Fingerprinting Deep Neural Networks for Ownership Protection: An Analytical Approach
Authors: Guang Yang
Ziye Geng
Yihang Chen
Changqing Luo
Venue: ICLR 2026 Poster (2026)
Keywords: neural network fingerprinting
ownership verification
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Adversarial-example-based fingerprinting approaches, which leverage the decision boundary characteristics of deep neural networks (DNNs) to craft fingerprints, has proven effective for protecting model ownership. However, a fundamental challenge remains unresolved: how far a fingerprint should be placed from the decision boundary to simultaneously satisfy two essential properties—robustness and uniqueness—required for effective and reliable ownership protection. Despite the importance of the fingerprint-to-boundary distance, existing works offer no theoretical solution and instead rely on empirical heuristics to determine it, which may lead to violations of either robustness or uniqueness properties.

We propose AnaFP, an analytical fingerprinting scheme that constructs fingerprints under theoretical guidance. Specifically, we formulate the fingerprint generation task as the problem of controlling the fingerprint-to-boundary distance through a tunable stretch factor. To ensure both robustness and uniqueness, we mathematically formalize these properties that determine the lower and upper bounds of the stretch factor. These bounds jointly define an admissible interval within which the stretch factor must lie, thereby establishing a theoretical connection between the two constraints and the fingerprint-to-boundary distance. To enable practical fingerprint generation, we approximate the original (infinite) sets of pirated and independently trained models using two finite surrogate model pools and employ a quantile-based relaxation strategy to relax the derived bounds. Particularly, due to the circular dependency between the lower bound and the stretch factor, we apply a grid search strategy over the admissible interval to determine the most feasible stretch factor. Extensive experimental results demonstrate that AnaFP consistently outperforms prior methods, achieving effective and reliable ownership verification across diverse model architectures and model modification attacks.

Published as a conference paper at ICLR 2026
FINGERPRINTING DEEP NEURAL NETWORKS FOR OWN- ERSHIP PROTECTION: AN ANALYTICAL APPROACH
Guang Yang', Ziye Geng", Yihang Chen', and Changying Luo? Virginia Commonwealth University, University of Houston yangg2@veu. edu, (zgeng2, ychen165, cluo3) (uhh edu
ABSTRACT
adversarial-exampll--aase baasdd fingerprinting approaches, which leverage the decision boundary characteristics of deep neural networks (DNNs) craft fingerprints, has proven effective for protecting model ownership. However, fundamental challenge remains unresolved: how far fingerprint should be placed from the decision boundary to simultaneously satisfy two essential properties coopertie--robusmeess robustmess and
for effective and reliable ownership protection. Despite distance, existing works offer no
the importance of the gngerpprit-to-boundee theoretical solution and instead rely on empirical heuristics to determine it, which may lead to violations of either robustness uniqueness properties.
We propose AnaFP, an analytical fingerprinting scheme that constructs fingerprints under theoretical guidance. Specifically, we formulate the fingerprint generation task as the problem controlling the iingrprint-to-boundee
distance through a tunable stretch factor. To ensure both robustness and uniqueness, mathemati- cally formalize these propertics that determine the lower and upper bounds of the stretch factor. These bounds jointly define admissible interval within which the stretch factor must lie, thereby establishing a theoretical connection between the two constraints and the gegerprint-to-buundae distance. To enable practical fingerprint generation, we approximate the original (infinite) sets of pirated and independently trained models using two finite surrogate model pools and employ a quantile- quastile-based relaxation strategy to relax the derived bounds. Particularly, due to the circular dependency between the lower bound and the stretch factor, we apply a grid search strategy over the admissible interval to determine the most feasible stretch factor. Extensive experimental results demonstrate that AnaFP consistently outperforms prior methods, achieving effective and reliable ownership verification across diverse model architectures and model modification attacks.
INTRODUCTION
Deep neural networks (DNNs) are increasingly vulnerable model piracy in real-world deploy- ments (Ren et al. 2023 Choi et al. 2025) Yao et al. 20255). Adversaries may steal a model, apply model modification attacks evade detection, and distribute these pirated ones as black-box services, thereby profiting from public usage while concealing the models' internal details. This emerging threat raises serious concerns about the intellectual property (IP) protection of DNN models. So far, extensive research has explored ownership protection techniques, such as
performance-preserne
watermarking (Fan al., 2019 Shaheinejaa et al.) 2021
Li al.) 2024 Choi al. 2025 Yao et
Choi
2025a) and fingerprinting (Chen et al.) 2022 Pan et al. 2022 I Liu & Zhong 2024 Godinot et al.
2025). While watermarking involves embedding identifiable patterns into DNN mondels-potentian
introducing new security vulnerabilities (Wang et al. 2021a Xu et al.) 2024). fingerprinting offers a non-intrusive alternative by leveraging the model's s intrinsic characteristics to generate unique, verifiable fingerprints. This non-intrusive nature has made fingerprinting increasingly appealing ownership protection approach.
To date, broad spectrum of model fingerprinting schemes has been proposed
(Cao et al. 2021 Guan
et al. 2022. Wang et al. [221a]] Xu et al. 2024; Zhao et al. 2024a You et al.
2024 Ren et al.
2023
Yin et al. 2022 Yang & Lai 2023 Peng al. 2022 Liu Zhong 2024
Godinot al.
2025

---

Published as a conference paper at ICLR 2026
These schemes involve two phases: fingerprint generation and ownership verification (Lukas et al. 2021; Yang et al. 2022). During the fingerprint generation phase, the inherent characteristics of a protected DNN model are leveraged to carefully craft fingerprints that elicit model-specific responses. In the subsequent ownership verification phase, these fingerprints are used to assess whether a suspect model is pirated version of the protected model. The goal is to reliably identify pirated models derived from the protected one, while avoiding false attribution of independently trained models. To ensure this, effective fingerprints must exhibit two essential properties: 1) robustness the ability to withstand performance performance-preserving model modifications, and 2) uniqueness the capability to distinguish the protected model from other independently trained models (Pan et al. 2022).
A prominent line of work among existing model fingerprinting schemes builds on the key observation that decision boundaries are highly model-specific, even across models trained on the same dataset (Somepalli et al. 2022). This motivates eeteesariil-exmmllee-ee
fingerprinting approaches that leverage the unique decision boundary characteristics of model to craft fingerprints (Cao et al. 2021
Wang al. 2021a Lukas et al., 2021 Yang & Lai 2023 Peng et al. 2022 Zhao et al. 2020). More
specifically, fingerprints are craited by applying minimal perturbations to input samples, pushing them across the decision boundary of the protected model, akin to adversarial example generation. Due to the inherent differences in decision boundaries, such perturbations typically induce prediction changes in the protected model but leave independently trained models largely unaffected (Szegedy eet al. 2014; Zhao et al., 2020). This resulting prediction asymmetry enables the construction of distinctive and reliable fingerprints for ownership verification (Zhao et al. 2020).
However, fundamental challenge in -weessarillexampll--aaaee fingerprinting is: how far should fingerprint be placed from the decision boundary to simultaneously satisfy the requirements of robustness and uniqueness? Ensuring uniqueness requires placing fingerprints close to decision boundaries, while enhancing robustness requires positioning fingerprints far from the boundaries. Recent works (Cao et al.) |021 & Zhong, 2024) have employed heuristic strategies to empirically select the fingerprint-tor boundayy distance. However, such approaches lack theoretical guidance, potentially resulting in fingerprints that violate the two desired properties. Consequently, how to theoretically determine the fingerprint- sopprrintttt-buuudrry distance that simultaneously satisfies both uniqueness and robustness properties remains open issue.
In this paper, we propose AnaFP, an Analytical adversarial-example that crafts fingerprints under theoretical guidance. Specifically, we first identify cogecconfee samples from the dataset used to train the protected model as anchors for fingerprint generation. For each anchor, we compute minimal perturbation that induces prediction change in the protected model, thereby ensuring strong uniqueness. To further improve robustness, we introduce a stretch factor that scales the perturbation, controlling the fingerprint's distance from the decision boundary. To ensure both robustness and uniqueness, we mathematically formalize the robustness and uniqueness constraints and theoretically derive the lower and upper bounds of the stretch factor accordingly. These bounds define an admissible interval within which the stretch factor must lie, thus establishing a theoretical relationship between the two constraints and the segerpprnttto-boundaa distance.
FingerPrintingg scheme
Although this theoretical relationship offers strong theoretical guarantees, its practical implementation poses several challenges. First, computing the bounds requires worst-case parameter estimation over all possible pirated and independently trained models-two theoretically infinite sets. Thus, we ap- proximate the two sets using two surrogate model pools. Second, using the worst-case estimates often leads to overly conservative bounds, reducing the feasibility of fingerprint construction. To mitigate this, we employ a quantile-based relaxation mechanism to relax the two bounds through quantile- based parameter estimation. Third, there exists circular dependency between the lower bound and the stretch factor. We address this by applying a grid search strategy over the admissible interval to determine the most feasible value for the stretch factor. We conduct extensive experiments across di- verse model architectures and datasets, and experimental results demonstrate that AnaFP consistently achieves superior ownership verification performance, even under performance- preserrviii model modification attacks, outperforming existing eexeesariallexampll-- based fingerprinting approaches.
2

