{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,2,21]],"date-time":"2025-02-21T23:29:29Z","timestamp":1740180569212,"version":"3.37.3"},"reference-count":31,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2024,12,23]],"date-time":"2024-12-23T00:00:00Z","timestamp":1734912000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,12,23]],"date-time":"2024-12-23T00:00:00Z","timestamp":1734912000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100001809","name":"Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62121002","U20B2047"],"award-info":[{"award-number":["62121002","U20B2047"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100001809","name":"Natural Science Foundation of China","doi-asserted-by":"crossref","award":["U2336206","62372423"],"award-info":[{"award-number":["U2336206","62372423"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100001809","name":"Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62102386"],"award-info":[{"award-number":["62102386"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Efforts have been made to safeguard DNNs from intellectual property infringement. Among different techniques, model fingerprinting has gained popularity due to its ability to examine potential infringement without altering the model\u2019s parameters. However, there is a concern regarding the vulnerability of previous model fingerprints to \u201cambiguity attacks,\u201d where attackers may use fabricated fingerprints to bypass ownership verification, potentially leading to disputes. To address this issue, we propose a dual-verification-based fingerprint authentication system that incorporates the verification of fingerprint genuineness. Briefly, this system involves two authentication processes: conventional fingerprint methods for authenticating model copyrights and <jats:italic>the incorporation of copyright information into the fingerprint feature map to confirm ownership of the model fingerprint.<\/jats:italic> Extensive experiments have been conducted to demonstrate the effectiveness of our approach in resisting ambiguity attacks and managing attempts to remove the fingerprint.<\/jats:p>","DOI":"10.1186\/s42400-024-00298-6","type":"journal-article","created":{"date-parts":[[2024,12,23]],"date-time":"2024-12-23T02:02:14Z","timestamp":1734919334000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Dual-verification-based model fingerprints against ambiguity attacks"],"prefix":"10.1186","volume":"7","author":[{"given":"Boyao","family":"Zhao","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6491-2023","authenticated-orcid":false,"given":"Haozhe","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jie","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Weiming","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nenghai","family":"Yu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2024,12,23]]},"reference":[{"key":"298_CR1","first-page":"129","volume":"2","author":"D Blalock","year":"2020","unstructured":"Blalock D, Gonzalez Ortiz JJ, Frankle J et al (2020) What is the state of neural network pruning? Proc Mach Learn Syst 2:129\u2013146","journal-title":"Proc Mach Learn Syst"},{"key":"298_CR2","doi-asserted-by":"crossref","unstructured":"Cao X, Jia J, Gong NZ (2021) Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary. In: Proceedings of the 2021 ACM Asia conference on computer and communications security, pp 14\u201325","DOI":"10.1145\/3433210.3437526"},{"key":"298_CR3","unstructured":"Coates A, Ng A, Lee H (2011) An analysis of single-layer networks in unsupervised feature learning. In: Proceedings of the fourteenth international conference on artificial intelligence and statistics, JMLR Workshop and Conference Proceedings, pp 215\u2013223"},{"key":"298_CR4","unstructured":"Dabkowski P, Gal Y (2017) Real time image saliency for black box classifiers. Adv Neural Inf Process Syst 30"},{"key":"298_CR5","doi-asserted-by":"crossref","unstructured":"Deng J, Dong W, Socher