Towards the Resistance of Neural Network Fingerprinting to Fine-tuning
Authors: Ling Tang
YueFeng Chen
Hui Xue
Quanshi Zhang
Venue: NeurIPS 2025 poster ()
Keywords: Neural Network Fingerprinting
Fourier analysis
Primary area: theory
TL;DR: This paper proves that specific frequency components of convolutional filters are robust to fine-tuning and uses them as neural network fingerprinting.

Abstract: This paper proves a new fingerprinting method to embed the ownership information into a deep neural network (DNN) with theoretically guaranteed robustness to fine-tuning. Specifically, we prove that when the input feature of a convolutional layer only contains low-frequency components, specific frequency components of the convolutional filter will not be changed by gradient descent during the fine-tuning process, where we propose a revised Fourier transform to extract frequency components from the convolutional filter.  Additionally, we also prove that these frequency components are equivariant to weight scaling and weight permutations. In this way, we design a fingerprint module to embed the fingerprint information into specific frequency components of convolutional filters. Preliminary experiments demonstrate the effectiveness of our method.

Towards the Resistance of Neural Network Fingerprinting to Fine-tuning
Ling Tang Shanghai Jiao Tong University tlingesjtu. edu..edu..oom en
Yuefeng Chen Alibaba Group
yuefeng
com
Hui Xue
Quanshi Zhang
Alibaba Group mui.xxee@@libabaaiin com
Shanghai Jiao Tong University zqs10228a edu, cn
Abstract
This paper proves new fingerprinting method to embed the ownership information into deep neural network (DNN) with theoretically guaranteed robustness fine- tuning. Specifically, prove that when the input feature of convolutional layer only contains low-frequency components, specific frequency components the convolutional filter will not be changed by gradient descent during the fine-tuning process, where we propose revised Fourier transform to extract frequency compo- nents from the convolutional filter. Additionally, components are equivariant to weight scaling and weight permutations. In this way, we design fingerprint module to embed the fingerprint information into specific frequency components of convolutional filters. Preliminary experiments demonstrate the effectiveness of our method. The source code has been released httg::/gttthbb.com////ie/DDwDwtt
also prove that these frequency
Introduction
Fingerprinting techniques have long been used to protect the copyright of digital content, including images, videos, and audio [Nematollahi et al. 2017). Recently, these techniques have been extended to protect the intellectual property of neural networks. Fingerprinting a neural network is usually conducted to implicitly embed the ownership information into the neural network. In this way, if neural network is stolen or further optimized, the ownership information embedded in the network be used verify its true origin. Previous studies usually embedded the ownership information in different ways. For example, Zeng et al. 2024) directly embedded the fingerprint into the network parameters. Kim et al. [2023) used the classification results particular type of adversarial examples as the backdoor fingerprint. Kirchenbauer et al. [2023 added a soft fingerprint to the generation result.
However, one of the core challenges of neural network fingerprinting is the theoretically guaranteed resistance to fine-tuning. When network parameters changed during the fine-tuning process, the fingerprint implicitly embedded in the parameters may be overwritten. Although many studies
(Uchida et al.] 2017, AAd al. 2018 Liu et al.) 2021 Bansal al.) 2022 Kim al. 2023 Yang and Wu 2024 Zeng et al. [2023 Zhang et al. 2024] have realized this problem and have tested the resistance of their fingerprints fine-tuning, or boosted the resistance in engineering manner,
