{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,18]],"date-time":"2026-06-18T15:43:48Z","timestamp":1781797428040,"version":"3.54.5"},"reference-count":58,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2024,10,25]],"date-time":"2024-10-25T00:00:00Z","timestamp":1729814400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,10,25]],"date-time":"2024-10-25T00:00:00Z","timestamp":1729814400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int J Comput Vis"],"published-print":{"date-parts":[[2025,4]]},"DOI":"10.1007\/s11263-024-02254-w","type":"journal-article","created":{"date-parts":[[2024,10,25]],"date-time":"2024-10-25T19:02:33Z","timestamp":1729882953000},"page":"1912-1926","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["Sample Correlation for Fingerprinting Deep Face Recognition"],"prefix":"10.1007","volume":"133","author":[{"given":"Jiyang","family":"Guan","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jian","family":"Liang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yanbo","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ran","family":"He","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2024,10,25]]},"reference":[{"key":"2254_CR1","unstructured":"Adi, Y., Baum, C., Cisse, M., Pinkas, B., & Keshet, J. (2018). Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In Proceedings USENIX (pp. 1615\u20131631)."},{"key":"2254_CR2","doi-asserted-by":"crossref","unstructured":"Bai, T., Luo, J., Zhao, J., Wen, B., & Wang, Q. (2021). Recent advances in adversarial training for adversarial robustness. arXiv:2102.01356.","DOI":"10.24963\/ijcai.2021\/591"},{"key":"2254_CR3","doi-asserted-by":"crossref","unstructured":"Cao, X., Jia, J., & Gong, N. Z. (2021). Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary. In Proceedings ICCCS (pp. 14\u201325).","DOI":"10.1145\/3433210.3437526"},{"key":"2254_CR4","doi-asserted-by":"crossref","unstructured":"Chen, H., Rohani, B. D., & Koushanfar, F. (2018). Deepmarks: A digital fingerprinting framework for deep neural networks. arXiv:1804.03648.","DOI":"10.1145\/3323873.3325042"},{"key":"2254_CR5","doi-asserted-by":"crossref","unstructured":"Chen, J., Wang, J., Peng, T., Sun, Y., Cheng, P., Ji, S., Ma, X., Li, B., & Song, D. (2022). Copy, right? a testing framework for copyright protection of deep learning models. In Proceedings SP (pp. 824\u2013841).","DOI":"10.1109\/SP46214.2022.9833747"},{"key":"2254_CR6","doi-asserted-by":"crossref","unstructured":"Davis, J., & Goadrich, M. (2006). The relationship between precision-recall and roc curves. In Proceedings ICML (pp. 233\u2013240).","DOI":"10.1145\/1143844.1143874"},{"key":"2254_CR7","doi-asserted-by":"crossref","unstructured":"Deng, J., Guo, J., Xue, N., & Zafeiriou, S. (2019). Arcface: Additive angular margin loss for deep face recognition. In Proceedings CVPR (pp. 4690\u20134699).","DOI":"10.1109\/CVPR.2019.00482"},{"key":"2254_CR8","unstructured":"Fan, L., Ng, K. W., & Chan, C. S. (2019). Rethinking deep neural network ownership verification: Embedding passports to defeat ambiguity attacks. In Proceedings NeurIPS."},{"key":"2254_CR9","unstructured":"Fan, L., Ng, K. W., Chan, C. S., & Yang, Q. (2021). Deepip: Deep neural network intellectual property protection with passports. IEEE Transactions on Pattern Analysis and Machine Intelligence."},{"key":"2254_CR10","doi-asserted-by":"crossref","unstructured":"Ge, Y., Wang, Q., Zheng, B., Zhuang, X., Li, Q., Shen, C., & Wang, C. (2021). Anti-distillation backdoor attacks: Backdoors can really survive in knowledge distillation. In Proceedings ACMMM (pp. 826\u2013834).","DOI":"10.1145\/3474085.3475254"},{"issue":"6","key":"2254_CR11","doi-asserted-by":"publisher","first-page":"1094","DOI":"10.1080\/02699930701626582","volume":"22","author":"E Goeleven","year":"2008","unstructured":"Goeleven, E., De Raedt, R., Lemke, L., & Verschuere, B. (2008). The karolinska directed emotional faces: A validation study. Cognition and emotion, 22(6), 1094\u20131118.","journal-title":"Cognition and emotion"},{"issue":"6","key":"2254_CR12","doi-asserted-by":"publisher","first-page":"1789","DOI":"10.1007\/s11263-021-01453-z","volume":"129","author":"J Gou","year":"2021","unstructured":"Gou, J., Baosheng, Y., Maybank, S. J., & Tao, D. (2021). Knowledge distillation: A survey. International Journal of Computer Vision, 129(6), 1789\u20131819.","journal-title":"International Journal of Computer Vision"},{"key":"2254_CR13","unstructured":"Gu, T., Dolan-Gavitt, B., & Garg, S.. (2017). Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv:1708.06733."},{"key":"2254_CR14","unstructured":"Guan, J., Liang, J., & He, R. (2022). Are you stealing my model? sample correlation for fingerprinting deep neural networks. In Proceedings NeurIPS,35 (pp. 36571\u201336584)."},{"key":"2254_CR15","doi-asserted-by":"crossref","unstructured":"Guan, J., Tu, Z., He, R., & Tao, D. (2022b). Few-shot backdoor defense using shapley estimation. In Proceedings CVPR (pp. 13358\u201313367).","DOI":"10.1109\/CVPR52688.2022.01300"},{"key":"2254_CR16","doi-asserted-by":"crossref","unstructured":"Guo, Y., Zhang, L., Hu, Y., He, X., & Gao, J. (2016). Ms-celeb-1m: A dataset and benchmark for large-scale face recognition. In Proceedings ECCV (pp. 87\u2013102).","DOI":"10.1007\/978-3-319-46487-9_6"},{"key":"2254_CR17","doi-asserted-by":"crossref","unstructured":"He, Z., Zhang, T., & Lee, R. (2019). Sensitive-sample fingerprinting of deep neural networks. In Proceedigs. CVPR (pp. 4729\u20134737).","DOI":"10.1109\/CVPR.2019.00486"},{"key":"2254_CR18","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., & Sun, J. (2016). Deep residual learning for image recognition. In Proceedings CVPR (pp. 770\u2013778).","DOI":"10.1109\/CVPR.2016.90"},{"key":"2254_CR19","unstructured":"Hendrycks, D., & Dietterich, T. (2018). Benchmarking neural network robustness to common corruptions and perturbations. In Proceedings ICLR."},{"key":"2254_CR20","doi-asserted-by":"crossref","unstructured":"Huang, G., Liu, Z., Van D. M., Laurens, & Weinberger, K. Q. (2017). Densely connected convolutional networks. In Proceedings CVPR (pp. 4700\u20134708).","DOI":"10.1109\/CVPR.2017.243"},{"key":"2254_CR21","doi-asserted-by":"crossref","unstructured":"Huang, Y., Wu, J., Xu, X., & Ding, S. (2022). Evaluation-oriented knowledge distillation for deep face recognition. In Proceedings CVPR (pp. 18740\u201318749).","DOI":"10.1109\/CVPR52688.2022.01818"},{"key":"2254_CR22","unstructured":"Jagielski, M., Carlini, N., Berthelot, D., Kurakin, A., & Papernot, N. (2020). High accuracy and high fidelity extraction of neural networks. In Proceedings USENIX (pp. 1345\u20131362)."},{"key":"2254_CR23","unstructured":"Jia, H., Choquette-Choo, C.\u00a0A., Chandrasekaran, V., & Papernot, N. (2021). Entangled watermarks as a defense against model extraction. In Proceedings. USENIX (pp. 1937\u20131954)."},{"key":"2254_CR24","unstructured":"Krizhevsky, A., Hinton, G., et al. (2009). Learning multiple layers of features from tiny images."},{"key":"2254_CR25","unstructured":"Kurakin, A., Goodfellow, I., & Bengio, S. (2016). Adversarial machine learning at scale. In Proceedings ICLR."},{"key":"2254_CR26","unstructured":"Le, Y., & Yang, X. (2015). Tiny imagenet visual recognition challenge. CS 231N,7(7), 3."},{"key":"2254_CR27","doi-asserted-by":"crossref","unstructured":"Li, Y., Zhang, Z., Liu, B., Yang, Z., & Liu, Y. (2021). Modeldiff: testing-based dnn similarity comparison for model reuse detection. In Proceedings SIGSOFT (pp. 139\u2013151).","DOI":"10.1145\/3460319.3464816"},{"key":"2254_CR28","doi-asserted-by":"crossref","unstructured":"Li, Y., Zhu, L., Jia, X., Jiang, Y., Xia, S.T., & Cao, X. (2022). Defending against model stealing via verifying embedded external features. In Proceedings AAAI.","DOI":"10.1609\/aaai.v36i2.20036"},{"key":"2254_CR29","doi-asserted-by":"crossref","unstructured":"Liu, K., Dolan-G., Brendan, & Garg, S. (2018). Fine-pruning: Defending against backdooring attacks on deep neural networks. In Proceedings. RAID, (pp. 273\u2013294).","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"2254_CR30","doi-asserted-by":"crossref","unstructured":"Lu, C., & Tang, X. (2015). Surpassing human-level face verification performance on lfw with gaussianface. In Proceedings AAAI, volume\u00a029.","DOI":"10.1609\/aaai.v29i1.9797"},{"key":"2254_CR31","unstructured":"Lukas, N., Zhang, Y., & Kerschbaum, F. (2021). Deep neural network fingerprinting by conferrable adversarial examples. In Proceedings. ICLR."