R, et\u00a0al (2009) Imagenet: A large-scale hierarchical image database. In: 2009 IEEE conference on computer vision and pattern recognition, Ieee, pp 248\u2013255","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"298_CR6","unstructured":"Dosovitskiy A, Beyer L, Kolesnikov A, et\u00a0al (2020) An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929"},{"key":"298_CR7","doi-asserted-by":"crossref","unstructured":"Fang S, Choromanska A (2022) Backdoor attacks on the dnn interpretation system. In: Proceedings of the AAAI conference on artificial intelligence, pp 561\u2013570","DOI":"10.1609\/aaai.v36i1.19935"},{"key":"298_CR8","doi-asserted-by":"crossref","unstructured":"Fong RC, Vedaldi A (2017) Interpretable explanations of black boxes by meaningful perturbation. In: Proceedings of the IEEE international conference on computer vision, pp 3429\u20133437","DOI":"10.1109\/ICCV.2017.371"},{"key":"298_CR9","doi-asserted-by":"crossref","unstructured":"Hatamizadeh A, Yin H, Roth HR, et\u00a0al (2022) Gradvit: gradient inversion of vision transformers. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 10021\u201310030","DOI":"10.1109\/CVPR52688.2022.00978"},{"key":"298_CR10","doi-asserted-by":"crossref","unstructured":"He K, Zhang X, Ren S, et\u00a0al (2016) Deep residual learning for image recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 770\u2013778","DOI":"10.1109\/CVPR.2016.90"},{"key":"298_CR11","unstructured":"Ioffe S, Szegedy C (2015) Batch normalization: Accelerating deep network training by reducing internal covariate shift. In: International conference on machine learning, pmlr, pp 448\u2013456"},{"key":"298_CR12","doi-asserted-by":"crossref","unstructured":"Kim Y, Park D, Kim D, et\u00a0al (2022) Naturalinversion: data-free image synthesis improving real-world consistency. In: Proceedings of the AAAI conference on artificial intelligence, pp 1201\u20131209","DOI":"10.1609\/aaai.v36i1.20006"},{"key":"298_CR13","unstructured":"Krizhevsky A, Hinton G, et\u00a0al (2009) Learning multiple layers of features from tiny images"},{"key":"298_CR14","unstructured":"Lukas N, Zhang Y, Kerschbaum F (2019) Deep neural network fingerprinting by conferrable adversarial examples. arXiv preprint arXiv:1912.00888"},{"key":"298_CR15","doi-asserted-by":"crossref","unstructured":"Lv, Qing, Zhang, et\u00a0al (2022) Deep learning model of image classification using machine learning. Adv Multimedia 2022","DOI":"10.1155\/2022\/3351256"},{"key":"298_CR16","unstructured":"Madry A, Makelov A, Schmidt L, et\u00a0al (2017) Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083"},{"key":"298_CR17","doi-asserted-by":"crossref","unstructured":"Ning R, Li J, Xin C, et\u00a0al (2021) Invisible poison: A blackbox clean label backdoor attack to deep neural networks. In: IEEE INFOCOM 2021-IEEE conference on computer communications, IEEE, pp 1\u201310","DOI":"10.1109\/INFOCOM42981.2021.9488902"},{"key":"298_CR18","doi-asserted-by":"crossref","unstructured":"Pan X, Yan Y, Zhang M, et\u00a0al (2022) Metav: A meta-verifier approach to task-agnostic model fingerprinting. In: Proceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining","DOI":"10.1145\/3534678.3539257"},{"key":"298_CR19","doi-asserted-by":"crossref","unstructured":"Peng Z, Li S, Chen G, et\u00a0al (2022) Fingerprinting deep neural networks globally via universal adversarial perturbations. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 13430\u201313439","DOI":"10.1109\/CVPR52688.2022.01307"},{"key":"298_CR20","doi-asserted-by":"crossref","unstructured":"Selvaraju RR, Cogswell M, Das A, et\u00a0al (2017) Grad-cam: Visual explanations from deep networks via gradient-based localization. In: Proceedings of the IEEE international conference on computer vision, pp 618\u2013626","DOI":"10.1109\/ICCV.2017.74"},{"key":"298_CR21","unstructured":"Simonyan K, Zisserman A (2014) Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556"},{"key":"298_CR22","doi-asserted-by":"crossref","unstructured":"Stallkamp J, Schlipsing M, Salmen J, et\u00a0al (2011) The german traffic sign recognition benchmark: a multi-class classification competition. In: The 2011 international joint conference on neural networks, IEEE, pp 1453\u20131460","DOI":"10.1109\/IJCNN.2011.6033395"},{"key":"298_CR23","doi-asserted-by":"crossref","unstructured":"Szegedy C, Vanhoucke V, Ioffe S, et\u00a0al (2016) Rethinking the inception architecture for computer vision. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 2818\u20132826","DOI":"10.1109\/CVPR.2016.308"},{"key":"298_CR24","doi-asserted-by":"crossref","unstructured":"Wang S, Chang CH (2021) Fingerprinting deep neural networks-a deepfool approach. In: 2021 IEEE international symposium on circuits and systems (ISCAS), IEEE, pp 1\u20135","DOI":"10.1109\/ISCAS51556.2021.9401119"},{"issue":"4","key":"298_CR25","doi-asserted-by":"publisher","first-page":"600","DOI":"10.1109\/TIP.2003.819861","volume":"13","author":"Z Wang","year":"2004","unstructured":"Wang Z, Bovik AC, Sheikh HR et al (2004) Image quality assessment: from error visibility to structural similarity. IEEE Trans Image Process 13(4):600\u2013612","journal-title":"IEEE Trans Image Process"},{"key":"298_CR26","doi-asserted-by":"crossref","unstructured":"Yuan C, Ma Q, Chen J, et\u00a0al (2020) Exploiting heterogeneous artist and listener preference graph for music genre classification. In: Proceedings of the 28th ACM international conference on multimedia, pp 3532\u20133540","DOI":"10.1145\/3394171.3414000"},{"key":"298_CR27","unstructured":"Zhang X, Wang N, Shen H, et\u00a0al (2020) Interpretable deep learning under fire. In: 29th $$\\{$$USENIX$$\\}$$ security symposium ($$\\{$$USENIX$$\\}$$ security 20)"},{"issue":"1","key":"298_CR28","doi-asserted-by":"publisher","first-page":"47","DOI":"10.1109\/TCI.2016.2644865","volume":"3","author":"H Zhao","year":"2016","unstructured":"Zhao H, Gallo O, Frosio I et al (2016) Loss functions for image restoration with neural networks. IEEE Trans Comput Imaging 3(1):47\u201357","journal-title":"IEEE Trans Comput Imaging"},{"key":"298_CR29","doi-asserted-by":"publisher","first-page":"488","DOI":"10.1016\/j.comcom.2019.12.016","volume":"150","author":"J Zhao","year":"2020","unstructured":"Zhao J, Hu Q, Liu G et al (2020) Afa: adversarial fingerprinting authentication for deep neural networks. Comput Commun 150:488\u2013497","journal-title":"Comput Commun"},{"key":"298_CR30","doi-asserted-by":"crossref","unstructured":"Zhou B, Khosla A, Lapedriza A, et\u00a0al (2016) Learning deep features for discriminative localization. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 2921\u20132929","DOI":"10.1109\/CVPR.2016.319"},{"key":"298_CR31","doi-asserted-by":"crossref","unstructured":"Zhou Y, Ren J, Li J, et\u00a0al (2017) Video classification via relational feature encoding networks. In: Proceedings of the workshop on large-scale video classification challenge, pp 9\u201313","DOI":"10.1145\/3134263.3134265"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00298-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-024-00298-6\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00298-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,12,23]],"date-time":"2024-12-23T03:06:42Z","timestamp":1734923202000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-024-00298-6"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,23]]},"references-count":31,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2024,12]]}},"alternative-id":["298"],"URL":"https:\/\/doi.org\/10.1186\/s42400-024-00298-6","relation":{},"ISSN":["2523-3246"],"issn-type":[{"type":"electronic","value":"2523-3246"}],"subject":[],"published":{"date-parts":[[2024,12,23]]},"assertion":[{"value":"25 July 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"26 September 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"23 December 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no Conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"78"}}