Boosting the Uniqueness of Neural Networks Fingerprints with Informative Triggers
Authors: Zhuomeng Zhang
Fangqi Li
Hanyi Wang
Shi-Lin Wang
Venue: NeurIPS 2025 poster ()
Keywords: Deep Neural Networks
Uniqueness
Fingerprints
Copyright Tracing
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: One prerequisite for secure and reliable artificial intelligence services is tracing the copyright of backend deep neural networks. 
In the black-box scenario, the copyright of deep neural networks can be traced by their fingerprints, i.e., their outputs on a series of fingerprinting triggers. 
The performance of deep neural network fingerprints is usually evaluated in robustness, leaving the accuracy of copyright tracing among a large number of models with a limited number of triggers intractable. 
This fact challenges the application of deep neural network fingerprints as the cost of queries is becoming a bottleneck. This paper studies the performance of deep neural network fingerprints from an information theoretical perspective. 
With this new perspective, we demonstrate that copyright tracing can be more accurate and efficient by using triggers with the largest marginal mutual information. Extensive experiments demonstrate that our method can be seamlessly incorporated into any existing fingerprinting scheme to facilitate the copyright tracing of deep neural networks.

Boosting the Uniqueness of Neural Networks Fingerprints with Informative Triggers
Zhuomeng Zhang Shanghai Jiao Tong University zzmsmm@s tu. edu. en
Fangqi Li
Shanghai Jiao Tong University solour solour_lf@@sj tu. edu. en
Hanyi Wang
Shi-Lin Wang"
Shanghai Jiao Tong University why_ why_820esjtu, edu. cn
Shanghai Jiao Tong University wal@sjtu. edu. on
Abstract
One prerequisite for secure and reliable artificial intelligence services tracing the copyright of backend deep neural networks. In the black-box scenario, the copyright of deep neural networks can traced by their fingerprints, i.c., their outputs series of fingerprinting triggers. The performance of deep neural network fingerprints is usually evaluated in robustness, leaving the accuracy of copyright tracing among a large number of models with limited number of triggers intractable. This fact challenges the application of deep neural network fingerprints the cost of queries is becoming bottleneck. This paper studies the performance of deep neural network fingerprints from an information theoretical perspective. With this perspective, demonstrate that copyright tracing be more accurate and efficient by using triggers with the largest marginal mutual information. Extensive experiments demonstrate that our method can be seamlessly incorporated into any existing fingerprinting scheme to facilitate the copyright tracing of deep neural networks.
Introduction
Ragieane
Regitteed Ragendinte
DNN models
Recent progress in deep neural network (DNN) models is raising privacy and ethics concerns since they might facilitate the propagation of fake information with negative social im- pacts [I]. To ensure that Al serves people prop- erly, necessary trace the copyright of DNN models and attribute the misuse of mod- els specific users. The majority of existing studies concentrate on copyright tracing in the black-box setting where the copyright verifier interferes with the suspicious DNN model as black box. Two mainstream methods are DNN watermarking 2 8 and DNN fingerprinting (9]
Pingrepeint datahave
Triggers
How in commene
Stown
Onigplt
Compare
Copyright identifeed!
Altack
Suspicion
Figure 1: The framework of fingerprint- based DNN copyright tracing system.
[6].
DNN watermarking schemes use a series of inputs as watermark triggers and tune DNN models so that their outputs triggers differentiated as pre-defined. Therefore, they appeal only copyright
Conresponding author
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

verifiers who can tune the DNN models to be protected or owners who distribute model to multiple clients. Watermarking schemes inevitably introduce deline in the performance of watermarked DNN models, which is unacceptable in industrial fields.
In contrast, DNN fingerprinting schemes produce series of fingerprinting triggers. The outputs of suspicious DNN model on the triggers constitute its fingerprint, with which its identity is recognized. An illustration is given in Fig.
The reliability of DNN fingerprinting schemes has usually been interpreted as their robustness, i.e., the fingerprint of a DNN model should remain invariable under adversarial modifications. Despite established results on robustness, the uniqueness of DNN fingerprinting is still under-explored. This aspect is crucial for industrial copyright tracing especially when the number of model to be traced is large while the expense retrieving fingerprint grows in the number of triggers and could become bottleneck. It is hard to evaluate how every trigger contributes differently to copyright tracing, and under which circumstances does each DNN model have a unique fingerprint. Consequently, is difficult to optimize the collection of triggers with a fixed cardinality. To address the above challenges, this paper proposes general method to improve the efficiency of fingerprint-based DNN copyright tracing. The contributions are concluded as follows:
We adopt an information theoretical perspective to measure the contribution to copyright tracing of each fingerprinting trigger by its conditional mutual information.
We boost the copyright tracing performance by greedily optimizing the collection of triggers and validate this method through extensive experiments.
We derive the first necessary condition for the number of fingerprinting triggers to ensure copyright tracing.
Preliminaries
2.1 DNN Fingerprint
D We focus on classifiers that map the input space
Notations used in this paper are listed in Table
Table 1: Frequently used notations in this paper.
X' to y 21,2.... .C.. Altogether P clas-
Symbol X
Meaning
laput space of DNN models.
sifiers F {fp)p=1 require copyright tracing. fingerprinting scheme draws N independent triggers T = {t,, | from a distribution T. Choices of T include random noises [9], out-
Number classes.
p=1
Ourpuz space of DNN models. Number registered DNN models. Registered DNN models,, F ) Number of fingorprinting triggers. Number of greedily selected triggers. Distribation triggers.
N
N
liers 3 10). normal samples that are close to
the centers of each class [15 [6), adversarial samples that are close to the decision bound- aries
Fingerprinting triggers, T [t_,, Lmm--
Verifie''s tolerance on adversary's 's attack.
A.
Verifie''s 's threat model.
13) etc.
randomly selected
from
A randomly selected attack from A..
The fingerprint the p-th model its outputs on triggers: (t)),,... (fp(tt) The finger- prints of all models are computed and registered in database. Upon locating suspicious model, the verifier computes its fingerprint and compares with records in the database. If there exists a registered model whose fingerprint is close to the suspicious model's, then copyright issue is reported. Otherwise, the suspicious model is registered as a new model. The distance between two fingerprints measured by the number of triggers where two models return different outputs.
The andomly selected model's prediction fy-
Uniqueness rule
I. (ta)frra))))
Conditional mutual information
2.2 Robustness Uniqueness
The performance of a DNN fingerprinting scheme is inclusively reflected in its robustness and uniqueness.
The robustness of a DNN fingerprinting scheme is characterized by the difference between registered models' fingerprints before and after adversarial modifications. Formally, the verifier assumes that the adversary has sacrificed the victim model's performance for probability at most (it is impossible to

---

J paodde
(a) The idcalistic setting.
(b) Triggers with biased outputs.
Triggers the largest entropy uniquenees..
Figure 2: An illustration of the difficulties in deciding the optimal fingerprinting triggers P = 9 and C = Each column denotes model. Each row denotes fingerprinting trigger. Each color denotes classification label. (a) The idealistic case where loge P = triggers produce unique fingerprints. (b) When the predictions on triggers are biased, two triggers are insufficient. (c) Choosing the first three triggers with the largest independent entropy fails the uniqueness property. The correct choice the last three triggers.
trace the copyright of models whose functionality has been arbitrarily modified). The threat model is:
A. = (A: (fz=x(((x) + (z))) c
where f denotes model undertaken attack A. In general, the adversary's attack always
has a measurable influence on the model's performance so Ao = 0. The verifier should assume non-trivial adversary and focus on the maximal damage that the adversary might cause [17], so the robustness of a fingerprinting trigger distribution T is quantified by:
(7(+)= FEF.AEA,
{Pre-T (s(t) + (())
A fingerprinting trigger distribution with large (7()) yields weak fingerprints, since the adversary can obfuscate the fingerprints with little decline in functionality.
Empirically, the robustness of fingerprinting trigger distribution is estimated with a finite collection of adversarial modifications including fine-tuning [8] 19], neuron pruning [20]. distillation [2]] etc. Although it is hard to directly foster the robustness by modifying the trigger distribution, some
distributions are reported to more robust under certain attacks 12 15 [6].
On the other hand, the fingerprint of each model should be unique so the false positive rate is negligible. The low transferability of Characteristic Examples [22] primarily addresses the fin- gerprint of individual models, whereas our study focuses on the uniqueness of fingerprints for distinguishing between different models in large-scale deployment scenarios. This property is reflected in the percentage of models whose fingerprints remain unique under any attack. Let F. (T) [ A., F (f). Vt ftt) (t)), the uniqueness rate u can be de- fined as:
u = 1- F. (T)
(3)
Unfortunately, this metric u can hardly be optimized as a function in T. In existing literature, is generally assumed that the models' outputs fingerprinting trigger randomly distributed as shown in Fig. a]), so logg P triggers are sufficient and the probability that two arbitrary models have the same fingerprint declines exponentially in N [9. So any fingerprinting scheme is expected to have u + when N is large.
2.3 Challenges
The assumptions behind the uniqueness of DNN fingerprinting schemes are challenged by the following facts.
(I): The number of triggers is not arbitrarily large. The number of triggers determines the cost of copyright tracing and could become a bottleneck in large-scale or expensive service or when querying the API of suspicious DNN models is expensive. It is necessary evaluate the performance of DNN fingerprints when the number of triggers is limited.
(I): The value of each trigger has been overestimated. DNN models' outputs on a trigger might not be uniformly distributed, as shown in Fig. b). Moreover, the triggers are not independent of each other. Using triggers with independently the largest entropy might turn out to be misleading as

