LiteGuard: Efficient Task-Agnostic Model Fingerprinting with Enhanced Generalization
Authors: Guang Yang
Ziye Geng
Yihang Chen
Changqing Luo
Venue: ICLR 2026 Poster (2026)
Keywords: neural network fingerprinting
ownership verification
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Task-agnostic model fingerprinting has recently gained increasing attention due to its ability to provide a universal framework applicable across diverse model architectures and tasks. The current state-of-the-art method, MetaV, ensures generalization by jointly training a set of fingerprints and a neural-network-based global verifier using two large and diverse model sets: one composed of pirated models (i.e., the protected model and its variants) and the other comprising independently-trained models. However, publicly available models are scarce in many real-world domains, and constructing such model sets requires intensive training efforts and massive computational resources, posing a significant barrier to practical deployment. Reducing the number of models can alleviate the overhead, but increases the risk of overfitting, a problem further exacerbated by MetaV's entangled design, in which all fingerprints and the global verifier are jointly trained. This overfitting issue leads to compromised generalization capability to verify unseen models.

In this paper, we propose LiteGuard, an efficient task-agnostic fingerprinting framework that attains enhanced generalization while significantly lowering computational cost. Specifically, LiteGuard introduces two key innovations: (i) a checkpoint-based model set augmentation strategy that enriches model diversity by leveraging intermediate model snapshots captured during the training of each pirated and independently-trained model—thereby alleviating the need to train a large number of pirated and independently-trained models, and (ii) a local verifier architecture that pairs each fingerprint with a lightweight local verifier, thereby reducing parameter entanglement and mitigating overfitting. Extensive experiments across five representative tasks show that LiteGuard consistently outperforms MetaV in both generalization performance and computational efficiency.

Published as a conference paper at ICLR 2026
LITEGUARD: EFFICIENT TASK- MODEL FIN- GERPRINTING WITH ENHANCED GENERALIZATION
Guang Yang', Ziye Geng", Yihang Chen', and Changying Luo? 1 Virginia Commonwealth University, University of Houston yangg2@veu. edu, (zgeng2, ychen165, cluo3] (uh, edu
ABSTRACT
Task-agnostic model fingerprinting has recently gained increasing attention due its ability provide universal framework applicable across diverse model architectures and tasks. The current state-of-the-ar method, MetaV, ensures gener- alization by jointly training
of fingerprints and a neural-network-basee global verifier using two large and diverse model sets: one composed of pirated models (i.e., the protected model and its variants) and the other comprising independently- trained models. However, publicly available models are scarce in many real-world domains, and constructing such model sets requires intensive training efforts and massive computational resources, posing significant barrier to practical deploy- ment. Reducing the number models can alleviate the overhead, but increases the risk of overfitting, problem further exacerbated by Meta entangled design, in which all fingerprints and the global verifier are jointly trained. This overfitting issue leads to compromised generalization capability of verifying unseen models.
In this paper, we propose LiteGuard, an efficient task aag-stgnottcc fingerprinting framework that attains enhanced generalization while significantly lowering com- putational cost. Specifically, LiteGuard introduces two key innovations: (i) a checkpoint- based model set augmentation strategy that enriches model diversity by leveraging intermediate model snapshots captured during the training of each pi- rated and independently-train trained model- alleviating the need to train a large number of pirated and independently-triinn trained models, and (ii) local verifier archi- tecture that pairs each fingerprint with lightweight local verifier. thereby reducing parameter entanglement and mitigating overfitting. Extensive experiments across five representative tasks show that LiteGuard consistently outperforms Meta in both generalization performance and computational efficiency.
INTRODUCTION
Model fingerprinting has been considered a promising technique for safeguarding the ownership of deep neural networks (DNNs) (Chen et al.. 2022 Xu al., 2024 Godinot al.) 2025 /Zhang et all 2025). As valuable digital assets, DNN models often become prime targets for adversaries seeking unauthorized use and redistribution (Cen al. |021 Waheed al. 2024 Stang al.)
2024: Yao et al.) (2025a). For instance, adversaries may steal DNN models and publicly deploy these pirated models as service. To protect the intellectual property (IP) of such DNN models, model fingerprinting exploits a model's inherent characteristics to generate fingerprints during the fingerprint generation stage, and utilizes these fingerprints verify the ownership of suspect models during the fingerprint verification stage. However, adversaries may intentionally evade ownership verification by exploiting ownership obfuscation techniques (Pan al. 2022]] /hao al.) 2024 Xu et al., 20244 Yao all 2025b) to modify the stolen models without degrading their utility. and/or publicly deploying these models as cloud services. To counter such threats, model fingerprinting typically crafts inputs that elicit distinctive model outputs, and uses the resulting input-output pairs as unique fingerprints to verify model ownership.
Researchers have developed model fingerprinting methods that can be broadly categorized into task- siss--pecific and agnostgi approaches. To the best of our knowledge, most existing methods task-specific, with particular focus on classification tasks (Zhao et al. 2020 Cao al. 2021

---

Published as a conference paper at ICLR 2026
Wang et al. 202 Yin et al. 2022 Yang & Lai 2023 Liu & Zhong 2024 Lukas et al. 202 l
Li et al. 2021: Ren et al. 2023; Peng et al. 2022 Guan et al. 2022 Xu et al., 2024: Godinot
et aLl 2025; Tang et al. (222)) For example, many of them leverage adversarial examples to craft
fingerprints that reflect the unique characteristics of a model's decision boundaries (Zhao et al.
2020 Cao et al. [02T [Wang et al.; 2021b Yin et al., 2022 Yang & Lai 2023 Liu & Zhong 2024
Xu et al. 2024; Godinot et al., (025). thereby effectively distinguishing the protected model and its variants from independently-triieee ones. Some works consider evading verification through
ownership obfuscation techniques, such as fine-tuning and pruning (Lukas et al. 2021; Li et al.
202T Ren et al.) 2023). Beyond the classification task, a few recent studies have begun exploring
fingerprinting for non-classification tasks. For instance, You et al. (2024); Waheed et al. (2024) generates fingerprints based on node features and graph topology to protect the ownership of graph neural networks (GNNs). Similarly, other researchers propose training classifiers to learn distinct fingerprints from images produced by Generative Adversarial Networks (GANs) to protect their ownership (Yu et al. 2019 Huang al. 2023). While these task-specific fingerprinting methods have shown effectiveness in ownership protection, their reliance on task-specific characteristics inherently restricts their applicability beyond their target tasks.
In contrast, task-agnostic fingerprinting aims to provide broad applicability across diverse model architectures and tasks. To date, two task-agnostic approaches have been proposed: TAFA (Pan et al., 2021) and MetaV (Yang et al. 2022). However, TAFA assumes ReI.U activations and continuous model outputs, restricting its practical applicability and preventing from being fully task-agnostic. MetaV, by contrast, imposes no architectural assumptions and remains the only fully task-agnostic approach. It adopts an end-to-end framework that jointly trains a set of fingerprints and a neural- network-basse based global verifier. The training utilizes piracy set composed of protected model and its variants and an independence set comprising independently- trained models. During ownership verification, all fingerprints are passed through a suspect model, and the resulting outputs are concatenated and fed into the global verifier to produce a confidence score indicating the likelihood of the suspect model being pirated copy of the protected one.
However, MetaV ensures generalization by heavily relying on access to large and diverse model sets during fingerprint training. In practice, publicly available models are scarce in many real- world domains, and constructing large model sets incurs intensive training efforts and prohibitive computational costs. While reducing the size of the model sets can alleviate computational burden, it significantly increases the risk of overfitting, i.e., the jointly trained fingerprints and global verifier tend to overfit to the limited training models, consequently resulting in poor generalization unseen models. This issue is further exacerbated by the entangled training of all the fingerprints and the verifier. Since a large number of fingerprints is typically required to ensure high verification reliability, this training architecture introduces a substantial number of jointly trained parameters. Consequently, the risk of overfitting to limited training models in both sets further amplified, potentially undermining MetaV's generalization performance.
In this paper, we propose LiteGuard, an efficient task mask-agnostic model fingerprinting method that enhances generalization while maintaining low computational cost. To achieve this, LiteGuard introduces the following two key innovations: (i) Checkpoint-based model set augmentation: Lite- Guard leverages checkpoints-interneddaae intermediate model snapshots saved during the training (Eisenman et al. 2022; Wang et al. 2021a) of each pirated and independently-tramee
model to augment the pirated and independently-rrainee trained model sets. These checkpoints reflect diverse decision be- haviors, enhancing model diversity at no extra computational cost; (ii) Local verifier architecture: Instead of using global verifier that is jointly trained with all the fingerprints, LiteGuard pairs each fingerprint with a lightweight local verifier. While each pair is jointly trained, different pairs are optimized independently, substantially reducing the number of jointly trained parameters. The two novel designs aim to address the overfitting issue caused by reducing the number of training models, thereby enhancing the computational efficiency of the task-agnostic fingerprinting paradigm without compromising generalization. We evaluate LiteGuard on five representative tasks involving multiple types of DNN models. Experimental results demonstrate that LiteGuard consistently surpasses both task-agnostic and task-specific fingerprinting baselines, achieving higher generalization capability and computational efficiency.
2