},{"key":"2254_CR32","doi-asserted-by":"crossref","unstructured":"Ma, Y., Lao, S., Takikawa, E., & Kawade, M. (2007). Discriminant analysis in correlation similarity measure space. In Proceedings ICML (pp. 577\u2013584).","DOI":"10.1145\/1273496.1273569"},{"key":"2254_CR33","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2018). Towards deep learning models resistant to adversarial attacks. In Proceedings ICLR."},{"key":"2254_CR34","unstructured":"Metzen, J. H., Genewein, T., Fischer, V., & Bischoff, B. (2016). On detecting adversarial perturbations. In Proceedings ICLR."},{"key":"2254_CR35","doi-asserted-by":"crossref","unstructured":"Molchanov, P., Mallya, A., Tyree, S., Frosio, I., & Kautz, J. (2019). Importance estimation for neural network pruning. In Proceedings CVPR (pp. 11264\u201311272).","DOI":"10.1109\/CVPR.2019.01152"},{"key":"2254_CR36","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, Seyed-Mohsen, Fawzi, Alhussein, Fawzi, O., & Frossard, P. (2017). Universal adversarial perturbations. In Proceedings CVPR (pp. 1765\u20131773).","DOI":"10.1109\/CVPR.2017.17"},{"key":"2254_CR37","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, Seyed-Mohsen, Fawzi, A., & Frossard, P. (2016). Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings CVPR (pp. 2574\u20132582).","DOI":"10.1109\/CVPR.2016.282"},{"key":"2254_CR38","doi-asserted-by":"crossref","unstructured":"Nguyen, H. V., & Bai, Li. (2010). Cosine similarity metric learning for face verification. In Proceedings CVPR (pp. 709\u2013720).","DOI":"10.1007\/978-3-642-19309-5_55"},{"key":"2254_CR39","doi-asserted-by":"crossref","unstructured":"Orekondy, T., Schiele, B., & Fritz, M. (2019). Knockoff nets: Stealing functionality of black-box models. In Proceedings CVPR (pp. 4954\u20134963).","DOI":"10.1109\/CVPR.2019.00509"},{"key":"2254_CR40","doi-asserted-by":"crossref","unstructured":"Peng, B., Jin, X., Liu, J., Li, D., Wu, Y., Liu, Y., Zhou, S., & Zhang, Z. (2019). Correlation congruence for knowledge distillation. In Proceedings CVPR (pp. 5007\u20135016).","DOI":"10.1109\/ICCV.2019.00511"},{"key":"2254_CR41","doi-asserted-by":"crossref","unstructured":"Peng, Z., Li, S., Chen, G., Zhang, C., Zhu, H., & Xue, M. (2022). Fingerprinting deep neural networks globally via universal adversarial perturbations. arXiv:2202.08602.","DOI":"10.1109\/CVPR52688.2022.01307"},{"key":"2254_CR42","doi-asserted-by":"crossref","unstructured":"Sandler, M., Howard, A., Zhu, M., Zhmoginov, A., & Chen, L. C. (2018). Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings CVPR (pp. 4510\u20134520).","DOI":"10.1109\/CVPR.2018.00474"},{"key":"2254_CR43","unstructured":"Shafahi, A., Najibi, M., Ghiasi, M. A., Xu, Z., Dickerson, J., Studer, C., Davis, L. S., Taylor, G., & Goldstein, T. (2019). Adversarial training for free! In Proceedings NeurIPS."},{"key":"2254_CR44","unstructured":"Simonyan, K., & Zisserman, A. (2014). Very deep convolutional networks for large-scale image recognition. arXiv:1409.1556."},{"issue":"10","key":"2254_CR45","doi-asserted-by":"publisher","first-page":"4635","DOI":"10.1109\/TIT.2006.881713","volume":"52","author":"I Steinwart","year":"2006","unstructured":"Steinwart, I., Hush, D., & Scovel, C. (2006). An explicit description of the reproducing kernel hilbert spaces of gaussian rbf kernels. IEEE Transactions on Information Theory, 52(10), 4635\u20134643.","journal-title":"IEEE Transactions on Information Theory"},{"key":"2254_CR46","doi-asserted-by":"crossref","unstructured":"Taigman, Y., Yang, M., Ranzato, M., & Wolf, L. (2014). Deepface: Closing the gap to human-level performance in face verification. In Proceedings CVPR (pp. 1701\u20131708).","DOI":"10.1109\/CVPR.2014.220"},{"issue":"5","key":"2254_CR47","doi-asserted-by":"publisher","first-page":"1299","DOI":"10.1109\/TMI.2016.2535302","volume":"35","author":"N Tajbakhsh","year":"2016","unstructured":"Tajbakhsh, N., Shin, J. Y., Gurudu, S. R., Todd