Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: This paper studies fingerprinting a neural network model by using adversarial example techniques. The idea itself is interesting enough, the this work presents a neat development toward solving this problem. An important issue with this problem is to distinguish a reference model from a stolen model. Thus a desire property of the fingerprint adversarial example is to mislead all surrogate models but non reference models. Since adversarial examples are typically transferable to reference models, thus it is important to distinguish a fingerprint from a transferable adversarial example. For a long time, researchers do not have an answer to whether this is possible, and this work provides an evidence that it may generate a conferrable but not transferable adversarial example to achieve the goal. 

The idea is pretty simple: we construct a conferrable score function to induce all surrogate models to produce a target label; while all reference models to produce different labels. The experiments show that such an approach can indeed produce some fingerprint adversarial examples to distinguish between reference models and surrogate models to a certain degree. 

Having said this, the results are not perfect. For example, Fig 3(b) shows that FGM and PGD have better detectability AUC when epsilon is larger. Although the results are not perfect, this shows promising initial results toward an interesting research domain.

The presentation has some issues that can be fixed by revision. The figures are generally too small to read. Authors can increase them by leveraging one more page. Also, it's necessary to include the definition of FTLL, FTAL, RTLL, RTAL in the main text. Again, one more page should be able to fix the issue.
review_title: important problem and nice initial results

final_score: rating: 7: Good paper, accept
review_content: ########################################################################## 
Summary:

The paper considers the fingerprinting of a DNN model via usage of specifically designed adversarial examples.
The authors describe a proposed loss function and results of their experiments 

########################################################################## 
Reasons for score: I vote for weak accept, because the model fingerprinting is an important topic in the modern DL, and authors propose an interesting idea on how one can generate such fingerprints via adversarial attacks

The authors propose new fingerprinting strategy for an already constructed DL model. They demonstrate, that their method can generate conferrable examples and has a solid performance 

######################################################################### 
Proposed minor improvements:

Abstract: provider trains a deep neural network and
provides many users access -> remove one word "provide"
everywhere: AUC -> ROC AUC, as there can be other curves with areas under them
 training a DNN is costly because of data preparation (collection, organization, and cleaning) and computational
resources required for training and validating the model -> remove one training; better say "validation of a model"
Formulas 2, 3: not clear what does Classify(S, x) mean
Formula 4: is $\sigma$ a sigmoid function? please, specify
Formula 5: is H a categorical cross entropy? please, specify
Figure 3: what is BIM?
review_title: Novel idea in NLP word with interesting loss

final_score: rating: 6: Marginally above acceptance threshold
review_content: This paper proposed a fingerprinting approach for identifying stolen models. To distinguish stolen models from reference models, the proposed approach generated conferrable adversarial examples, which can only be transferred to the stolen models, but not to the reference models. 

Pros:
1. The idea of using adversarial examples to identify stolen models is interesting.
2. The paper provides comprehensive experiments, including model extraction attacks, adaptive model extraction attacks, etc.  The results outperform popular adversarial attacks, FGM, PGD, and CW attacks. 

Cons:
1. The key concern about the paper is the unclear threat model. Why does the model stealing attacker have white-box access to the source model? In general, the white-box access means the attacker has all the information about the source model. The definition of “strong attacker” is confusing: If the attacker requires access to domain data, then why the attacker is strong? Do attackers have access to the data? It seems the attackers have only the input data but partial label data, which is a strong assumption. Many recent works show that model stealing attacks can surrogate datasets to extract the victim models. Can these attacks be detected by the proposed approach?
2. The paper is very hard to follow. Many definitions are missing in the paper. 
3. What is Transfer(S, x; t) in Eq (1)? What is Classify(S, x) in Eq (2) and (3)? What is H in Eq (5)?
4. In the conclusion section, CW-L2 should be L-infinity?
review_title: the threat model is unclear

final_score: rating: 6: Marginally above acceptance threshold
review_content: Summary:
This paper introduces an interesting property of adversarial examples, which is called conferrability and can reflect the abilities whether an instance can exclusively transfer with a target label from a source model to its surrogates. A new method is proposed to generate conferrable adversarial examples. Experimental results show the effectiveness of the proposed method. The most impressive thing is the AUC of this method in verifying surrogates.

Comments:

I'm not familiar enough with the field to judge the novelty and soundness of the proposed method. But I'm willing to roll with the main idea of the paper. Conferrability is the core contribution of the paper. The existence of the conferrable adversarial examples is shown empirically in the paper. Ensemble adversarial attack CEM is shown effective in the same time.

Strengths:

1.The research on this issue has extremely high application value and practical significance. The problem is very important for providers, especially when they want to protect their intellectual property. 

2.This paper is well motivated, and thus it is enjoyable to read.

3.The idea of conferrability is very interesting. The existence of the conferrable adversarial examples is shown empirically to prove the value of this definition.

4.Impressive empirical results. Fingerprint in this paper is the first method that reaches an AUC of 1.0 in verifying surrogates, which is impressive for me. Because I'm not familiar enough with the field, I'm not sure whether the method is SOTA in more benchmarks.

5.Interesting figures make the paper easy to follow. I suggest the authors replace Figure 2(b) with a vetorgram to improve the quality.

Weaknesses:

1.There are 3 hyperparameters in equation 5, sensitivity analysis may be needed.

2.Is decision threshold sensitive in different datasets? It may affect the practicality of the method.

3.Clarity: What is the meaning of $\sigma$ in equation (4)? Is it an activation function? More clarification may be needed to make the paper easier to read.

4.What is the meaning of 'unremovable'? Is this a formal term in English (irremovable)?
review_title: An interesting paper.

Meta-review: The paper presents a new idea for detection of model stealing attacks. The new method generates "fingerprint", i.e., adversarial examples that transfer to surrogate models (extracted in model stealing attacks) but not to reference models (i.e., models obtained independently from the same data). If a model owner suspects that some model is stolen, fingerprints can be used for verifications of such claims. 

The paper's contribution is novel and significant. It is the first practical tool, to my knowledge, suitable for a reliable characterization of stolen models. The empirical results are quite impressive demonstrating the detection of stolen models with an AUC = 1.0. Some presentations issues have been addressed by the authors during the revision.  
Decision: Accept (Spotlight)