{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,27]],"date-time":"2026-04-27T01:34:53Z","timestamp":1777253693794,"version":"3.51.4"},"reference-count":48,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2026,4,27]],"date-time":"2026-04-27T00:00:00Z","timestamp":1777248000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,4,27]],"date-time":"2026-04-27T00:00:00Z","timestamp":1777248000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>\n                    Training deep learning models requires substantial financial and human resources, so once deployed in untrusted environments, these models immediately attract the attention of attackers who seek to steal and misuse them. Traditional model protection methods are ineffective in addressing model accuracy, performance, and proactive defense. To this end, we present an active defensive approach\n                    <jats:sc>SwitchNet<\/jats:sc>\n                    by obfuscating model structure and proposing a switch-controlled mechanism to manage model inference. Specifically,\n                    <jats:sc>SwitchNet<\/jats:sc>\n                    learns the weight distribution of the original model and then constructs confusion layers that are strategically inserted into the original model for structure obfuscation. Each of the model layers is equipped with a\n                    <jats:italic>switch<\/jats:italic>\n                    , which is controlled by a switching policy network. We train this policy network with an adaptive pattern as a \u201csecret key\u201d that can accurately control the switch states, and thereby the model inference process. We conduct a comprehensive theoretical analysis of the perturbation boundary and certify that\n                    <jats:sc>SwitchNet<\/jats:sc>\n                    maintains high robustness under\n                    <jats:inline-formula>\n                      <jats:alternatives>\n                        <jats:tex-math>$$\\ell _\\infty$$<\/jats:tex-math>\n                        <mml:math xmlns:mml=\"http:\/\/www.w3.org\/1998\/Math\/MathML\">\n                          <mml:msub>\n                            <mml:mi>\u2113<\/mml:mi>\n                            <mml:mi>\u221e<\/mml:mi>\n                          <\/mml:msub>\n                        <\/mml:math>\n                      <\/jats:alternatives>\n                    <\/jats:inline-formula>\n                    perturbations, with certified accuracy exceeding 80% at\n                    <jats:inline-formula>\n                      <jats:alternatives>\n                        <jats:tex-math>$$\\epsilon = 0.0048$$<\/jats:tex-math>\n                        <mml:math xmlns:mml=\"http:\/\/www.w3.org\/1998\/Math\/MathML\">\n                          <mml:mrow>\n                            <mml:mi>\u03f5<\/mml:mi>\n                            <mml:mo>=<\/mml:mo>\n                            <mml:mn>0.0048<\/mml:mn>\n                          <\/mml:mrow>\n                        <\/mml:math>\n                      <\/jats:alternatives>\n                    <\/jats:inline-formula>\n                    (CROWN). In addition, we perform extensive experiments on both classical convolutional networks and Vision Transformers. The results show that\n                    <jats:sc>SwitchNet<\/jats:sc>\n                    effectively preserves model accuracy for legitimate users (with only a 0.35% drop), while reducing the accuracy for unauthorized users to near-random guessing. Compared to the state-of-the-art, our approach reduces inference and construction overhead by 20.89% and 12.08%, respectively. Furthermore,\n                    <jats:sc>SwitchNet<\/jats:sc>\n                    proves to be stealthy and resilient against various attacks aimed at detecting or compromising the protection mechanism.