---

shown in Fig. C). The value of each trigger is determined by the conditional entropy it contains w.r.t. queried tnggers.
(IT;: The influence of adversarial modifications is unclear. When the adversary modifies the victim model's fingerprint, the information value of each trigger might change. The optimal number of triggers varies with the assumptions of the adversary. So far, the relationship between uniqueness and robustness has been established.
As a result, the volume information that limited number triggers can provide in the adversarial environment is intractable bottleneck of the copyright tracing system, leaving the uniqueness property as a risk.
3 Method
3.1 Information in DNN Copyright Tracing
We consider the copyright tracing of DNN mod- els as a communication channel. From the veri- fier's view, the information source is the identity of the suspicious model, which is represented by random variable F whose domain is F. Without loss of generality, we assume that the suspicious model F is equally likely to be any registered model, so contains log, P bits of information.
Algorithm 1 Computing To (t., (tn]tt:(nn1)))-
Input: Registered models triggers t,, 12, bn Output: 1o (t.. (1:(()))))))
I: M = 0, h =0
2: for i = to P do
3: flag False
for in
5:
ir E F (P(A). = (,,,,,/)
f((t)) then
The adversarial modifications, represented by random variable A, are noises in this channel. Without prior knowledge, the attack randomly chosen from A., where reflects the verifier's
6:
M = MU flag=True; break
end if
8: end for
9: flag=False then
10: - (fi
tolerance. We further assume that the attack
11: end if
is independent of the triggers and the victim
end
model.
13: for M in M do
14:
for 1 to C do 0
The output from the suspicious model F on the n-th trigger, denoted by on. another random
15:
for in M do
variable, so is the fingerprint of the suspicious
17:
if ft.)) = then
model & (01, 22.................. ΦN). We are inter-
18:
Ue = uh +
ested in how much information the fingerprint
19:
end if end for
reveals about the suspicious model's identity,
20:
which is inclusively quantified by the mutual
21:
Ue = ue/ MM| h-
[M]
Uh log, Ue
information (F: fact, the volume of in-
22:
end for
formation to secure uniqueness rate is at least
23:
end for
24:
Return h
uu log, u (1 u) logo (1 u) + log, uP. so an upper bound of is
2loga uP
2 ulog --11----- (1- loga(1 (1- Hoga uP
2((FF)
P
P
P
Therefore, necessary condition for better uniqueness using informative triggers. We begin with the conditional mutual information of the n-th trigger under threat model A.-
tn Definition 1. Let the threat model be As, denote the mutual information tn conditioned on queried triggers t1, 1.. ...... tn-1 by:
Ie (tx (1:(n):())))) = =Hn0l001, (0.,l,,...,,---1 ( --
2n-1)
(4)
The mutual information of all triggers is decomposed as:
N Σ n=l
(t (1)(1:(a-11)
(5)

---

In the vanilla setting, the verifier considers c = 0 and the modified model is always recognized as irrelevant from the original version. So H ( I. and:
To (In](1:(n-1))
(1 ... .nn1))
(6)
The complexity in computing the r.h.s. of Eq. ( by iterating over all possible values of (Ø),... 1, Un) ) is of order O(C*). Instead, we resort to Algo. | where all registered mod- els are segmented into disjoint sets according to their partial fingerprints Fingerprints that never appear are ignored. The complexity is reduced to (max [P2 PC}) and is acceptable since P < C usually holds in practice, especially when n is large.
the first (n 1) triggers.
In non-trivial cases where the tolerance their original version and H [Φn]ór, the conditional mutual information of each trigger is given by the following theorem.
O, the verifier attributes modified models as copies of :. no longer always equals zero. A lower bound of
Theorem 1. Let the threat model be A. in Eq. ( then:
Le (tn (1:(n-1)) 2 Lo (tn (1:((nnn)) h(e).
where h(e) ÖT (e) log2 (c) (1 (T)) logg(1 (E)) +
1).
Conceptually, Theorem iis variant of Fano's inequality. The complete proof is given in Appendix A
3.2 Greedy Optimization of Triggers
Being equipped with the conditional mutual information of each trigger, we proceed to optimize the collection of triggers. Given the budget Ñ < N, the optimized collection of triggers T with size N selected by Algo. 2 where the trigger with the largest conditional entropy is iteratively included. Remarkably, T is permutation of subset of T.
Theorem D indicates that even for > 0, the mutual information provided by the n-th trigger is lower bounded by Iu minus a constant. So the cumulative mutual information provided by triggers selected ac- cording to Algo. is lower bounded under arbitrary threat models.
Algorithm 2 Greedily selecting Ñ informative triggers.
Input: Budget Ñ, triggers T, registered models Output: A collection of triggers T, IT| N.
1: T 0
2: for to Ñ do
Selecting a fixed number of triggers that provides
3:
m = 0, r T T
the largest mutual information essentially com-
4: for E T T
binatorial optimization problem that is NP-hard. We prove that our strategy selects triggers whose mutual information is lower bounded compared with the optimal triggers in theory. Let I, (t., (t.ltt((a-i)) max (0, Lo (n) -h
5:
if [u([)) > then lo T),
6:
7:
end if end for
9: T T U Uftt, =r]
10: end for
The mutual information provided by triggers T is no less than (T) = Em= L (tm/lt:(nn1)) which turns out to be non-negative, monotonically increasing, and submodular function in T 23 25 Because for V c U c T and E T U:
11: Return T
((UU(t))- max H (t(e)
<max {0, H (()V))
The submodularity guarantees that the lower bound of mutual information given by Ñ greedily selected triggers is no less than (1 1) of that of Ñ optimal triggers in theory, i.c.
N Σ
L (in (1)(-))) 2 (1 (1- Σ L. (ī., )
(in./1.(n-1))-
(8)
n=1
where tt, is the n-th trigger in the greedily selected/optimal collection with size N.
In summary, When the verifier can only query Ñ instead of all N triggers, we recommend retrieving the fingerprint with T instead of Ñ random triggers in This discussion further implies a necessary condition on the number of triggers.
5

---

heae
Are1
Reen Me-1 Adp2
New
A3-1
Roen
Ad-1
Atw2
Peg
(a) MNNST.
(b) FashionMNIST.
(c) CIFAR-10.
(d) ImageNet.
Figure 3: The robustness of studied DNN fingerprints measured å7 (c), averaged on 600 models under the fine-pruning attack.
Theorem 2. Let the threat model be A necessary condition for the number of triggers is:
-1-- log2 P
N min Ñ Σ (fxlt
(9)
=fe= c==0am and N fails meet Eg. (9) then any collection of N triggers cannot trace the copyright of all registered models. If > 0 and N fails to meet Eq. (9) then any collection of N triggers has risk of failing to trace the copyright of all registered models.
Proof. If N fails to satisfy Eq. then the optimal N triggers might provide less information than loga P bits due to Eq.
Le (Inl (Ialf:((n-)) S n=1
Σ L. (fmlf1:(0-1)) <logg P.
n=1
When = 0 we have To = Io- so failing satisfy Eq. 99) implies a deterministic failure in copyright tracing. Otherwise, we can only assert that copyright tracing has a chance to fail since the lower bound of mutual information provided by any combination of triggers is insufficient to identify all registered models.
3.3 Remarks
We make three remarks regarding the implications and applications of our analyses.
Remark 1: Optimizing the distribution of triggers. Theorem 2 gives two directions to reduce the number of triggers for copyright tracing. The first is reduce ò7(E), i.c., to increase the robustness, since h(c) monotonically increases in (c) when 5y(c) is small. The second is to increase To (t., [1)(-1)). Unfortunately, neither direction can be directly transformed into changes T. Moreover, there might be trade-off between robustness and mutual information uniqueness according to our empirical studies presented the next section.
Remark 2: Fingerprint vs. watermark. In contrast to fingerprinting triggers, watermarking triggers have labels that are deliberately assigned. It can always be expected that lo (t,, (1:(n-1)) = log,, C for watermarking triggers (unless is large that queried triggers have already provided enough information for copyright tracing). Despite this advantage, fingerprinting schemes are applicable in more settings so they remain competitive option.
Remark 3: Generalization to non-classifiers. Our method can be generalized black-box copy- right tracing systems for non-classifiers such as multimedia content generators [26]. The bridge is considering the basic copyright interpreter as a classifier [27] 28 example on a copyright tracing
system for generative language models is given in Appendix B