---

Published as a conference paper at ICLR 2026
2 PROBLEM FORMULATION
We consider a typical model fingerprinting scenario involving two entities: model owner and an adversary. illustrated in Figure []] Specifically, the model owner trains and deploys a proprietary DNN model Mp. To safeguard its ownership, the model owner generates set F of fingerprints by crafting input samples that elicit distinctive responses from Mp. Meanwhile, an adversary gains unauthorized access Mp, e.g.. via model theft, and redistributes this pirated copy as a black-box service that clients can access through an API. In particular, the adversary may apply performance- preserving ownership obfuscation techniques to the stolen model before redistribution, in order to evade ownership verification (Pan et al. 2022 Zhao et al. 2024 Xu et al. 2024).
Upon identifying suspect model Ms, the model owner performs ownership verification determine whether it piracy version of Mp. Concretely, the model owner queries Ms using the fingerprint set FF and analyzes its outputs to determine whether Ms is a piracy version of Mr or an independently-trrinee model.
Pruning Fine Fine-tuning KD
Redistribute
Adversary
Obfuscation Operations
Pirated Model
Steal
Generate
Verily
Fingerprints
Fingerprints
Model
Model Owner
Figure A typical model fingerprinting scenario.
METHODOLOGY
3.1 OVERVIEW
We present LiteGuard, task-agnostic model fingerprinting framework with enhanced generalization capability under the limited computational cost. Specifically, LiteGuard jointly learns a set of fngerprint-verrfier pairs through end-to-end training process. As illustrated in Figure [ LiteGuard consists of the following three components,
Model Set Construction. LiteGuard constructs model sets: an independence set and piracy set. The independence set consists of models independently trained from scratch, along with the checkpoints captured during their training. The piracy set includes the protected model, its checkpoints, and optionally its variants with their checkpoints. By leveraging these checkpoints, LiteGuarr significantly increases model diversity without requiring additional training efforts, thereby enhancing generalization capability at no extra computational cost.
Fingerprint- Verifier Pair Joint Training. Each fingerprint and its paired local verifier are jointly trained using the constructed model sets. Unlike global verifier that processes the joint responses from model to all fingerprints, each local verifier operates solely on the models response to single fingerprint, significantly reducing the number of jointly trained parameters and thus mitigating overfitting.
Ownership Verification. During model ownership verification, each fingerprint is passed through the suspect model to obtain an output, which is evaluated by its corresponding local verifier produce confidence score. The final verification decision is made by averaging the confidence scores across all verifiers.
Model Set Construction
Fingerprint-werifie Joint Training
Ownership Verification
Selected checkpoints of pirated models
Mp
M
Pirated!
Gr
Selected checkpoints of Independent models
x
eggregate
G
Independent
Figure The overview of LiteGuard.
3

---

Published as a conference paper at ICLR 2026
3.2 MODEL SET CONSTRUCTION
Prior to fingerprint generation, we construct two distinct model sets: a piracy set Gp and an indepen- dence set G₁. The piracy set contains protected model and may also include its variants produced by applying ownership obfuscation operations. In contrast, the independence set comprises models that are independently trained from scratch on the same or similar datasets, but with different seeds and/or architectures, thereby ensuring independence from the protected model. To introduce additional diversity for both sets, we capture model models for both sets-and incorporate them into their respective sets.
snapshots saved during training
The Checkpoint Selection Strategy. A typical training process yields a large number of model checkpoints, but using all of them for fingerprint generation is essource-consuming. and often redundant. Thus, we propose principled checkpoint selection strategy that maintains model diversity while reducing resource compsumption. Specifically, starting from epoch es. uniformly sample checkpoints throughout training, selecting one every epochs until the end of training. Choosing e, is crucial: checkpoints from the early stage often produce near-random predictions and lack meaningful decision behavior, while those near the final epoch tend to resemble the converged model and thus contribute little additional diversity. This approach reduces redundancy among adjacent checkpoints while ensuring sufficient diversity.
3.3 JOINT TRAINING OF FINGERPRINT- VERIFIER PAIRS
At this stage, we aim to construct a set of N fingerrrin--erifier pairs, each consisting of fingerprint and lightweight verifier. These pairs are trained using the piracy set 9p and the independence set G1, with the objective maximizing their ability to distinguish pirated models from madependently-traiie ones. To mitigate overfitting, we adopt batch-wit training: At each iteration, fingerprint-verifer pair is optimized using two mini-batches K models, denoted as Bp and B,, which are randomly sampled from Gp and Gy, respectively.
Let x denote trainable fingerprint, where is the input space of the models. For each model E Bp J B,, the model output is computed as y =g(x). This output is then evaluated by a corresponding verifier v y - (0, 1), where y is the output space of the models. The verifier is designed as lightweight model comprising linear layer followed by sigmoid activation. Specifically, given a model output E y, the verifier computes v(y) = a( ())))r), where w is trainable weight tensor of the same dimensionality as y, (, represents the Frobenius inner product, and a-)) is the sigmoid function. A binary label s is assigned to each model, where s = models.
indicates pirated models and
indicates independently-traiin
The fingerprint x and verifier e are jointly trained with the objective of minimizing the average binary cross-entropy loss over the pair of sampled model batches. Specifically, the objective function is defined as follows:
[(x, v) Oppoat Liben (ahceoo(MMM))) (MMMM()))
1)+
OP Σ (rcc(((g)(())) K
1)+
ar Σ (bcc((((r(x))) 0), K
grEBp
BrEB,
(I) log(l p) is the binary cross-entropy loss. The weights are
where = chosen to satisfy arot + ap z a1, ensuring a balanced contribution from positive and negative samples to prevent biased optimization. The parameters of both x and v updated using the Adam optimizer (Kingma & Ba 2017) based on the gradients of the objective.
s logp
Upon the completion of training, obtain the fingerprint set F {(x), o ) where each (x% er)) represents a trained fingerrrint-eerfiier pair.
3.4 OWNERSHIP VERIFICATION
At the ownership verification stage, the goal is to determine whether suspect model is pirated copy of the protected model Mp or an independently-
model. To this end, we leverage the learned fingerprint-vene veriffer set J { {(x,, of ) 1 to perform ownership verification.
Given a suspect model Ms. each fingerprint x", is first fed into the model to produce an output Yn Mx(x))) which is then evaluated by the corresponding verifier vy producing confidence
4

---

Published as a conference paper at ICLR 2026
score u (y)m) E (0, 1) that indicates the likelihood of Ms being a piracy version of the protected model Mp. Subsequently, the N confidence scores corresponding to the N fingerprint-verifer pairs
are aggregated by taking their average, i.e., Save = * -m U (Ms(x,,)) After obtaining the averaged confidence score Sung. a verification decision is made by comparing Savg with threshold E (0, 1). If Savg > Ms is determined as pirated copy of Mp, otherwise Ms is classified as an independentl-trraneen model. Formally, the decision rule is defined by Decision(Ms, where 1 [:] is the indicator function, which returns 1 if the condition holds, and O otherwise.
1 [Savg > T].
4 PARAMETER COMPLEXITY ANALYSIS
We analyze the parameter complexity of LiteGuard and MetaV. Here, parameter complexity is defined as the total number of learnable parameters entangled in the joint training architecture of each method. To facilitate this analysis, we introduce the following notation: Let denote the number of parameters per fingerprint, O the model output dimension, and N the total number of fingerprints.
MetaV: V: Entangled Architecture. MetaV adopts an entangled architecture in which all fingerprints trained jointly with global verifier. The global verifier is implemented as L-layer multilayer perception (MLP) with H neurons in each hidden layer. It takes as input the concatenated model outputs corresponding all fingerprints, resulting in input dimension of N O, and maps them to a scalar score. Hence, the number of parameters contained by the global verifier is PMetaV (N 0)- H (L- 2)- 112 + H. Together with N fingerprints, the number of entangled parameters that are jointly trained is Palata
verifier
N F F FMMaa which leads to an overall complexity of PMeav = ONN(F + +0 H) - L).
LiteGu Decoupled Architecture. LiteGuard employs a modular design, where each fingerprint is paired with lightweight, independent local verifier. Each fingerprint-verifie pair consists of F parameters from the fingerprint and from the linear layer of the local verifier that maps the model's ' O Oddimensional output to scalar score. Thus, the number of jointly trained parameters is PLissGuard F + O. Since all pairs are optimized independently, the parameter complexity of this pair
design remains constant, i.c., PLeeeaard= = O(F + +O).
Implications. MetaV's parameter complexity scales with the number of fingerprints N, consequently increasing the risk of overfitting, particularly when N is large. In contrast, LiteGuards decoupled architecture maintains constant parameter complexity independent of N, thereby mitigating the overfitting risk and improving generalization capability.
EXPERIMENTS
We perform systematic experiments to thoroughly evaluate the effectiveness of LiteGuard with the following experimental settings.
Tasks. We consider five typical tasks, each corresponding specific type of neural network architecture and a dataset: (1) image classification using convolutional neural networks (CNNs) on the CIFAR-I00 dataset (Krizhevsky al. (2014), (2) protein property regression using MLPs on the CASP dataset (Rana, (013)) (3) tabular data generation with autoencoders (AEs) on the California Housing (CH) dataset (Pace & Barry 1997), (4) molecular property prediction via GNNs on the
QM9 dataset (Ruddigkeit et al. 2012 Ramakrishnan et al., 2014), and (5) time-series sequence data generation with recurrent neural networks (RNNs) on the Weather dataset (023).
Baselines. We compare LiteGuard with several representative model fingerprinting methods. Specifi- cally, since Meta a task-agoostic approach, we compare LiteGuard with MetaV across all five tasks. Besides, for the molecular property prediction task, we also include GNNFingers (You et al.) (024)), method specifically tailored for GNNs. For the classification task, besides Meta we additionally compare LiteGuard with several representative existing methods, including IPGuard (Cao al.) 2021), which utilizes near- boundary samples that capture unique model behaviors as fingerprints, UAP (Peng et al. 2022), which is based on universal adversarial perturbations, and ADV-TRA (Xu et all 2024). which employs adversarial trajectories that encode richer decision boundary information to achieve enhanced verification reliability.
5

