{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T12:35:44Z","timestamp":1785328544760,"version":"3.55.0"},"reference-count":47,"publisher":"IEEE","license":[{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,5]]},"DOI":"10.1109\/sp46214.2022.9833747","type":"proceedings-article","created":{"date-parts":[[2022,7,27]],"date-time":"2022-07-27T15:28:05Z","timestamp":1658935685000},"page":"824-841","source":"Crossref","is-referenced-by-count":76,"title":["Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Models"],"prefix":"10.1109","author":[{"given":"Jialuo","family":"Chen","sequence":"first","affiliation":[{"name":"Zhejiang University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jingyi","family":"Wang","sequence":"additional","affiliation":[{"name":"Zhejiang University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tinglan","family":"Peng","sequence":"additional","affiliation":[{"name":"Zhejiang University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Youcheng","family":"Sun","sequence":"additional","affiliation":[{"name":"University of Manchester"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Peng","family":"Cheng","sequence":"additional","affiliation":[{"name":"Zhejiang University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shouling","family":"Ji","sequence":"additional","affiliation":[{"name":"Zhejiang University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xingjun","family":"Ma","sequence":"additional","affiliation":[{"name":"Fudan University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bo","family":"Li","sequence":"additional","affiliation":[{"name":"UIUC"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dawn","family":"Song","sequence":"additional","affiliation":[{"name":"UC Berkeley"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref13","first-page":"31","article-title":"Bent Fuglede and Flemming Topsoe. Jensen-shannon divergence and hilbert space embedding","year":"2004","journal-title":"International Symposium on Information Theory"},{"key":"ref35","article-title":"Comparing rewinding and fine-tuning in neural network pruning","author":"renda","year":"2020","journal-title":"arXiv preprint arXiv 2003 02255"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3395363.3397357"},{"key":"ref34","first-page":"1","article-title":"DeepXplore: Automated whitebox testing of deep learning systems","author":"pei","year":"2017","journal-title":"SOSP"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2013.6638947"},{"key":"ref37","article-title":"The cost of training nlp models: A concise overview","author":"sharir","year":"2020","journal-title":"arXiv preprint arXiv 2004 00493"},{"key":"ref14","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2014","journal-title":"arXiv preprint arXiv 1412 6572"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"ref31","article-title":"Reading digits in natural images with unsupervised feature learning","author":"netzer","year":"2011","journal-title":"NIPS Workshop on Deep Learning and Unsupervised Feature Learning"},{"key":"ref30","article-title":"A survey on bias and fairness in machine learning","author":"mehrabi","year":"2019","journal-title":"arXiv preprint arXiv 1908 09043"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2017.2740965"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref10","article-title":"Rethinking deep neural network ownership verification: Embedding passports to defeat ambiguity attacks","author":"fan","year":"2019"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3437526"},{"key":"ref1","first-page":"1615","article-title":"Turning your weakness into a strength: Watermarking deep neural networks by backdooring","author":"adi","year":"2018","journal-title":"Usenix Security"},{"key":"ref17","article-title":"The hidden vulnerability of watermarking for deep neural networks","author":"guo","year":"2020","journal-title":"arXiv preprint arXiv 2009 08003"},{"key":"ref39","article-title":"Robustness may be at odds with accuracy","author":"tsipras","year":"2018","journal-title":"arXiv preprint arXiv 1805 12152"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref38","first-page":"601","article-title":"Stealing machine learning models via prediction APIs","author":"tram\u00e8r","year":"2016","journal-title":"Usenix Security"},{"key":"ref19","first-page":"1345","article-title":"High accuracy and high fidelity extraction of neural networks","author":"jagielski","year":"2020","journal-title":"Usenix Security"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref24","article-title":"MNIST handwritten digit database","author":"lecun","year":"2010"},{"key":"ref46","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","author":"zhang","year":"2019","journal-title":"ICML"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-019-04434-z"},{"key":"ref45","article-title":"Es attack: Model stealing against deep neural networks without data hurdles","author":"yuan","year":"2020","journal-title":"arXiv preprint arXiv 2009 09796"},{"key":"ref26","article-title":"Rethinking the value of network pruning","author":"liu","year":"2018","journal-title":"arXiv preprint arXiv 1810 05533"},{"key":"ref25","doi-asserted-by":"crossref","first-page":"273","DOI":"10.1007\/978-3-030-00470-5_13","article-title":"Fine-pruning: Defending against backdooring attacks on deep neural networks","author":"liu","year":"2018","journal-title":"International Symposium on Research in Attacks Intrusions and Defenses"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196550"},{"key":"ref20","article-title":"Entangled watermarks as a defense against model extraction","author":"jia","year":"2021","journal-title":"Usenix Security"},{"key":"ref42","article-title":"Speech commands: A dataset for limited-vocabulary speech recognition","author":"warden","year":"2018","journal-title":"arXiv preprint arXiv 1804 00209"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref22","article-title":"Learning multiple layers of features from tiny images","author":"krizhevsky","year":"2009"},{"key":"ref44","article-title":"Understanding neural networks through deep visualization","author":"yosinski","year":"2015","journal-title":"arXiv preprint arXiv 1506 06579"},{"key":"ref21","first-page":"512","article-title":"PRADA: protecting against dnn model stealing attacks","author":"juuti","year":"2019","journal-title":"EuroS&P"},{"key":"ref43","article-title":"Skip connections matter: On the transferability of adversarial examples generated with resnets","author":"wu","year":"2020","journal-title":"ICLRE"},{"key":"ref28","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2017","journal-title":"arXiv preprint arXiv 1706 06083"},{"key":"ref27","article-title":"Deep neural network fingerprinting by conferrable adversarial examples","author":"lukas","year":"2021","journal-title":"ICLRE"},{"key":"ref29","article-title":"Dataset inference: Ownership resolution in machine learning","author":"maini","year":"2021","journal-title":"ICLRE"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2018.8489592"},{"key":"ref7","first-page":"2493","article-title":"Natural language processing (almost) from scratch","volume":"12","author":"collobert","year":"2011","journal-title":"Journal of Machine Learning Research"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3297858.3304051"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref3","first-page":"189","article-title":"Cryptanalytic extraction of neural network models","author":"carlini","year":"2020","journal-title":"Crypto"},{"key":"ref6","article-title":"Kapre: On-gpu audio preprocessing layers for a quick implementation of deep neural network models with keras","author":"choi","year":"2017","journal-title":"Machine Learning for Music Discovery Workshop ICML"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.312"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3078971.3078974"}],"event":{"name":"2022 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2022,5,22]]},"end":{"date-parts":[[2022,5,26]]}},"container-title":["2022 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9833550\/9833558\/09833747.pdf?arnumber=9833747","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T18:20:57Z","timestamp":1699467657000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9833747\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5]]},"references-count":47,"URL":"https:\/\/doi.org\/10.1109\/sp46214.2022.9833747","relation":{},"subject":[],"published":{"date-parts":[[2022,5]]}}}