---

Corpina sevestoo
A0-2
0011
Ad-2
Adv2
Ad-2
000
000
000
(a) MINST.
(b) FaShionMNIST.
(c) CIFAR-10 10.
(d) ImageNet.
Figure 4: The cumulative mutual information (in bit) provided by triggers in the original order (the solid curves) and triggers selected by the greedy algorithm (the dashed curves) when 0. The black line marks (1 2) logg 600 bits.
4 Experiments and Results
4.1 Settings
Following the settings of existing studies 29 conducted experiments four classification tasks:
MNIST [30], FashionMNIST (31), CIFAR-10 [32], and ImageNet [33]. The number of classes was
= (randomly drawn from ImageNet). A series of DNN models
trained as registered
models. The sources of heterogeneity were (I) Four network architectures including LeNet-5 (3],
VGG-16 (35), ResNet-18, 18, and ResNet-34 [36]- (II) Five learning rates ranging from 0.02 0.1. (III)
Two learning schedules with step lengths 5 and 10. (IV) Five training epochs ranging from 10 to 60. (V) Three random downsampling of training data. So, there were p 600 models for each task. We used four GeForce RTX 2080 Ti GPUs for acceleration. All experiments were implemented using the PyTorch framework. Link to the code repo given in the Appendix C
We considered five representative DNN fingerprinting schemes. For each task, 50 triggers were produced by each scheme. The robustness measured under the fine tieepprunigg attack [20], results are shown in Fig. 3).
(I) Noise 99. The pixel of each trigger was randomly generated from normal distribution whose mean and variance were identical to samples from the training dataset. (II) Benign [4 37 38 Each trigger randomly drawn from the training dataset. (III) OOD 13) Triggers are randomly drawn across training datasets. For classifiers on MNIST and FasionMNIST, each trigger was randomly drawn from the training dataset of CIFAR-10. For classifiers CIFAR-10 10 and ImageNet, triggers were drawn from MNIST. (IV) Adv-1 I... The first category of adversarial samples was produced from ordinary SGD-based adversarial attack [39]. The victim model randomly chosen classifier. (V) Adv-2. The second category of adversarial samples was produced from the same SGD--assed adversarial attack, but initial images were noises.
4.2
Results of Using Informative Triggers
4.2.1
Baseline Setting:
The cumulative mutual information provided by triggers when <= visualized in Fig. 4 The necessary condition for the number of triggers given by Theorem 2 was uniformly no less than 4 in all combinations of task and fingerprinting scheme, i.e., it is impossible to trace all models with Ilogio 600] 3 triggers. Greedily selected triggers were always more informative than the original triggers. cases, first 15 triggers selected by greedy algorithm have provided the same amount of information as all 50 triggers, so extra querying is redundant.
4.2.2 Adversarial Setting:
To delve into the influence of greedy selection on the uniqueness rate u in adversarial environments, we computed u defined by Eq. 3 Results are listed Table When the number of triggers is limited, using greedily selected triggers always yielded larger mutual information and secured the uniqueness of more models. This phenomenon appeared in all cases regardless of the task, the choice of fingerprinting scheme, the number of triggers, and the threat model with exception. Notably,
7

---

8 0 10
15
Indgement
8
8
000.
000
(a) MNIST.
(b) FaShI
(c) CIFAR-10.
(d) ImageNet.
Figure 5: Uniqueness rate (%) provided by greedily selected informative triggers when c == -2.5%
(the solid curves) and 10.0% (the dashed curves).
Table 2: Uniqueness rate of registered models (%). For A/B in each entry, A is the uniqueness rate provided by the original order of triggers, and B is the uniqueness rate provided by greedily selected triggers. The dataset is MNIST, FashionMNIST, CIFAR-10, and ImageNet from top to bottom. The better scheme in each setting is highlighted in bold.
Noise
OOD
Ade-
10
8
8
8
5
8
10
15
8
S
98
L355a
3399.5
133122
0.5735
0.723
2,03377
53.07992
03.29665
96.59665
09.8813
$0.591.5
90 90.3935
23 23.255.7
62.592.3
64295
5.0
L388
3.0.
333.7
0.513.
0.337
2,03.
0.54LT
3307.2
7.01522
0.788
8.117.7
16319
3.8/120
6.7/55
7.503T
1,88
05:28
0,5077
3,08.
1:344
0.7088
1.508
6.7953
47/2055
5.0
15402
7.8828
1.3455
1.00855
5
16.2213
24.543.1
54.7547
28 33.888
51.1437
68 571.
53 53.0/260
43.0542
10.0
1.502.
12477
23577
0.88.5
0.78.
0.700.7
0.208
4.79
26.726.7
0,5113
25.038
55 55.7000
0.59.5
16.3285
38 38.744755
000
200189
97 00.9913
172822
56 3933
SE39333
47.5568
273888
63.2743
110053
1777812
$52000
8139133
2300893
76.9980
2913
17.082.0
69.9847
17-5568
74.3762
63.2943
7130K3
80 888877
13:28111
510914
31.309
9133956
3977
97.3960
107733
013311
97.500
40.376.
91.392.7
07.995
66228377
92 0980
97.896.8
39.586.
91.9913
97.399.0
14.7783
94.387.8
87 600900
64.394.8
97.598.
98,09K.
0.0
40.3760
74.380.2
96 09.299.
65.1883
97 17.8
91.79667
29.58600
69.294.
95.0968
74.7763
763899
82 733
61.894.
$0.593.5
95.397.5
although the necessary condition in Theorem is not a guarantce of perfect uniqueness, satisfying Eq. (9) implies minimal uniqueness rate of at least 56.8%.
Table also indicates that fewer models' fingerprints could remain unique when the threat model became stronger, i.e., when increased. One interesting finding is that some fingerprints might not have a higher uniqueness rate when the number of triggers increased. We suspect that when the threat model becomes very strong, the incremental mutual information for large N can be completely nullified, what is implied by the form of the lower bound given in Theorem I phenomenon, recorded the uniqueness rate w.r.t. N under different threat models. Results shown in Fig. demonstrate that the uniqueness rate was not always increased in Ñ. The fluctuations due to rounding issues in computing the uniqueness rate, where only two fingerprints with at most [87 N1 differences were recognized as the same.
To examine this
4.2.3 Re-evaluation of DNN Fingerprinting Schemes
In addition robustness, statistics in Table and Fig. rieveal different ranking among examined DNN fingerprinting schemes. For example, despite the robustness, both Noise and Benign failed in MNIST by providing the least information, so did Benign FashionMNIST. The reason is that triggers similar to normal samples are robust due to their entanglement with the classifier's s functionality. However, this similarity means models trained on similar data perform alike, offering less model-specific information, especially for simple, high-accuracy tasks. Ady-2 appeared to be the optimal choices in CIFAR-10 10 when Ñ < 15 regarding the uniqueness rate. This result is non-trivial since Ady-2 was not judged as the most informative scheme before applying the greedy algorithm as shown in Fig. cc.. For ImageNet, Ady-1 outperformed Noise and 0OD in their original setting when N is small. However, both Noise and OOD provided perfect uniqueness after the greedy selection process, while Ady-1 failed. We emphasize that existing booustness-oricnter evaluation of DNN fingerprinting schemes tends to overlook these relationships between robustness and uniqueness and overfits oversimplified settings where P is very small and/or N/Ñ is very large.
The difficulty in tracing the copyright of DNN models also varies with the task. The more difficult the task is, the easier to distinguish models, since models trained on complex datasets tend to be more diversified instead of overfitting local optimum.
8

