comput. Commun."},{"key":"26_CR15","unstructured":"Pytorch hub. https:\/\/pytorch.org\/hub\/, Accessed 01 Feb 2021"},{"key":"26_CR16","unstructured":"Amazon aws. https:\/\/aws.amazon.com\/, Accessed 01 Feb 2021"},{"key":"26_CR17","unstructured":"Nair, V., Hinton, G.E.: Rectified linear units improve restricted boltzmann machines. In: ICML (2010)"},{"key":"26_CR18","unstructured":"Tram\u00e8r, F., Zhang, F., et al.: Stealing machine learning models via prediction apis. In: USENIX Security (2016)"},{"key":"26_CR19","unstructured":"Jagielski, M., Carlini, N., et al.: High accuracy and high fidelity extraction of neural networks. In: USENIX Security Symposium (2020)"},{"key":"26_CR20","unstructured":"Rolnick, D., Kording, K.P.: Reverse-engineering deep relu networks. In: ICML (2020)"},{"key":"26_CR21","unstructured":"Mont\u00fafar, G., Pascanu, R., et al.: On the number of linear regions of deep neural networks. In: NIPS (2014)"},{"key":"26_CR22","unstructured":"Hanin, B., Rolnick, D.: Complexity of linear regions in deep networks. In: ICML (2019)"},{"key":"26_CR23","volume-title":"Deep Learning","author":"I Goodfellow","year":"2016","unstructured":"Goodfellow, I., Bengio, Y., et al.: Deep Learning. MIT Press, Cambridge (2016)"},{"key":"26_CR24","doi-asserted-by":"crossref","unstructured":"Jarrett, K., Kavukcuoglu, K., et al.: What is the best multi-stage architecture for object recognition? In: ICCV (2009)","DOI":"10.1109\/ICCV.2009.5459469"},{"key":"26_CR25","doi-asserted-by":"crossref","unstructured":"Szegedy, C., Liu, W., et al.: Going deeper with convolutions. In: CVPR (2015)","DOI":"10.1109\/CVPR.2015.7298594"},{"key":"26_CR26","doi-asserted-by":"crossref","unstructured":"Pan, S.J., Yang, Q.: A survey on transfer learning. In: TKDE (2010)","DOI":"10.1109\/TKDE.2009.191"},{"key":"26_CR27","unstructured":"Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. ArXiv (2015)"},{"key":"26_CR28","doi-asserted-by":"crossref","unstructured":"Ren, J., Xu, L.: On vectorization of deep convolutional neural networks for vision tasks. In: AAAI (2015)","DOI":"10.1609\/aaai.v29i1.9488"},{"key":"26_CR29","unstructured":"Serra, T., Tjandraatmadja, C., et al.: Bounding and counting linear regions of deep neural networks. In: ICML (2018)"},{"key":"26_CR30","doi-asserted-by":"crossref","unstructured":"Wang, S., Chang, C.H.: Fingerprinting deep neural networks - a deepfool approach. In: ISCAS (2021)","DOI":"10.1109\/ISCAS51556.2021.9401119"},{"key":"26_CR31","doi-asserted-by":"crossref","unstructured":"Li, Y., Zhang, Z., et al.: Modeldiff: testing-based DNN similarity comparison for model reuse detection. In: ISSTA (2021)","DOI":"10.1145\/3460319.3464816"},{"key":"26_CR32","unstructured":"Han, S., Pool, J., et al.: Learning both weights and connections for efficient neural network. ArXiv (2015)"},{"key":"26_CR33","unstructured":"Li, H., Kadav, A., et al.: Pruning filters for efficient convnets. ArXiv (2017)"},{"key":"26_CR34","doi-asserted-by":"crossref","unstructured":"Juuti, M., Szyller, S., et al.: Prada: protecting against dnn model stealing attacks. In: EuroS&P (2019)","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"26_CR35","unstructured":"Gurobi linear programming optimizer. https:\/\/www.gurobi.com\/, Accessed 01 Feb 2021"},{"key":"26_CR36","doi-asserted-by":"crossref","unstructured":"Yang, J., Shi, R., et al.: Medmnist classification decathlon: a lightweight automl benchmark for medical image analysis. ArXiv (2020)","DOI":"10.1109\/ISBI48211.2021.9434062"},{"key":"26_CR37","doi-asserted-by":"crossref","unstructured":"Whirl-Carrillo, M., McDonagh, E., et al.: Pharmacogenomics knowledge for personalized medicine. In: Clinical Pharmacology & Therapeutics (2012)","DOI":"10.1038\/clpt.2012.96"},{"key":"26_CR38","unstructured":"Xiao, H., Rasul, K., et al.: Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. ArXiv (2017)"},{"key":"26_CR39","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.M., Fawzi, A., et al.: Deepfool: a simple and accurate method to fool deep neural networks. In: CVPR (2016)","DOI":"10.1109\/CVPR.2016.282"},{"key":"26_CR40","doi-asserted-by":"crossref","unstructured":"Boenisch, F.: A survey on model watermarking neural networks. ArXiv (2020)","DOI":"10.3389\/fdata.2021.729663"},{"key":"26_CR41","doi-asserted-by":"crossref","unstructured":"Regazzoni, F., Palmieri, P., et al.: Protecting artificial intelligence ips: a survey of watermarking and fingerprinting for machine learning. In: CAAI Transactions on Intelligence Technology (2021)","DOI":"10.1049\/cit2.12029"},{"key":"26_CR42","unstructured":"Rouhani, B., Chen, H., et al.: Deepsigns: a generic watermarking framework for ip protection of deep learning models. ArXiv (2018)"},{"key":"26_CR43","doi-asserted-by":"crossref","unstructured":"Xu, X., Li, Y., et al.: \u201cidentity bracelets\u201d for deep neural networks. IEEE Access (2020)","DOI":"10.1109\/ACCESS.2020.2998784"},{"key":"26_CR44","unstructured":"Goodfellow, I., Pouget-Abadie, J., et al.: Generative adversarial nets. In: NeurIPS (2014)"},{"key":"26_CR45","unstructured":"Truda, G., Marais, P.: Warfarin dose estimation on multiple datasets with automated hyperparameter optimisation and a novel software framework. ArXiv (2019)"},{"key":"26_CR46","unstructured":"Arjovsky, M., Chintala, S., et al.: Wasserstein generative adversarial networks. In: ICML (2017)"}],"container-title":["Lecture Notes in Computer Science","Computer Security \u2013 ESORICS 2021"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-88418-5_26","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,29]],"date-time":"2026-09-29T00:09:24Z","timestamp":1790640564000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-030-88418-5_26"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"ISBN":["9783030884178","9783030884185"],"references-count":46,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-88418-5_26","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021]]},"assertion":[{"value":"30 September 2021","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ESORICS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Symposium on Research in Computer Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Darmstadt","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Germany","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2021","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"4 October 2021","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"8 October 2021","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"esorics2021","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/esorics2021.athene-center.de\/index.php","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Single-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"EasyChair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"351","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"71","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"20% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3.07","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"6.06","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"The conference was held virtually due to the COVID-19 pandemic.","order":10,"name":"additional_info_on_review_process","label":"Additional Info on Review Process","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"This content has been made available to all.","name":"free","label":"Free to read"}]}}