\n                  <\/jats:p>","DOI":"10.1186\/s42400-025-00408-y","type":"journal-article","created":{"date-parts":[[2026,4,27]],"date-time":"2026-04-27T01:03:16Z","timestamp":1777251796000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["SwitchNet: protecting neural networks by structure obfuscation and switch-controlled inference"],"prefix":"10.1186","volume":"9","author":[{"given":"Yuling","family":"Cai","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6388-2571","authenticated-orcid":false,"given":"Guozhu","family":"Meng","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yinzhi","family":"Cao","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Guangdong","family":"Bai","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,4,27]]},"reference":[{"key":"408_CR1","unstructured":"Cifar dataset. https:\/\/www.cs.toronto.edu\/~kriz\/cifar.html"},{"key":"408_CR2","unstructured":"Svhn dataset. http:\/\/ufldl.stanford.edu\/housenumbers\/"},{"issue":"3","key":"408_CR3","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3505634","volume":"18","author":"M Alam","year":"2022","unstructured":"Alam M, Saha S, Mukhopadhyay D, Kundu S (2022) Nn-lock: a lightweight authorization to prevent ip threats of deep learning models. J Emerg Technol Comput Syst 18(3):1\u201319. https:\/\/doi.org\/10.1145\/3505634. (ISSN 1550-4832)","journal-title":"J Emerg Technol Comput Syst"},{"key":"408_CR4","doi-asserted-by":"publisher","unstructured":"Baheri A, Nageshrao S, Eric Tseng H, Kolmanovsky I, Girard A, Filev D (2020) Deep reinforcement learning with enhanced safety for autonomous highway driving. In 2020 IEEE Intelligent Vehicles Symposium (IV), pp 1550\u20131555. https:\/\/doi.org\/10.1109\/IV47402.2020.9304744","DOI":"10.1109\/IV47402.2020.9304744"},{"key":"408_CR5","doi-asserted-by":"crossref","unstructured":"Cao Y, Xiao C, Cyr B, Zhou Y, Park W, Rampazzi S, Chen QA, Fu K, Morley MZ (2019) Adversarial sensor attack on lidar-based perception in autonomous driving. In: Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, pp 2267\u20132281","DOI":"10.1145\/3319535.3339815"},{"key":"408_CR6","doi-asserted-by":"publisher","unstructured":"Chakraborty A, Mondal A, Srivastava A (2020) Hardware-assisted intellectual property protection of deep learning models. In: 57th ACM\/IEEE design automation conference, DAC 2020, San Francisco, CA, USA, July 20-24, , pp 1\u20136. IEEE, 2020. https:\/\/doi.org\/10.1109\/DAC18072.2020.9218651","DOI":"10.1109\/DAC18072.2020.9218651"},{"key":"408_CR7","doi-asserted-by":"publisher","unstructured":"Chen M, Wu M (2018a) Protect your deep neural networks from piracy. In: 2018 IEEE international workshop on information forensics and security (WIFS), pp 1\u20137, https:\/\/doi.org\/10.1109\/WIFS.2018.8630791","DOI":"10.1109\/WIFS.2018.8630791"},{"key":"408_CR8","doi-asserted-by":"crossref","unstructured":"Chen M, Wu M (2018b) Protect your deep neural networks from piracy. In: 2018 IEEE international workshop on information forensics and security (WIFS), pp 1\u20137. IEEE","DOI":"10.1109\/WIFS.2018.8630791"},{"key":"408_CR9","doi-asserted-by":"crossref","unstructured":"Chen Q, Zhao H, Li W, Huang P, Ou W (2019) Behavior sequence transformer for e-commerce recommendation in alibaba. CoRR, abs\/1905.06874,","DOI":"10.1145\/3326937.3341261"},{"key":"408_CR10","doi-asserted-by":"crossref","unstructured":"Cho I, Takahashi R, Yanase Y, Saito H(2024) Deep reinforcement learning with hierarchical action exploration for dialogue generation. In: Nicoletta Calzolari, Min-Yen Kan, V\u00e9ronique Hoste, Alessandro Lenci, Sakriani Sakti, and Nianwen Xue, editors, Proceedings of the 2024 Joint International Conference on Computational Linguistics, Language Resources and Evaluation, LREC\/COLING 2024, 20-25 , Torino, Italy, pages 4566\u20134579. ELRA and ICCL, 