"Quanshi Zhang the corresponding author ezqs1022@gs 10gg100@sttu..uu.ccm. He with the School of Computer Science, at Shanghai Jiao Tong University, China.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Convolution operation on an input tensor
Extracting frequency components from the convolutional filter
Changes the frequency components after fine-tuning:
Refore T(
fine-tuning
W
Jw
ww
Fw
AF
After
fine-tuning
Fingerprints: frequency components are robust to fine-tuning
W
Fw
Figure 1: Overview of our theory. We prove that the specific frequency components B fol)) which are obtained by conducting revised discrete Fourier transform T(-) on the convolutional filter W, keep stable the training process. Thus, these specific frequency components F(w") are used as robust fingerprints to fine-tuning.
there no theoretically designed metric that is intrinsically resistant to fine-tuning in mathematics, to the best of our knowledge.
To this end, the core challenge towards the resistance to fine-tuning is to explore an invariant term in the neural network to fine-tuning, e.g., certain network parameters some properties of network parameters that are least affected during the fine-tuning process. Although Zeng et al. [2023] and
Zhang et al. 2024 have explored invariant terms w.E.f weight scaling and weight permutations for fingerprinting, the theoretically guaranteed invariant term to fine-tuning remains unsolved.
Therefore, in this study, we aim to discover and prove such an invariant term to fine-tuning. Specif- ically, as Figure 2 shows, Tang et al.) [023] have found that the forward propagation through specific vector multiplication between frequency components F FF(e)) 8 M Nb in the frequency domain, where F denotes the frequency component of the input feature X at frequency (u, v), which extracted by conducting a discrete Fourier transform, F(ue) denotes the frequency componen of the convolutional filter W,
convolutional layer W X x-+bb1axx
be reformulated
and b is the bias term.
Based this, we prove that if the input feature only contains the low-frequency components, then specific frequency components of convolutional filter F( are stable w.r.l. network fine-tuning. Additionally, we also prove that these specific frequency component exhibit equivariance to weight scaling and weight permutations.
Therefore, Figure I shows, propose use such frequency components F w as the robust fingerprint. Besides, the overwriting attack is another important issue for fingerprinting. To defend the fingerprint from the overwriting attack, we introduce an additional loss to train the model, which ensures that overwriting of the fingerprint will significantly hurt the model's performance.
The contribution of this study can be summarized as follows. (1) We discover and theoretically prove that specific frequency components of a convolutional filter remain invariant during training and are equivariant to weight scaling and weight permutations. (2) Based on the theory, we propose to encode the fingerprint information into these frequency components, so as ensure that the fingerprint robust to fine-tuning, weight scaling, and weight permutations. (3) Preliminary experiments have demonstrated the effectiveness of the proposed method.
Related Work
The robustness of fingerprints has always been key issue in the field of neural network fingerprinting. In this paper, we limit our discussion to the fingerprint embedded in network parameters for the
"The frequency component F(ue) of the convolutional filter is defined in Equation which is extracted by applying revised discrete Fourier transform on convolutional filter W. According to Theorem the frequency component Flae) frequency (u, v) represents the influence the convolutional filter W the
corresponding frequency component f(lv) extracted from the input feature 3 For clarity, we move low frequencies to the center of the spectrum map, and move high frequencies to the corners of the spectrum map.