---

Published as a conference paper at ICLR 2026
Table 2: AUCs achieved by different approaches across five tasks (difffrent model types and datasets).
Method
CNN/CIFAR- 100
MLPICASP
AE/CH
GNN/QM9
RNN/Weather
UAP
0.752 1 0.045
IPGuard
0.708 1 0.055
ADVTRA
0.845 + 0.010
GNNFingeTs
0.608 + 0.165
MetaV
0.676 + 0.019
0.824 + 0.008
0.783
0.029
0.598 = 0.108
0.854 = 0.022
LiteGuard
0.936 0.007
0.902 0.007
0.977 0.001
0.803 + 0.003
0.971 = 0.004
Ownership obfuscation techniques. We consider six representative ownership obfuscation tech- niques: pruning, fine-tuning, knowledge distillation (KD), noise injection followed by fine-tuning (N-finetune), pruning followed by fine-tuning (P- (e-fintuune), and adversarial fine-tuning (A-finetune).
Model set construction. For each task, we designate a protected model, and construct four model sets facilitate the training and testing of our method phase demanding both a piracy set and an independence set. Specifically, unless otherwise specified in experimental settings, we adopt extreme setting for the training phase, wherein each model set contains only single trained model: the piracy set consists of the protected model, while the independence set consists of one independently-traine
model. This is the highest-efficieng scenario with minimal training overhead, enabling direct evaluation of LiteGuards capability to mitigate overfitting and improve generalization. Furthermore, augment both sets by incorporating checkpoints saved during models. Table summarizes the
the training process of the protected and independently-rraieed checkpoint selection configurations for each model type. For the testing phase, we construct large and diverse model sets that are entirely disjoint from those used in training: the piracy set comprises 91 models, including the protected model and 15 variants for each of six ownership obfuscation techniques, each generated using different random seeds, while the independence set consists of 100 models trained from scratch using varying architectures and random seeds. The testing model sets for experimental evaluation are completely disjoint from the model sets used for fingerprint generation, ensuring that the performance is assessed solely on previously unseen models.
Evaluation Metric. We employ the Area Un- der the Receiver Operating Characteristic Curve (AUC) our primary evaluation metric when assessing the effectiveness of LiteGuard. More specifically, AUC measures the likelihood that handomly-choseer pirated model is assigned higher confidence score than a randomly- independently- -traiiee model, thereby quantify- ing the capability of a fingerprinting method to discriminate pirated models and independently-tren -trained models. A higher AUC value generally indi- cates stronger verification performance, and an AUC of 1.0 represents perfect discrimination between pirated and independently-trainn trained models. In the experiments, report the mean and standard deviation of AUCs over five independent runs.
Table 1: Configurations of checkpoints selection for each model type: start epoch e.. selection in- terval and total training epochs E.
CNN
MLP
AE
GNN
RNN
20
6
12
6 60/120
e//E
400/600
60/120
60/120
180/300
Other Implementation Details. To evaluate LiteGuard, set the loss weights Aprot, ap,, and ai to be 0.5, 1.0, and 1.5. respectively, and use a batch size = 1. We set the number of fingerprints to N = 100 across all methods, consistent with the setting in MetaV (Pan al. (022).. We train
LiteGuard under the same training protocol used in MetaV, V, including using the Adam optimizer (Kingma & Ba 2017) with learning rate of 0.001 and 1000 training iterations.
5.1 EFFECTIVENESS OF OUR PROPOSED METHOD
The Generalization Capability of LiteGuard. We evaluate LiteGuards generalization capability by assessing its effectiveness in distinguishing unseen pirated models from unseen independentll-traine models in the testing phase, under a highly constrained training setting where only a single model is used in each model set during fingerprint training. Table pereset] the AUCs achieved by LiteGuard and various baselines across five representative tasks. Specifically. LiteGuard achieves the state-of- the-art performance on all five tasks, outperforming both task-specific baselines (i.e., UAP, IPGuard,

---

Published as a conference paper at ICLR 2026
ADVTRA, and GNNFingers) and the task-agnostic baseline (i.e., MetaV). Particularly, LiteGuard, as a task- agnostic approach, surprisingly outperforms task- specisic methods that are specifically tailored for their target tasks, underscoring its consistent effectiveness across different domains. Compared to MetaV, LiteGuard yields substantial improvement AUC: 34.5% on the image classification task, 9.5% the protein property regression task, 24.9% the tabular data generation task, 34.3% on the molecular prediction task, and 13.7% on the time-series sequence generation task. These results demonstrate LiteGuard's significantly enhanced generalizability.
We further plot the Receiver Operating Characteristic (ROC) curves and the distribution of confidence scores illustrate the discriminative power LiteGuard. The ROC curve depicts the relationship between true positive rate (TPR) and false positive rate (FPR) across different thresholds, offering holistic view methods ability to distinguish pirated models from independent ones. curve closer to the top-left corner indicates stronger discriminative power. As shown in Figure a), LiteGuard achieves the most favorable ROC profile on the image classification task, closely approaching the ideal top-left point and outperforming all baselines. In contrast, MetaV's ROC curve lies much closer to the diagonal, reflecting its limited discriminative power under the constrained training setting. On the other hand, also present the distribution of confidence scores for pirated and independently- -raaaddd models through boxplots Figure B].. A larger separation between the score distributions of pirated and independently-trainee a method. LiteGuard yields two clearly separated distributions with minimal overlap, indicating a strong ability distinguish pirated models from independentl-traiie ones, By comparison, other methods-eee esppcill- verify model ownership.
3
models implies higher discriminative power of
significant overlap, revealing their limited ability to reliably
The Computational Efficiency of LiteGuard.
1.0
The Rostive Rate
Confl fidennncc STATI
Figure demonstrates LiteGuard's computational efficiency by measur- ing the mean AUC (depicted as solid line) and the standard deviation (shown as a shaded area) across vary- ing numbers of trained models each model set used for training fingerprint- verifier pairs. We evaluate efficiency with respect to the number of trained models because such training opera- tions dominate the computation cost for both MetaV and LiteGuard. Our comparison focuses two tasks: the molecular property prediction task (GNN/QM9) and the protein property regression task (MLP/CASP). For LiteGuard, we vary the number of trained models in both sets from and augment each set with checkpoints to ensure fixed size of 10 models, which incur negligible additional cost. For MetaV, we consider three configurations with 1, 10, and n 30 trained models per set.
0.c
ADVTRA
Netall
UP
Ratadd
UtcOuard
0.0
Indepandent
0.0
0.2
0.4
0.6
0.5
10
Biound
ADVTRA
LPP
IiteGuued
Palse Posltive Rate
(a)
(b)
Figure 3: (a) The ROC curve and (b) the confidence score distribution.
As shown Figure [), on the molec- ular property prediction task, Lite- Guard achieves an AUC 0.858 us- ing 2 trained models per set, out- performing MetaV's AUC 0.849 obtained using 10 trained models per set, this corresponds to around fxfewer model training cost. With 5 trained models, LiteGuard'ss AUC further improves 0.944, nearly matching MetaV's performance at = 30-a model training cost reduc- tion. A similar trend is observed in Figure (b) for the protein property regression task, where LiteGuard with even trained model outperforms Meta V's performance (000000000000 (10xreduction), and with 5 models, matches Meta V's AUC at n 30 (6 (6xreduction). These results demonstrate that LiteGuard achieves superior owner-
1.0
0.85
5 0.u5
0.7
Vetal (pa))
Netay's (ta Matal' (tw10)
Picay (1-10)
0.80
0.6
Patall (1-30)
Liteciont
each Libquurr
Number Itained
(a)
Figure 4: The AUCs achieved by MetaV and LiteGuard on (a) the molecular property prediction task (GNN/QM9) and (b) the protein property regression task (MLP/CASP).
10
7