---

Published as a conference paper at ICLR 2026
2 BACKGROUND
2.1 ADVERSARIAL EXAMPLES
Adversarial examples are carefully crafted from samples in a clean dataset to induce a target model to make incorrect predictions (Szegedy al. 2014; Goodfellow al. 2013). Given model f and an input-label pair (x, y) in a clean dataset D, an adversarial example I z + 8 can be obtained by solving:
min || - #11. s.t. f(B)
where || denotes distance metric (e.g., f2 or to norm), and the perturbation is constrained to ensure imperceptibility. By inducing misclassifications with minimal perturbations, adversarial examples reveal the unique characteristics of model's decision boundary. This property makes them particularly effective for constructing fingerprints that capture model-specific behaviors used for ownership verification.
2.2 MODEL MODIFICATION ATTACKS
To circumvent ownership verification, adversaries usually launch performance-preservvee model modification attacks that alter a pirated model's decision boundary while maintaining predictive accuracy. Common techniques include tine-tuning (Zhuang al., 2020), pruning (Li al. (017).
knowledge distillation (KD) (Hinton et al., (015), and adversarial training (Zhao et al., 2024b).
Specifically, fine-tuning adjusts the weights of a pirated model through additional model training: pruning eliminates less significant weights neurons of pirated model to reshape its structure; KD trains a new model with a different structure and parameters to replicate the behavior of pirated model; and adversarial training updates model weights using mixture of clean data and adversarial examples, thereby posing a unique threat to exxesaarll-xampl---baaa basee fingerprinting methods. Even worse, adversaries may combine multiple techniques, such as pruning followed by fine-tuning, to induce substantial shifts in the decision boundary, thereby increasing the likelihood of invalidating fingerprints.
PROBLEM FORMULATION
We consider a typical simplified model finger- printing scenario with two parties: a model owner and an attacker, as shown in Figure [ Specifi- cally, the model owner trains a DNN model and deploys it service. The attacker acquires an unauthorized copy of P, applies performance- preserving model modifications to it, and subse- quently redistributes the pirated model in a black- box manner (e.g., via API access). Let Vp denote the set of pirated models derived from P. To safe- guard the intellectual property of P. the model owner leverages the adversarial example technique to produce set of fingerprints F for P. Once identifying suspect model S, the owner initiates ownership verification by querying using fin- gerprints in F. The goal is to determine whether S belongs to the pirated model set Vp or the independent model set Ip that includes models independently trained from scratch without any access to P.
Process
Pruning Fine-tuning
Deploy
Attacker
Modification Allacks
Pirated Model
Extract
Verify
Fingerprints
Ownership
Protected Model
Model Owner
Figure 1: A typical model fingerprinting scenario.
To enable reliable verification, the fingerprint set F = ((xt, sis Ny), where Ny is the number of fingerprints, x E X T&d x.., the input fingerprint and y E E (1...., K} is the corresponding target label, is constructed with the goal of satisfying the following properties:
Robustness: Any fingerprint (zt, v() F remains effective against cefformance-preseevvve modification attacks, i.e., P'(xt) = v for VP' Vp.
Uniqueness: Any fingerprint (x), y/) E F is unlikely to be correctly predicted by any indepen- dently trained models, i.e., [(x;]) # v/, for VT E Ip.
3

---

Published as a conference paper at ICLR 2026
Fingerprint Generation
Ownership Verification
Sep3
Seaching stretch faciors under theoretcal condiaaints
Fingerpiic i
xfo x
X2
B1
enderyy
Plocer
Tupper
di
2
84
f3
Anchor
74
Independont
Figure 2: The pipeline of fingerprint generation and ownership verification.
THE DESIGN OF ANAFP
We present AnaFP, an analytical fingerprinting scheme that mathematically formalizes the robustness and uniqueness properties, constructs practical fingerprints satisfying relaxed versions of these constraints, and enables ownership verification using these fingerprints. As illustrated in Figure 2 AnaFP comprises two phases: fingerprint generation and ownership verification. Partieularly, the fingerprint generation phase is composed of four main steps. The first step selects high-confidence samples from a clean dataset anchors, ensuring that independently trained models predict their original labels with high probability. The second step computes a minimal perturbation for each anchor such that the protected model, when evaluated on the perturbed anchor, outputs different label from that of the original anchor. The third step calculates stretch factor for each anchor. To this end, an admissible interval for a stretch factor is derived by first mathematically formulating robustness and uniqueness constraints and then relaxing the formulated ones based on surrogate-based parameter estimation and quantile-based relaxation. With this interval, a feasible stretch factor is determined by exploiting grid search strategy. The fourth step generates fingerprints by first scaling the perturbation with the obtained stretch factor and then applying it to its corresponding anchor. All resulting fingerprints form the final fingerprint set that will be used for ownership verification. In the following, we detail the four steps of fingerprint generation and the ownership verification protocol.
4.1 STEP 1: SELECTING HIGH--CONFIDENG ANCHORS
In the first step, we identify high-confidence samples from the training dataset used to train the protected model. These input-label pairs, referred to as anchors, are selected based on the model's confidence in correctly predicting their labels. To quantify the confidence, we define the logit margin of sample (Ir, y) E D with respect to the protected model P gp(x) sy, (ar) m8XK (p,) where & (x) is the logit (i.e., the pre-softmax outputs) of class outputted by P for input x.
We construct the anchor set A by selecting samples whose logit margins exceed predefined threshold Manchors i.c., AA = {(2", 8) E D (x(x))) 2 ) Intuitively, high-margin samples exhibit class- distinctive features that reliably captured across independently trained models. As such, using these samples as anchors helps enhance the uniqueness the resulting fingerprints.
4.2 STEP 2: COMPUTING MINIMAL DECISION-ALTERIEE PERTURBATIONS
In the second step, we compute a minimal perturbation for each anchor and apply it to produce a perturbed anchor that causes the protected model to change its prediction. Given an anchor (a v), we formulate a secision-altering perturbation minimization problem as
arg min |01|,, s.t. P(x" + 8) + y,
where 8 is the minimal perturbation for an anchor (x" .)) E A, and || 2l the lg norm.
To solve the formulated problem, employ the Carlini & Wagner &a attack (C&W-(2) (Carlini & Wagner 2017) to efficiently compute 8. The resulting perturbed input is xa + 8", which we refer to the boundary point, it resides decision boundary of the protected model. This is the closest point to the anchor (a", y) at which the protected model alters its prediction to a different label.
4

---

Published as a conference paper at ICLR 2026
4.3 STEP 3: SEARCHING STRETCH FACTORS UNDER THEORETICAL CONSTRAINTS
Since boundary points located directly on the decision boundary, they are highly vulnerable to boundary shifts caused by model modifications, often resulting in changes in model predictions. To improve robustness, stretch the perturbation 8' along its direction and apply it to the anchor to generate a fingerprint positioned farther from the boundary. Specifically, given an anchor (a", y), the corresponding fingerprint is defined as (x* x.h T y P(x*)), where 1 is stretch factor that controls the distance of the fingerprint from the decision boundary.
central challenge lies in selecting an appropriate stretch factor т, as the resulting fingerprint needs to satisfy both robustness and uniqueness properties. To mathematically formalize these requirements, we first define a lower bound Tlower and an upper bound Tupper with respect to т, corresponding the robustness and uniqueness constraints, respectively: the robustness constraint requires T > Tlower while the uniqueness constraint requires < Tupper- Then, we derive a theoretical constraint that defines the admissible interval of the stretch factor T:
2 Clogit
Mini
+
Cg |1011
Tlwwrr
< T < Tupper
2 Laniq
||0*
where o = [V 12 is the norm of the gradient of the logit margin function gp at the boundary point 9 x + 8", well mmin Lunig. and élogit are defined as follows:
mmin: a lower bound the logit margin of independently trained models the anchor y): (1,) maXXyy $1,x(x') 2 mmii, for Vk E V, VI E Ip.
Luigq an upper bound on the local Lipschitz constant of independently trained models in the region between x and xt, such that [1²r""))s><=" of an independently trained model I.
Tunig. for VT E Ip, and 87 s-(-) is the logit vector
élogic an upper bound on the logit shift at xx due to the performance- model modification attack protected model P: (sp)a(w*) 8p, (x*)] S élogit, Vk 27, VP' Vp.
The detailed derivation of Equation provided in Appendix A
4.3.1 PARAMETER ESTIMATION AND RELAXATION
Surrogate- based estimation. Mmin= Tuuigg and flogit are defined over Vp and Iy, which, however, contain an infinite number of models respectively. Consequently, it is impossible to compute them directly. To address this issue, a common approach to introduce two finite surrogate model pools to approximate the original sets (Li et al. 2021; Pan et al. 2022); a surrogate pirated pool Vi, and surrogate independent pool Zp. Di contains the protected model P and its pirated variants, while Zp,
is composed of independently trained models.
Then, each parameter is estimated over the corresponding surrogate pool: Mmin is estimated as the minimum margin over Ip, Tunig is estimated as the maximum local Lipschitz constant Ti., and Cogin is estimated as the maximum logit shift over Vj.- While these finite surrogate pools serve as practical approximations of the infinite sets Zp and Vp. this substitution inevitably relaxes the original theoretical constraints and introduces approximation error. Although such error is theoretically intractable and dependent on the choice of surrogate models, experimental results in Section 5.2.1 demonstrate that AnaFP remains robust to variations in pool size and diversity, consistently yielding stable verification performance.
Quantile-based relaxation. Directly adopting the most conservative estimates, i.c., the minimum value of Mynin and the maximum values of T.uii and Gogits may lead overly strict lower and upper bounds on т, potentially resulting in situation where no fingerprints simultaneously satisfy the constraints for robustness and uniqueness. To address this issue, we employ a quantile-based relaxation strategy. Instead of using extreme values, we estimate each parameter based on its empirical quantile distribution over the surrogate pools: Mymin is set to the qmargin quantile of the logit margins computed over Ip, Lunig is set to the [ip -quantile of local Lipschitz constants over Ip. and Goog is set to the qeps quantiie of logit shifts measured over Vp. In this way, we relax the lower and upper bounds on t, balancing theoretic rigor with practical feasibility.
5