---

Table I: Methods for model source tracing. "v" indicates robustness, "X" indicates lack of robustness, "_" means that the attack is no applicable, and "NTD" means that there is no target design defend against the attack.
Robustness against attacks Permutation
Method
Fine- tun-ttuing
Scaling
Overwriting
Pruning
Distillation
[Adi et al.
2018
NTD NTD
No test
Jia et al 2021
Tested
Bansul et m
2022
Enhunced via noise training
No test
Kim et al 2023
Enhanced via trigger confidence boosting
Tested
Gubei ct a
1024
NTD
No test
NTD
Szyller al
202
Charctie et
21122
Fan 2019
Enhanced via fingerprint amplification
Tosted
Zhang al.
2020
Enhanced via fingerprint amplification
Tested
Lchidl
Empirical, NTD Empirical, NTD Empirical, NTD Empirical, NTD
Tested
Yang and Wu
2024
No test
Zeng et al. 2024
No test
Zhang et al.
2024
Tested
Ours
Theoretically guaranteed
No test
protection of the DNN's ownership information. Especially, discuss previous methods under attacks of fine-tuning, weight scaling, weight permutations, pruning, and distillation.
Weight scaling and weight permutations are typical attacking methods which change the fingerprint by rearranging the network's s parameters. Therefore, Zeng et al. [2023] embedded the fingerprint information into the multiplication of specific weight matrices, which were invariant to weight scaling and weight permutations. Zhang et al. [2024) measured the CKA similarity Kornblith et al. [2019) between the features of different layers DNN the robust fingerprint towards weight scaling and weight permutations.
Compared to the robustness to weight scaling and weight permutations, the robustness to fine- tuning presents a more significant challenge. Up to now, there no theoretically guaranteed robust fingerprint to fine-tuning, to the best of our knowledge. Thus, many fingerprint techniques were implemented in an engineering manner defend the fine-tuning against attack. [iu al. [002]] selected network parameters, which did not change a lot during fine-tuning, to encode the fingerprint information. Kim et al. (2033) used the classification results on a trigger set as the fingerprint and
improved robustness by increasing the classification confidence. Zeng al. [2023] found that the
direction of the vector formed by all parameters was relatively stable during fine-tuning, so as to use
it the fingerprint.
However, Chen et al. (2019), Aiken et al. (202T), Shafieinejad al. [202]] and Xu al. [024]
showed that, despite various engineering defense methods, most fingerprints could still be effectively removed from the neural network under certain fine-tuning settings.
Therefore, a theoretically certified robust fingerprint is of considerable value in both theory and practice. To this end, Bansal al. [2022) and Ren et al. (2023) proposed to use the classification results on a trigger set as the fingerprint and proved that the classification accuracy was lower bounded when the attacker did not change the network's 's parameters by more than a distance in terms of l--norm (p > 1). These methods proved a safe range of parameter changes during fine-tuning, but they did not propose an intrinsically robust fingerprint.
In contrast, we have proved thcoretically guaranteed robust fingerprint to fine-tuning, i.e., proving that the convolutional filter's specific frequency components keep stable during fine-tuning. We summarize representative methods for model source tracing in Table
3 Method
3.1 Preliminaries: reformulating the convolution the frequency domain
In this subsection, we reformulate the forward propagation through convolutional filter in the frequency domain, i.e., Tang et al. 2023 have proven Theorem 3.1] showing that the convolution
3