2024. https:\/\/aclanthology.org\/2024.lrec-main.408","DOI":"10.63317\/3zoszh3k2xn8"},{"key":"408_CR11","doi-asserted-by":"publisher","unstructured":"Deng Z, Chen K, Meng G, Zhang X, Xu K, Cheng Y (2022) Understanding real-world threats to deep learning models in android apps. In: proceedings of the 2022 ACM SIGSAC conference on computer and communications security, CCS \u201922, pp 785\u2013799, New York, NY, USA, . Association for Computing Machinery. ISBN 9781450394505. https:\/\/doi.org\/10.1145\/3548606.3559388","DOI":"10.1145\/3548606.3559388"},{"key":"408_CR12","doi-asserted-by":"crossref","unstructured":"Dong Y, Liao F, Pang T, Su H, Zhu J, Hu X,Li J (2018) Boosting adversarial attacks with momentum. In: proceedings of the IEEE conference on computer vision and pattern recognition, pp 9185\u20139193","DOI":"10.1109\/CVPR.2018.00957"},{"key":"408_CR13","unstructured":"Dvijotham K, Gowal S, Stanforth R, Arandjelovic R, O\u2019Donoghue B, Uesato J, Kohli P (2018) Training verified learners with learned verifiers. CoRR, abs\/1805.10265"},{"key":"408_CR14","unstructured":"Fan L, Ng KW, Chan CS (2019) Rethinking deep neural network ownership verification: Embedding passports to defeat ambiguity attacks. In: Hanna\u00a0M. Wallach, Hugo Larochelle, Alina Beygelzimer, Florence d\u2019Alch\u00e9-Buc, Emily\u00a0B. Fox, and Roman Garnett, editors, Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pp 4716\u20134725, . https:\/\/proceedings.neurips.cc\/paper\/2019\/hash\/75455e062929d32a333868084286bb68-Abstract.html"},{"key":"408_CR15","doi-asserted-by":"crossref","unstructured":"Fredrikson M, Jha S, Ristenpart T (2015) Model inversion attacks that exploit confidence information and basic countermeasures. In: proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pp 1322\u20131333","DOI":"10.1145\/2810103.2813677"},{"key":"408_CR16","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2015) Explaining and harnessing adversarial examples. In: Yoshua Bengio and Yann LeCun, editors, 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, . http:\/\/arxiv.org\/abs\/1412.6572"},{"key":"408_CR17","doi-asserted-by":"publisher","unstructured":"Gowal S, Dvijotham K, Stanforth R, Bunel R, Qin C, Uesato J, Arandjelovic R, Mann TA, Kohli P (2019) Scalable verified training for provably robust image classification. In: 2019 IEEE\/CVF international conference on computer vision, ICCV 2019, Seoul, Korea (South), October 27 - November 2, 2019, pp 4841\u20134850. IEEE. https:\/\/doi.org\/10.1109\/ICCV.2019.00494","DOI":"10.1109\/ICCV.2019.00494"},{"key":"408_CR18","unstructured":"He Y,Meng G, Chen K, He J,Hu X(2021) DRMI: A Dataset Reduction Technology based on Mutual Information for Black-box Attacks. In: proceedings of the 30th USENIX security symposium (USENIX),"},{"issue":"5","key":"408_CR19","doi-asserted-by":"publisher","first-page":"1743","DOI":"10.1109\/TSE.2020.3034721","volume":"48","author":"Y He","year":"2022","unstructured":"He Y, Meng G, Chen K, Xingbo H, He J (2022) Towards security threats of deep learning systems: a survey. IEEE Trans Software Eng 48(5):1743\u20131770","journal-title":"IEEE Trans Software Eng"},{"key":"408_CR20","doi-asserted-by":"crossref","unstructured":"Hu Y, Yang J, Chen L, Li K, Sima C, Zhu X, Chai S, Du S, Lin T, Wang W, Lu L, Jia X, Liu Q, Dai J, Qiao Y, Li H (2023) Planning-oriented autonomous driving. In: proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR), pp 17853\u201317862","DOI":"10.1109\/CVPR52729.2023.01712"},{"key":"408_CR21","doi-asserted-by":"crossref","unstructured":"Juuti M, Szyller S, Marchal S, Asokan N (2019) PRADA: protecting against DNN model stealing attacks. In: IEEE European symposium on security and privacy, pp 512\u2013527. IEEE","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"408_CR22","unstructured":"Lin J, Chen WM, Lin Y, Cohn J, Gan C, Han S (2020) Mcunet: Tiny deep learning on iot devices. In: H.