---

Published as a conference paper at ICLR 2026
4.3.2 THE GRID SEARCH STRATEGY FOR FINDING A FEASIBLE
Based on Equation 3 the stretch factor r is constrained by lower bound Tower and an upper bound Tupper- While Tupper can be explicitly computed using the estimated parameters, Tlower is defined implicitly as function of r-since it depends on the logit shift at the point x = To + T8" This circular dependency introduces a non-trivial challenge in directly solving for Jower- As a result, it becomes necessary to search for a feasible value of that satisfies the constraint Tower(T) S S Tupper and simultancously achieves a balance between uniqueness and robustness in the resulting fingerprint.
To address this, we exploit a grid search strategy to determine the feasible т. Specifically, given 2 Elail
that Flower = +
1 2 1, we define the search interval as (1, Tupper]. We first construct a candidate set T by uniformly sampling stretch factors within this interval. For each E T, we compute Nower (T) and retain those satisfying 7 2 Tower to form the feasible set Treas If no valid exists within the search interval (i.e., Theas 0), the corresponding anchor is discarded, as it cannot yield valid fingerprint under the relaxed constraints. This infeasibility may arise in two cases: (i) Tupper L, rendering the interval void, (ii) Tupper
but candidate t satisfies T (TowerT): Finally, from the feasible set Treas we select the most feasible stretch factor r by T* = arg max, ETious min { - Tower(T), Tupper - -T }. This selection maximizes the minimum slack to both bounds, offering the greatest possible tolerance to parameter-estimation errors.
4.4 STEP 4: CONSTRUCTING THE FINGERPRINT SET
After determining the most feasible stretch factor TỤ for each retained anchor x; we proceed to generate the corresponding fingerprints. Specifically, we scale the minimal decision-altering perturbation 57 by T applying it to the anchor 2.. and then record the resulting label assigned by the protected model P. The final fingerprint set F is constructed F (a vt) (x7,
(a7 rf 8, P(a + T 8,)),, Ny ر By utilizing multiple fingerprints, our proposed scheme mitigates the potential impact of approximation ehrors-those introduced during the parameter estimation and relaxation in Step 3-that may affect the verification performance of individual fingerprint, thereby enhancing the overall reliability the ownership verification.
4.5 VERIFICATION PROTOCOL.
Given a suspect model S, the model owner verifies ownership by querying it with fingerprints in F = {(x) vt) ) Specifically, for a fingerprint (xt,vt) F, the model owner queries using xt and compares the returned label S(x;)) with y/ If S(x;) = yf the model owner counts it as match. After querying all fingerprints, the model owner computes the matching rate as N M 1 [xx) = 3/ where [[:] the indicator function. as 2 0, where 0 E [0. 1] is a decision threshold, the suspect model S is classified as pirated; otherwise, is deemed independent.
5 EXPERIMENTS
We conduct extensive experiments to evaluate the effectiveness of AnaFP across three representative types of deep neural networks: convolutional neural network (CNN) models trained on the CIFAR-10 dataset (Krizhevsky 2209) and the CIFAR- -000 dataset (Krizhevsky 2009), multilayer perceptron (MLP) models trained on the MNIST dataset (LeCun et al. 2010). and graph neural network (GNN) models trained on the PROTEINS dataset (Borgwardt al. (005).
Model construction. For each task, we designate a protected model and construct two surrogate model sets well as two testing model sets:
Protected model: The protected model architectures for CNN, MLP, and GNN are ResNet-18, ResMLP, and GAT.
Surrogate model sets: For each task, we construct a pirated model pool consisting of six models ob- tained via two simulated and knowledge distillation), and an independent model pool including six models independently trained from scratch with two different architectures and random seeds.
prreservii modifications of the protected model (fine-tuning

---

Published as a conference paper at ICLR 2026
Testing model sets: For each task, construct pirated model set via modification attacks, including pruning, fine-tuning, knowledge distillation (KD), adversarial training (AT), N-finetune (injecting noise into weights followed by fine-tuninge and P- P-finetune (pruning followed by fine- tuning). Each type of model modification produces 20 variants using different random seeds, resulting in 120 pirated models in this set. Besides, construct independent model set, and the independently trained models are trained from scratch with varying architectures and seeds, without any access to the protected model and its variants. This set includes 120 independently trained models.
The two testing sets constitute the evaluation benchmark used to test whether AnaFP can effectively discriminate pirated models from independently trained ones. The models in the testing sets used for performance testing are all unseen/unknown during the fingerprint generation process and have no overlap with the models the surrogate pools.
Baselines. We compare AnaFP with six representative model fingerprinting approaches: UAP P Peng
al. 2022). which generates universal adversarial perturbations as fingerprints: IPGuard (Cao et 2021) which probes bear-boundary samples to capture model-specific behavior; Margink inger (Liu & Zhong, 2024). which controls the distance between a fingerprint and the decision boundary to gain robustness; AKH (Godinot et al. 2025), a recently proposed fingerprinting method that uses the protected model's misclassified samples as fingerprints; GMFIP (Yan al., 2025).
fingerprinting method that trains a generator to synthesize fingerprint samples; and ADV-TRA (Xu et al., 2024), a fingerprinting method that constructs adversarial trajectories traversing across multiple boundaries.
recently-proposee non-ad watevvesariallxxappl...
Table 1: AUCs achieved by different approaches across DNN models and datasets.
Method
CNN (CIFAR-10)
CNN (CIFAR-100)
MLP (MNIST)
GNN (PROTEINS)
AnaFP (ours)
0,957 + 0.002
0.893 0.005
0.963 + 0.002
0.926 + 0.005
UAP
0.850 + 0.010
0,806 + 0.021
0.906 + 0.004
IPGuard
0.715 + 0.075
0.725 + 0.090
0.873 + 0.018
0.636 + 0.067
MarginFinger
0.671 = 0.064
0.630 0.072
0.653 + 0.051
AKH
0.723 + 0.016
0.802 + 0.019
0.851 + 0.013
0.854 + 0.021
ADV-TRA
0.878 = 0.012
0.850 0.024
0.887 : 0.005
GMFIP
0.814 + 0.047
0.781 + 0.075
0.892 + 0.023
Evaluation metric. We adopt the Area Under the Receiver Operating Characteristic (ROC) Curve (AUC) as the primary metric. AUC measures the probability that a randomly selected pirated model exhibits higher fingerprint matching rate than an independently trained model that is randomly selected, thereby quantifying the discriminative capability of the fingerprints across all possible decision thresholds. A higher AUC value indicates stronger discriminative capability, with an AUC of 1.0 representing perfect discrimination between pirated and independently trained models.
5.1 EFFECTIVENESS OF OUR DESIGN
The discriminative capability of AnaFP. To evaluate the discriminative capability of AnaFP, we conduct experiments across multiple types of DNN models (CNN, MLP, and GNN) trained on different datasets (CIFAR-10, CIFAR-100, MNIST, and PROTEINS). Note that UAP and MarginFinger are not evaluated on GNNs as they are designed for data with Euclidean structures, such as images vectors, and cannot generalize to graph-structured (i.e., non-Euclidean) data. All experiments were independently run five
1.0
Independent
times to find the mean and standard deviation across the runs.
True Postive Dobe
0.0
Matching Date
AnaFF
0.6
0.4
uPp
IRGuadd
The experimental re- sults are summarized in Table I Specifi- cally, observe that AnaFP consistently achieves the highest
Marginil mgar
AXH
ADVITIA GVPIP
0.0
0.2
0.4
0.5
0.0
1.0
False Pocitiva Rato
ArdFP
iNasend
LAP
Manginhinge
AKH
ADV-TRA
Eatri
(a)
(b)
Figure 3: (a) The ROC curve and (b) the matching rate distribution.
7

---

Published as a conference paper at ICLR 2026
Table 2: AUCs under various performaance-rreserving model modifications.
Method
Pruning
Fine-tuning
KDD
AT'
N-finetune
P-finetune
Prune-KD
AnaFP (ours)
1.000 0.000 0.979 0.008
0.023 0.983 0.015 0.010 0.989 0.007 0.689 0.031
UAP
1.000 0.000 0.868 0.023 0.023 0.013 0.783 0.07 0.021 0.876 060661000220006
0.625 + 0.02
0.026
IPGuard
0.999 0.002 0.741
0..13
1.10 0.079
Mingin
1,000 0.000 0.658 +: 0.119 0.083
1.11
0.088
AKH
0.999 0.001 0.848 + 0.016 0.624
00112 0.79
0.052 0.047
ADV-TRA
0.01 0.035 1.000 + 0.000 0.923 1: 0.010 0.025 0.742 0.896 0.032
GMFIP
0.999 + 0.001 0.779 + 0.054 0.035
0.035 0.711
0.084 0.031 0.819 0.061 0.6001 0.068
AUCs across all evaluation settings, whereas the baselines exhibit substantial variability across different models and datasets. This observation underscores AnaFP's superiority in distinguishing pirated models from independently trained ones across diverse DNN model types and data modalities, demonstrating its effectiveness for ownership verification.
To further illustrate AnalP's discriminative capability, we present both ROC curves and fingerprint matching rate distributions on representative case with CNN models trained on CIFAR-10. The ROC curve plots the true positive rate (TPR) against the false positive rate (FPR) across varying verification thresholds, providing comprehensive view of the fingerprint's 's discriminative ability. A curve closer to the top-left corner indicates stronger separability between pirated and independently trained models. As shown in Figure a)), AnaFP achieves the most favorable ROC curve that approaches the top left corner, while the curves of baseline methods lie relatively closer to the diagonal line, indicating weaker discriminative capability. This result further confirms AnaFP's superior performance in distinguishing pirated and independently trained models. On the other hand, Figure 3] b) complements this analysis by showing the distribution of fingerprint matching rates for both model sets with boxplots. The matching rate reflects the proportion of fingerprints for which a model returns the expected label. greater separation between the distributions for pirated and independently trained models indicates higher discriminative capability. As depicted in the figure, AnaFP exhibits sharply separated distributions, enabling reliable verification outcomes, In contrast, the baselines show overlapped distributions, indicating ambiguity in their verification decisions.
The robustness to performance- preserrvieeeeeggggge. model modification attacks. We evaluate AnalPPs ro- model modifications using seven representative attacks: pruning. fine-tuning, KD, AT, and three composite attacks (N-finetune, P-inettnee, and Prune-KIl KD). Table 2 shows AUCs obtained by AnaFP and the six baselines under each attack with CNN models. Under the pruning attack, all methods achieve near-perfect performance (AUC 2 0.999). However, AnaFP consistently outperforms the baselines under the remaining attacks, including fine-tuning, KID, AT, N-finetune, P-finetune, and Prune-KD KD. Notably, AnaFP achieves mean AUCs of 0.979, 0.983, 0.978, and 0.989 for fine-tuning, AT, N-finetune, and P-finetune, respectively, showing strong resistance to these attacks. Although KD and Prune-KI KD present unique challenge by distilling knowledge without retaining internal structures and weights, AnaFP still maintains a leading AUC of 0.756 and 0.689, surpassing all baselines. These results collectively demonstrate AnaFP's robustness against a wide range of model modification attacks.
bustness to celooommance-preseeveee
5.2
SENSITIVITY TO DESIGN CHOICES
5.2. THE IMPACT OF SURROGATE MODEL POOL
To evaluate the robustness of AnaFP under different surrogate pool configurations, we examine two key factors: pool size and pool diversity.
Sensitivity to pool size. We examine the impact of surrogate pool size on verification performance by varying the number of models in each pool, considering configurations with 2, 4, 6, 8, and 10 models. As shown by the line plot in Figure the AUC stabilizes rapidly once the pool size exceeds 6 models. This finding indicates that AnaFP achieves stable and reliable verification performance with only a modest number of surrogate models, indicating robustness to pool size.
Sensitivity to pool diversity. We further analyze the effect of surrogate set diversity on verification performance by constructing pools with varying levels of model diversity. In the low-diversity setting, the pirated model pool consists solely of fine-tuned variants of the protected model, and the independent model pool contains independently trained models sharing the same architecture the protected model. The medium-diversie set-
8

