{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T20:21:11Z","timestamp":1792786871786,"version":"4.5.0"},"reference-count":62,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2021YFB2900103"],"award-info":[{"award-number":["2021YFB2900103"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61932016"],"award-info":[{"award-number":["61932016"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62441228"],"award-info":[{"award-number":["62441228"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Science and Technology Tackling Program of Anhui Province","award":["202423k09020016"],"award-info":[{"award-number":["202423k09020016"]}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["WK2150110024"],"award-info":[{"award-number":["WK2150110024"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100009558","name":"University Synergy Innovation Program of Anhui Province","doi-asserted-by":"publisher","award":["GXXT-2022-049"],"award-info":[{"award-number":["GXXT-2022-049"]}],"id":[{"id":"10.13039\/501100009558","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2024.3518061","type":"journal-article","created":{"date-parts":[[2024,12,16]],"date-time":"2024-12-16T14:15:52Z","timestamp":1734358552000},"page":"854-870","source":"Crossref","is-referenced-by-count":3,"title":["DeepReg: A Trustworthy and Privacy-Friendly Ownership Regulatory Framework for Deep Learning Models"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9476-8587","authenticated-orcid":false,"given":"Xirong","family":"Zhuang","sequence":"first","affiliation":[{"name":"School of Computer Science and Technology, University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1004-8588","authenticated-orcid":false,"given":"Lan","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1200-475X","authenticated-orcid":false,"given":"Chen","family":"Tang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4204-6096","authenticated-orcid":false,"given":"Yaliang","family":"Li","sequence":"additional","affiliation":[{"name":"Alibaba Group, Bellevue, WA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/s11704-022-2256-5"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/s11704-023-2386-4"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TAI.2021.3133824"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3369405"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/j.scitotenv.2022.159158"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2022.3222821"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3297858.3304051"},{"key":"ref8","first-page":"1615","article-title":"Turning your weakness into a strength: Watermarking deep neural networks by backdooring","volume-title":"Proc. 27th USENIX Conf. Security Symp.","author":"Adi"},{"key":"ref9","article-title":"MOVE: Effective and harmless ownership verification via embedded external features","author":"Li","year":"2022","journal-title":"arXiv:2208.02820"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2023.3250210"},{"key":"ref11","first-page":"1","article-title":"Explanation as a watermark: Towards harmless and multi-bit model ownership verification via watermarking feature attribution","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"Shao"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.241012"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3198267"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01307"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3437526"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/ISCAS51556.2021.9401119"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/109"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3534678.3539257"},{"key":"ref19","first-page":"36571","article-title":"Are you stealing my model? Sample correlation for fingerprinting deep neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Guan"},{"key":"ref20","first-page":"6885","article-title":"False claims against model ownership resolution","volume-title":"Proc. USENIX Secur. Symp.","author":"Liu"},{"key":"ref21","article-title":"Bayes\u2019 theorem","author":"Joyce","year":"2021","journal-title":"Stanford Encyclopedia of Philosophy"},{"key":"ref22","volume-title":"Introduction to Trusted Execution Environment: Arm\u2019s Trustzone","year":"2024"},{"key":"ref23","article-title":"Intel Corp","volume-title":"Intel Software Guard Extensions","year":"2024"},{"key":"ref24","article-title":"Integrating remote attestation with transport layer security","author":"Knauth","year":"2018","journal-title":"arXiv:1801.05863"},{"key":"ref25","first-page":"991","article-title":"Foreshadow: Extracting the keys to the Intel SGX kingdom with transient out-of-order execution","volume-title":"Proc. USENIX Secur. Symp.","author":"Bulck"},{"key":"ref26","first-page":"699","article-title":"VoltPillager}: Hardware-based fault injection attacks against Intel SGX Enclaves using the SVID voltage scaling interface","volume-title":"Proc. USENIX Secur. Symp.","author":"Chen"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354209"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485370"},{"key":"ref29","first-page":"3593","article-title":"Teacher model fingerprinting attacks against transfer learning","volume-title":"Proc. 31st USENIX Secur. Symp. (USENIX Security)","author":"Chen"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref31","article-title":"Adam: A method for stochastic optimization","author":"Kingma","year":"2014","journal-title":"arXiv:1412.6980"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3300061.3345447"},{"key":"ref33","article-title":"Intel Corp","volume-title":"3rd Gen Intel Xeon Scalable Processors Brief","year":"2024"},{"key":"ref34","article-title":"Fusion: Efficient and secure inference resilient to malicious servers","author":"Dong","year":"2022","journal-title":"arXiv:2205.03040"},{"key":"ref35","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"issue":"7","key":"ref36","first-page":"3","article-title":"Tiny ImageNet visual recognition challenge","volume":"7","author":"Le","year":"2015","journal-title":"CS 231N"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/ICVGIP.2008.47"},{"key":"ref38","first-page":"2","article-title":"Learning algorithms for classification: A comparison on handwritten digit recognition","volume":"261","author":"LeCun","year":"1995","journal-title":"Neural Networks: The Statistical Mechanics Perspective"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref40","article-title":"Very deep convolutional networks for large-scale image recognition","author":"Simonyan","year":"2014","journal-title":"arXiv:1409.1556"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00474"},{"key":"ref42","article-title":"DenseNet: Implementing efficient ConvNet descriptor pyramids","author":"Iandola","year":"2014","journal-title":"arXiv:1404.1869"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/1873951.1874254"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01167"},{"key":"ref46","article-title":"ResNet strikes back: An improved training procedure in timm","author":"Wightman","year":"2021","journal-title":"arXiv:2110.00476"},{"key":"ref47","first-page":"10096","article-title":"EfficientNetv2: Smaller models and faster training","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Tan"},{"key":"ref48","article-title":"Masked autoencoders are scalable vision learners","author":"He","year":"2021","journal-title":"arXiv:2111.06377"},{"key":"ref49","article-title":"Vision transformers in 2022: An update on tiny ImageNet","author":"Huynh","year":"2022","journal-title":"arXiv:2205.10660"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/2783258.2783417"},{"key":"ref51","article-title":"How powerful are graph neural networks?","author":"Xu","year":"2018","journal-title":"arXiv:1810.00826"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D13-1170"},{"key":"ref53","first-page":"2","article-title":"BERT: Pre-training of deep bidirectional transformers for language understanding","volume-title":"Proc. NAACL-HLT","volume":"1","author":"Devlin"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/AITB48515.2019.8947435"},{"key":"ref55","article-title":"Speech commands: A dataset for limited-vocabulary speech recognition","author":"Warden","year":"2018","journal-title":"arXiv:1804.03209"},{"key":"ref56","article-title":"A neural attention model for speech command recognition","author":"de Andrade","year":"2018","journal-title":"arXiv:1808.08929"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1212.0402"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7299101"},{"key":"ref59","first-page":"487","article-title":"Container-IMA: A privacy-preserving integrity measurement architecture for containers","volume-title":"Proc. Int. Symp. Res. Attacks, Intrusions Defences","author":"Luo"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2019.02.026"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1088\/1742-6596\/1619\/1\/012014"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/jsen.2024.3445576"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/10803000.pdf?arnumber=10803000","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,1,15]],"date-time":"2025-01-15T14:38:24Z","timestamp":1736951904000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10803000\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":62,"URL":"https:\/\/doi.org\/10.1109\/tifs.2024.3518061","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}