---

Corgznn sevestio
A0-2
0011
Ad-2
Adv2
Ad-2
000
000
000
(a) MNNST.
(b) FashionMNIST.
(c) CIFAR-10. 10.
(d) ImageNet.
Figure The culmulative mutual information (in bit) provided by greedily selected triggers with 100 models (the dotted curves), 200 models (the dashed curves), and 600 models (the solid curves)..
Table Uniqueness rate within all 600 models (%). The dataset is MNIST, FashionMNIST, CIFAR- 10, and ImageNet from top to bottom. R denotes randomly drawn triggers, 100/200/600 denotes the number of models used greedily select triggers (i.e., the size of F in Algo. D Settings that satisfy the order R < 100 I 200 < 600 are highlighted in green.
0OD
Adv2
m
10
15
15.2
1.1
8.0
8.3
1.7
4.2
5.2
4.7
388
8.5
11.3
6.7
7.5
20.2
25.
0.3
54.0
76.2
79.3
94.5
96.0
96.0
96.0
96.0
96.0
96.0
96.0
96.0
71.5
77.2
74.5
50.0
89.3
91.5
94.2
95.5
33.7
9422
54.8
91.0
5.0
10.3
16.3
70.6
11.3
10
14.5
17.
63.
54.7
54.7
54.7
$4.7
12.2
16.2
28.8
78.0
43.0
46.5
63.3
54.2
195
997
50.1
71.5
10.0
0.2
0.5
1.0
0.8
4.7
5.0
3,2
9.5
26.7
26-7
26.7
26.7
0.5
0.3
0.5
0.5
16.3
18.3
13.7
20.5
36.7
39.7
40.0
47.5
02
47.
35.0
55.8
56.8
77.3
778
793
800
79.8
83.7
85.2
35.8
13.7
47.0
558
61.2
53.2
82.7
91.7
93.0
83.8
95.0
55.0
93.3
80.0
720
96.0
K5
96.2
95.
96.5
96.5
968
K3
19.5
913
94.
95.5
96.5
97.2
97.3
4.3 Scalability to Online Copyright Tracing
An final concern is whether greedily selected triggers remain informative when more models registered online. Specifically, we assume that the verifier only obtains a small number of DNN models the beginning, with which he/she greedily selects series of triggers. We interested in whether these triggers still outperform randomly drawn triggers on unseen models or not.
The greedily selected triggers according either 100 or 200 models performed almost identically to those selected according to all 600 models regarding culmulative information, as shown Fig. 6 The failure to refer to all registered DNN models had small impact the uniqueness rate as shown greedily selected triggers outperformed randomly selected triggers,
Table 3 In almost all cases, if only 100 models were considered. In general, the more models verifier observe during greedy selection process, the larger the uniqueness rate is. This fact justified by the dominance of green entries in Table 3 Therefore, models as possible to select informative triggers, or choose to update the collection of triggers when the number of registered DNN models increases. Even if the number of observed models is small, the greedily selected triggers are more informative than randomly drawn triggers and result a larger uniqueness rate.
recommend that the copyright verifier collects as many
160
100
120
Time (sec).
200
80
600
0-
10
20
30
40
N
Figure 7: The time consumption of greedy trigger selection.
4.4 Overhead
We also evaluated the overhead of our method. The time consumption is no more than 160 seconds when all 600 models were used to optimize 50 triggers (it has been shown that 15-30 triggers

---

were sufficient for copyright tracing), as shown in Fig. 7 This overhead is acceptable and is independent from the dataset.
Discussions
The fingerprint optimization algorithm proposed in this paper adopts informative triggers during the fingerprint selection phase, aiming to achieve enhanced uniqueness. It does not involve the design implementation of the fingerprint scheme itself, and can be seamlessly integrated with trigger set-based fingerprint schemes to improve their effectiveness in practical application scenarios.
Limitations. More complex task scenarios beyond text generation, such as image and video genera- tion, have not yet been discussed, which will also be the focus of our future work.
Conclusions
This paper explores uniqueness, less frequently studied yet important dimension in evaluating DNN fingerprinting schemes for copyright tracing. After highlighting the significance and challenges regarding this property, adopt information theoretical perspective quantify the contribution of each fingerprinting trigger. We design an algorithm to efficiently estimate the conditional mutual information of each trigger and propose greedy algorithm that facilitates the efficiency of copyright tracing. Extensive experiments show that our method can be easily combined with arbitrary DNN fingerprinting schemes to improve the performance regarding uniqueness, even in the online setting. Our studies reveal several new insights evaluating and comparing DNN fingerprinting schemes and suggest more attentions on uniqueness addition robustness.
Acknowledgments and Disclosure of Funding
The work described in this paper was supported in part by the National Natural Science Foundation
of China (6227130) 1307).
The Al-driven experiments, simulations and model training were performed on the robotic AI- Scientist platform of Chinese Academy of Sciences.
10

---

References
[1] D. Guo, H. Chen, R. Wu, and Y. Wang, "Aige challenges and opportunities related to public safety: case study of chatgpt," Journal of Safety Science and Resilience, vol. 4, no. 4, pp. 329-333 229-339, 2023.
[2] Y. Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, "Turning your weakness into a strength: Watermarking deep neural networks by backdooring," in 27th USENIX security symposium (USENIX Security 18), 2018, pp. 1615-1631.
[3] J. Zhang. Z. Gu, J. Jang. H. Wu, and M. P. Stoecklin et al., "Protecting intellectual property of deep neural networks with watermarking," in Proceedings of the 2018 on Asia conference on computer and communications security, 2018, pp. 159-172.
[4] R. Namba and J. Sakuma, "Robust watermarking of neural network with exponential weighting." Proceedings of the 2019 ACM ASIACCS, 2019, pp. 228-240.
[5] J. Zhang, D. Chen, J. Liao, H. Fang. W. Zhang, W. Zhou, H. Cui, and N. Yu, "Model water- marking for image processing networks," in Proceedings of the AAAl conference on artificial intelligence, vol. 34, no. 07, 2020, pp. 12 825-12812
[6] J. Zhang, D. Chen, J. Liao, W. Zhang, G. Hua, and N. Yu, "Passport-aware normalization for deep model protection," Advances in Neural Information Processing Systems, vol. 33, pp. 22 22961226666 628, 2020.
[7] J. Zhang, D. Chen, J. Liao, W. Zhang, H. Feng, G. Hua, and N. Yu, "Deep model intellec- tual property protection via deep watermarking," IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 44, no. 8. pp. 4005-00222 2021.
[8] J. Zhang, D. Chen, J. Liao, 7. Ma, H. Fang, W. Zhang, H. Feng, G. Hua, and N. Yu, "Ro- bust model watermarking for image processing networks via structure consistency," IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024.
[9] T. Dong, S. Li, G. Chen, M. Xue, H. Zhu, and Z. Liu, "Rai 2: Responsible identity audit govern- ing the artificial intelligence," in 2022 Network and Distributed System Security Symposium, 2022, pp. 1-18.
[10] A. Bansal, P-yy Chiang, J. Curry, R. Jain, C. Wigington, and V. Manjunatha al., "Certified neural network watermarks with randomized smoothing," in International Conference on Machine Learning. PMLR, 2022, pp. 1450-1465.
[11] Zhao, Q. Hu, G. Liu, X. Ma, F. Chen, and M. M. Hassan, "Afa: Adversarial fingerprinting authentication for deep neural networks," Computer Communccations, vol. 150, pp. 488-497, 497, 2020.
[12] N. Lukas, Y. Zhang, and F. Kerschbaum, "Deep neural network fingerprinting by conferrable adversarial examples," in 9th International Conference Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021. [Online]. Available:
[13] X. Cao, J. Jia, and N. Z. Gong, "Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary," in Proceedings of the 2021 ACM ASIACCS, 2021, pp. 14-25.
[14) Z. Peng. S. Li, G. Chen, C. Zhang, H. Zhu, and M. Xue, "Fingerprinting deep neural networks globally via universal adversarial perturbations." in IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022. IEEE, 2022, pp. 13 433-211 429. [Online]. Available: https://doi.org// org/100.o..r/111001 100.1009/9V
[15] K. Yang, R. Wang, and L. Wang, "Metafinger: Fingerprinting the deep neural networks with meta-training." " in IJCAI, 2022, pp. 776-782.
[16] S. Wang, Zhao, X. Wang, Chin, T. Wahl, and Y. Fei al., "Intrinsic examples: Robust fingerprinting of deep neural networks," in British Machine Vision Conference (BMVC), 2021.
11