---

Published as a conference paper at ICLR 2026
Table 3: Effect of the quantile thresholds.
Suorgia Mip
0.1/0.9
0.2/0.8
0.3/0.7
0.4/0.6
0.5/0.5
0.6/0.4
0.7/0.3
0.8/0.2
0.9/0.1
Valid Fingerprints AUC
0
11
33
56
103
228
428
1158
0.848
0.906
0.957
0.959
0
ting expands the pirated pool diversity to include both fine-tuned and knowledge-distille models, while the independent pool comprises models with two distinct architectures. In the high-diversity setting, we further incorporate moise-finetuned pirated variants into the pirated pool and independently trained models with three different architectures in the independent pool. As shown in the bar plot of Figure A increasing diversity generally improves AUC. However. the performance gain from medium and high diversity is marginal, indicating diminishing returns. Importantly, even in the low- diversity setting, AnaFP maintains a strong AUC of 0.912, demonstrating its robustness to variations in surrogate pool diversity.
Number of Surroqate Modills
10
0.92
0.90
Low
Mediuum
High
Surrogate Pool Diversity
In summary, these results show that AnaFP is insensi- tive to the specific configurations of surrogate pools. Reliable ownership verification can be achieved using
Figure 4: Line plot (top axis): effect of surro- gate pool size; Bar plot (bottom axis): effect of surrogate pool diversity. modest number of surrogate models and without requiring extensive diversity, thereby underscoring AnaFP's practicality and generalizability.
5.2.2 THE IMPACT OF THE QUANTILE THRESHOLD
To assess how the quantile thresholds affect verification performance, we perform a sensitivity study on gmargin and Dip while fixing Gars 1.0, as its impact found to be empirically negligible. The results are summarized in Table Overly strict thresholds (e.g.. 0.1/0.9 and 0.2/0.8) result in no valid fingerprints, making ownership verification impossible. Even with slightly relaxed threshold like 0.3/0.7, the small number of valid fingerprints remains limited (only 11), leading to a low AUC of 0.848. As the thresholds are moderately relaxed, the number of valid fingerprints increases, and verification performance quickly stabilizes. Notably, starting from the 0.5/0.5 configuration, all subsequent threshold pairs yield AUC values exceeding 0.950, indicating that once sufficiently large and reliable fingerprint set is established, the verification performance becomes robust to further threshold variations. However, excessive relaxation introduces a substantial number of low-quality fingerprints, ultimately degrading the discriminative capability (e.g., achieving the AUC of 0.896 at 0.9/0.1). Overall, these findings indicate that AnaFP's verification performance is not highly sensitive to the precise choice of quantile thresholds. As long as the thresholds are moderately relaxed, high-quality fingerprint pool can be obtained without extensive tuning.
5.3 ABLATION STUDY OF THE STRETCH FACTOR
To assess the impact of the stretch factor on verification performance, we conduct an ablation study using five variants of AnaFP: A-lower (se- lecting 7 from the feasible set Treas that is closest to the lower bound), A-upper (selecting from the feasible set Tieas that is closest to the upper bound), C-fix (applying fixed prediction margin across all fingerprints by optimizing T to enforce the same difference between the probabilities of the first and eecond-highes, predicted classes), C- lower (fixing T to the lower bound Nower to solcly enforce robustness), and C-upper (setting to the upper bound Tupper to solely enforce uniqueness).
1.0
0.957
0.976
0.810
0.883
0.631
0.6
0.4
060
0.1
2.00
0.0
0.2
0.0
0.0
AnarP
A-lower
Asupper
Colower
Crupper
C-fix
Figure 5: The AUCs achieved by AnaFP and three variants.
Figure 5 shows the AUC values achieved by AnaFP and its variants. Specifically, AnaFP consistently outperiorms all five variants, validating the importance of searching for a feasible 7 within its admissible interval. Among the variants, C-fix performs better than both C-lower and C-upper, it

---

Published as a conference paper at ICLR 2026
seeks balance between robustness and uniqueness using uniform margin. In contrast, C-lower and C-upper impose single constraints across all fingerprints either robustness or mmiqueness-witte verifying whether both constraints are satisfied. Consequently, many infeasible degrading the overall discriminative capability. However, C-fix lacks the flexibility to adapt its margin the local decision geometry of individual samples. On the other hand, AnaFP, A-lower, and A-upper discard infeasible т, thereby maintaining high verification reliability. While A-lower and A-upper exhibit slightly reduced performance, primarily due the lower tolerance of their selected feasible т to -sstmmatiooo errors, they still outperform C-fix, C-lower, and C-upper. These results underscore the importance of selecting r that within the admissible interval.
retained,
CONCLUSIONS
We study the problem of constructing effective fingerprints for adversarial-example- fingerprinting by ensuring simultaneous satisfaction of both robustness and uniqueness constraints. To this end, we propose AnaFP, an analytical fingerprinting scheme that mathematically formalizes the two constraints and theoretically derives an admissible interval, which is defined by the lower and upper bounds for the robustness and uniqueness constraints, for the stretch factor used in fingerprint construction. To enable practical fingerprint generation, AnaFP approximates the original model sets using two finite surrogate model pools and employs a quantile-based relaxation strategy to relax the derived bounds. Particularly, due to the circular dependency between the lower bound and the stretch factor, grid search strategy is exploited to determine the most feasible stretch factor. Extensive experiments across diverse DNN architectures and datasets demonstrate that AnaFP achieves effective and reliable ownership verification, even under various model modification attacks, and consistently fingerprinting methods.
model
outperforms prior adversarial-example
REFERENCES
Karsten M. Borgwardt, Cheng Soon Ong, Stefan Schönauer, S. V.N. Vishwanathan, Alex J. Smola, and Hans-Peter Kriegel. Protein function prediction via graph kernels. Bioinformaties, 21(1): 47-56, January 2005. ISSN 1367-4803.
Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. IPGuard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary. In Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security, 2021.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017
IEEE Symposium on Security and Privacy (SP), pp. 39-57. IEEE. 2017.
Yufei Chen, Chao Shen, Cong Wang, and Yang Zhang. Teacher model fingerprinting attacks against transfer learning. In Proceedings of 31st USENIX Security Symposium (USENIX Security 22), pp. 3593-3618 Boston, MA, 2022.
Brian Choi, Shu Wang, Isabelle Choi, and Kun Sun. Chainmarks: Securing dnn watermark with cryp- tographic chain. In ASIA CCS '25 pp. 442-455 455, New York, NY, USA, 2025. ISBN 9798400714100
Lixin Fan, Kam Woh Ng, and Chee Seng Chan. Rethinking deep neural network ownership verifica- tion: Embedding passports to defeat ambiguity attacks. Advances in neural information processing systems, 32, 2019.
Augustin Godinot, Erwan Le Merrer, Camilla Penzo, François Talani, and Gilles Trédan. Queries, representation detection: The next 100 model fingerprinting schemes. In AAAI, pp. 16817-16825. 2025. htttlttps://// /ooi. wr..or////// 10. 1609/ aaai. v39116. 33848
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.), Proceedings of ICLR 2015, 2015.
Jiyang Guan, Jian Liang, and Ran He. Are you stealing my model? sample correlation for fingerprint- ing deep neural networks. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho (eds.), Proceedings of Advances in Neural Information Processing Systems, 2022.
Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the knowledge in neural network, 2015.
10

---

Published as a conference paper at ICLR 2026
Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical Report TR-2009, University Toronto, 2009. URL
Fearning--eatuuess -oti-rees--009-11 20.9-TR. pdE
Yann LeCun, Corinna Cortes, and CJ Burges. MNIST handwritten digit database. ATT Labs [Online]. 2. 2010.
Available: http://yann.eccu..com/eeeed
Hao Li, Asim Kadav, Igor Durdanovic, Haman Samet, and Hans Peter Graf. Pruning filters for efficient convnets. In Proceedings of ICLR (Poster), 2017.
Yuanchun Li, Ziqi Zhang, Bingyan Liu, Ziyue Yang, and Yunxin Liu. ModelDiff: testing-based DNN similarity comparison for model reuse detection. In Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, 2021.
Yuxuan Li, Sarthak Kumar Maharana, and Yunhui Guo. Not just change the labels, learn the features: Watermarking deep neural networks with multi-view data, 2024. URL / http//.wwvvv.././//
Weixing Liu and Shenghua Zhong. MarginFinger: Controlling generated fingerprint distance to classification boundary using conditional gans. In Proceedings of the 2024 International Conference on Multimedia Retrieval, 2024.
Nils Lukas, Yuxuan Zhang, and Florian Kerschbaum. Deep neural network fingerprinting by conferrable adversarial examples. In Proceedings of 2021 International Conference on Learning Representations, 2021.
Alcksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant adversarial attacks. In International Conference on Learn- ing Representations, 2018. URL /tttp:://oeenrevieer net/ wow.:niddddaaieea....
Seyed-Mohsee Moosavi- Deauvi--ezffoii.. Alhussein Fawzi, and Pascal Frossard. Deepfool: A simple and accurate method to fool deep neural networks. 2016 IEEE Conference on Computer Vision and Patern Recognition (CVPR), pp. 2574 2582, 2015. URL htt.//ttess//p......cnicccccoooo brq/Corpus 12387176
Xudong Pan, Yifan Yan, Mi Zhang, and Min Yang. MetaV: A meta-verifier approach to task-agnostic model fingerprinting. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2022.
Zirui Peng, Shaofeng Li, Guoxing Chen, Cheng Zhang, Haojin Zhu, and Minhui Xue. Fingerprinting deep neural networks globally via universal adversarial perturbations. In Proceedings of 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 13420-13429, 2022.
Huali Ren, Anli Yan, Xiaojun Ren, Peigen Ye, Chong zhi Gao, Zhili Zhou, and Jin Li. GanFinger: Gan-based fingerprint generation for deep neural network ownership verification. ArXiv, 2023.
Reuven Rubinstein. The cross-entropy method for combinatorial and continuous optimization. Method. Comput. Appl. Prob., 1(2):127-190, 1999 ISSN 1387-5841. doi: 10.1023/A:
1010091220143, UtLpttps::/ doi. www.oogg/110. 00110/222:1111012000000000
Masoumeh Shafieinejad, Nils Lukas, Jiaqi Wang, Xinda Li, and Florian Kerschbaum. On the robustness of backdoor- basedd watermarking in deep neural networks. In Proceedings of the 2021 ACM workshop on information hiding and maltimedia security, pp. 177-188, 2021.
Gowthami Somepalli, Liam Fowl, Arpit Bansal, Ping Yeh-Chiang, Yehuda Dar, Richard Baraniuk, Micah Goldblum, and Tom Goldstein. Can neural nets learn the same model twice? investigating reproducibility and double descent from the decision boundary perspective. In Proceedings of CVPR 2022, pp. 16699-13708 2022.
Christian Szegedy, Wojciech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In Proceedings of ICLR 2014, 2014.
11

