{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,20]],"date-time":"2026-02-20T11:48:35Z","timestamp":1771588115327,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":54,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,10,28]],"date-time":"2024-10-28T00:00:00Z","timestamp":1730073600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/https:\/\/doi.org\/10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62272175"],"award-info":[{"award-number":["62272175"]}],"id":[{"id":"10.13039\/https:\/\/doi.org\/10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,10,28]]},"DOI":"10.1145\/3664647.3681691","type":"proceedings-article","created":{"date-parts":[[2024,10,26]],"date-time":"2024-10-26T06:59:41Z","timestamp":1729925981000},"page":"9875-9884","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Towards Stricter Black-box Integrity Verification of Deep Neural Network Models"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-8936-9336","authenticated-orcid":false,"given":"Chaoxiang","family":"He","sequence":"first","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, Hubei, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-6796-3773","authenticated-orcid":false,"given":"Xiaofan","family":"Bai","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, Hubei, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6363-3209","authenticated-orcid":false,"given":"Xiaojing","family":"Ma","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, Hubei, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3571-7808","authenticated-orcid":false,"given":"Bin B.","family":"Zhu","sequence":"additional","affiliation":[{"name":"Microsoft Corporation, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-5616-7418","authenticated-orcid":false,"given":"Pingyi","family":"Hu","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, Hubei, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4908-3081","authenticated-orcid":false,"given":"Jiayun","family":"Fu","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, Hubei, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3934-7605","authenticated-orcid":false,"given":"Hai","family":"Jin","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, Hubei, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9230-2799","authenticated-orcid":false,"given":"Dongmei","family":"Zhang","sequence":"additional","affiliation":[{"name":"Microsoft Corporation, Beijing, China"}]}],"member":"320","published-online":{"date-parts":[[2024,10,28]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"Amazon Web Services. 2023. Amazon SageMaker. https:\/\/aws.amazon.com\/sagemaker."},{"key":"e_1_3_2_2_2_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2021.06.073"},{"key":"e_1_3_2_2_3_1","volume-title":"Secure hash standard. Federal information processing standards publication","author":"Burrows James H.","year":"1995","unstructured":"James H. Burrows. 1995. Secure hash standard. Federal information processing standards publication (1995), 180--1."},{"key":"e_1_3_2_2_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3437526"},{"key":"e_1_3_2_2_5_1","volume-title":"Proceedings of the 36th International Conference on Neural Information Processing Systems. Curran Associates, Inc., 21575--21589","author":"Chadebec Cl\u00e9ment","year":"2022","unstructured":"Cl\u00e9ment Chadebec, Louis Vincent, and Stephanie Allassonniere. 2022. Pythae: Unifying Generative Autoencoders in Python - A Benchmarking Use Case. In Proceedings of the 36th International Conference on Neural Information Processing Systems. Curran Associates, Inc., 21575--21589."},{"key":"e_1_3_2_2_6_1","unstructured":"Yaofo Chen. 2022. Pytorch CIFAR Models. https:\/\/github.com\/chenyaofo\/pytorchcifar- models."},{"key":"e_1_3_2_2_7_1","volume-title":"A survey of model compression and acceleration for deep neural networks. arXiv preprint arXiv:1710.09282","author":"Cheng Yu","year":"2017","unstructured":"Yu Cheng, Duo Wang, Pan Zhou, and Tao Zhang. 2017. A survey of model compression and acceleration for deep neural networks. arXiv preprint arXiv:1710.09282 (2017)."},{"key":"e_1_3_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.195"},{"key":"e_1_3_2_2_9_1","unstructured":"Distributed (Deep) Machine Learning Community. 2021. Gluon CV Toolkit. https:\/\/github.com\/dmlc\/gluon-cv."},{"key":"e_1_3_2_2_10_1","doi-asserted-by":"publisher","DOI":"10.4204\/EPTCS.342.4"},{"key":"e_1_3_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01268"},{"key":"e_1_3_2_2_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00932"},{"key":"e_1_3_2_2_13_1","unstructured":"Google Cloud. 2023. AutoML. https:\/\/cloud.google.com\/automl."},{"key":"e_1_3_2_2_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"e_1_3_2_2_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_2_16_1","unstructured":"Zecheng He. 2021. The Implementation of Sensitive Sample Fingerprinting. https:\/\/github.com\/zechenghe\/Sensitive_Sample_Fingerprinting."