---

[17] Li, H. Zhao, W. Du, and S. Wang, "Revisiting the information capacity of neural network watermarks: Upper bound estimation and beyond." " in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 19, 2024, pp. 21 331-21 339.
[18] W. Aiken, H. Kim, Woo, and J. Ryoo, "Neural network laundering: Removing black-box backdoor watermarks from deep neural networks," Computers & Security, vol. 106, 102277, 2021.
[19] X. Chen, W. Wang, C. Bender, Y. Ding, R. Jia, B. Li, and D. Song, "Refit: unified watermark removal framework for deep learning systems with limited data," in Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security, 2021, pp. 321-335.
[20] K. Liu, B. Dolan-Gavitt, and S. Garg. "Fine-pruning Defending against backdooring attacks on deep neural networks," in International symposium on research in attacks, intrusions, and defenses. Springer, 2018, pp. 273-294.
[21] N. Chattopadhyay, C. S. Y. Viroy, and A. Chattopadhyay, "Re-markable: Stealing watermarked neural networks through synthesis," in Security, Privacy, and Applied Cryptography Engineer- ing: 10th International Conference, SPACE 2020, Kolkata, India, December 17-21, 2020, Proceedings 10, Springer, 2020, pp. 46-65.
[22] S. Wang, X. Wang, P.- Chen, Zhao, and X. Lin, "Characteristic examples: High-robustness, low-transferability fingerprinting of neural networks," in International joint conferences on artificial intelligence organization (IJCAT), 2021.
[23] A. Karanam, K. Killamsetty, H. Kokel, and R. Iyer, "Orient: Submodular mutual information measures for data subset selection under distribution shift," Advances in neural information processing systems, vol. 35, pp. 31 796-31 808, 2022.
[24] C. Li, S. Kothawade, F. Chen, and R. Iyer, "Platinum: Semi-supervised model agnostic meta- learning using submodular mutual information," in International Conference on Machine Learning. PMLR, 2022, pp. 12 826-228844 842.
[25] C. Di, F. Li, P. Xu, Y. Guo, C. Chen, and M. Shu, "Learning automata-acceelerate greedy algorithms for stochastic submodular maximization," Knowledge-Boud -Based Systems, vol. 282, 11 111118, 2023.
[26] Z. Xi, W. Huang. K. Wei, W. Luo, and P. Zheng, "Ai-generated image detection using a cross-atee coss-attention enhanced dual-stream network," in 2023 Asia Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC). IEEE, 2023, pp-
[27] E. Mitchell, Lee, A. Khazatsky, C. D. Manning, and C. Finn, "Detectgpt: Zero-shot machine- generated text detection using probability curvature," in International Conference Machine Learning. PMLR, 2023, pp. 24 950-55222 24 962.
[28] L. Dugan, D. Ippolito, A. Kirubarajan, S. Shi, and C. Callison-Burch, "Real fake text?: Investigating human ability to detect boundaries between human-written written and machine generated text," in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 11, 2023, pp. 12763-1277 771.
machine-generated
[29] C. Xiong, G. Feng, X. Li, X. Zhang, and C. Qin, "Neural network model protection with piracy identification and tampering localization capability," in Proceedings of the 30th ACM International Conference Multimedia, 2022, pp. 1289..
[30] M. B. Abdulrazzaq and N. Saeed, "A comparison of three classification algorithms for handwritten digit recognition," in 2019 International Conference on Advanced Science and Engineering (ICOASE). IEEE, 2019, pp. 53-63.
[31] M. Kayed, A. Anter, and H. Mohamed, "Classification of garments from fashion mnist dataset using enn lenet-5 architecture," in 2020 international conference on innovative trends com- munication and computer engineering (ITCE). IEEE, 2020, pp. 238-243.
12

---

[32] N. Sharma, V. Jain, and A. Mishra, "An analysis of convolutional neural networks for image classification," Procedia computer science, vol. 132. pp. 377-384, 2018.
[33] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, "Imagenet: A large-scale hierar- chical image database," " in 2009 IEEE conference on computer vision and pattern recognition. IEEE, 2009, pp. 248-255.
[34] M. R. Islam and A. Matin, "Detection of covid 19 from et image by the novel lenet-5 cnn architecture," 2020 23rd International Conference on Computer and Information Technology (ICCIT). IEEE, 2020, pp. 1-5.
[35] A. Vedaldi and A. Zisserman, "Vgg convolutional neural networks practical," " Department of Engineering Science, University of Oxford, vol. 66, 2016.
[36] K. He, X. Zhang, S. Ren, and J. Sun, "Deep residual learning for image recognition," in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770-778.
[37] H. Wu, G. Liu, Yao, and Zhang. "Watermarking neural networks with watermarked images," " IEEE Trans. Circuits Syst. Video Technol., vol. 31, no. 7, pp. 2591-2601, 2021. [Online]. Available: https://doi.org/ 1ttT:/.......TTT................
[38] T. Maho, T. Furon, and E. Le Merrer, "Fingerprinting classifiers with benign inputs," IEEE Transactions on Information Forensics and Security, vol. 18, pp. 5459-5472, 2023.
[39] X. Yuan, P. He, Q. Zhu, and X. Li, "Adversarial examples: Attacks and defenses for deep learning," IEEE transactions neural networks and learning systems, pp. 2805-2824, 2019.
[40] A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, Sutskever, J. Dean, and Ghemawat, "Language models are unsupervised multitask learners," in OSD/004: Sixth Symposium on Operating System Design and Implementation, pp. 137-150.
[41] L. Gao, S. Biderman, S. Black, L.. Golding, T. Hoppe, C. Foster, J. Phang, H. He, A. Thite, N. Nabeshima al., "The pile: An 800gb dataset of diverse text for language modeling," arXiv preprint arXiv:2101.0002. 2020.
[42] S. Zhang, S. Roller, N. Goyal, M. Artetxe, M. Chen, S. Chen, C. Dewan, M. Diab, X. Li. X. V. Lin et al, "Opt: Open pre-trained transformer language models," arXiv preprint arXiv:2205.01068 2022.
[43] S. Biderman, H. Schoelkopf, Q. G. Anthony, H. Bradley, K. O'Brien, Hallahan, M. A. Khan, S. Purohit, U. S. Prashanth, E. Raff et al., "Pythia: A suite for analyzing large language models across training and scaling," " in International Conference on Machine Learning. PMLR, 2023, pp. 2397-2430.
[44] C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y. Zhou, W. Li, and P. Liu, "Exploring the limits of transfer learning with a unified text-to-text transformer," Journal of machine learning research, vol. 21, no. 140, pp. 1-67, 2020.
[45] H. W. Chung. L. Hou, S. Longpre, B. Zoph, Y. Tay, W. Fedus, Y. Li, X. Wang, M. Dehghani, S. Brahma al. "Scaling ciarructionfinettunne language models," Journal of Machine Learning Research, vol. 25, no. 70, pp. 1-53, 2024.
[46] B. Workshop. T. L. Scao, A. Fan, C. Akiki, E. Pavlick, S. Ilié, D. Hesslow, R. Castagné. A, S. Luccioni, F. Yvon et al., "Bloom: A 776b-parameter open-access multilingual language model." arXiv preprint arXiv:22/ 1.05//2/..0000.,.. 2022.
[47] C. Tan, V. Niculae, C. Ganescu-Nieulescu-Nee dynamics and persuasion strategies in good-faith online discussions," Proceedings of the 25th international conference world wide web, 2016, pp. 613-624.
and I.. Lee, "Winning arguments: Interaction
[48] X. Zhang, Thao, and Y. LeCun, "Character-leve" convolutional networks for text classification," Advances in neural information processing systems, vol. 28, 2015.
13

---

[49] S. Narayan, S. B. Cohen, and M. Lapata, "Don't t give me the details, just the summary! topic-aware convolutional neural networks for extreme summarization," arXiv preprint arXiv: 08745, 2018.
[50] A. Fan, Y. Jernite, E. Perez, D. Grangier, J. Weston, and M. Auli, "Eli5; Long form question answering," arXiv preprint arXivv 2019.
[51] A. Fan, M. Lewis, and Y. Dauphin, "Hierarchical neural story generation," arXiv preprint 18X1::1805.04833 2018.
[52] N. Mostafazadeh, N. Chambers, X. He, D. Parikh, Batra, L. Vanderwende, Kohli, and J. Allen, "A corpus and cloze evaluation for deeper understanding of commonsense stories," in Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, 2016, pp. 839 849.
[53] R. 7ellers, A. Holtzman, Y. Bisk, A. Farhadi, and Y. Choi, "Hellaswag: Can machine really finish your sentence?" arXiv preprint arXiv: /905. 07830, 2019.
[54] Rajpurkar, J. Zhang, K. Lopyrev, and P. Liang, "Squad: 100,000+ questions for machine comprehension of text," arXiv preprint arXiv:1606.005550 2016.
[55] N. S. Moosavi, A. Rücklé, D. Roth, and I. Gurevych, "Learning to reason for text generation from scientific tables," arXiv preprint urXiv:2104.08200 2021.
[56] Y. Chen, H. Kang, V. Zhai, L. Li, R. Singh, and B. Raj, "Token prediction as implicit classifica- tion identify llm-generated text," " in The 2023 Conference on Empirical Methods in Natural Language Processing, 2023.
[57] K. Wu, I.. Pang, H. Shen, X. Cheng, and T.-S. Chua, "Limdet: A third party large language mod- els generated text detection tool," in Findings of the Association for Computational Linguistics: EMNLP 2023, 2023, pp. 2113-2133.
[58] B. Mirzasoleiman, A. Badanidiyuru, A. Karbasi, J. Vondrák, and A. Krause, "Lazier than lazy greedy," in Proceedings of the AAAI Conference on Artificial Intellignce, vol. 29, no. 1, 2015.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract has stated the claims made, including the contributions made in the paper and important assumptions and limitations.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
The limitations are discussed in conclusions.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
15

---

Justification:
Self-contained proofs have been given for theoretical results. Additional assumptions and theories have been given sufficient references.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We disclose as many details as we could, and provide the codes. We used public datasets and toolkits.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
16

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
The anonymous repo has been given in the appendix D.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.co cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//nips //ips.cc//pill wttpcccppppcccceeeeeeeeee..c.ett httpa//gguddeee/eeeeabiisssssss /Cc////oddiiisssseeeeeee ssiiiiiiccyyyyyyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification: Most settings showned in section 4.1, and more details can be found and checked in the anonymous code repo
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer:
[Yes]
Justification:
We recorded and visualized each experiment in Figures, including noises.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for
example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
17