---

operation can be reformulated as the vec- tor multiplication in the frequency domain as shown in Figure 2 Specifically, let us focus on a convolutional filter with C channels and a kernel size of K x K. The convolutional filter is parameterized by weights W E RC*X*X and the bias term b e R. Accordingly, we apply this filter to an input feature X E RCx xM and obtain an output feature map
F
F (us))
I (ue)
+ 6..NNb
(u,
(u, 2)
(2,
11 DFT
TT
1 DFT
M'x".
Y = -= & X + b. 1M'N'' (1)
(b)
W
X
+ 1.b-1axx
where @ denotes the convolution oper- ation. x is an M' x N" matrix, in
Figure 2: The convolution operation in the spatial domain (a) can be reformulated as the vector multiplication in the frequency domain (b)
which elements are all ones.
Background notation for frequency components of the input feature and the output feature. Before reformulating the convolution operation, we first introduce the notation for frequency com- ponents. Given the input feature two-dimensionall DFT on each e-th channel ( IgMx of X and the output matrix Y to obtain the frequency element G E C and Hur E C at frequency (u, v) as follows. C denotes the set of complex numbers.
xxxMxx and the output feature
RMMN we conduct the
M-1 N-1 Σ 1000
M-1 N-1 H Σ
G
Σ
X
22)
Σ VIL AED
Yon
(m 42
(2)
where X Ymn denote the elements of (e) and position (m, n), respectively.
For clarity, organize all frequency elements belonging the e-th channel construct a frequency spectrum matrix ( E CMNN, Alternatively, we can also re-organize these frequency
elements at the same frequency (u, v) to form frequency component vector I(uv) CC
(Gle)
Yu, v, plun) [G
G
G
Ce
Vc,
G
CAXN
(3)
Similarly, Flam) Huv E C represents the frequency component of the output feature Y the frequency (u, v).
Background 2: notation for frequency components of the convolutional filter. By following
[Tang et al. 2023), J the frequency componen F((=) of the convolutional filter W E c at frequency (w, is defined as follows, which is computed by conducting the revised discrete Fourier transform (-) (-) of frequency (u, v) W.
Vu, v, Flue) Tao(W) [
Q
Je......
Q C.
(4)
where Q(9 K- -K-IK-I W # 4 22, w:(e) denotes the element at position (1, of the e-th channel (c) E Rx w.
For all frequency components Fl"") CC, Ffne)) E C and F(re) E cC, frequency (u, v) close to (0. 0). (0, 1), (M 1,0), or (M-1,N 1,N - represents the low frequency, while frequency (u,v) close to (M/2, N/2) is considered as the high frequency.
For notational convenience, we can tensors Fx E CCXMXN and Fw T(W) COXMNN to denote the tensors of frequency components X and W.
(00)
(00)
Fx
E CXMXN
Fw = T(W)) =
E CCXMX
(5)
Reformulating the convolution operation in the frequency domain. Based on the above notation. 'Tang al. 22023) have proven that the forward propagation of the convolution operation in Equation (1) can be reformulated as a vector multiplication in the frequency domain as follows. Theorem 3.1.
Y 1
plun) F(um)) + Sa Nb,
(6)
(Spatial domain)
(Frequency domain)

---

where denotes the scalar product of two vectors; 8uv is defined as ó.. if and only if = 0. and 8 otherwise. In particular, the convolution operation & conducted with circular padding Jain 1989 and stride size of 1, which avoids changing the size of the oulput feature (i.e., ensuring M and N' = =N).
3.2 Invariant frequency components of the convolutional filter
In this subsection, we aim to prove that frequency components of the convolutional filter Fwv at certain frequencies (u, u) are relatively stable during training. Additionally, these frequency components also equivariant way, we can embed the fingerprints into these components to enhance their resistance to fine-tuning, weight scaling, and weight permutations.
other attacks like weight scaling and weight permutations. In this
Proving specific frequency components of the filter are invariant towards fine-tuning. Specif- ically, based on the forward propagation in the frequency domain formulated in Equation (6). we prove that if the input feature X contains only the fundamental frequency components, i.e V(u, u) * (0, 0), x = O, then frequency components Ffum) specific frequencies will not change over the training process.
To prove the invariance of the frequency components towards fine-tuning, we decompose the entire training process into massive steps of gradient descent optimization. Each step of gradient descent optimization w.r.l. the loss function can be formulated as W' = w lj aw denote the frequency component extracted from the filter before the optimization, according to
&Loss
Let F = Tu. (W)
Equation (4). Let F(ae)) Tuo (W n ow denote the frequency component extracted from the updated filter W' after the step of gradient descent optimization.
Blas
Theorem 3.2. (The change of frequency components during training. proven in Appendix (A.
The change of each frequency component Flue) before and after a single-step gradient descent optimization reformulated as follows.
AF(U)) (uv) =Tan -aww"
ØLoss aw
(W) Flue)
JW
1
M-1 N-1
Σ
Awou's
ŌLoss ax(dto
[(u'v)
af
W RD=D v/=0
where Auou'y sin
K(u
sin
Riv
(K-1)a--))
11(
w')
C is complex coeffi-
sin
cient; Fx denotes the conjugate of J
Corollary shows that if the input feature only contains the fundamental frequency component, then the specific frequency components F(we) keep unchanged over the training process. This is an ideal case where the input feature only contains the fundamental frequency component, and u, can take non-integer values.
Corollary 3.3. (Invariant frequency components towards fine-tuning, proven in Appendix A.2) In the training process, if the input feature X only contains the fundamental frequency component, i.e., V(u, v) # (0, 0), Fi,Fiiu invariant.
pluv)
0, then frequency components F(ue) at all the following frequencies keep
iM K
jN K
AF
O,
(1,2, ..., K-
(8)
However, in real applications, the input feature usually contains low-frequee www-frquency components, and frequencies must be integers when conducting the DFT. Under these conditions, each element in AF(ee) is nearly zero at integer frequencies that are close to the frequencies specified above.
Proposition 3.4. If input feature X only contains the low-frequency components, i.e., V(u, u) & glow J Ffa)) S.l. St." ((u, u)lu E [0,r] U [M r, M)) [0, U IN r, N,,)),, then frequency folquwinngrequuncice
components F(lo)) at all following frequencies keep relative stable during the training process.
AF (u) 0,
iM
jN KR
i
(9)
K
where [x]] is used to round the real number to the nearest integer; is a positive integer (r S 2).
Proving frequency components are equivariant weight scaling. The scaling attack (Yan et al. 2023) means scaling the weights of convolutional layer by a constant and scaling the weights
5