},{"key":"e_1_3_2_2_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00486"},{"key":"e_1_3_2_2_18_1","volume-title":"Proceedings of the Twenty-eighth Annual Conference on Neural Information Processing Systems (NIPS 2014) Deep Learning Workshop. Curran Associates, Inc.","author":"Hinton Geoffrey","year":"2014","unstructured":"Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. 2014. Distilling the knowledge in a neural network. In Proceedings of the Twenty-eighth Annual Conference on Neural Information Processing Systems (NIPS 2014) Deep Learning Workshop. Curran Associates, Inc."},{"key":"e_1_3_2_2_19_1","volume-title":"Mobilenets: Efficient convolutional neural networks for mobile vision applications. arXiv preprint arXiv:1704.04861","author":"Howard Andrew G.","year":"2017","unstructured":"Andrew G. Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam. 2017. Mobilenets: Efficient convolutional neural networks for mobile vision applications. arXiv preprint arXiv:1704.04861 (2017)."},{"key":"e_1_3_2_2_20_1","volume-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE Computer Society, 4700--4708","author":"Huang Gao","unstructured":"Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q. Weinberger. 2017. Densely connected convolutional networks. In Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE Computer Society, 4700--4708."},{"key":"e_1_3_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485368"},{"key":"e_1_3_2_2_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCAD51958.2021.9643556"},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11432-022-3548-2"},{"key":"e_1_3_2_2_24_1","volume-title":"Proceedings of the International Conference on Machine Learning. PMLR","author":"Koh Pang Wei","year":"2017","unstructured":"Pang Wei Koh and Percy Liang. 2017. Understanding black-box predictions via influence functions. In Proceedings of the International Conference on Machine Learning. PMLR, 1885--1894."},{"key":"e_1_3_2_2_25_1","unstructured":"Alex Krizhevsky. 2009. Learning multiple layers of features from tiny images. Citeseer."},{"key":"e_1_3_2_2_26_1","volume-title":"Proceedings of the 5th International Conference on Learning Representations ICLR 2017, Workshop track. OpenReview.net.","author":"Kurakin Alexey","year":"2017","unstructured":"Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2017. Adversarial examples in the physical world. In Proceedings of the 5th International Conference on Learning Representations ICLR 2017, Workshop track. OpenReview.net."},{"key":"e_1_3_2_2_27_1","volume-title":"Proceedings of the 5th International Conference on Learning Representations ICLR","author":"Kurakin Alexey","year":"2017","unstructured":"Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2017. Adversarial machine learning at scale. In Proceedings of the 5th International Conference on Learning Representations ICLR 2017. OpenReview.net."},{"key":"e_1_3_2_2_28_1","volume-title":"C","author":"Kuttichira Deepthi Praveenlal","year":"2022","unstructured":"Deepthi Praveenlal Kuttichira, Sunil Gupta, Dang Nguyen, Santu Rana, and Svetha Venkatesh. 2022. Verification of integrity of deployed deep learning models using Bayesian Optimization. Knowledge-Based Systems 241, C (2022), 108238."},{"key":"e_1_3_2_2_29_1","volume-title":"Learning algorithms for classification: A comparison on handwritten digit recognition. Neural Networks","author":"LeCun Yann","year":"1995","unstructured":"Yann LeCun, Lawrence D. Jackel, L\u00e9on Bottou, Corinna Cortes, John S Denker, Harris Drucker, Isabelle Guyon, Urs A Muller, Eduard Sackinger, Patrice Simard, and Vladimir Vapnik. 1995. Learning algorithms for classification: A comparison on handwritten digit recognition. Neural Networks (1995), 261--276."},{"key":"e_1_3_2_2_30_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"e_1_3_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298965"},{"key":"e_1_3_2_2_32_1","unstructured":"Microsoft Azure. 2023. Microsoft Machine Learning. https:\/\/azure.microsoft.com\/en-us\/products\/machine-learning."},{"key":"e_1_3_2_2_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01152"},{"key":"e_1_3_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2009.191"},{"key":"e_1_3_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3534678.3539257"},{"key":"e_1_3_2_2_36_1","unstructured":"Pytorch. 2022. Pytorch Hub. https:\/\/pytorch.org\/hub\/."},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00130"},{"key":"e_1_3_2_2_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.91"},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"crossref","unstructured":"Ronald Rivest. 1992. RFC1321: The MD5 message-digest algorithm.","DOI":"10.17487\/rfc1321"},{"key":"e_1_3_2_2_40_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"e_1_3_2_2_41_1","volume-title":"Proceedings of the 29th USENIX Security Symposium, USENIX Security","author":"Salem Ahmed","year":"2020","unstructured":"Ahmed Salem, Apratim Bhattacharya, Michael Backes, Mario Fritz, and Yang Zhang. 2020. Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning. In Proceedings of the 29th USENIX Security Symposium, USENIX Security 2020. USENIX Association, 1291--1308."},{"key":"e_1_3_2_2_42_1","volume-title":"Proceedings of the 32nd International Conference on Neural Information Processing Systems. Curran Associates, Inc., 6106--6116","author":"Shafahi Ali","year":"2018","unstructured":"Ali Shafahi, W. Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. 2018. Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks. In Proceedings of the 32nd International Conference on Neural Information Processing Systems. Curran Associates, Inc., 6106--6116."},{"key":"e_1_3_2_2_43_1","volume-title":"Proceedings of the 3th International Conference on Learning Representations, ICLR","author":"Simonyan Karen","year":"2015","unstructured":"Karen Simonyan and Andrew Zisserman. 2015. Very Deep Convolutional Networks for Large-Scale Image Recognition. In Proceedings of the 3th International Conference on Learning Representations, ICLR 2015. OpenReview.net."},{"key":"e_1_3_2_2_44_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"e_1_3_2_2_45_1","volume-title":"Proceedings of the 27th USENIX Security Symposium (USENIX Security 18)","author":"Suciu Octavian","year":"2018","unstructured":"Octavian Suciu, Radu Marginean, Yigitcan Kaya, Hal Daume III, and Tudor Dumitras. 2018. When does machine learning FAIL? generalized transferability for evasion and poisoning attacks. In Proceedings of the 27th USENIX Security Symposium (USENIX Security 18). USENIX Association, 1299--1316."},{"key":"e_1_3_2_2_46_1","volume-title":"Proceedings of the 31st International Conference on Neural Information Processing Systems. Curran Associates, Inc., 6309--6318","author":"van den Oord Aaron","year":"2017","unstructured":"Aaron van den Oord, Oriol Vinyals, and Koray Kavukcuoglu. 2017. Neural discrete representation learning. In Proceedings of the 31st International Conference on Neural Information Processing Systems. Curran Associates, Inc., 6309--6318."},{"key":"e_1_3_2_2_47_1","doi-asserted-by":"publisher","DOI":"10.5555\/211359"},{"key":"e_1_3_2_2_48_1","volume-title":"Proceedings of the 2023 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 1239--1256","author":"Wang Shuo","year":"2022","unstructured":"Shuo Wang, Sharif Abuadbba, Sidharth Agarwal, Kristen Moore, Ruoxi Sun, Minhui Xue, Surya Nepal, Seyit Camtepe, and Salil Kanhere. 2022. PublicCheck: Public Integrity Verification for Services of Run-time Deep Models. In Proceedings of the 2023 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 1239--1256."},{"key":"e_1_3_2_2_49_1","volume-title":"Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI. 575--582","author":"Chen Pin-Yu","year":"2021","unstructured":"SiyueWang, XiaoWang, Pin-Yu Chen, Pu Zhao, and Xue Lin. 2021. Characteristic Examples: High-Robustness, Low-Transferability Fingerprinting of Neural Networks. In Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI. 575--582."},{"key":"e_1_3_2_2_50_1","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/109"},{"key":"e_1_3_2_2_51_1","volume-title":"Proceedings of the 29th USENIX Security Symposium, USENIX Security","author":"Yao Fan","year":"2020","unstructured":"Fan Yao, Adnan Siraj Rakin, and Deliang Fan. 2020. DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips. In Proceedings of the 29th USENIX Security Symposium, USENIX Security 2020. USENIX Association, 1463--1480."},{"key":"e_1_3_2_2_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00765"},{"key":"e_1_3_2_2_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01445"},{"key":"e_1_3_2_2_54_1","volume-title":"Fragile Neural Network Watermarking with Trigger Image Set. In International Conference on Knowledge Science, Engineering and Management. Springer, 280--293","author":"Zhu Renjie","year":"2021","unstructured":"Renjie Zhu, Ping Wei, Sheng Li, Zhaoxia Yin, Xinpeng Zhang, and Zhenxing Qian. 2021. Fragile Neural Network Watermarking with Trigger Image Set. In International Conference on Knowledge Science, Engineering and Management. Springer, 280--293."}],"event":{"name":"MM '24: The 32nd ACM International Conference on Multimedia","location":"Melbourne VIC Australia","acronym":"MM '24","sponsor":["SIGMM ACM Special Interest Group on Multimedia"]},"container-title":["Proceedings of the 32nd ACM International Conference on Multimedia"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3664647.3681691","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3664647.3681691","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:17:50Z","timestamp":1750295870000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3664647.3681691"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,10,28]]},"references-count":54,"alternative-id":["10.1145\/3664647.3681691","10.1145\/3664647"],"URL":"https:\/\/doi.org\/10.1145\/3664647.3681691","relation":{},"subject":[],"published":{"date-parts":[[2024,10,28]]},"assertion":[{"value":"2024-10-28","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}