---

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (c.g. negative emror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: See Section 4.1.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification: This paper is with the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
This paper address a crucial aspect of AI security
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
18

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification:
This paper aims to analyze critical threat to the misuse of Al models.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: They have been explicitly mentioned and properly respected.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
19

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: This paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
20

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: This paper does not involve LLMs any important, original, non-standard components.
Guidelines:
The answer NA means that the method development in this research does involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy for what should or should be described.
21

---

A Proof of Theorem 1
Proof. Consider an attack that changes each position of the fingerprint with a probability 6. This attack is featured by C-ary code of length N, among which (1 N positions equal zero to represent triggers whose predictions remain invariable. The other NN positions are distributed in {1, C }} to represent that the corresponding predictions have been shifted to the next 1, 1, . (C 1)-th class (modulo C).
We use 6h to denote the output of the suspicious model on tr before being attacked. For the first term in Eq. 4
(0)
H H On 1)
2 H( .y An-
(10)
H HH
A)
(2) 1o ( (tn)t1:n-1))
in which (a) follows the basic properties of entropy, (b) and (c) hold since once the attack is known, the entire case can be reduced to the vanilla setting as if no attack has been applied.
The second term in Eq. (4) equals:
H ( A
1)
(a(F)-(((AA)))) H(Aial11, DRn F)
H H( A 10 2n-
(8) H (A1:a Ø1, F, (e)
(11)
H (An))
5log2 8- (1-8) loga 8) 8 logz 1):
where AL. and An, denote the attack corresponding triggers. All (a)-(d) use the attack's represen- tation, (b) also relies on the chain rule of entropy. Combining Eq. (10) and Eq. (11) yields:
Le (t (tmlti:(n-))) I0o (tx t1:(m 11) + 8 8log2 8
(12)
+ -11 5) logg (1 5) ō lo -1) 1).
The r.h.s. of Eq. (12) monotonically decreases in d (when 8 < 0.5). Combining this observation with Eq. yields Eq.
B Applications on Copyright Tracing of Generative Language Models
We demonstrate the application of the proposed method on the copyright tracing of generative language models.
We built collection of P 50 generative language models including GPT-2
40
with 10
fine-tuned versions, GPT-Neo-1283 -15M [41] with 10 fine-tuned versions, OPT-125M
42
with 10
fine-tuned versions, 0PT-350M with 10 fine-tuned versions, Pythia-70M 43).
Pythia-160M,
Pythia-160M-dedupel T5-Small [44] Tan-TT-Small (55,, and BLOOM-560M
46 Each fine-
tuned version used one corpus from CMV 47 Yelp 48 TLDR [49]. XSum
49 EL15 [50].
WP [51] ROC [52), HellaSwag (33] SQuAD
and SciGen [53)
Candidate basic copyright tracing algorithms were T5-Sentinel 56 (C 5), T5-Hidden (C 5), and LLMDDt (57) (C 9). Given a series prompts, the suspicious model generates a series of texts, which are fed into the basic copyright tracing algorithm. The fingerprint of the suspicious model the list of outputs from the copyright tracing algorithm. For example, LLMDet has captured texts generated from (O:Human, 1:GPT-2, 2:0PT, 3:UniLM, 4:LLaMA, 5:BART, 6:T5, 7:BLOOM, 8:GPT Given list of seven prompts, T5-Small returns six sentences, which might classified by LLMDet into [Human,GPT] be encoded as [0.1,,,4.0,6,11], which can be interpreted as the fingerprint of a nine-class classifier.
GPT-2), so the fingerprint of T5-Small under LLMDet can
Initially, N 200 prompts were random drawn from the union of 10 corpura for fine-tuning. The culmulative mutual information provided by fingerprints from three algorithms visualuzed in Fig. R It turns out that either T5-Sentinel or T5-Hidden was capable of distinguishing all 50 models with five prompts, although they were trained on only five models (Human, GPT3. 5, PALM, LLaMA, and GPT2-XL). XL). Mcanwhile, LLMDet has leamed data generated from nine different models, but it failed
22

---

Colmulative information
Uniqueress rate (%)
To Sentiel
T5 T5-Serinnd
Hideon
20
Hidde
LLMDet
2
10
(b)
Figure 8: (a) The culmulative mutual information (in bit) and (b) the uniqueness rate provided by prompts in the original order (the solid eurves) and prompts seleted by the greedy algorithm (the dashed curves). The black line marks (1 2) log, 50 bits.
Sorind. TS-Hicton
Accuray (N)
T5:Sertind.
20
Hidde
0
10
01
Top-5.
(b) Top-10. 10.
Figure 9: The copyright tracing accuracy provided by prompts in the original order (the solid curves) and prompts seleted by the greedy algorithm (the dashed curves).
to differentiate all models even with ten prompts. After all, all three schemes' performance was boosted under the greedy selection framework.
The uniqueness declined sharply in the adversarial setting where we implemented fine-tuning with Wikimedia corpus as adversarial modifications. Greedily selected triggers outperformed the baseline random setting as well. This is reflected in the copyright tracing accuracy in Fig. 9
We remark that for generative language models, the conditional mutual information of prompt depends on both the prompt's 's source corpus and the classifier algorithm (there is no extra copyright tracing classifier for DNN classifiers be protected), also had a small influence as shown in Fig. 10 Although T5-Sentinal and T5-Hidden performed differently across corpura (using random prompts from corpus), their performed almost identically after incorporating the greedy selection scheme. Meanwhile, the culmulative mutual information of LLMDet remained the lowest in all cases, yet our greedy selection scheme uniformly boosted its performance.
experiments suggested that the first factor
To simplify the evaluation, the random seeds within language models were manually fixed. In practice, the verifier is encouraged to feed prompt to a language model for multiple times, record the predictions returned from the basic copyright tracing algorithm, and conduct voting. It can be proven that when the error of this estimation for each prompt is bounded by e (i.e., the probability that the prediction for this prompt differs from the statistical mode is larger than then the bound in Eq. (8) should be relaxed into:
N
Σ I. (tn (tu(ti:(a-))) N
==1
(13)
N (To (w))t
Σ 21- n=1
- - (1- log, C -ei2 lo2g C.
httpss//dumps. wikimediaa.rg.
23

---

Carisiin montineeeea rennal Irtoraatoo
Carribin maboi inforaaioon
Carssiin mazus
Se-iened Ts T5-46kk1
TI- Sariedd To Tec
T5 Sesiad Ts LLMDet
TV Seried Ts-kkles LLMDe.
LLMDe
LUMD
(a) CMV.
(b) Yelp.
(c) TLDR.
(d) XSum.
Carminn Inberotta
Carruri euc.a inberatioa
Calrulaity infor mastonaton 1d
(c) ELIS.
(f) WP.
ROC.
(h) HellaSwag wag.
Commsitte inforcioon
Coriiatte mutal oforrnion
Sererind 1SHoden LUM.3t.
ThSeried
LLMUe
SQuAD.
ii)
Sci-Gen.
Figure 10: The culmulative mutual information (in bit) provided by prompts in the original order (the solid curves) and prompts seleted by the greedy algorithm (the dashed curves). The black line marks (1 (1-1) ) log2 50 bits.
The proof is similar to the induction in Lemma 2 in 58
conclusion, our scheme can be generalized to other non-classifiers and boost the performance of copyright tracing by increasing the uniqueness rate. Additionally, it can be used in the open setting where the models to traced have not been included into the training set of basic copyright tracing multiple prompts to extract their fingerprints.
algorithms, it is necessary
C Code Repo Link
All codes for reproducibility in htttt::/ttgtteeie com/ htamm//zsmmmIffoonaattoooo hwraam/nnnnooanitteeeeeeeer
24