---

Fingerprint module
Extructing the filtens' specific frequency components as the fingerprint:
Wi
(XX)
W3
Convolution
Backbone
the network
A(X)
Low-puss Filtering
T
W.
Fw:
Stable F
W.
[un)
Figure 3: Architecture of the fingerprint module. The fingerprint module is connected in parallel to the backbone of the neural network. We extract the specific frequency components from the convolutional filters in the fingerprint module as the network's fingerprint.
of the next convolutional layer by the inverse proportion 1/a. In this way, the model's performance will not be affected, but the fingerprint embedded in the weights usually will change. We prove Theorem 3.5 which shows that the frequency components are equivariant to the scaling attack.
Theorem 3.5. (Equivariance towards weight scaling, proven in Appendix A.3) If we scale all weights in the convolutional filter W by constant W' (a 0), then the frequency components of W equal to the scaled frequency components of W, as follows.
Vu,
F pu))) W a- F Flue)
(10)
Proving frequency components are equivariant to weight permutations. The permutation attack (Yan et al., 2023] on the filters means permuting the filters and corresponding bias terms of convolutional layer, and then permuting the channels of every filter in the next convolutional layer in the same order. Thus, the network's s outputs remain unaffected, while the fingerprint embedded in the weights is altered. Theorem 3.6 proves the equivariance of the frequency components when permuting convolutional filters.
Theorem 3.6. (Equivariance towards weight permutations, proven in Appendix A.4) Let us consider convolutional layer with D convolutional filters with D) bis terms arranged as W IW1, W....., Wp) and b b2. .bb]- If filters and bias terms as n' [W x(1), W x=)) W [() and ab [b be(a). ... bT(D)), where [T((1,, (2)).... (D)) is a random permutation of integers from to D, then the frequency components of n' are equal to the permuted frequency components of V. as follows.
permulation to rearrange the above
VT, u. v,
F WW
plue) W [(D)
plue) Wi
(()) W
(1I)
where Fluu) = TWo(Wa) E c denotes the frequency components extracted from the d-th filter W at frequency (u, v).
3.3 Using the invariant frequency components as the neural network's fingerprint
In the last subsection, we prove that if the input feature only contains the low-frequency components, the filter's frequency components F(me) at specific frequencies (u,v) keep stable during training. Furthermore, these components exhibit equivariance to weight scaling and weight permutations.
Fingerprint module. All the above findings and proofs enable us to use the specific frequency components the fingerprint of the neural network. In this way, the fingerprint will be highly robust fine-tuning, weight scaling, and weight permutations. Specifically, the following fingerprint module (XX) to contain the fingerprint, which consists of low-pass filter A(-) and a convolutional layer with D convolutional filters V [W1, W2, "., Wo] and D bias terms [bi, b2.
Figure shows, we construct
bD].
(X) = Y2, ... Yo), s.f. Ya = W. A(X) + by 1MxN.
(12)
where the low-pass filtering operation A(-) preserves frequency components in X at low frequencies in S! {(u, w) E [0, r] U [M M), E [0,r] [N r, N)} (r S 2) and removes all other frequency components, i.e., setting V(u, v) & glow 3lm (wv) = 0. 1MxN an M x N matrix, in which elements all ones.
Setting invariant frequency components the fingerprint. In this way, when extract frequencc components J from each d-th convolutional filter W a in the fingerprint module x(X) based on