Hurst, R., Kendall, C. B., Gotway, M. B., & Liang, J. (2016). Convolutional neural networks for medical image analysis: Full training or fine tuning? IEEE Transactions on Medical Imaging, 35(5), 1299\u20131312.","journal-title":"IEEE Transactions on Medical Imaging"},{"key":"2254_CR48","doi-asserted-by":"crossref","unstructured":"Truong, J. B., Maini, P., Walls, R. J., & Papernot, N. (2021). Data-free model extraction. In Proceedings CVPR( pp. 4771\u20134780).","DOI":"10.1109\/CVPR46437.2021.00474"},{"key":"2254_CR49","doi-asserted-by":"crossref","unstructured":"Uchida, Y., Nagai, Y., Sakazawa, S., & Satoh, S. (2017). Embedding watermarks into deep neural networks. In Proceedings ICMR, (pp. 269\u2013277).","DOI":"10.1145\/3078971.3078974"},{"key":"2254_CR50","doi-asserted-by":"crossref","unstructured":"Wang, S., & Chang, C-H. (2021). Fingerprinting deep neural networks-a deepfool approach. In Proceedings ISCAS (pp. 1\u20135).","DOI":"10.1109\/ISCAS51556.2021.9401119"},{"key":"2254_CR51","doi-asserted-by":"publisher","first-page":"215","DOI":"10.1016\/j.neucom.2020.10.081","volume":"429","author":"M Wang","year":"2021","unstructured":"Wang, M., & Deng, W. (2021). Deep face recognition: A survey. Neurocomputing, 429, 215\u2013244.","journal-title":"Neurocomputing"},{"issue":"1","key":"2254_CR52","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s40537-016-0043-6","volume":"3","author":"K Weiss","year":"2016","unstructured":"Weiss, K., Khoshgoftaar, T. M., & Wang, D. (2016). A survey of transfer learning. Journal of Big data, 3(1), 1\u201340.","journal-title":"Journal of Big data"},{"key":"2254_CR53","unstructured":"Yi, D., Lei, Z., Liao, S., & Li, S. Z. (2014). Learning face representation from scratch. arXiv:1411.7923."},{"key":"2254_CR54","doi-asserted-by":"crossref","unstructured":"Yu, H., Yang, K., Zhang, T., Tsai, Y. Y., Ho, T. Y, & Jin, Y. (2020). Cloudleak: Large-scale deep learning models stealing through adversarial examples. In Proceedings NDSS.","DOI":"10.14722\/ndss.2020.24178"},{"key":"2254_CR55","unstructured":"Zhang, J., Chen, D., Liao, J., Zhang, W., Hua, G., & Yu, N. (2020). Passport-aware normalization for deep model protection. In Proceedings NeurIPS (pp. 22619\u201322628)."},{"key":"2254_CR56","doi-asserted-by":"crossref","unstructured":"Zhang, J., Gu, Z., Jang, J., Wu, H., Stoecklin, M. P., Huang, H., & Molloy, I. (2018). Protecting intellectual property of deep neural networks with watermarking. In Proceedings ASIACCS, (pp. 159\u2013172).","DOI":"10.1145\/3196494.3196550"},{"key":"2254_CR57","doi-asserted-by":"crossref","unstructured":"Zhu, Z. A., Lu, Y. Z., & Chiang, C. K. (2019). Generating adversarial examples by makeup attacks on face recognition. In Proceedings ICIP (pp. 2516\u20132520).","DOI":"10.1109\/ICIP.2019.8803269"},{"key":"2254_CR58","doi-asserted-by":"crossref","unstructured":"Zoran, D., & Weiss, Y. (2009). Scale invariance and noise in natural images. In Proceedings ICCV (pp. 2209\u20132216).","DOI":"10.1109\/ICCV.2009.5459476"}],"container-title":["International Journal of Computer Vision"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-024-02254-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11263-024-02254-w\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-024-02254-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,3,30]],"date-time":"2025-03-30T22:13:15Z","timestamp":1743372795000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11263-024-02254-w"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,10,25]]},"references-count":58,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2025,4]]}},"alternative-id":["2254"],"URL":"https:\/\/doi.org\/10.1007\/s11263-024-02254-w","relation":{},"ISSN":["0920-5691","1573-1405"],"issn-type":[{"value":"0920-5691","type":"print"},{"value":"1573-1405","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,10,25]]},"assertion":[{"value":"15 September 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"23 September 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"25 October 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}