Reviews:
[{"review_id": "1319A5vksa", "reviewer": "Reviewer_9qe1", "summary": "This paper explores an information-theoretic approach to enhance the uniqueness of deep neural network (DNN) fingerprints for copyright tracing. The authors propose selecting fingerprinting triggers by maximizing conditional mutual information, aiming to improve the uniqueness rate of fingerprints. Experiments on datasets including MNIST, FashionMNIST, CIFAR-10, and ImageNet validate the proposed approach.", "questions": "1. How does the fingerprinting method affect model accuracy, and can you provide a quantifiable cost-benefit analysis?\n\n2. Why were comprehensive comparisons with state-of-the-art fingerprinting methods (such as MetaFinger or Characteristic Examples) not included experimentally?\n\n3. How do you anticipate your method scaling to more complex, large-scale real-world datasets and models?", "limitations": "No. The authors have not adequately addressed the potential negative societal impacts or thoroughly discussed limitations beyond adversarial robustness.\n\nSuggestions for improvement:\n1. Explicitly discuss any potential negative impacts, such as misuse or unintended consequences related to model fingerprinting and intellectual property tracing.\n\n2. Provide a deeper exploration of the broader ethical implications of deploying this technology in practical settings.\n\n3. Clearly outline the limitations associated with scalability, robustness in diverse real-world conditions, and potential accuracy degradation due to fingerprinting.", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths\n+ The theoretical analysis leveraging information theory is solid, and the greedy trigger-selection algorithm is clear and well-justified.\n+ The paper is generally well-structured, with clear explanations and systematic presentation of concepts and experiments.\n+ Using information theory for optimizing fingerprints has some novelty, although similar ideas about optimizing robustness have been explored before.\n\nWeaknesses\n- Limited Realism in Experimental Setting: The experiments primarily utilize simpler, smaller-scale datasets like MNIST, FashionMNIST, and CIFAR-10. Although ImageNet is included, experiments on more complex and realistic scenarios remain limited.\n\n- Insufficient Comparison with State-of-the-Art: While several existing fingerprinting methods are listed, the paper lacks comprehensive comparative experiments against these methods, notably missing direct experimental comparisons to established state-of-the-art methods such as MetaFinger or Intrinsic Examples.\n\n- Lack of Accuracy-Cost Analysis: The paper does not explicitly analyze or quantify the cost associated with accuracy degradation due to fingerprinting, an essential consideration for practical deployment.\n\n- Incomplete Coverage of Relevant Literature: Important related works such as \"Characteristic Examples: High-robustness, Low-transferability Fingerprinting of Neural Networks\" (Wang et al., IJCAI 2021) and \"An Overview of Trustworthy AI\" (Zheng et al., IEEE 2024) were not sufficiently considered or compared against in the paper. Specifically, the concept of \"Low-transferability\" discussed in Wang et al. (2021) closely aligns with the notion of \"uniqueness\" explored in this paper, yet the comparison is absent.", "was_revised": true, "final_justification": "While the paper is clearly written and presents interesting ideas, its applicability is still limited due to the lack of validation on more complex, realistic scenarios—especially regarding model performance under adversarial conditions, model modifications, and fine-tuning. I appreciate the authors’ hard work and contributions, but these gaps mean the proposed method is not yet ready for real-world deployment, so I recommend keeping the current rating.", "rebuttal": "Dear Reviewer 9qe1,\n\nThank you for the insightful comments.\n\nWe summarize your concerns into five aspects: **Settings of datasets & models**, **Settings of comparision baselines**, **Accuracy-cost analysis**, **Relevant literature**, **Limitations & ethical considerations**.\n\n**Settings of datasets & models (Weakness 1, Question 3):**\nIn addition to image classification, we also conducted experiments on generative language models. \nThis is mentioned in *Remark 3, Sec.3.3*, results are reported in *Appendix B*. \n\n**Settings of comparison baselines (Weakness 2, Question 2):**\nOur method is not a stand-alone fingerprinting scheme. \nInstead, it is a universally application optimization scheme that improves the uniqueness of DNN fingerprinting schemes (either established schemes or future schemes), and is not a direct competitors to any DNN fingerprinting scheme. \nTo the best of our knowledge, we are the first to study the uniqueness of trigger set-based fingerprints for black-box scenarios in large-scale distribution settings as an individual problem. \nMetaFinger has been cited as Reference [15], and we demonstrated the performance of our scheme with it under the name *Adv-1*. \nIntrinsic Examples focuses on optimizing the fingerprint embedding stage, and is out of the scope of our study, which focus on selection of triggers without tuning the original model.\n\n**Accuracy-cost analysis (Weakness 3, Question 1):**\nOur method modifies the trigger selection process and does not modify the underlying model. \nTherefore, it introduces zero performance degradation. \nThe trigger-set-based fingerprinting methods that we optimize do not modify the model either, so there is no accuracy loss involved.\nThe overhead caused by trigger selection has been detailed in *Sec.4.4, Fig.7*. \n\n**Relevant literature (Weakness 4):**\nThe low transferability of Characteristic Examples pertains to the fingerprint of a single model, while our work focuses on the uniqueness of fingerprints in distinguishing between models in large-scale deployments, we would properly cite this work in the prelimary section. \n\"An Overview of Trustworthy AI\" is a survey, yet it neither specificifies the uniqueness of fingerprint nor provide solution, so we did not include it in our related works. \n\n\n**Limitations & ethical considerations (Limitations):**\nThe limitations of this work is that we have not applied it to multi-model tasks, and we mention this by the end of *Sec.5*. \nThe work described in this paper aims to advance the field of artificial intelligence in a positive way. While our research may have broader societal implications, these considerations have not been the primary focus of the current discussion. We will include a dedicated examination of these aspects in future revisions.\n\nThanks again for your valuable feedback and careful review. \n\nIf you have any other concerns, we would be happy to discuss them. \n\nIf not, we would be grateful if you could consider increasing your evaluation of our work."}, {"review_id": "iRVRVSAXw2", "reviewer": "Reviewer_RULe", "summary": "This paper focuses on improving the efficiency of fingerprint sequence selection by choosing samples with the highest marginal mutual information based on information theory. The author provides sufficient theoretical and experimental justification for this selection strategy.", "questions": "See weaknesses above.", "limitations": "See weaknesses above.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n1.\tThe paper has sufficient theoretic analysis to support its claims\n2.\tThe experiments empirically evaluate the statements and are consistent with the results of theoretic analysis\n3.\tThis author has provided detailed results to validate the generalizability of such fingerprint triggers selection method.\n4.\tThe paper is well-written and easy to understand for both the theoretic and experimental parts.\n\nWeaknesses\n1.\tThe author said “the verifier assumes that the adversary has sacrificed the victim model’s performance”, which seems to be one-sided and subjective since the adversary may use the victim model as a base model (if the adversary could access the original victim model in a white-box manner) and fine-tuning it on themselves data thereby further improving the victim model’s performance. \n2.\tIn Sec 3.1, the author assumes “the suspicious model F is equally likely to be any registered model”. I understand this assumption is durable when there is no any prior knowledge on the suspicious model. However, practically, this assumption is hard to hold as the suspicious model is bound to be more likely to be the models that are corresponding-original-victim-model-like(e.g. models with same architecture, similar training data and method).\n3.\tIn Line 131, what the meaning of “so is the fingerprint of the suspicious model”? it seems to be a typo.\n\nOverall, this paper is well-motivated and the presentation is good. I’d like to see it at NIPS 2025. \nBy the way, I have reviewed this paper last year, and I believe the current version has addressed most of my previous concerns. Hence, I have changed my stance to a positive one and am happy to support its acceptance. Moreover, to further improve the quality of the paper, I also recommend the authors carefully consider the issues I raised.", "was_revised": true, "final_justification": "All the concerns are addressed. My recommendation is Accept.", "rebuttal": "Dear Reviewer RULe,\n\nThank you for the positive comments and we appreciate the advices.\n\n**Regarding Weakness 1:** \nIt is true that an adversary could fine-tune the model to improve its performance on specific tasks. \nOur assumption here was intended to convey that any modification to the model by the adversary could potentially cause errors in fingerprint verification: the higher the error rate, the lower the robustness. \nTherefore, a robust fingerprint should be resilient even against the strongest possible attacks. \nWe acknowledge that our original statement was not clear enough and we would make appropriate clarification on this point in the final version.\n\n**Regarding Weakness 2:** \nWe made this assumption and derivation to maintain generality, i.e., we focused on the primary and most difficult setting in which each model is equally likely to be stolen. \nIn cases where the suspicious model is likely to be derived from a certain subset of all candidate models, the discussions in our paper maintain valid after replacing $F$ with this subset. \nWhen the suspicious model is more likely to be some specific model within $F$, the entropy of the copyright tracing event is strictly smaller than $\\log_{2}|F|$, so our conclusions on the minimal number of triggers remain a pessimistic yet valid bound. \nIn future revisions, we will supplement our discussion to include the influence of prior biases.\n\n**For the last concern**, line 130-131 mean that both the output on the $n$-the trigger ($\\phi_{n}$) and the outputs on all triggers ($\\Phi$, which is composed of $\\phi_{1},\\phi_{2},\\cdots,\\phi_{N}$) are random variables, which may be grammatically misleading but is not a typo.\n\n\nThanks again for your insightful suggestions."