\u00a0Larochelle, M.\u00a0Ranzato, R.\u00a0Hadsell, M.F. Balcan, and H.\u00a0Lin, editors, Advances in Neural Information Processing Systems, volume\u00a033, pp 11711\u201311722. Curran Associates, Inc,. https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2020\/file\/86c51678350f656dcc7f490a43946ee5-Paper.pdf"},{"key":"408_CR23","unstructured":"Liu H, Weng Z, Zhu Y (2021) Watermarking deep neural networks with greedy residuals. In: Marina Meila and Tong Zhang, editors, Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event, volume 139 of Proceedings of Machine Learning Research, pp 6978\u20136988. PMLR, . http:\/\/proceedings.mlr.press\/v139\/liu21x.html"},{"key":"408_CR24","doi-asserted-by":"publisher","first-page":"215","DOI":"10.1016\/j.comcom.2020.01.050","volume":"152","author":"M Masud","year":"2020","unstructured":"Masud M, Muhammad G, Alhumyani H, Alshamrani XH, Cheikhrouhou O, Ibrahim S, Shamim Hossain M (2020) Deep learning-based intelligent face recognition in iot-cloud environment. Comput Commun 152:215\u2013222. https:\/\/doi.org\/10.1016\/j.comcom.2020.01.050. (ISSN 0140-3664)","journal-title":"Comput Commun"},{"key":"408_CR25","doi-asserted-by":"publisher","DOI":"10.1145\/3578938","author":"G Menghani","year":"2023","unstructured":"Menghani G (2023) Efficient deep learning: a survey on making deep learning models smaller, faster, and better. ACM Comput Surv. https:\/\/doi.org\/10.1145\/3578938","journal-title":"ACM Comput Surv"},{"issue":"7","key":"408_CR26","doi-asserted-by":"publisher","first-page":"4316","DOI":"10.1109\/TITS.2020.3032227","volume":"22","author":"K Muhammad","year":"2021","unstructured":"Muhammad K, Ullah A, Lloret J, Del Ser J, de Albuquerque VHC (2021) Deep learning for safe autonomous driving: current challenges and future directions. IEEE Trans Intell Transp Syst 22(7):4316\u20134336. https:\/\/doi.org\/10.1109\/TITS.2020.3032227","journal-title":"IEEE Trans Intell Transp Syst"},{"key":"408_CR27","doi-asserted-by":"crossref","unstructured":"Nguyen NB, Chandrasegaran K, Abdollahzadeh M, Cheung NM (2023) Re-thinking model inversion attacks against deep neural networks. In: proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 16384\u201316393","DOI":"10.1109\/CVPR52729.2023.01572"},{"key":"408_CR28","doi-asserted-by":"publisher","unstructured":"Orekondy T, Schiele B, Fritz M(2019) Knockoff nets: Stealing functionality of black-box models. In: 2019 IEEE\/CVF conference on computer vision and pattern recognition (CVPR), pp 4949\u20134958, https:\/\/doi.org\/10.1109\/CVPR.2019.00509","DOI":"10.1109\/CVPR.2019.00509"},{"key":"408_CR29","doi-asserted-by":"publisher","unstructured":"Pyone A, Maung M, Kiya H (2020) Training dnn model with secret key for model protection. In: 2020 IEEE 9th global conference on consumer electronics (GCCE), pp 818\u2013821. https:\/\/doi.org\/10.1109\/GCCE50665.2020.9291813","DOI":"10.1109\/GCCE50665.2020.9291813"},{"key":"408_CR30","doi-asserted-by":"publisher","unstructured":"Serengil SI,Ozpinar A (2020) Lightface: A hybrid deep face recognition framework. In: 2020 innovations in intelligent systems and applications conference (ASYU), pp 1\u20135. https:\/\/doi.org\/10.1109\/ASYU50717.2020.9259802","DOI":"10.1109\/ASYU50717.2020.9259802"},{"key":"408_CR31","doi-asserted-by":"publisher","unstructured":"Sirichotedumrong W, Maekawa T, Kinoshita Y, Kiya H (2019a) Privacy-preserving deep neural networks with pixel-based image encryption considering data augmentation in the encrypted domain. In: 2019 IEEE international conference on image processing (ICIP), pp 674\u2013678, https:\/\/doi.org\/10.1109\/ICIP.2019.8804201","DOI":"10.1109\/ICIP.2019.8804201"},{"key":"408_CR32","doi-asserted-by":"crossref","unstructured":"Sirichotedumrong W, Maekawa T, Kinoshita