---

Published as a conference paper at ICLR 2026
Table 3: AUCs under various ownership obfuscation techniques across various tasks.
Model/Datasel
Method
Pruning
Finetuning
KD
N-finetune
P-finetume
A-finetume
UAP
0.731 0.068 0,903 = 0.003 0.703 : 0.072 0.642 +: 0.054 0.752 : 0.050 0.780 0.066
IPGuard
0.742 0.078 0.990 -0.111 0.581 1: 0.030 0.720 1 0.024 0.653 0.017 0.561
0.027
CN
ADVTRA
0.887 0.011 0.993
-0.05 0.816 1 0.008 0.726 + 0.009 0.897 + 0.015 0.869
0,011
MetaV
0.728 0.030 0.776
0017 0.603 + 0.022 0.707 + 0.013 0.681 + 0.012 0.511
0.018
LiteGuard
0.955 0.007
0.996
0.002
0.786 4: 0.009 0.986 1: 0.005 0.975 0.010 0.980 0.004
MetaV
0.997 0.005
0.988
0.010
0.520 0.038 0.987 + 0.015 0.697 0.070
0.886 0.056
MLPICASP
LiteGuard
0 0.013 1.000
0.000
0.534 1: 0.004 1.000 1: 0.000 0.985 0.003 0.978 0.002
AE/CH
MetaV
0.655
0.015
0.826
0.051
0.798 +: 0.022 0.812 + 0:025 0.779 0.022
0.801 0.005
LiteGuard
0.927 0.005
0.992 0.000 0.991 +: 0.000 0.991 +: 0.001 0.975 1: 0.001 0.991 0.000
GNNFingers
0.688
0.111 0.637
0.266
0.506 + 0.105 0.589 + 0.196 0.621 + 0.125 0.623 0.031
GNN/QM9
MetaV
0.673
0.047 0.601 = 0.162 0.550 + 0.020 0.580 1: 0.164 0.681 +: 0.098 0.601 + 0.022
LiteGuard
0.984 0.001 0.834 0.005 0.645 + 0.005 0.791 + 0.003 0.812 0.004 0.770 0.002
RNN/Weather
MetaV
0.870
0.018
0.816 = 0.030
0.922 + 0.018 0.835 + 0.016 0.835
0.023
0.762 0.021
LiteGuard
0.988 0.000 0.964 0.007 0.991 :: 0.003 0.962 + 0.005 0.957 0.006 0.947 0.002
ship verification performance while requiring much fewer trained models, thus yielding substantial computational savings.
Robustness to Ownership Obfuscation Techniques.
We evaluate the robustness of LiteGuard against a range of ownership obfuscation techniques (i.e., pruning, fine-tuning, KD, N-finetune, P-finetune, and A-finetune). The corresponding results summarized in Table 3 It can be observed that LiteGuard consistently outperforms all baseline methods in most cases, demonstrating strong robustness against various ownership obfuscation techniques. Specifically, for the image classification task (CNN/CIFAR-100)) LiteGuard achieves near-perfect verification performance under four of the six techniques, achieving AUCs of 0.996 (Finctuning), 0.986 (N-finetune), 0.975 (P-finetunc), and 0.980 (A-finetune). It also maintains strong performance under pruning (0.955) and exhibits competitive robustness against the more challenging KD (0.786). Particularly, compared to Meta LiteGuard shows substantial improvements in AUC under all six obfuscation techniques-named 39.5% (N-finetune), 43.2% (P-finetune), and 91.8% (A-finetune). Beyond the image classification task, LiteGuard also demonstrates superior robustness across the other four tasks. For instance, on the tabular data generation task (AE/CH), LiteGuard achieves 41.5% higher AUC than MetaV under pruning, and on the molecular property prediction task (GNN/QM9), it outperforms MetaV by 38.8% under fine-tuning. An exception is observed in the protein property regression task (MLP/CASP) under pruning, where both LiteGuard and Meta yield comparable AUCs. These results underscore LiteGuard's 's strong robustness against broad range of ownership obfuscation techniques.
31.1% 1% (Pruning), 28.4 28.4% (Finetuning). 30.3% (KD),
5.2
ABLATION STUDIES
0.95
0.05
0.9
0.65
0.7
Natal Sheckporets
Steckpoirts
0.00
Matel/ checkports
UiteGard checkpointr
Notay of Checkipiinss
Liel.ard cpontc
0.80
MetaV vi checkpoliis
UisCuard sn chackpeints
Uiclaard Chackpannt
UitCuard velo checkports
Leee, and with cteckpalnte
LiteCcand witn checkport
Netav with checkpoines
Metal wis checkpo niss
Nolav wit chokppertts
Metol volo chockpo rts.
0.6
2
30
0.70
G
12
30
330
0.70
10
25
60
110
Serectioon Intervel
Selection Intervali
Selection Start Epesc my
Serucctinn Start Esoch
(a)
(b)
Figure 5: The AUCs under varying checkpoint selection intervals I for (a) tabular data generation task (AF/CH) and (b) time-series sequence generation task (RNN/Weather). The AUCs under varying start epoch e, for (c) tabular data generation task (AE/CH) and (d) time-series sequence generation task (RNN/Weather).
Impact of the Checkpoint-based Augmentation. We evaluate the impact of checkpoint-based augmentation and its configuration parameters on discriminative capability. More specifically, we vary the selection interval and the starting epoch eg. Besides, to assess whether MetaV can benefit from incorporating checkpoints, we also extend its implementation with checkpoint augmentation. The experimental results are shown in Figure(5) in which solid lines represent methods with checkpoint augmentation, while dashed lines represent the corresponding methods without it.
8

---

Published as a conference paper at ICLR 2026
Figure 5 a), (b), (c), and (d) show the impact of varying selection interval I and varying selection start epoch cg on the tabular data generation task and the time-series sequence generation task, respectively. We can from the sub-figures that for both LiteGuard and MetaV, the solid lines always above the corresponding dashed lines, demonstrating that introducing extra checkpoints to the piracy and independence sets increases diversity and thus enhances discriminative power. These results suggest that checkpoint-basee augmentation is generally effective strategy for enhancing generalization capability.
Figure 5[a) and (b) show the impact of varying selection interval I with fixed start epoch e, on both tasks. A clear decline AUC is observed when / increases from 6 to 30, as a larger interval yields fewer available checkpoints and thereby limits the diversity of the model set. In contrast, when the interval decreases from 6 to 2, the performance quickly saturates since close checkpoints provide limited additional diversity.
Figure ((c) and (d) show the impact of varying selection start epoch e, with fixed interval I on both tasks. Adopting an early start epoch (e.g., 6, 10) lowers AUCs because early-stage models behave almost randomly and lack meaningful decision behaviors. Using a late start epoch (e.g., e. = 110) also exhibits a similar performance degradation, as such checkpoints are close to the converged model and contribute little diversity. The best results occur with moderate e, values (e.g., 3585). which avoid noisy early checkpoints while retaining sufficiently diverse intermediate ones. Particularly, the AUCs achieved when es = 10 are always higher than those achieved when e 110, since early start still includes mid- and late-stage checkpoints and thus preserves sufficient diversity, whereas a late start is restricted to overly similar checkpoints.
Impact of the Verifier Design. Fig- ure 6 shows the effect of the verifier design on the discriminative power across two tasks. In the experiment, we consider four configurations: Lite- Guard, MetaV, LiteGuard-MV (Lite- Guard using MetaVs verifier), and VeLV (MetaV using LiteGuards verifier). As shown in the figure, Lite- Guard achieves the highest AUC on both tasks, outperforming all other configurations. On the image clas- sification task, LiteGuard attains an AUC of 0.936, substantially exceed- ing LiteGuard-MV (0. (0.809), MetaV (0.676), and MetaV-LV (0.793). A similar trend is observed in the time-series task, where LiteGuard achieves an AUC of 0.977, while LiteGuard-MV drops to 0.908. MetaV achieves an AUC of 0.854, which is substantially improved to 0.959 when equipped with LiteGuard's verifier. Therefore, these results clearly reveal the importance of LiteGuard's verifier design in enhancing discriminative capability.
LibeSuar
Melt LibeSuard-IV Hetav
0.9
Herriv
0.8
0.5
Uhauuad LIbGGavrd--VV
Meeal
Netes-LV
Utsoward UtsCuarc-MM
MetaViir
(a)
(b)
Figure 6: The AUCs under different verifier designs for (a) the image classification task (CNN/CIFAR-100) and (b) the time-series sequence data generation task (RNN/Weather).
Impact of the Fingerprint Set Size. Figure demonstrates the impact of the fingerprint set size on the verifi- cation performance. As previously discussed, MetaV's performance is highly sensitive to the number of fin- gerprints. To assess whether Lite- Guard exhibits similar behavior, conduct experiments on the tabular data generation task and the protein property regression task. The experi- mental results in Figure reveal that LiteGuard achieves a monotonic in- crease in AUC as the number of fingerprints grows, with consistently decreasing standard deviations, indicating stable performance improvements. This observation reveals that LiteGuard benefits from the increased number of fingerprints without suffering from overfitting. contrast, Meta shows a fluctuating and non- mon-monotonic trend. While it initially gains from moderate increase in the number
0.9
0.90
mm
0.0
UteSuard
0.75
UteSuard
06
10
150
077
50
300
150
Number of Aineerointss
Number of fingerprints
(b)
Figure 7: The AUC under varying numbers of fingerprints for (a) the tabular data generation task (AE/CH) and (b) the protein property regression task (MLP/CASP).