---

Published as a conference paper at ICLR 2026
Ling Tang, YueFeng Chen, Hui Xue, and Quanshi Zhang. Towards the resistance of neural network fingerprinting to fine-tuning. In The nhith Annual Conference on Neural Information Processing Systems, 2025.
Siyue Wang, Xiao Wang, Pinyu Chen, Pu Zhao, and Xue Lin. Characteristic examples: High- robustness, low-transferability fingerprinting of neural networks. In Proceedings of International Joint Conference on Artificial Intelligence, 2021a.
Siyue Wang, Pu Zhao, Xiao Wang, Sang Peter Chin, Thomas Wahl, Yunsi Fei, Qi Alfred Chen, and Xue Lin. Intrinsic examples: Robust fingerprinting of deep neural networks. In Proceedings of British Machine Vision Conference, 2021b.
Tianlong Xu, Chen Wang, Gaoyang Liu, Yang Yang, Kai Peng, and Wei Liu. United we stand, divided fall: Fingerprinting deep neural networks via adversarial trajectories. In Proceedings of Neural Information Processing Systems, 2024.
Anli Yan. Huali Ren, Kanghua Mo, Zhenxin Zhang, Shaowei Wang, and Jin Li. Enhancing model intellectual property protection with robustness fingerprint technology. IEEE Transactions on Information Forensics and Security, 20:9235-9222 9249, 2025.
Kan Yang and Kunhao Lai. NaturalFinger: Generating natural fingerprint with generative adversarial networks. ArXiv, 2023.
Kan Yang, Run Wang, and Lina Wang. MetaFinger: Fingerprinting the deep neural networks with meta-training. In Proceedings of International Joint Conference Artificial Intelligence, 2022.
Lingfeng Yao, Chenpei Huang, Shengyao Wang, Junpei Xue, Hanqing Guo, Jiang Liu, Xun Chen, and Miao Pan. Speechverifier: Robust acoustic fingerprint against tampering attacks via watermarking. arXiv preprint arXiv:2505.22 23 2025a.
Lingfeng Yao, Chenpei Huang, Shengyao Wang, Junpei Xue, Hanqing Guo, Jiang Liu, Phone Lin, Tomoaki Ohtsuki, and Miao Pan. Yours mine? overwriting attacks against neural audio watermarking. arXiv preprint wxxi:2509.0583: 2025b.
Zhaoxia Yin, Heng Yin, and Xinpeng Zhang. Neural network fragile watermarking with no model performance degradation. In Proceedings of 2022 IEEE International Conference on Image Processing (ICIP), pp. 9958-3962, 2022.
Xia Zheng You, Youhe Jiang, Jianwei Xu, Mi Zhang, and Min Yang. GNNFingers: A fingerprinting framework for verifying ownerships graph neural networks. In Proceedings of the ACM on Web Conference 2024, 2024.
Zhuomeng Zhang, Fangqi Li, Hanyi Wang, and Shi-Lin Wang. Boosting the uniqueness of neural networks fingerprints with informative triggers. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025.
Boyao Zhao, Haozhe Chen, Jie Zhang, Weiming Zhang, and Neng Yu. Dual-verification-oe model fingerprints against ambiguity attacks. Cybersecur, 7:78, 2024a.
Jingjing Zhao, Qin Hu, Gaoyang Liu, Xiaoqiang Ma, Fei Chen, and Mohammad Mehedi Hassan. AFA: Adversarial fingerprinting authentication for deep neural networks. Comput. Commun., 150: 488-497, 2020.
Mengnan Zhao, Lihe Zhang, Jingwen Ye, Huchuan Lu, Baocai Yin, and Xinchao Wang. Adversarial training: A survey, 2024b.
15042
Fuzhen Zhuang, Zhiyuan Qi, Keyu Duan, Dongbo Xi, Yongchun Zhu, Hengshu Zhu, Hui Xiong, and Qing He. A comprehensive survey on transfer learning. Proceedings of the IEEE, 109(1):43776 2020.
12

---

Published as a conference paper at ICLR 2026
APPENDIX
A THEORETICAL DERIVATION OF THE LOWER AND UPPER BOUNDS
we introduced two theoretical constraints: robustness constraint that defines lower bound for and uniqueness constraint that defines upper bound for т. In this section, we present formal derivations of both bounds.
In Section 4.3
First, we provide Lemma A.I about the lower bound for the robustness as follows.
Lemma A.1 (Lower bound for robustness). For the input of a fingerprint x² = x² + + the
prediction of an arbitrary pirated model P' E Vp is P'(x") = provided that + c, 18
2 2ege
(x*) > sp (x") For any pirated model P', its logit shift éloga is bounded by (sprr,((=") - 8P,8 (x=(( S Elogits Wk E y. Following this, for label of the fingerprint y" and the original label y, we have
Proof. To guarantee P'(x") y", we have sp'. (="))=((")
Sp sp' (x") 2 SP.y (x') - Gogii
sp', (x=))(x") S (P:y((=) + Clogit
Subtracting them yields spr.y- "p=",)((x=)> - guaranteed if the margin of the protected model satisfies
(ax") 2 gr(x*) - 2elogit- Hence, the robustness is
gp(x*) 20oogit
(4)
We perform the first-order Taylor expansion at the boundary point q x + + where gr(4) 0.
Letting x² = q + (T 1)8 we approximate gr(x*) se (T - 1) 8 Vgp(q). Since d is the optimal
direction that minimizes ||ōl|2 while satisfying gp(#" 8) = O, the KKT condition yields 8
( for some À > O, implying colinearity. Therefore, we have gp(x") RS (T - 1) cg 11
Plugging gr(x") ) into Equation equation 4 we find (r 1) 1gll0"11 2ogat i.e., T >>>> 1 + co which concludes the proof.
25n
Next, state Lemma A.2 about the upper bound for the uniqueness as follows.
Lemma A.2 (Upper bound for uniqueness). For the input of a fingerprint xx = x0a T the
original label y of the anchor is preserved for VI E Ip, provided that T < 2 Irauing 11 11a'
mamin
Proof. We first fix an arbitrary independently trained model with Lipschitz constant L S Lunig Let A 78 and k arg maxuşy $1, (xx ) be the runner-up class. Then, the margin at the anchor is (x=) (x*) 8s,t (x*) 2 Mmiin- Now, setting arg maxk (1,x(x=) and considering the margin at x", we have
g1(xx) s1.p(x")) (x") (z,)
(5)
Because Lunig is upper bound on the local Lipschitz constant across all independently trained models, we have [|sr(x*) - s1(x")]1 < Luniql Alle Lunig | ||2, for VI Ip. Each individual coordinate satisfies (s),(("*) (1,((=)) ||s (x*) sy (x:) )l2 Thus, we have (=),<(=*)
(1,((=") < Lunig ||0"" Following this equation, we have the following two inequalities:
8 81y 2 (xx) - T 1 1|2.
(x") S (xx) + Lunig | ||2.
Subtracting equation] 7 from equation and inserting the result into equation 5 we have
(x(")) 2 [8t.y (xx") - 81, (x:)) 2 2 7 1|
2 [s1.y (x=)) - $I,A (x²)
2L L Tl 1|660|1 (since (1,) S (1,11(²)))
gr (xx") ) 2 2Tanin T 1|0 ||2-
(8)
Preserving the original label y at xx requires gr (x*)== > 0, which implics 7 <
91(
Since
27. 2T 1|8 lla
9r (x(") 2 Mmiaa obtain gr (xx" for any 2h [ which concludes the proof.
main
O
13