}, {"review_id": "NGW51vdFnV", "reviewer": "Reviewer_cgHY", "summary": "This paper addresses a challenge in deep neural network (DNN) copyright tracing: enhancing the uniqueness of fingerprints generated from limited fingerprinting triggers. While prior work largely focuses on robustness, this work emphasizes the importance of uniqueness, especially in scenarios where the number of triggers must be kept small due to practical constraints such as query cost. Additionally, the paper presents a necessary condition for the minimum number of triggers required to reliably identify models. Overall, the work contributes a novel information-theoretic perspective and optimization strategy for boosting the robustness and discrimination power of DNN fingerprints.", "questions": "1. The proposed mutual information-based trigger selection involves estimating conditional mutual information, which can be computationally intensive, especially for large models and numerous triggers. Could you provide more detailed analysis or empirical measurements of the computational costs involved?\n\n2. While the method optimizes trigger selection based on information contribution, how does it perform under potential adversarial scenarios where attackers might attempt to modify or remove triggers (by some watermark removal techniques) ?\n\n3. The experiments primarily focus on classification tasks with standard datasets. Can the approach generalize to more complex scenarios, such as models for object detection, segmentation, or models trained on proprietary, domain-specific data?\n\n4. How easily can your trigger selection framework be integrated into existing fingerprinting schemes, especially those that do not rely explicitly on carefully designed triggers?", "limitations": "No. In the Checklist, the authors state that \"The limitations are discussed in conclusions\". But I don't find any relevant content in conclusions.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\n1. This work addresses a timely and relevant challenge—making DNN fingerprints more discriminative and resource-efficient, which could influence future research and applications in model ownership verification.\n\n2. The extensive experimental results validate the proposed approach across multiple datasets and fingerprinting schemes. The improvements in both the uniqueness and efficiency of the fingerprinting process suggest that the method is practically valuable for copyright tracing.\n\n3. The paper clearly articulates the problem of uniqueness in DNN fingerprinting and why previous work’s emphasis on robustness alone is insufficient.\n\nWeaknesses:\n\n1. While the experimental results are comprehensive, they primarily focus on classification tasks with standard datasets. The applicability of the approach to more complex, real-world scenarios such as models trained on proprietary datasets or in adversarial environments remains to be explored.\n\n2. The paper does not extensively discuss potential computational overheads associated with estimating mutual information for large-scale models or triggers, which could impact real-world deployment.\n\n3. Although the information-theoretic approach is well-motivated, the paper would benefit from a more detailed discussion on how the method integrates into existing fingerprinting frameworks and its robustness against potential adversarial attacks aimed at circumventing the fingerprint.\n\n4. The theoretical analysis assumes that adversarial modifications are independent and random from a distribution, which might be simplified compared to realistic adaptive attackers that could target specific triggers. This potentially weakens the applicability of theoretical guarantees.", "was_revised": true, "final_justification": "The authors effectively addressed concerns about the integration of information - theoretic triggers, clarifying how mutual information alignment strengthens fingerprint uniqueness. Rebuttals provided clear experimental validations (e.g., on CIFAR - 10, ImageNet) that improved understanding of the method’s robustness. Discussions on ethical risks (e.g., model fingerprinting misuse) were supplemented with mitigations, showing awareness of real - world implications and addressing reviewer worries.\n\nHowever, there are several issues the authors have not addressed, such as edge cases of adversarial attacks on triggers. But I think this  is not important considering this paper's novelty and contribution. Therefore, I raise my score to 4.", "rebuttal": "Dear Reviewer cgHY,\n\nThank you for the insightful concerns.\n\nWe summarize your concerns into five aspects: **Settings of datasets & models**, **Cost analysis**, **Integration with existing frameworks**, **Robustness under adaptive attacks**, **Limitations**.\n\n**Settings of datasets & models (Weakness 1, Question 3):**\nIn addition to image classification, we also conducted experiments on generative language models. \nThis is mentioned in *Remark 3, Sec.3.3*, results are reported in *Appendix B*. \nWe are going to invesitage the performance of our scheme on fingerprinting algorithms designed for other multi-model models in the future. \n\n**Cost analysis (Weakness 2, Question 1):**\nDue to the lazy evaluation shown in Algo. 2, the space complexity of the entropy estimation is reduced according to the analyses in *line 144-154*. \nThe empirical overhead introduced by our scheme is discussed in *Sec.4.4* and visualized in *Fig.7*. \n\n**Integration with existing frameworks (Weakness 3, Question 4):** \nEach trigger-based DNN fingerprinting scheme would have its own trigger set (either it is carefully designed or randomly produced).\nAs shown by *Algo.2*, our algorithm reduces the size of a trigger set from $N$ to $\\hat{N}$, this is where the integration takes place.\nOur method cannot be direcly generalized to fingerprinting schemes that do not involve triggers (e.g., some white-box schemes that rely on the weights), yet most black-box DNN fingerprinting schemes are trigger-based and can be optimized with our scheme. \n\n**Robustness under adaptive attacks (Weakness 4, Question 2):**\nWe adopt an attack-agnostic threat model in *Sec.2.2* to maintain theoretical consistency. \nTo capture the diversity of real-world attacks, we define and quantify the level of model corruption after attack (Eq.(2)). \nThis provides a unified framework to analyze robustness without relying on specific attacker designs.\nOur experiments focused on fine-pruning, which is adopted as a baseline for watermark removal in existing literature (although they are not necessarily challenging for fingerprints). \nIt is ture that we did not include all possible attacks, yet the experiment pipiline can be directly generalized to more powerful adversaries by assuming a larger $\\delta$ given $\\epsilon$ (defined by Eq.(1) and Eq.(2) in Sec.2.2), which does not falsify our theoretical analyses. \n\n\n**Limitations:**\nThe limitation of this work is that we have not applied it to multi-model tasks, and we mention this by the end of *Sec.5*. We will include a dedicated discussion on this aspect in future revisions to ensure clarity.\n\nThanks again for your valuable feedback and careful review. \n\nIf you have any other concerns, we would be happy to discuss them. \n\nIf not, we would be grateful if you could consider increasing your evaluation of our work."}, {"review_id": "UX3bUHRQC9", "reviewer": "Reviewer_4rAP", "summary": "This paper presents an innovative view of black-box DNN fingerprinting schemes using information theory. The authors explore the uniqueness property of DNN fingerprinting methods and provide a theoretical analysis of the contribution of each trigger to copyright tracing. Furthermore, this paper proposes a greedy algorithm to select triggers for efficient copyright tracing. Empirical results show that the proposed trigger selection method provides a better uniqueness rate compared to existing fingerprinting methods.", "questions": "Please consider addressing the weak points above.", "limitations": "This paper does not provide sufficient discussion of existing DNN fingerprinting methods, especially the ones that explored the uniqueness of model fingerprints. The authors should expand this discussion and clarify the contribution of this work compared to the previous ones.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 3, "originality": 4, "strengths_and_weaknesses": "This paper has the following strengths:\n+ The authors explore uniqueness, an important property of DNN fingerprinting methods that is less frequently studied. This property is particularly important to large-scale model distributions.   \n+ The authors provide a theoretical quantification of the contribution of each trigger using mutual information, and also derive the necessary condition on the number of triggers to ensure the uniqueness rate. \n+ The authors develop a greedy algorithm that optimizes the collection of triggers using conditional mutual information. Empirical results show that the proposed greedy selection algorithm outperforms existing DNN fingerprinting schemes in terms of model tracing efficiency and uniqueness.  \n\nThis paper has the following weakness:\n- The authors did not provide sufficient discussion about prior works that study the uniqueness of DNN fingerprinting. For example, the paper DeepMarks has leveraged Balanced Incomplete Block Design (BIBD) to design anti-collusion codebooks to ensure the uniqueness of each fingerprint.", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer 4rAP,\n\nThank you for the positive comments and we appreciate the advices.\n\nDeepMarks you mentioned is a pioneering work in DNN fingerprinting. \nOur work is fundamentally different in both the **objectives** and **applicable scenarios**.\n\n**Objectives:**\nOur approach focuses on providing a universal optimization for fingerprinting schemes, aiming to improve the distinguishability (or uniqueness) with the least number of queries. \nIn other words, our method can be integrated with any trigger set-based fingerprinting approach in to enhance the uniqueness of fingerprints. \n\nOn the other hand, DeepMarks embeds fingerprints by modifying model weights, and does not directly handle the optimization of the uniqueness of fingerprints. \n\n**Scenarios:**\nDeepMarks focuses on the white-box settings, whose applicable situation is limited compared with the black-box setting in our scheme, as the suspicious model is not always open-sourced.\nMoreover, our scheme explicitly considers the large-scale distribution of models, where the difficulty in copyright verification is much higher, since there are multiple models to be traced.\n \n\nWe agree that works including DeepMark have established initial results and drawn attention to the uniqueness of DNN fingerprints, which is precisely the subject of our work, and we would include a more comprehensive discussion and clarification in the future revision of our paper.\n\nThanks again for your insightful suggestions."}]

Author rebuttal:

Meta-review: The paper aims to enhance figureprint trigger selection for DNNs by choosing samples with the highest marginal mutual information. The approach is information-theory inspired and can determine an optimal number of triggers to reliably identify models. The contribution from an information theory perspective to the model fingerprinting process is novel, and the experiments are also comprehensive on multiple models and datasets.

The reviewers and the AC are generally positive about the paper, and some concerns are addressed during the discussion period. The main issue remaining is the lack of discussion of some related work. When the AC recommends acceptance of this paper, the authors should discuss related work in a more comprehensive way and explain how this work can be specifically integrated into these existing schemes. This will reduce the confusion from readers.
Decision: Accept (poster)