---

Published as a conference paper at ICLR 2026
of fingerprints, its performance deteriorates beyond certain point. This suggests that MetaV's entan- gled fingerprints-goobe verifier design introduces susceptibility to overfitting when the fingerprint set becomes large. Consequently, Meta requires careful tuning of the fingerprint set size, which is non-trivial in practice.
6 DISCUSSION: A UNIFIED VERIFIER
MetaV's global verifier and LiteGuards local verifiers represent two extremes along a broader design spectrum for aggregating fingerprints for ownership decisions. A natural approach is to design unified verifier paradigm: partition the fingerprint set into multiple groups, with each group sharing lightweight verifier that jointly processes the concatenated outputs of the fingerprints within that group. This design retains the ability to model cross-fingeres fingerprint interactions through joint verification, while mitigating the full parameter coupling and overfitting risks that arise when the available model pool is limited. At the same time, it generalizes the fully decoupled local-verifier strategy by allowing controlled coupling within groups, offering practical mechanism balance generalization, robustness, and computational efficiency.
7 CONCLUSIONS
In this paper, we present LiteGuard, a task-agnostic model fingerprinting method that offers enhanced generalization capability under high-efficiency settings where the number of trained models in the piracy and independence sets is limited, addressing the generalization issue suffered by Meta By leveraging checkpoint-based model set augmentation and a modular local verifier architecture, LiteGuard significantly improves model diversity and verification robustness without incurring extra computational costs. Experimental results across various tasks demonstrate that LiteGuard achieves superior verification performance, outperforming MetaV in both generalization performance and computational efficiency. These results highlight LiteGuard's practical value as an efficient task-agnostic fingerprinting method.
REFERENCES
Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. IPGuard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary. Proceedings of the 2021 ACM Asia Conference Computer and Communications Security, 2021.
Jialuo Chen, Jingyi Wang, Tinglan Peng, Youcheng Sun, Peng Cheng, Shouling Ji, Xingjun Ma. Bo Li, and Dawn Xiaodong Song. Copy, Right? A testing framework for copyright protection of deep learning models. In Proceedings of 2022 IEEE Symposium Security and Privacy (S&P) P), pp. 824-841, 2021.
Yufei Chen, Chao Shen, Cong Wang, and Yang Zhang. Teacher model fingerprinting attacks against transfer learning. In Proceedings of 31st USENIX Security Symposium (USENIX Security 22), pp- 3593-3610, Boston, MA, 2022.
Assaf Eisenman, Kiran Kumar Matam, Steven Ingram, Dheevatsa Mudigere, Raghuraman Krish- namoorthi, Krishnakumar Nair, Misha Smelyanskiy, and Murali Annavaram. Check-N-Ree checkpointing system for training deep learning recommendation models. In 19th USENIX Sympo- sium on Networked Systems Design and Implementation, pp. 929-943 Renton, WA, 2022. ISBN 118-1-9391133-27-2
Jianwei Fei, Yunshu Dai, Zhihua Xia, Fangjun Huang, and Jiantao Zhou. Omnimark: efficient and scalable latent diffusion model fingerprinting. In Proceedings of the Thirty-Ninth AAAI Conference Artificial Intelligence and Shiiry-Seventte Conference Innovative Applications of Artificial Intelligence and Fifteenth Symposium on Educational Advances in Artificial Intelligence, 2AAEIAAAA"///AAA22220 AAAI Press, 2025. ISBN 777-1157773--997
Augustin Godinot, Erwan Le Merrer, Camilla Penzo, Francois Taiani, and Gilles Tredan. Queries, representation & detection: The next 100 model fingerprinting schemes. Proceedings of the AAAI Conference Artificial Intelligence, 39(16): 1667--1611188 Apr. 2025.
10

---

Published as a conference paper at ICLR 2026
Jiyang Guan, Jian Liang, and Ran He. Are you stealing my model? sample correlation for fingerprint- ing deep neural networks. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho (eds.), Proceedings of Advances in Neural Information Processing Systems, 2022.
Ziheng Huang, Boheng Li, Yan Cai, Run Wang, Shangwei Guo, Liming Fang, Jing Chen, and Lina Wang. What can discriminator do? towards box-free ownership verification of generative adversarial networks. In 2023 IEEE/CVF International Conference on Computer Vision (ICCV), pp. 4986-4996, 2023.
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization, 2017.
Alex Krizhevsky, Vinod Nair, Geoffrey Hinton, et al. The CIFAR-100 dataset. online: http://www. cs. toronto. edu/kriz/cffar html, 55(5):2, 2014.
Yuanchun Li, Ziqi Zhang, Bingyan Liu, Ziyue Yang, and Yunxin Liu. ModelDiff: testing-based DNN similarity comparison for model reuse detection. In Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, 2021.
Weixing Liu and Shenghua Zhong. MarginFinger: Controlling generated fingerprint distance to classification boundary using conditional gans. In Proceedings of the 2024 International Conference on Multimedia Retrieval, 2024.
Nils Lukas, Yuxuan Zhang, and Florian Kerschbaum. Deep neural network fingerprinting by conferrable adversarial examples. Proceedings of 2021 International Conference on Learning Representations, 2021.
NCEL
Local climatological data (led). 2023.
http:://ww..ool..roaa..//////
local -
local-cll
R. Kelley Pace and Ronald Barry. Sparse spatial autoregressions. Statistics and Probability Letters, 33(3)2291-297, 1997.
Xudong Pan, Mi Zhang, Yifan Lu, and Min Yang. TAFA: A task-agnostic fingerprinting algorithm for neural networks. In I Proceedings of European Symposium on Research in Computer Security, 2021.
Xudong Pan, Yifan Yan, Mi Zhang, and Min Yang. MetaV: A meta-verifier approach to task-agnostic model fingerprinting. In Proceedings of the 28th ACM SIGKDD Conference Knowledge Discovery and Data Mining, 2022.
Zirui Peng. Shaofeng Li, Guoxing Chen, Cheng Zhang, Haojin Zhu, and Minhui Xue. Fingerprinting deep neural networks globally via universal adversarial perturbations. In Proceedings of 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 13420-13429, 2022.
Raghunathan Ramakrishnan, Pavlo O. Dral, Matthias Rupp, and O. Anatole von Lilienfeld. Quantum chemistry structures and properties of 134 kilo molecules. Scientific Data, 1:140022, 2014.
Prashant Rana. Physicochemical Properties of Protein Tertiary Structure. UCI Machine Learning Repository, 2013.
Huali Ren, Anli Yan, Xiaojun Ren, Pei gen Ye, Chong zhi Gao, Zhili Zhou, and Jin Li. GanFinger: Gan-based fingerprint generation for deep neural network ownership verification. ArXiv, 2023.
Lars Ruddigkeit, Ruud van Deursen, Lorenz C. Blum, and Jean-Louis Reymond. Enumeration of 166 billion organic small molecules in the chemical universe database gdb-17. Journal of Chemical Information and Modeling, 52(11): 2875, 2012.
Jasper Stang, Torsten KrauSS, and Alexandra Dmitrienko. Dnnshield: Embedding identifiers for deep neural network ownership verification, 2024.
Ling Tang, YueFeng Chen, Hui Xue, and Quanshi Zhang. Towards the resistance of neural network fingerprinting to fine-tuning. In The Thith Annual Conference on Neural Information Processing Systems, 2025. URL

---

Published as a conference paper at ICLR 2026
Asim Waheed, Vasisht Duddu, and N. Asokan. Grove: Ownership verification of graph neural net- works using embeddings. In 2024 IEEE Symposium on Security and Privacy (SP), pp. 2460-2477, 2024.
Feng Wang, Guoyizhe Wei, Qiao Liu, Jinxiang Ou, xian wei, and Hairong Lv. Boost neural networks by checkpoints. In Advances in Neural Information Processing Systems (NeurIPS 2/"), volume 34, pp. 19719-19729. Curran Associates, Inc., 2021a.
Siyue Wang, Xiao Wang. Pin-Yu Chen, Pu Zhao, and Xue Lin. Characteristic examples: High- robustness, low-transferabillty fingerprinting of neural networks. In Proceedings of International Joint Conference on Artificial Intelligence, 2021b.
Tianlong Xu, Chen Wang, Gaoyang Liu, Yang Yang, Kai Peng, and Wei Liu. United we stand, divided fall: Fingerprinting deep neural networks via adversarial trajectories. In Proceedings of Neural Information Processing Systems, 2024.
Kan Yang and Kunhao Lai. NaturalFinger: Generating natural fingerprint with generative adversarial networks. ArXiv, 2023.
Kan Yang, Run Wang, and Lina Wang. MetaFinger: Fingerprinting the deep neural networks with meta-training. In Proceedings International Joint Conference Artificial Intelligence, 2022.
Lingfeng Yao, Chenpei Huang, Shengyao Wang. Junpei Xue, Hanqing Guo, Jiang Liu, Xun Chen, and Miao Pan. Speechverifier: Robust acoustic fingerprint against tampering attacks via watermarking. arXiv preprint arXiv:2505.2382 2025a.
Lingfeng Yao, Chenpei Huang, Shengyao Wang, Junpei Xue, Hanqing Guo, Jiang Liu, Phone Lin. Tomoaki Ohtsuki, and Miao Pan. Yours or mine? overwriting attacks against neural audio watermarking. arXiv preprint 1xXiv:25090088355 2025b.
Zhaoxia Yin, Heng Yin, and Xinpeng Zhang. Neural network fragile watermarking with no model performance degradation. In Proceedings of 2022 IEEE International Conference Image Processing (ICIP), pp. 9958-3962. 2022.
Xia Zheng You, Youhe Jiang, Jianwei Xu, Mi Zhang, and Min Yang. GNNFingers: A fingerprinting framework for verifying ownerships of graph neural networks. In Proceedings of the ACM on Web Conference 2024, 2024.
Ning Yu, Larry S Davis, and Mario Fritz. Attributing fake images to gans: Learning and analyzing gan fingerprints. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 7556-7566, 2019.
Zhuomeng Zhang, Fangqi Li, Hanyi Wang, and Shi-Lin Wang. Boosting the uniqueness of neural networks fingerprints with informative triggers. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025.
Boyao Zhao, Haozhe Chen, Jie Zhang, Weiming Zhang, and Neng Yu. Dual-verification-bai model fingerprints against ambiguity attacks. Cybersecur, 7:78, 2024.
Jingjing Zhao, Qin Hu, Gaoyang Liu, Xiaoqiang Ma, Fei Chen, and Mohammad Mehedi Hassan. AFA: Adversarial fingerprinting authentication for deep neural networks. Comput. Commun., 150: 488-497, 2020.
12