---

Published as a conference paper at ICLR 2026
establish Theorem A.1 about the robustness and uniqueness. Theorem A.1 (Admissible interval for T). For YP' Vp and VI Ip, any fingerprint (x", . y²) constructed with feasible stretch factor T" is guaranteed to be both robust and unique if
Following Lemmas A.1 and A.2
Co 1
Elowe
T
Loisin
mhml
B SUPPLEMENTAL EXPERIMENTAL RESULTS
B.1 ROBUSTNESS TO MODEL MODIFICATION ATTACKS
Tables and summarize the AUCs of AnaFP and the baseline methods under performance- preserving model modifications across CNN, MLP, and GNN architectures. For CNN models trained on CIFAR-100, AnaFP consistently achieves high AUCs (2 0.930) five out of seven attacks, with the sole exception being KD and Prune-KD KDD, where UAP and AKH marginally outperform AnaFP respectively. For MLP models, AnalF attains near-perfect AUCs (2 0.999) on four attacks and maintains strong performance and Prume-KD. KD. In contrast, for GNN models, AnaFP achieves the highest AUC across all six attacks, with AUCs, ranging from 0.736 to 0.971, significantly outperforming IPGuard and AKH. It is worth noting that UAP, MarginFinger, ADV-TRA, and GMFIP are not directly applicable to graph-structured data, as they assume fixed input geometry. The consistently superior performance achieved by AnaFP across diverse model types highlights its strong generalization ability and robustness to modification attacks, which particularly important for ownership verification in diverse deployment scenarios.
AT with AUC of 0.987; besides, AnaFP performs best under KD
B.1.1 THE IMPACT OF ANCHOR SELECTION
We investigate the impact of confidence levels during anchor selection by performing experi- ments with low-confidence, mid-confidence, and high-confidence anchors on CNN(CIFAR-10) and MLP(MNIST). The three confidence levels are defined by the range of logit margins gp(x%). Experimental results illustrate that low-confidence anchors (0 S gp(z") 2.5) yield 0 valid finger- prints for both cases, mid-confidence anchors (2.5 < (x(x)) ) < 5.0) produces 3 valid fingerprints for CNN and 2 for MLP with the achieved AUCs of 0.791 and 0.755, respectively. and high-confidence anchors (gp(x*) ) 2 5.0) produce 57 valid fingerprints for CNN and 85 for MLP with much higher AUC (i.e., 0.958 for CNN and 0.961 for MIP)). This confirms that low-confidence anchors fail to produce sufficient number of valid fingerprints and thus degrade the performance.
B.1.2 . ROBUSTNESS TO THE KNOWLEDGG DISTILLATION ATTACK
In addition to the main metric AUC, which reflects the overall detection capability across all threshold settings, we will also assess TPR, FPR, TNR, and FNR for the KD attack. The experimental results are summarized the Table 7 From this table, we can observe that AnaFP achieves the strongest separation between pirated models under the KD attack and independently trained models, reaching high true positive rate (TPR=0.80) while keeping the false positive rate relatively low (FPR=0.22). ADV-TRA and UAP perform worse than AnaFP but better than other baselines, showing moderate- level performance (TPR=0.73, FPR=0.30 for UAP, and TPR=0.75, FPR=0.27 for ADV-TRA). In contrast, AKH, IPGuard, GMFIP, and MarginFinger are relatively less capable of distinguishing
Table 4: AUCs under various performance- model modifications CNN models trained on 10FAR100.
Method
Pruning
Finetuning
KD
N-finetune
P-finetune
Prune-KD
AnaFP (ours)
0.963 0.002 0.954 0.004 0.009 0.930 0.007
0.005 0.956 0,574 0.013
UAP
0.897
0.015 0.852 0.022 0.018 0.802 0.027
0.859 +
0.583 0.019
IPGuard
0.845
0.086 0.811 0.066
0.096
MarginFinger
0.737
0.076 0.667 + 0.519 0.026
0.058 0.026
AKH
0.915 0.007 0.838 0.032 000
0.041
ADV-TRA
0.953 1. 0.007 0.904 11:00411::00 0.0024 0:011 0.886 00010000000000000000000001000010
GMFIP
0.885 0.048 0.794 000.000085-000000000000000000000
0.721
14

---

Published as a conference paper at ICLR 2026
Table 5: AUCs under various performancee-preerviinn model modifications on MLP models.
Method
Pruming
Finctuning
KD
AT
N-finctune
P-finctunc
Prune-KD
AnaFP (ours)
1.000 0.000 1.000 + 0.000/0.792. 0.002 0.987 + 0.005|10000 1.000 + 0.000 0.999 + 0.000 + 0.006
UAP
0 + 0.001 0.969 + 0.635 + 0.002 0.931 +1933++000 0.010 0.007 0.976
0.610 0.005
IPGuard
0.924 = 0.042 0.983 = +.007 0.535 0.036 0.902 0.029 0.008 0.922
0.0077 0.029
MarginFinger
0.708 0.130 0.750 0.144 0.041 1
0.14
0.090 0.034
AKH
0.849 0.017 0.870 + 0.023 0.765 0.008 0.897 0.026
0.025 0.777 0.759 0.011
ADV-TRA
0.971 0.010 0.964 0.007 0.5%
0.907 0.00
0.004 0.054 + 0.001 0.602 0.005
GMFIP
0.978 0.021 0.971 00000000000000000000000000000000
0.042 0.033 0.029 0.017 0.054
Table 6: AUCs under various performannce--presevvvigg model modifications on GNN models.
Method
Pruning
Finctuning
KD
AT
N-finctune
P-finctunc
Prunc-KD
AnaFP (ours) 0.933 + 0,002 0.971 + 0.007 0.806 = 0,002 0.970 = 0,012 0.962 + 0.013 + 0.006 + 0.015
IPGuard
0.806 + 0,051 0.668 + 0,053 0.529 = 0.330 0.612 = 0.112 0669 = 0.027
0,551 + 0.074 0,571 + 0.174
AKH
0.859 + 0.011 0.831 + 0.043 0.790 + 0.021 0.869 + 0.045 0.838 + 0.04
0.849 + 0.038 0.719 + 0.036
pirated models under the KD attack from independently trained models, reflected by their high FPR (0.36-0.47) and only moderately high TPR (0.57-0.67).
B.2 EFFICIENCY ANALYSIS
We experimentally compare the computing time and peak GPU memory consumed by AnaFP and baselines. The experimental results summarized in Table 8 Specifically, AKH and IPGuard are the most lightweight methods: AKH operates purely through forward inference, and IPGuard performs small-batch gradient updates without minimizing perturbation magnitude, resulting in runtimes of around one minute and memory usage below 3 GB. UAP is the most expensive method, as it requires multiple full passes over the training data to optimize a universal perturbation, leading to high computing time and memory usage. Both MarginFinger and GMFIP achieve moderate cost by training a generator model synthesize boundary-adjie adjacett samples. ADV-TRA generates adversarial trajectories as fingerprints, which causes high time cost due to the sequential generation process. Compared to these baselines, AnaFP consumes high memory but achieves balanced runtime. More specifically, AnaFP costs the most GPU memory to 40 GB on ViT-S/16, as it processes large batch of anchors parallel during the adversarial optimization step. This parallel design reduces the total number of optimization iterations, thus reducing the overall runtime. Despite the high memory usage, AnaFP can still run on a single A A100 GPU, making the cost manageable in practice.
Moreover, we profiled the runtime of the three steps in our proposed fingerprinting method: Step 1 (anchor selection), Step 2 (adversarial perturbation computation), and Step 3 (searching stretch factors). We also examine the impact of the model sizes (ResNet18 18 and ViT-S/16) and the number of surrogate models used. The results are presented in the Table From the table, we can see that the runtime cost is acceptable. Specifically, first, Step dominates the total runtime, requiring 1000-3800 seconds depending on the protected model size and surrogate pool size, whereas the time cost of Step I is negligible, and Step 3 contributes a moderate amount (1000-2100 seconds). Second, the time cost scales with model size: fingerprinting V requires significantly more time cost than fingerprinting ResNet- because a larger model incurs more computations during the fingerprint generation process. Third, increasing the surrogate pool from 4 to 8 models increases the runtime of Step 3, where grid search accounts for the major time cost. From the above discussion, we can see AnaFP's ' runtime is moderate.
We also measured GPU memory usage during Step and Step 3, the experimental results are summarized in Table I0 We can observe that first, Step 2 requires the highest memory because it performs adversarial optimization, consuming 13 GB for ResNet-18 and about 40 GB for ViT-S/16. whereas Step 3 requires 1-3 GB. Second, memory usage grows with model size: VIT-S/16 on Tiny-Image ImageNet has roughly three times the memory requirements of ResNet-18 due to a larger model size. Third, increasing the surrogate pool size from 4 to models increases memory usage slightly.
Discussion on Potential Speedups. The computational efficiency of AnaFP can be further improved through the following practices. First, regarding surrogate pools, independent surrogate models can
15

---

Published as a conference paper at ICLR 2026
Table Detection performance under the KD attack for CNNICIFARIO.
Method
TPR
FPR
TNR
FNR
AnaFP (ours)
0.80
0.22
0.78
0.20
UAP
0.73
0.30
0.70
0.27
IPGuard
0.46
0.54
0.42
MarginFinger
0.57
0.47
0.53
0.43
AKH
0.63
0.40
0.60
0.37
ADV-TRA
0.75
0.27
0.73
0.25
GMFIP
0.67
0.36
0.64
0.33
Table 8: Time cost and peak GPU memory consumption of different fingerprinting methods under two representative protected models.
ResNet-18
ViT-S/16
Time
Memory
Time
Memory
AnaFP (ours)
33 8
13 GB
1 h 26
40 GB
UAP
4 5. m
GB
8 h 10 m
10 GB
IPGuard
1 6m
GB
1 m1
3 GB
MarginFinger
51 m 18
4 GB
1 m m 10
10 GB
AKH
20
GB
3 GB
ADV-TRA
58 m 01
4 GB
1 m
10 GB
GMFIP
h m
GB
40
10 GB
be drawn directly from publicly available models, eliminating the need for additional training, while generating pirated surrogate models via fine-tuning or pruning incurs very low cost. Even performing knowledge distillation, which relatively more expensive, remains cheaper than training models from scratch. Second, the C&& optimization used in Step 2 (computing minimal decision-altering perturbations) can be replaced with more efficient alternatives, such as PGD (Madry et al., 2018) and DeepFool (Moosavi-Deziie et al. (013), which can reduce computations. Third, a coarse-to-fing search strategy (Rubinstein) 1999) can be applied to further reduce the computational cost.
C IMPLEMENTATION DETAILS
C.1 MODEL ARCHITECTURES AND TRAINING SETTINGS
We summarize the architectures and training configurations of the protected model, the attacked models, and the independently trained models used for each task the following.
C.1.1 PROTECTED MODEL
CNN (CIFAR-10 and CIFAR-100). The protected model ResNet-18 trained from scratch using SGD with momentum 0.9, weight decay Se-4, learning rate 0.1, cosine annealing learning rate scheduling, and Xavier initialization. Training is conducted for 600 epochs with a batch size of 128.
MLP (MNIST). The protected model is ResMLP trained from scratch using SGD with momentum 0.9, weight decay 5e-4, a learning rate of 0.01, cosine annealing learning rate scheduling, and Kaiming initialization (default Pytorch setting). Training conducted for 40 epochs with a batch size of 64.
GNN (PROTEINS). The protected model is a Graph Attention Network (GAT) trained using the Adam optimizer with learning rate of 0.01 and Xavier initialization (default Pytorch setting). The default PyTorch Adam settings are used: 3 = 0.9 and B₂ = 0.999.
C.1.2 INDEPENDENTLY TRAINED MODELS
CNN (CIFAR-10 and CIFAR-100). The independent model set consists of ten diverse architec- tures: ResNet-18, ResNet-50, 10s WideResNet-500. MobileNetV2, MobileNerV3--Lare EfficientNet-B2. EfficientNet-BA DenseNet-121, and 1enseNet-169. Each model is trained from
16