Y, Kiya H (2019b) Privacy-preserving deep neural networks with pixel-based image encryption considering data augmentation in the encrypted domain. In: 2019 IEEE international conference on image processing (ICIP), pp 674\u2013678. IEEE","DOI":"10.1109\/ICIP.2019.8804201"},{"key":"408_CR33","unstructured":"Sun Z, Sun R, Lu L, Mislove A(2021) Mind your weight(s): a large-scale study on insufficient machine learning model protection in mobile apps. In: 30th USENIX security symposium (USENIX Security 21), pp 1955\u20131972. USENIX Association, August . ISBN 978-1-939133-24-3. https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/sun-zhichuang"},{"key":"408_CR34","doi-asserted-by":"publisher","unstructured":"Sun Z, Sun R, Liu C, Chowdhury AR, Lu L, Jha S (2023a) Shadownet: a secure and efficient on-device model inference system for convolutional neural networks. In: 44th IEEE symposium on security and privacy, SP 2023, San Francisco, CA, USA, May 21-25, 2023, pp 1596\u20131612. IEEE,. https:\/\/doi.org\/10.1109\/SP46215.2023.10179382","DOI":"10.1109\/SP46215.2023.10179382"},{"key":"408_CR35","doi-asserted-by":"crossref","unstructured":"Sun Z, Sun R, Liu C, Chowdhury AR, Lu L, Jha S(2023b) ShadowNet: a secure and efficient on-device model inference system for convolutional neural networks. In: 2023 IEEE symposium on security and privacy (SP), pp 1596\u20131612. IEEE","DOI":"10.1109\/SP46215.2023.10179382"},{"key":"408_CR36","doi-asserted-by":"crossref","unstructured":"Suta P, Lan X, Wu B, Mongkolnam P, Chan JH (2020) An overview of machine learning in chatbots. https:\/\/api.semanticscholar.org\/CorpusID:236964183","DOI":"10.18178\/ijmerr.9.4.502-510"},{"key":"408_CR37","doi-asserted-by":"publisher","first-page":"167425","DOI":"10.1109\/ACCESS.2020.3023084","volume":"8","author":"HC Tanuwidjaja","year":"2020","unstructured":"Tanuwidjaja HC, Choi R, Baek S, Kim K (2020) Privacy-preserving deep learning on machine learning as a service\u2013a comprehensive survey. IEEE Access 8:167425\u2013167447. https:\/\/doi.org\/10.1109\/ACCESS.2020.3023084","journal-title":"IEEE Access"},{"key":"408_CR38","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107118","volume":"170","author":"C Wang","year":"2020","unstructured":"Wang C, Wang Y, Chen Y, Liu H, Liu J (2020) User authentication on mobile devices: approaches, threats and trends. Comput Netw 170:107118. https:\/\/doi.org\/10.1016\/j.comnet.2020.107118. (ISSN 1389-1286)","journal-title":"Comput Netw"},{"key":"408_CR39","doi-asserted-by":"publisher","unstructured":"Wang Z, Ma Z, Feng X, Sun R, Wang H, Xue M, Bai G (2024) Corelocker: Neuron-level usage control. In: 2024 IEEE symposium on security and privacy (SP), pp 222\u2013222, Los Alamitos, CA, USA, IEEE Computer Society. https:\/\/doi.org\/10.1109\/SP54263.2024.00233. https:\/\/doi.ieeecomputersociety.org\/10.1109\/SP54263.2024.00233","DOI":"10.1109\/SP54263.2024.00233"},{"key":"408_CR40","doi-asserted-by":"publisher","unstructured":"Xi WD, Huang L,Wang CD,Zheng YY, Lai J (2019) BPAM: recommendation based on BP neural network with attention mechanism. In: Sarit Kraus, editor, proceedings of the twenty-eighth international joint conference on artificial intelligence, IJCAI 2019, Macao, China, , pp 3905\u20133911. ijcai.org, 2019. https:\/\/doi.org\/10.24963\/IJCAI.2019\/542","DOI":"10.24963\/IJCAI.2019\/542"},{"key":"408_CR41","doi-asserted-by":"publisher","unstructured":"Yan R, Song Y, Wu H (2016) Learning to respond with deep neural networks for retrieval-based human-computer conversation system. In: Raffaele Perego, Fabrizio Sebastiani, Javed\u00a0A. Aslam, Ian Ruthven, and Justin Zobel, editors, Proceedings of the 39th International ACM SIGIR conference on research and development in information retrieval, SIGIR 2016, Pisa, Italy, July 17-21, 2016, pages 