---

Published as a conference paper at ICLR 2026
Table 4: 95% confidence intervals (CI) for AUCs by different approaches across five tasks (different model types and datasets).
Method
CNN/CIFAR-100
MLP/CASP
AE/CH
GNN/QM9
RNN/Weather
UAP
[0.696, 0.808]
IPGuard
[0.640, 0.776]
ADVTRA
[0.833, 0.857]
GNNFingers
[0.403, 0.813]
MetaV
[0.652. 0.699]
[0.814, 0,834] [0.747. 0.819]
[0.464 0.732]
[0.827, 0.881]
LiteGuard
[0.927, 0.945]
[0.893, 0.911] [0.976. 0.978]
(0.799, 0.807]
[0. (0.966, 0.976]
Table 5: 95% confidence intervals (CI) for AUCs under various ownership obfuscation techniques
across various tasks.
Dataset
Method
Pruning
Finetuning
KD
N-Finetune
P-Finetune
A-Finetune
UAP
[0.647, 0.815]
[0.899. 0.907]
[0.614,0. 0.792]
[0.575, 0.709]
[0.690, 0.814]
[0.698, 0.862]
IPCuard
[0.645, 0.839]
[0.976, 1.004]
[0.544, 0.618]
[0.690, 0.750]
[0.632, 0.674]
[0.527, 0.595]
CNNVCIFAR- 100
ADVTRA
[0.873, 0.901]
[0.987, 0.999]
[0.806, 0,826]
[0,715, 0.737]
[0.878, 0.916]
[0.855, 0.883]
Meta'V
[0.691, 0.765]
[0.755,
0.797]
[0.576, 0.630)
[0.691, 0.723)
[0.666, 0.696]
[0.489, 0.533]
LiteGuard
[0.946, 0.964]
[0.994, 0.998]
[0.775, 0.797]
[0,980, 0.992]
[0.963, 0.987]
[0.975, 0.985]
MetVV
[0.991. 1.003]
[0.976,
1,000]
[0.473, 0.567]
[0.968,
1.006]
[0.610, 0.784]
[0.816, 0.956]
MLPICASP
LiteGuard
[0.965, 0.997]
[1.000, 1.000]
[0.529, 0.539]
[1.000, 1.000]
[0.981, 0.989]
[0.976, 0,980]
MetaV
[0.636, 0.674]
[0.763. 0.889]
[0.771. 0.825]
[0.781, 0.843)
[0.752, 0.806]
[0.795. 0.807]
AE/CH
LiteGuard
[0.921, 0.933]
[0.992, 0.992]
[0.991, 0.991]
[0,990, 0.992]
[0.974, 0.976]
[0.991, 0.991]
GNNFingers
[0.550, 0.826]
[0.307. 0,967]
[0,376, 0.636]
[0.346, 0.832]
[0.466, 0.776]
[0.585, 0.661]
GNN/QM9
VetaV
[0.615, 0.731]
[0.400, 0,802]
[0.525, 0.575]
[0.376, 0.784]
[0.559, 0.803]
[0.574, 0.628]
LiteGuard
[0.983, 0.985]
[0.828, 0.840]
[0.639, 0.651]
[0.787, 0.795]
[0.807, 0.817]
[0.768, 0.772]
MetaV [0.848, 0.892]
[0.779. 0 0.853]
[0. 900900,000 0.944]
[0.815, 0.855]
[0.806, 0. 0.864]
[0.736, 0.788]
RNN/Weather
LiteGuard
[0.988, 0.988]
[0.955, 0.973]
[0.987, 0.995]
[0.956, 0.968]
[0.950, 0.964]
[0.945, 0.9491
APPENDIX
A THE CONFIDENCE INTERVALS FOR AUC RESULTS
Table presents the 95% Confidence Intervals (CIs) for the AUCs of LiteGuard and various baselines across five representative tasks, and Table summarizes the 95% CIs for the AUCs of LiteGuard and various baselines across a range of ownership obfuscation techniques. From both tables, we can observe that LiteGuard's 's confidence intervals do not overlap with those of MetaV and other baselines across all datasets and obfuscation settings. This observation highlights that LiteGuard's 's performance improvement is statistically significant.
B A UNIFIED VERIFIER DESIGN
We assess the unified verifier design examining how its performance changes as the number of fingerprints per group varies. Specifically, we divide the N fingerprints into multiple groups of size M, assigning one verifier to each group. When M = 1, the design reduces to LiteGuards local-verifier architecture; when M N. it becomes MetaVs global verifier. Each group-level verifier is trained jointly with the M fingerprints in its group and takes as input the concatenated outputs of these fingerprints produce the corresponding ownership decision.
We evaluate this unified framework on the CNN/CIFAR- 100 task by fixing N = 100 and varying the group size M E {1, 5, 10, 50). The experimental results are summarized in Table Empirically, we observe that partially shared verifiers do not outperform fully independent local verifiers, evidenced by the highest AUC obtained at M 1. As M increases, i.c., more fingerprints sharing the same verifier, AUC gradually decreases due to the reintroduction of jointly optimized parameters, which increases overfitting risk when only a small number of training models is available.
13

---

Published as a conference paper at ICLR 2026
Table 6: AUC under different group sizes.
M
AUC
0.936 = 0.007
2 0.932 - 0.007
5 0.925 = 0.011
10 0.906 = 0.014
50 0.853 = 0.023
C DISCUSSION ON BIAS AND VARIANCE
We discuss how checkpoint-based augmentation and local verifier design influence bias and variance. Checkpoint-basee augmentation increases the diversity of model behaviors that each fingerprint- verifier pair encounters during training, which makes the learned decision rule less sensitive to any single model and therefore reduces variance. Modularity further lowers variance by reducing the number of jointly trained parameters, which is crucial when the number of available training pair
models is limited. Bias is not the limiting factor in this setting, as the Angerprint-verifie already offers sufficient expressive power for the binary discrimination task. This is evidenced by the experimental results on GNN/QM9 summarized in Table 7 where deeper verifier architectures do not yield performance gains. Instead, they reduce AUC, indicating that the added capacity increases the number of jointly optimized parameters and ultimately harms generalization.
Table 7: Impact of verifier depth on the verification performance.
Verifier Depth
AUC (QM9)
layer
0.803 + 0.003
2 layers
0.792 + 0.007
3 layers
0.766 + 0.021
4 layers
0.725 = 0.078
D THE EFFICIENCY ANALYSIS
The execution time of task-agnostic fingerprinting comes from two sources: the query-time overhead and the training time. For the query-time overhead, same as V, LiteGuard also requires exactly one forward pass per fingerprint, and its verification consists of simple aggregation of local-verifier outputs, leading to negligible computational cost. Instead, the training time is the dominant execution cost in task-agnostic fingerprinting, as pirated and independently-ree -tranned models need be trained for constructing the two model sets.
Therefore, LiteGuard's 's computational efficiency stems from its ability to dramatically reduce the number of trained models required. Figure [highlights these savings. On the QM9 task. LiteGuard achieves an AUC 0.858 with only trained models per set, surpassing MetaV's AUC of 0.849 obtained with 10 trained models-a a 5 x reducction in training cost. With 5 trained models, LiteGuard reaches an AUC of 0,944, closely matching MetaV's performance with 30 models, yielding a rxdduction,. A similar pattern appears the CASP regression task: LiteGuard with just I trained model exceeds MetaV's performance at 10 models (a 10 redeucction and with models matches MetaV V at 30 models (a 6 reductioon These results demonstrate that LiteGuard achieves -elvel performance while requiring far fewer trained modelsthe dominant source of computational cost.
E KEY DIFFERENCES BETWEEN LITEGUARD AND PRIOR WORKS
Table summarizes the comparison of fingerprint methods along three key axes, including task- agnostic, model-set training cost, and verifier decoupling.
14

---

Published as a conference paper at ICLR 2026
Table 8: Comparison of fingerprinting methods along three key axes.
Method
Task-agnostic Model-set training cost Scalability
IPGuard
No
High
UAP
No
Low-Moderate
High
ADVTRA
No
High
GNNTingers
No
High
Low
MetaV
Yes
High
Low
LiteGuard (ours)
Yes
Low
High
The table shows that only MetaV and LiteGuard are task-agnostic, i.e., applicable for different tasks. Compared with MetaV, LiteGuard requires much lower model-set training cost and stronger scalability. In particular, the decoupled verifier design makes LiteGuard highly scalable- new fingerprint-verifie pairs can be added without retraining cxisting ones, and verification can flcxibly adapt to different query budgets by using corresponding number of fingerprint- verifier pairs. In contrast, MetaV requires retraining all fingerprints and the verifier together whenever the fingerprint set changes.
F IMPLEMENTATION DETAILS
F.1 MODEL ARCHITECTURES AND TRAINING SETTINGS
We summarize the architectures and training configurations of the protected model, the pirated models, and the ceopendentll-trainne models used for each task in the following.
F.1.1 PROTECTED MODEL.
CNN (CIFAR-100). The protected model is a ResNet-18 trained from scratch using SGD with momentum 0.9, weight decay 5e-4, learning rate 0.1, cosine annealing learning rate scheduling, and Xavier initialization. Training is conducted for 600 epochs with a batch size of 128.
MLP (CASP). The protected model is Residual Multilayer Perceptron (ResMLP) trained from scratch using Adam Optimizer, with learning rate of 0.001, and Kaiming initialization. Training is conducted for 120 epochs with batch size of 128.
GNN (QM9). The protected model is a Graph Attention Network (GAT) trained using the Adam optimizer with learning rate of 0.001 and Xavier initialization. Training is conducted for 300 epochs with a batch size of 128.
AE (CH). The protected model is Variational Autoencoder (VAE) trained using the Adam optimizer with a learning rate of 0.01. In line with the default PyTorch implementation, the initialization scheme sets the weights of all linear layers samples from a normal distribution (000, 0.02²) and their biases to zero. Training is conducted for 160 epochs with a batch size of 128.
RNN (Weather). The protected model Vanilla Recurrent Neural Network (RNN) trained using the Adam optimizer with a learning rate of 0.001 and Xavier initialization. Training is conducted for 120 epochs with a batch size of 128.
1.1 INDEPENDENCE SET FOR FINGERPRINT TRAINING
For each task, the independence used for fingerprint generation consists of a single independently- trained model together with its checkpoints. The architecture of the independently-trained model is: CNN (CIFAR-100) DenseNet- 169;; MLP (CASP): TabNet; GNN (QM9): Graph Isomorphism Network (GIN); AE (CH): Variational Autoencoder (VAE): RNN (Weather): Gated Recurrent Unit (GRU).
15