---

Published as a conference paper at ICLR 2026
Table 9: Time for the three iinerprint-geneeaaion steps: Step 1 (anchor selection), Step
(adversarial perturbation generation), and Step 3 (7 search).
Protected Model
Surrogate pool size
Step 1
Step 2
Step 3
ViT-S/16
63s
3856s
1276s
ResNet18
8s
1004s
976s
ViT-S/16
8
61s
3855s
2121s
ResNet18
8s
997s
1419s
Table 10: Peak memory consumption for Step 2 (adversarial perturbation generation) and Step (grid search).
Protected Model
Surrogates
Step
Step 3
ViT-S/16
4
40G
3G
ResNet18
4
13G
1G
ViT-S/16
8
41G
3.2G
ResNet18
8
13G
1.1G
scratch with different random seeds under the same optimizer, scheduler, and initialization scheme as the protected model.
The independent model set includes seven multilayer perceptron architectures: WideDeep, ResMLP, FTMLP, SNNMLP, NODE, TabNet, and TabTransformer. Each model is trained from scratch under the same optimizer, learning rate, scheduler, and number of epochs as the protected model, but with different random seeds and architecture-specfff parameters where applicable.
MLP (MNIST).
GNN (PROTEINS). The independent model set includes seven graph neural network architectures: GCN, GIN, GraphSAGE, GAT, GATv2, SGC, and APPNP. Each model trained from scratch using the same optimizer, learning rate, and number of epochs as the protected model, but with different random seeds and architecture-specifi configurations.
C.1.3 PIRATED MODELS
construct pirated models across tasks using seven types of performance-pressevinng attacks applied to the protected model with the following settings.
Fine-tuning: retraining the protected model for specified number of epochs.
Adversarial Training (AT): retraining the protected model for specified number of epochs using a mix of normal data samples and adversarial samples.
Pruning: applying unstructured global pruning with sparsity levels ranging from 10% to 90% in increments of 10%, without retraining.
P-Finetune: applying pruning at sparsity levels of 30%, 60%, and 90%, followed by fine-tuning.
N-Finetume: perturbing each trainable parameter tensor with Gaussian noise scaled by its standard deviation, i.e., param += 0.09 x std(param) (0, 1), followed by fine-tuning.
Knowledge Distillation (KD): training student model of the same different architecture with the protected model using the KI. divergence between the outputs of the protected (teacher) model and the student model, temperature T set to
Prune-KD: performing pruning the protected model, followed by knowledge distillation (KD) attack.
All attacks are applied consistently across tasks, with differences only optimizer settings, learning rates, and the number of fine-tuning epochs. For CNN (CIFAR-10), we use SGD with a learning rate of 0.01 and cosine annealing scheduler for 200 epochs (600 epochs for KD). For MLP (MNIST), the optimizer is SGD with a learning rate of 0.001, also using cosine annealing over 30 epochs (30 epochs for KD). For GNN (PROTEINS). we use the Adam optimizer with a learning rate of 0.001 for 60 epochs (100 epochs for KD).
17

---

Published as a conference paper at ICLR 2026
C.1.4 DATA PREPROCESSING
All datasets are normalized prior to training the DNN models, in line with standard preprocessing practice. For the MNIST dataset, each 28 x 28 grayscale image is flattened into a 784-dimensional vector to serve as the input to the MLP model. For CIFAR-10, CIFAR-100, and PROTEINS, no additional preprocessing is applied beyond normalization.
C.2
THE IMPLEMENTATION DETAILS OF ANAFP
C.2.1 ANCHOR SELECTION AND ADVERSARIAL. PERTURBATION
To identify anchors. we use logit margin threshold of Manchor = 1.0 for GNN on PROTEINS, and Manchor 8.0 for all other tasks. To compute the minimal perturbation that can alter prediction results (cf. Step 2 of AnaFP), we adopt the C&W-&z attack. The attack is parameterized with a confidence margin kappa = 0, the number of optimization steps steps = 3000, and the optimization learning rate Ir = 0.01. We set the regularization constant per model datased pair, since the difficulty of finding decision-altering adversarial perturbations varies across models and dataset; for example, we use 10 for CNNs on CIFAR-10 and CIFAR-100, while using 0.9 for MLPs on MNIST and c = 10 10-2 for GNNs on PROTEINS. In practice, we recommend tuning c based on the number of successfully obtained boundary points, increasing if too few boundary points are found.
C.2.2 SURROGATE MODEL POOLS CONSTRUCTION
To enable estimation of theoretical bounds in Step 3 of AnaFP, we construct two surrogate model pools for each task: pirated model pool consisting of six models obtained via two simulated performance- preserving modifications of the protected model (fine-tuning and knowledge distillation), and an independent model pool consisting of six independently trained models trained from scratch with different architectures and random seeds. All surrogate models and test models are trained with different random seeds and architectures, ensuring no surrogate models overlap with any test models.
Specifically, for the CNN on CIFAR-I0 and -IFAR-100, pirated models include fine-tuned and showledge-distille models using R8 and DenseNet- 121. The architectures of independently trained models include ResNet-18 8 and DenseNet-169 169, with three random seeds per architecture. For the MLP on MNIST, pirated models include fine-tuned ones, along with miittedee-distilledd models using FT-MLP and Deee&Deep. The architectures of independently trained models consist of NODE and ResMLP, each instantiated with three seeds. For the GNN task on PROTEINS, pirated models include fine-tuned ones, as well as knowledge-distille architectures of independently trained models consist of APPNP and GAT, each trained with three random seeds.
distilled
models with GAT and GATv2. The
In principle, the surrogate pool should be as diverse as possible; however, under a constrained budget, prioritize challenging surrogates- ee.g., knowledge-distille variants- in the pirated pool, and include independently trained models that share the same architecture with the protected model in the independent pool, since such models are behaviorally closer to the protected model and therefore yield a stricter and more informative bound.
C.2.3 PARAMETER ESTIMATION
The three parameters Miii Lunig, and élogir are estimated using the surrogate model pools described in Appendix C.2.2 For each anchor, the lower bound mmin of the logit margin is estimated by computing the logit margin for each surrogate independently trained model 1, and aggregating using the Imargin -qantiie. The local Lipschitz constant Lunig is estimated for each independently trained model based on the ratio of logit difference to input norm between the anchor input and its boundary point x + 8"" and aggregated via the Qlip -quantile. The bound Clogi of the logit shift bound is computed as the maximum per-class logit difference between the protected model and the pirated ones at the perturbed input x", and relaxed using 4eps-quante -quantile The quantile configurations are as follows. For the CNN model evaluated on CIFAR-10 and MLP on MNIST, 9margin- nip- and Jeps are set to be 0.5, 0.5, and 1.0, respectively. For GNN on PROTEINS, 0.4, 0.6, and 1.0, respectively. For CNN on CIFAR- 100, we set qmargin qiip> and 9eps are set to be 0.3, 0.7, and 1.0, respectively. In practice, though the optimal values often vary across different scenarios,
set Imargin- Rip, and Jeps to be
18

---

Published as a conference paper at ICLR 2026
selecting the thresholds requires only coarse adjustment, typically by gradually relaxing them from the conservative end until a reasonable number valid fingerprints is found (e.g., 20-100), which is corroborated by the experimental results in Section 5.2.2
C.2.4 GRID SEARCII
The grid search over the interval (1, Tupper] is implemented by uniformly sampling finite number of stretch factor value candidates. Specifically, we sample Ngra points within this interval, where Ngri = 500 is used by default in all our experiments. Increasing Niai enables finer- finer-grained search over (1, Tupper] and may yield better performance in principle, but it also increases the computational cost proportionally.
D SCOPE AND APPLICABILITY
AnaFP is fundamentally task-dependent, as it constructs and verifies fingerprints based on class decision boundaries. As result, like most existing fingerprinting methods, naturally designed for classification tasks. This dependence limits its applicability in scenarios where well-defined class boundaries do not exist, such as regression problems (which produce continuous outputs without discrete decision regions) and many self-supervised unsupervised models whose objectives are not label-based (e.g., representation learning without a classifier head). Extending AnaFP to these settings would likely require redefining the fingerprint signal around alternative structural properties, such as similarity geometry in embedding space or task-specific surrogate decision functions. We leave this extension to future work.
E THE COMPUTATION PLATFORM
All experiments are conducted on a high-performance server equipped with an NVIDIA A GPU with 40 GB of memory and an Intel Xeon Gold 6246 CPU running at 3.30 GHz. The software environment includes Python 3.9.21, PyTorch 2.5.1, and CUDA 12.5.
F RELATED WORK
Model fingerprinting has become key paradigm for protecting intellectual property (IP) of DNN models (Cao et al. 2021 Guan al. 2022 Wang et al. 2021a). contrast to watermarking that embeds additional functionalities into model parameters, which introduces security issues to the model (Wang al., 2021a Xu al. 2024 et al. 2024 Choi al. (2025), fingerprinting provides non-intrusive alternative that protects model's 's ownership by extracting its intrinsic decision behavior without making any modifications to it. The majority
existing methods consider
practical black-box setting where ownership verification is conducted by querying the suspect model with fingerprints and comparing the similarity between the outputs of the protected model and the
suspect model (Cao al. 2021 Xu al. 2024 Zhao al. 2024a You al. 2024 Ren et al. 2023
Yin et al. 2022 Yang & Lai 2023 Peng et al. 2022 Liu & Zhong 2024 Godinot et al.) 2025).
Among these methods, many works leverage adversarial examples fingerprints to induce model- specific outputs for the protected models (Zhao et al. 2020 Yin et al., 22022, Peng et al., [022 Yang Lai 2023). To improve robustness against ownership obfuscation techniques, several studies create variants for the protected model to optimize fingerprints (Wang et al.) [202 b). To further enhance the detection capability. [ukas al. (2021): [i et al. (2021): Yang et al. (2022): Ren et al. (2023) train fingerprints to yield consistent outputs across pirated variants of the protected model while remaining distinguishable from independently trained models. Besides, some methods extract robust, task-relevant features such universal perturbations or adversarial trajectories to construct stronger identifiers Peng et al. (2022): Xu et al. (2024). Recently, Godinoo et al. (2025) leverages the training samples that have been misclassified by the protected model as fingerprints. which demonstrate stronger discriminative power than normal adversarial examples. [Tagg et al. (2025) proposes a robust fingerprinting scheme that embeds ownership information in the frequency domain. Zhang et al. (2025) identifies the most informative fingerprints from the set to achieve higher verification performance under limited query budgets.
19