55\u201364. ACM, https:\/\/doi.org\/10.1145\/2911451.2911542","DOI":"10.1145\/2911451.2911542"},{"key":"408_CR42","doi-asserted-by":"publisher","unstructured":"Yang P, Lao Y, Li P (2021) Robust watermarking for deep neural networks via bi-level optimization. In: 2021 IEEE\/CVF international conference on computer vision, ICCV 2021, Montreal, QC, Canada, October 10-17, pp 14821\u201314830. IEEE, 2021. https:\/\/doi.org\/10.1109\/ICCV48922.2021.01457","DOI":"10.1109\/ICCV48922.2021.01457"},{"key":"408_CR43","doi-asserted-by":"crossref","unstructured":"Ye M, Luo J, Zheng G, Xiao C, Xiao H, Wang T, Ma F(2022) Medattacker: Exploring black-box adversarial attacks on risk prediction models in healthcare. In: 2022 IEEE international conference on bioinformatics and biomedicine (BIBM), pp 1777\u20131780. IEEE","DOI":"10.1109\/BIBM55620.2022.9994898"},{"key":"408_CR44","doi-asserted-by":"crossref","unstructured":"Zhang C, Benz P, Lin C, Karjauv A, Wu J, Kweon IS (2021) A survey on universal adversarial attack. arXiv preprint arXiv:2103.01498,","DOI":"10.24963\/ijcai.2021\/635"},{"key":"408_CR45","first-page":"4944","volume":"31","author":"H Zhang","year":"2018","unstructured":"Zhang H, Weng T-W, Chen P-Y, Hsieh C-J, Daniel L (2018) Efficient neural network robustness certification with general activation functions. Adv Neu Inf Process Syst 31:4944\u20134953","journal-title":"Adv Neu Inf Process Syst"},{"key":"408_CR46","doi-asserted-by":"publisher","unstructured":"Zhang J, Gu Z, Jang J, Wu H, Stoecklin MPh, Huang H, Molloy I (2018b) Protecting intellectual property of deep neural networks with watermarking. In: proceedings of the 2018 on Asia conference on computer and communications security, ASIACCS \u201918, pp 159\u2013172, New York, NY, USA, . Association for Computing machinery. ISBN 9781450355766. https:\/\/doi.org\/10.1145\/3196494.3196550","DOI":"10.1145\/3196494.3196550"},{"key":"408_CR47","unstructured":"Zhang J, Chen D, Liao J, Zhang W, Hua G, Yu N (2020) Passport-aware normalization for deep model protection. In: Hugo Larochelle, Marc\u2019Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan-Tien Lin, editors, Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, . https:\/\/proceedings.neurips.cc\/paper\/2020\/hash\/ff1418e8cc993fe8abcfe3ce2003e5c5-Abstract.html"},{"key":"408_CR48","doi-asserted-by":"publisher","unstructured":"Zhao X, Gu C, Zhang H, Yang X, Liu X, Tang J, Liu H (2021) DEAR: deep reinforcement learning for online advertising impression in recommender systems. In Thirty-Fifth AAAI Conference on Artificial Intelligence, AAAI 2021, Thirty-Third Conference on Innovative Applications of Artificial Intelligence, IAAI 2021, The Eleventh Symposium on Educational Advances in Artificial Intelligence, EAAI 2021, Virtual Event, February 2-9, 2021, pp 750\u2013758. AAAI Press, https:\/\/doi.org\/10.1609\/AAAI.V35I1.16156","DOI":"10.1609\/AAAI.V35I1.16156"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00408-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-025-00408-y","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00408-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,27]],"date-time":"2026-04-27T01:03:21Z","timestamp":1777251801000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1186\/s42400-025-00408-y"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,27]]},"references-count":48,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,12]]}},"alternative-id":["408"],"URL":"https:\/\/doi.org\/10.1186\/s42400-025-00408-y","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4,27]]},"assertion":[{"value":"19 December 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"13 April 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"27 April 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no Conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"61"}}