---

Published as a conference paper at ICLR 2026
F.1.3 PIRACY SET FOR FINGERPRINT TRAINING
For each task, as mentioned in Section 5] the piracy set used for fingerprint generation only consists of the protected model and its checkpoints.
F.1.4 INDEPENDENCE SET FOR PERFORMANCE EVALUATION
Across all tasks, models in the independence set are trained from scratch without access to the protected model; they share the tasks default training protocol for faimess, while diversity arises from heterogeneous architectures and distinct random seeds. The architectures included in the independence set for testing are specified follows:
CNN (CIFAR-100). ResNet-18, ResNer-50, ResNet-101, MobileNetV2, MobileNerV3-LLare. EfficientNet-B2, FfficientNet-B4, DenseNet-121, and DenseNet-169.
AE (CH). Autoencoder (AE), Variational Autoencoder (VAE), Wasserstein Autoencoder (WAE), Beta- Variational Autoencoder (BetaVAE), Sparse Autoencoder (SparseAE), Denoising Autoencoder (DenoisingAE), Adversarial Autoencoder (AdversarialAE))
MIP (CASP). Wide & Deep Model (Wide&Deep), Residual Multi-Layer Perceptron (ResMLP), Feature Tokenizer Transformer (FT- Transsssfforrr) Spiking Neural Network (SNN), Neural Ordinary Differential Equation (NODE), TabNet, and TabTrrnsformer.
GNN (QM9). Graph Convolutional Network (GCN), Graph Isomorphism Network (GIN), Graph Sample and Aggregate (GraphSAGE), Graph Attention Network (GAT), Graph Attention Network v2 (GATv2), Simple Graph Convolution (SGC), and Approximate Personalized Propagation Neural Predictions (APPNP).
RNN (Weather). Vanilla Recurrent Neural Network (VanillaRNN), Long Short-Term Memory (LSTM), Gated Recurrent Unit (GRU), Residual Recurrent Neural Network (Residual VanillaRNN), Residual Long Short-Term Memory (Residual LSTM), and Residual Gated Recurrent Unit (Residual GRU).
F.1.5 PIRACY SET FOR PERFORMANCE EVALUATION
We generate pirated models for all tasks by applying six types of performance performance-preservinng ownership obfuscation techniques to the protected model, with the following configurations:
Fine-tuning: updating the parameters of the already trained protected model for fixed number of epochs.
Adversarial fine-tuning (A-Finetune): fine-tuning the protected model using a mixture of clean and adversarially perturbed samples. For regression tasks with continuous outputs, adversarial examples are generated by maximizing the prediction loss (e.g., MSE) w.r.t. input perturbations using standard methods such as FGSM or PGD.
Pruning: applying unstructured global pruning at sparsity levels ranging from 10% to 90% (step size 10%).
Prune Fine-tuning (P-Finetune): pruning the model at sparsity levels 30%, 60%, and 90%.
followed by fine-tuning recover performance.
Noise injection Fine-tuning (N-Finetune): adding scaled Gaussian noise to the parameter tensor and then fine-tuning the noisy model.
Knowledge Distillation (KD): training a student model to mimic the protected model behavior by minimizing the KL divergence (or temperature-scaled soft targets) between the teacher and student outputs.
F.2 DATASET PROCESSING
Data Normalization. Each dataset is preprocessed using its commonly adopted normalization parameters prior to model training, ensuring that inputs are scaled consistently with standard practice in the respective domains.
16

---

Published as a conference paper at ICLR 2026
G PRACTICAL DEPLOYMENT CONSIDERATIONS
In real-world deployments, a key consideration is the risk of false cesttivs--namlle incorrectly flagging an independently trained model as pirated due incidental behavioral similarity under finite set of verification queries. This issue is practically important because a false-positive allegation may lead to erroneous IP claims, unnecessary legal or compliance procedures, and substantial reputational or operational costs for the parties involved. Importantly, this risk is inherent to ownership verification in general and not specific to our method. Within our framework, false positives can be mitigated by adopting more conservative verification threshold, which reduces the likelihood of accidental matches at the cost of decreased sensitivity.
Furthermore, fingerprinting-base based ownership verification should be viewed as an evidence-generating mechanism rather than an definitive decision oracle. It functions as an initial screening tool that produces preliminary evidence. A positive screening outcome can then prompt more rigorous follow- up analysis, such as expanded testing with additional query sets, tross-validation with complementary evidence sources, escalation to a formal third-party adjudication process when necessary.
H RELATED WORK
Most existing studies exploit the characteristics of model decision boundaries generate effective fingerprints for DNN models used for classification tasks. A common approach is to craft fingerprints that induce different labels for the protected model from other independent models. For instance, some researchers leverage adversarial examples as fingerprints to trigger distinguishable outputs for the protected models (Zhao et 2020 Yin et al. 2022 Peng al.) 2022 Yang & Lai 2023). Cao et al. (202T) constructs near-boundary samples as fingerprints. Xu el al. (024) forms adver- sarial trajectories to enhance verification reliability. Godinot et al. (2025) proposed leverage the misclassified samples as fingerprints that demonstrate stronger discriminatve power than normal adversarial examples. [Tang et al. (2025) proposes a frequency-dome
CNN fingerprinting scheme that embeds ownership information into low-frequency components of convolutional filters. /Zhang] ct al, (2025) identifies the most informative triggers to achieve accurate model attribution under limited query budgets. However, the reliance on the presence of decision boundaries makes these methods applicable only to classification tasks.
Recent studies have begun to extend fingerprinting techniques broader set of tasks. For example, some methods (You et al. 2024] Waheed et al. 2024) generate fingerprints based on node features and graph topology protect the ownership of graph neural network (GNN) models. Other studies (Yu et al. 2019; Huang et al. 2023) have explored training a classifier to extract unique identifiers from images produced by Generative Adversarial Network (GAN) models and used the identifiers as fingerprints for ownership verification. [ei et al. (2025) introduces fingerprinting mechanism for latent diffusion models by encoding user-specific identifiers directly into model weights to enable model attribution.
While these task spec-fee fingerprinting techniques achieve strong performance within their intended domains, their dependence on task -tallord properties fundamentally limits their use across different tasks. This motivates the development of task task-agnostic fingerprinting. which seeks a unified solution applicable to a broad range of models. To date, two approaches fall into this category: TAFA (Pan) at 202T) and Meta (Yang et al. 2022). TAFA imposes assumptions -usoonssssuchh as requiring ReLU activations and continuous-valuee outputs- restrict its generality and prevent it from serving as fully task-agnostic solution. MetaV employs a more universal strategy that co-trains a global verifier alongside a collection of fingerprints using both pirated and seapenndetll-trainnee models. However, MetaV's ability to generalize relies heavily on constructing large, diverse model sets, which incur substantial computational cost. While reducing the size of these model sets lowers the training cost, also leads to significant drops in generalization performance, making it difficult to preserve reliable verification accuracy.
17