---

Published as a conference paper at ICLR 2026
For model fingerprinting, open question is how to craft fingerprints that can satisfy the properties of robustness (robust to model modification attacks) and uniqueness (not falsely attribute independently trained models pirated) simultaneously. Several previous works provided their answers, i.c., empirically controlling the placement of fingerprints relative to the decision boundaries (Cao et al. 202T Liu & Zhong 2024). However, these approaches rely empirically tuned distance without any theoretical guidance, which can lead to unstable fingerprint behavior and inconsistent verification performance. In this paper, we propose analytical fingerprinting approach that crafts adversarial example-based fingerprints under the guidance of formalized properties of robustness and uniqueness.
G SOCIETAL IMPACTS
Our work proposes a fingerprinting framework for verifying the ownership of deep neural network (DNN) models, aiming protect the intellectual property (IP) model creators. By enabling reliable and robust ownership verification, our method contributes positively to the development of secure and trustworthy Al ecosystems. This can help mitigate unauthorized usage, model stealing, and commercial misuse, encouraging responsible Al deployment and fair attribution in both academia and industry.
20


Reviews:
[{"review_id": "mnP60q9ep8", "reviewer": "Reviewer_5yER", "summary": "This paper focuses on the fingerprint generation for model ownership verification based on two essential properties—robustness and uniqueness from a theoretical perspective, which links the two constraints introduced by robustness and uniqueness to the fingerprint-to-boundary distance. The authors formalize two key properties—robustness (against model modifications) and uniqueness (against independently trained models)—and derive τ bounds that satisfy both. They further relax these bounds via surrogate model pools and quantile estimation, and determine τ via grid search. Extensive experiments show superior AUC over prior work across CNN, MLP, and GNN architectures.", "questions": "1.\tCould the authors provide more information on the fingerprints’ generation cost rather than only the detection performance? Like time and memory size compared to other existing methods\n2.\tKD is known as the most challenging IP attack in the real-world scenario. I wonder about the detailed attack settings and detection performance(e.g., detection rate and FPR) on this attack, which could significantly help readers to buy these results.\n\nOverall, although the current version of this paper lacks some important results and details, I believe the theoretical perspective presented is somewhat reasonable and could inspire more future work in similar directions. Therefore, I am currently slightly inclined to accept it. I hope the author will provide point-by-point responses to the issues I raised during the rebuttal phase. If these issues can be adequately clarified, I would be willing to raise my score and support the acceptance of this paper.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.\tTo the best of my knowledge, this might be the first work to analytically characterize the admissible τ-interval that jointly guarantees robustness and uniqueness. The derivation is clean and verifiable, and surrogate pools + quantile relaxation elegantly make the bounds estimable without violating the theory.\n2.\tConsistently highest AUC on all six modification attacks and four datasets, while showing low sensitivity to pool size/quantile settings.\n3.\tExtensive results demonstrate the superior performance of AnaFP over other methods, which can generalize to CNN, MLP, and GNN models among diverse model IP attacks.\n4.\tWhile casting fingerprint generation as a “distance-to-boundary” control problem is not new (MarginFinger, IPGuard), AnaFP’s main novelty is adding analytical bounds on the stretch factor τ. I believe this idea and perspective could motivate more follow-up work in the community.", "weaknesses": "1.\tMy first concern is about the cost. Every anchor requires a full targeted C&W optimization (≈ 3,000 steps) and a 500-point grid search over τ. Complexity is O(N_f × 3,000 × 500) forward-backward passes—impractical for ImageNet-scale models. No speed-up (e.g., early termination, bisection search, Jacobian-free solvers) is discussed.\n2.\tMissing baselines. The experimental comparison is restricted to adversarial-example methods; recent non-adversarial ownership schemes are omitted, which can provide more necessary information on AnaFP’s superior performance.\n3.\tThe evaluated surrogate piracy pool is limited to six handcrafted attacks (fine-tune, KD, prune). Stronger attack combinations (like prune→KD or adversarial training with fingerprint-aware data) are not covered.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "4vUVa4VgRN", "reviewer": "Reviewer_JWiN", "summary": "This paper presents AnaFP, an analytical framework for generating adversarial fingerprint samples to verify the ownership of deep neural networks. Unlike prior heuristic approaches that place fingerprints near decision boundaries, AnaFP derives theoretical upper and lower bounds on the fingerprint-to-boundary distance, governed by a scaling factor. The bounds are motivated by two conflicting objectives: robustness against model modifications and uniqueness across independently trained models. The authors further propose a practical approximation using surrogate model pools and quantile relaxation, followed by a grid search to select feasible fingerprints.", "questions": "See Weaknesses", "limitations": "", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "1. The paper provides a clean analytical formulation for the long-standing heuristic choice of how far fingerprints should lie from the decision boundary. By deriving explicit upper and lower bounds on the scaling factor, the authors turn this into a principled optimization problem rather than an empirical guess.\n2. Experiments cover multiple model families (CNN/MLP/GNN), datasets (image and graph), a wide range of model modification attacks, several baselines, and repeated runs to report mean ± std. Tables and figures indicate consistently strong AUCs for AnaFP.", "weaknesses": "1. The related-work section lacks a systematic overview of existing fingerprinting or watermarking techniques for deep models.\n2. While the appendix mentions some hyperparameters, key details such as exact model architectures used and number of models in each surrogate pool are missing or only briefly listed. These are central to understanding the experiment setup. Important configurations should appear in the main text, not just in appendices.\n3. While AnaFP is analytically grounded, its deployment requires maintaining surrogate model pools, performing adversarial optimization (e.g., C&W attacks) for fingerprint generation, and running grid search for each anchor. These steps incur substantial training and inference cost, which may limit practicality in large-scale or resource-constrained settings. The paper would benefit from reporting quantitative cost and discussing potential efficiency improvements.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "FeECwQoyUj", "reviewer": "Reviewer_ZKy4", "summary": "This paper introduces AnaFP, an analytical framework for generating adversarial-example-based fingerprints for deep neural network model ownership verification. The key contribution is the mathematical formalization and unified treatment of both robustness and uniqueness constraints, enabling derivation of a theoretically principled interval for positioning fingerprints relative to the decision boundary. AnaFP employs surrogate model pools and a quantile relaxation strategy to make implementation practical and robust to variations in model modification and diversity.", "questions": "- How would AnaFP fare against adaptive attackers who are aware of the fingerprint generation protocol and attempt to evade by specifically distorting or randomizing localized decision boundaries? Are there (perhaps adversarially optimized) model modifications that could reduce the efficacy of the derived interval without violating standard performance constraints?\n\n- Can the authors clarify or provide more guidance on choosing quantile thresholds for the relaxation strategy (see Table 3), beyond the trial-and-error or “reasonable number of fingerprints” heuristic? Any analytical or automated procedure to further reduce parameter sensitivity?\n\n- The use of grid search with potentially many anchors and surrogate models may be computationally expensive, especially for large-scale or production systems. Could you provide more details on the runtime complexity and memory requirements for AnaFP in realistic settings?  \n\n- The evaluation focuses on known model modification attacks (pruning, fine-tuning, KD, AT). Have you considered or tested robustness against adaptive attackers who might specifically attempt to evade fingerprinting by perturbing near-anchor regions or strategically altering decision boundaries?  \n\n- While AnaFP shows strong results on CNNs, MLPs, and GNNs, are there any specific architectural choices, dataset characteristics, or domains where the approach might face limitations? For example, very large-scale models or models trained with self-supervised or unsupervised objectives?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The paper rigorously formalizes the requirements for fingerprint robustness and uniqueness, deriving both lower and upper bounds on the stretch factor that controls fingerprint placement. \n\n- AnaFP is demonstrated on a diverse set of DNN models, indicating broad applicability. Unlike some baselines (UAP, MarginFinger), AnaFP naturally extends to non-Euclidean domains.\n\n- The paper provides well-designed ablations on surrogate pool size/diversity, quantile relaxation parameters, and the selection of the stretch factor τ. \n\n- The methodology is well structured and enhanced with explanatory figures.", "weaknesses": "- While the authors thoroughly test robustness to model modifications and evaluate discriminability between pirated and independent models, there is no assessment of scenarios with \"unknown\" models or more ambiguous conditions (e.g., surrogate attacks specifically designed to evade fingerprints; adaptive adversaries targeting decision geometry). Similarly, detailed analysis of the potential for false positives in more open-world settings is missing.\n\n- AnaFP's practicality depends on the construction of surrogate pirated and independent pools. While sensitivity to pool size/diversity is empirically analyzed, the method still assumes access to representative pools, which may not always be feasible—especially in dynamic, heterogeneous model deployment ecosystems. There is little discussion of how errors in pool selection could impact the upper/lower bound estimation and thus fingerprint viability.\n \n- Although quantile-based relaxation is well motivated, the chosen quantiles are somewhat arbitrary and task dependent. The method remains sensitive to settings that are not fully justified theoretically.\n\n- The fingerprint creation protocol may incur significant computational costs for large-scale or production systems. There is no empirical profiling of runtime or scalability as the number of fingerprints, surrogates, or model size increases.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "GCxq8GrInf", "reviewer": "Reviewer_UJXn", "summary": "This paper proposes an adversarial-example-based fingerprinting approach for Deep Neural Networks (DNNs). It investigates the fingerprint-to-boundary distance, which is a fundamental challenge in current DNN fingerprinting methods. By introducing a tunable stretch factor and determine the lower and upper bounds of this factor, the authors mathematically define an admissible interval within which the fingerprint-to-boundary distance must lie.", "questions": "The authors claim that selecting high-confidence samples ensures strong uniqueness. However, logically, the closer the fingerprint is to the decision boundary, the more likely it is to ensure uniqueness. In generating adversarial fingerprint samples, a smaller update step size should, in theory, bring the fingerprint closer to the decision boundary. Selecting high-confidence samples as anchors could potentially increase the number of iterations, but this may not necessarily reduce the distance of the generated adversarial fingerprint sample from the decision boundary. If time permits, I would appreciate it if the authors could provide experimental results using mid-confidence or low-confidence examples as anchors.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "The paper is well-written and clearly introduces the challenges associated with current DNN fingerprinting methods as well as the proposed solution. \n\n\nThe paper offers an effective solution for quantitatively characterizing model boundaries for models that function similarly or identically but originate from different sources.", "weaknesses": "The effectiveness of the proposed method heavily depends on the prior knowledge provided by the 120 pirated-independent model pairs in the model pool. To protect a model, it is necessary to construct a model pool, and techniques such as Knowledge Distillation (KD) and Adversarial Training (AT) introduce additional overheads that may limit practical applications.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)