---

Features of specific frequencies:
Frequency components specific frequencies are robust to finctuning.
Extracting
Frequency spectrum:
channel of W
(Mo
W
T(
(b)
(ug a)
A Filter
specific revised DFT
Before fine-tuning
After fine-tuning
Before finc-tuning
After fine-tuning
(ugg V2)
Figure 4: (a) We show the matrix of frequency components extracted from a single channel of the convolutional filter. (b) Specific feature components are robust to fine-tuning.
Equation {. we can consider the frequency components at the following frequencies in the set S' as the fingerprint.
F Jlue)
WD
(u,v) E
(13)
where S' = Uu, uu [iMjK] or LiN/K]; i,j (1,2,..., K 15-1p 1}}. According to Proposi- tion 3.4 the fingerprint will keep stable during training.
Implementation details. We notice that in the fingerprint module, the low-pass filter A(-) may hurt the flexibility of feature representations. Therefore, Figure shows, the fingerprint module is connected in parallel to the backbone architecture of the neural network. In this way, this design does significantly change the network's architecture or seriously hurt its performance. Unless stated otherwise, we set the integer = 1, the kernel size K = 3, and the filter number D = 256.
Verifying the invariance towards fine-tuning. We conducted experiments to verify the invariance of the fingerprint frequency components towards fine-tuning. We computed the average l2 12-norm of the change of the frequency components E. |/ the frequency components extracted from the d-th convolutional filter after fine-tuning, Please see Appendix B.2 for more details. The experimental results are shown in Figure indicating that the robust fine-tuning.
[I]. where AF denotes the change of
frequency components used the fingerprint
Visualization of the fingerprint. Figure 4a) a) shows the feature maps when we apply the inverse discrete Fourier transform (IDFT) to each specific unit in the fingerprint feature components. Fig- ure b)) shows the specific frequencies the set used as the fingerprint. Notably, the revised transformation of the convolutional filter in Equation (4) is irreversible, so the feature maps can illustrate features of specific frequencies that are affected by the selected frequency components F(ue) the filter
3.4 Detecting the fingerprint
In this subsection, we introduce how detect the fingerprint. We are given source fingerprinted DNN with a fingerprint module containing D convolutional filters [W,, Wz.... ... WD) and suspi- cious DNN with fingerprint module also containing D convolutional filters [W,, W'... Wb). We aim to detect whether the suspicious DNN is obtained from the source DNÑ by fine-tuming, weight scaling, weight permutations.
Considering the permutation attack, the detection towards the frequency components should consider the matching between the frequency components of different convolutional filters of the two DNNs. ie.. we can definitely find permutation [i(1,, (2), (D)) to assign each d-th convolutional filter Wa in the source DNN with the (d)-th filter W Wi in the suspicious DNN. Specifically, we use the
following fingerprint score E [0, between two DNNs to identify the matching quality.
max Ess
[(cos(F((r)) Wa
(o(u))
w'
)27)
(14)
where 1(-) denotes an indicator function that returns if cos( (lv)) x(wv) Wa ((d)
2 and returns 0 denotes the cosine similarity of the frequency components. 7 is
otherwise. cos(F(ur) r(uv) W. 7(4)
threshold, and we r 0.99 in this paper unless otherwise stated. Thus, can use the fingerprint
'The cosine similarity between two complex vectors lies in the range [-1, where larger values indicate higher similarity. Please see Appendix C.I for details.
7