Reviews:
[{"review_id": "8NeFI2o63F", "reviewer": "Reviewer_QEjw", "summary": "This paper introduces LiteGuard, an efficient and task-agnostic framework for model fingerprinting designed to enhance generalization and reduce computational overhead in ownership verification of deep neural networks. Building upon the limitations of prior work such as MetaV—which relies on extensive model collections and joint training of entangled fingerprints and verifiers—LiteGuard contributes two core innovations: a checkpoint-based model set augmentation strategy that increases model diversity by reusing intermediate training checkpoints, and a local verifier architecture that pairs each fingerprint with an independent, lightweight verifier to mitigate overfitting. Extensive experiments across five representative tasks—spanning classification, regression, generation, and graph modeling—demonstrate that LiteGuard achieves superior generalization and computational efficiency, while maintaining robustness against a wide range of ownership obfuscation attacks. This paper offers a well-motivated and technically grounded contribution that effectively addresses a genuine limitation of existing task-agnostic fingerprinting methods. While it represents a solid and practically meaningful advance, further analytical depth would strengthen its impact.", "questions": "1. Could the authors provide quantitative evidence of computational efficiency?\n\n2. Would it be possible to characterize the relationship between checkpoint diversity, parameter decoupling, and generalization empirically or theoretically?\n\n3. Could the authors complement Tables 2 and 3 with some statistical significance tests or confidence intervals to ensure the reported improvements are not due to stochastic variation?\n\n4. Would a comparative summary table outlining architectural dependencies, training assumptions, and verifier coupling help clarify the theoretical boundary of LiteGuard’s contributions relative to existing methods?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. Well-identified practical bottleneck (generalization vs. efficiency trade-off).\n\nThe authors clearly articulate that the core limitation of existing task-agnostic fingerprinting, especially MetaV, lies in its dependence on large and diverse model collections to achieve generalization. This observation grounds the work in a genuine real-world constraint: publicly available models are scarce, and constructing them is resource-intensive. The authors convincingly motivate the need for a lightweight yet generalizable alternative, establishing a coherent link between practical constraints and methodological innovation. This framing situates LiteGuard as a realistic and deployable solution to a widely recognized challenge in model IP protection.\n\n2. Checkpoint-based model set augmentation strategy.\n\nThe checkpoint-based augmentation mechanism is one of the paper’s most compelling contributions. By systematically incorporating intermediate model snapshots captured during training, LiteGuard effectively transforms existing computational by-products into valuable training diversity (Sec. 3.2; L162–L215). The checkpoint selection scheme—starting from a mid-training epoch and uniformly sampling at fixed intervals—balances representational variety and redundancy. The ablation results in Figure 4 empirically confirm that this augmentation consistently improves AUCs across tasks, even when applied to MetaV, illustrating its general applicability. Conceptually, this design elegantly aligns with the paper’s goal of efficiency without sacrificing robustness, and it represents a practically impactful contribution to fingerprint generation under constrained resources.\n\n3. Modular local verifier architecture with analytical justification.\n\nLiteGuard’s second key innovation is its decoupled verifier structure, which addresses the overfitting and scalability issues inherent in MetaV’s global verifier design. Each fingerprint is paired with an independent, lightweight verifier trained only on its own outputs (Sec. 3.3; L213–L217), dramatically reducing parameter entanglement. The formal complexity analysis in Sec. 4 shows that this approach lowers parameter scaling from O(N(F+O⋅H)) to O(F+O), thereby bounding overfitting risk. This theoretical rationale is reinforced experimentally: Figure 5 shows that substituting LiteGuard’s verifier into MetaV significantly boosts performance, while removing it leads to a marked decline. The synergy of analytical reasoning and empirical validation gives this architectural refinement both conceptual soundness and demonstrable impact.\n\n4. Comprehensive and multi-domain empirical validation.\n\nThe experimental design is broad and methodologically rigorous. LiteGuard is evaluated across five tasks—classification, regression, graph prediction, tabular data generation, and time-series modeling—each involving distinct architectures and datasets (Sec. 5; Table 2). The results reveal consistent AUC improvements over both task-specific and task-agnostic baselines, with gains ranging from 9% to 35%. Moreover, Figure 3 demonstrates that LiteGuard achieves comparable performance to MetaV while using up to 80 % fewer trained models, confirming its superior efficiency. Table 3 further shows that LiteGuard maintains robustness under diverse ownership obfuscation techniques, outperforming MetaV across nearly all categories. The breadth and consistency of these results give the work strong empirical credibility.", "weaknesses": "1. Limited theoretical understanding of generalization improvement.\n\nSection 4 provides a parameter-count argument suggesting that reduced entanglement mitigates overfitting, but it stops short of a quantitative or theoretical treatment. There is no analysis of how checkpoint diversity or modularity affects the variance or bias of fingerprint representations, nor are there experiments correlating parameter scale with test AUC. As a result, the claim of “enhanced generalization” remains empirically supported but theoretically underdeveloped, limiting the scientific depth of the contribution.\n\n2. Lack of theoretical justification for why checkpoint augmentation and local verifiers work.\n\nThe paper convincingly shows that both the checkpoint-based augmentation and the local verifier design improve performance, but it is unclear whether checkpoints truly capture orthogonal decision behaviors or merely introduce correlated noise, and whether independent verifiers learn complementary discriminative subspaces or simply reduce parameter coupling. \n\n3. Incomplete analysis of computational efficiency and broader implications.\n\nWhile the efficiency advantage is repeatedly emphasized, the paper evaluates it solely through AUC comparisons at different model counts (Fig. 3) rather than concrete computational metrics such as training time, GPU hours, or memory usage. This omission makes it difficult to quantify the real-world resource savings claimed in the abstract. Moreover, the conclusion section does not discuss potential security or ethical implications—such as false positives in ownership verification or adversarial adaptation to the local verifier design—leaving the practical boundaries of LiteGuard’s applicability somewhat underexplored.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "yThTmP0P9B", "reviewer": "Reviewer_588g", "summary": "This paper proposed LITEGUARD, a Task-agnostic model fingerprinting model fingerprinting framework with enhanced generalization. It features two key innovations, (1) using intermediate model check-points from training to enrich the model set, and (2) using a local verifier architecture that all fingerprints are optimized independently. Empirical results are provided to show that the proposed method achieves a better performance as well as a lower computation cost.", "questions": "1. In the experiments, is the number of models (including different model snapshots) the same between the proposed method and baselines? \n\n2. In the complexity discussion in section 4 \"LiteGuard: Decoupled Architecture\", shouldn't it have a factor N in the formula?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper is well structured and easy to follow.\n\n2. The empirical results are strong and the experiment design is fair. It shows a large margin of improvement given by the proposed method compared to the baselines.\n\n3. Very rich experimental results. It considered both scenarios with and without obfuscation methods. \n\n4. Ablation studies are also well designed and convincing.", "weaknesses": "1. The novelty of this paper is relatively weak. Independently optimizing different fingerprints is also used in other previous works. Although these works are not considered task-agnostic, it would be better to clarify how this work differs from them.\n\n2, Font size in Fig. 4 is too small to read.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zMjbM61ZPJ", "reviewer": "Reviewer_CS8j", "summary": "This paper proposes LiteGuard, an efficient and task-agnostic model fingerprinting framework that enhances the generalization and computational efficiency of ownership verification compared to the state-of-the-art method MetaV. The authors identify that MetaV’s reliance on large, diverse training model sets and its globally entangled fingerprint–verifier architecture cause severe overfitting and high training cost. To address these issues, LiteGuard introduces two key innovations: (1) a checkpoint-based model set augmentation strategy that leverages intermediate training snapshots to enrich model diversity without additional training effort, and (2) a local verifier architecture that pairs each fingerprint with a lightweight, independent verifier to reduce parameter entanglement. Extensive experiments across five representative tasks (covering CNNs, MLPs, AEs, GNNs, and RNNs) demonstrate that LiteGuard achieves significantly higher AUC scores, superior robustness against six ownership-obfuscation techniques, and comparable verification accuracy, highlighting its practicality for efficient model IP protection.", "questions": "1. Could the authors provide a theoretical justification (even high-level) for why local verifiers improve generalization?\n\n2. Would a small shared backbone with partially independent verifiers achieve better efficiency?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. **Elegant and Practical Design Innovations.** The checkpoint-based augmentation cleverly utilizes existing training artifacts to boost model diversity. The local verifier design directly reduces overfitting and decouples parameter dependencies. Both are low-cost, widely applicable strategies that can be generalized beyond fingerprinting. \n\n2. **Strong Problem Motivation and Practical Relevance.** This paper addresses a real deployment bottleneck in model IP protection—MetaV’s dependence on large training model sets—and proposes a solution that is conceptually simple yet effective.\n\n3. **Strong Empirical Results and Robustness.** LiteGuard shows large AUC gains over MetaV. The robustness experiments under six obfuscation types are particularly convincing.\n\n4. **Excellent Writing and Clarity.** This paper is well-structured and clearly written.", "weaknesses": "1. **Limited Theoretical Analysis.** The paper’s central claim—improved generalization via reduced entanglement—is only empirically validated. There is no formal generalization or bias-variance analysis to support the intuition.\n\n2. **Verifier Design.** The local verifier is a single linear layer; its capacity to handle high-dimensional nonlinear outputs is questionable. Runtime or query-efficiency trade-offs are not discussed.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6XQIFZ6QyJ", "reviewer": "Reviewer_GCH5", "summary": "Liteguard targets the fingerprinting of DNNs (i.e., not LLMs) and places a focus on lightweight execution.\n\nThe idea of aggregating fingerprints and paired verifiers (the second component of the approach) is interesting, as verifiers are generally a single large model trained on all fingerprints.", "questions": "* how is is Litegard performing in an open garden setup?\n\n* what about execution timings w.r.t. MetaV?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "* interesting verifier aggregating individual classifiers", "weaknesses": "* no guarantees whatsoever\n* no proper related work\n* missing discussions (open garden models, execution timings)\n\nLiteguard is not backed by any formal guarantee, the whole performance assessment is experiment-based. And as the experimental section relies on modest scenarios in practice (cifar 100...), it questions the performance to be expected in modern applications. In particular, it is clear that performance depends on the models present and compared in both sets; experiments only go up to 5 or 30 models and variants per set, which is a tiny number today (see e.g., \"Fingerprinting Classiﬁers with Benign Inputs\",2023 where 1046 variants are discriminated, for larger DNNs), facing the proliferation of architectures, proposals, and potential variants. This precludes a clear forecast of practical performances and generalization to other included models.\n\nLacks consideration of unseen models: this is not very clear in the paper, but it seems that all experiments consider a \"closed garden\" setup, where only models at hand are considered (ie models that have been part of the training for discrimination). In practice, and as in multiple papers in the SoA, the question is what happens to accuracy where there is an unseen model in the blackbox under scrutiny. What are the generalization capabilities of Liteguard in open garden/sets scenarios? This must be discussed.\n\nAs one of the major motivations of the approach is a lower computational cost than MetaV for instance, and provided that both are compared in the experiments, I find it unfortunate not to have a plot or table measuring the gain (faster timings). To judge, we are left with a brief discussion on parameter complexity, that is interesting, but insufficient to support the claim in my opinion.\n\nA proper related work section is missing, some papers are only briefly mentioned in the introduction. For instance, multiple papers on fingerprinting DNNs from recent conferences (e.g., AAAI 2025) are missing from the references.\n\nIn summary, I think this is an interesting lead, but that the experimental part in its current form is not enough to convey evidence and support the claims made at the beginning of the paper. The positioning w.r.t. the proliferation of prior work is also a problem.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)