---

Examples of robust frequency components
02
1yo of the change
0.08
Lyoom of the change
0.2
0006
(8)
(b)
0004
0.1
0.0
0.00
ImageNette
CIFAR-10
Caltech-101
ImageNette
CIFAR-10
Caltech-101
Figure 5: Significance of the change of frequency components after fine-tuning. The red color indicates high 12-norm of the change of the frequency component at (u, e). given as E.lllA/ w. [[]. which is averaged across all filters. (a) The results for AlexNet fine-tuned the ImageNette, CIFAR- 10, and Caltech-100 101 datasets. (b) The results for ResNet-18 fine-tuned on the same datasets.
score to determine whether the suspicious network originates from the source network by checking p > t, where the setting of threshold will be introduced in Section 4
3.5 Learning towards the overwriting attack
Another challenge is the resistance of the fingerprint to the overwriting attack. Given the fingerprint module's architecture, if the attacker has obtained the authority edit its parameters, then he can overwrite the weights W in the fingerprint module with entirely new values to change the fingerprint.
Let us consider a DNN for the classification of n categories. To defend the overwriting attack, the basic idea is to construct the (n + 1)-th category as a pseudo category besides the existing categories. If the network is under an overwriting attack, then the neural network is trained to classify all samples into the pseudo category. Thus, the neural network's 's vulnerability to overwriting attacks can effectively prevent attacker from conducting such attacks to the neural network, i.e., the attacker would not obtain a high-performance network without the fingerprint. Therefore, we train the network by adding an additional loss Latuck, which pushes the attacked network to classify all samples into the pseudo category, to the standard cross-entropy loss Lee for multi-category classification.
L(W, b. 0|) Lee(W, b, A|x: + Carack (W. b, ((r))
(15)
Σ ply k/z)log a'y k|2; W. b, 0) X log g(v 1| c,b,),
where denotes an imput sample, and denotes its corresponding label; 0 denotes the DNN's parameters. 7(y = k|2; W, b, 0) denotes the classification probability predicted by the DNN. p(y k))) is the ground truth probability. The scalar weight À balances the influence of Lee and Landk-
In the above loss function, add random noise the parameters W in the fingerprint module to mimic the state of the neural network with an overwritten fingerprint. To enhance the module's sensitivity such attacks, we do not completely overwrite the parameters but add random noise.
Ablation studies. We conducted an ablation experiment to evaluate the effectiveness of the newly added loss term Lance. We compared the classification accuracy of the network without the attack and the classification accuracy under the attack to analyze the performance decline of the network towards the overwriting attack. Please Appendix B.I for results and more details. The results indicated that the loss term Lamex made the fingerprint more resistant to overwriting attacks.
Experiments
Verifying the robustness towards the combined attacks. We conducted experiments compare the proposed fingerprint with other competing methods for model source tracing under combined attacks, where the permutation attack, the scaling attack, and the fine-tuning attack were applied sequentially. Specifically, let us consider a source DNN, denoted by M and a set of suspicious DNNs, denoted
Some suspicious DNNs were unrelated the source DNN Msouree while others were obtained by sequentially applying the permutation attack, the scaling attack, and the fine-tuning a to M Then, for each pair of source DNN M and
'The magnitude and other specific settings of noise will be introduced Appendix "Specifically, filters of all convolutional layers were first permuted, then scaled, and the DNN was finally fine-tuned new dataset. Please Appendix C.2 for technical details.

---

Table 2: Classification accuracy (%) for determining whether suspicious model originates from
source model.
Fine-tuning
CIFAR-10
Imagenette
Methods
Learning rate
1
10-1
10-
10-3
10-11
1
10-1
10-2
10-3
10-1
RS
Bansal et al.
2022
51.1
100.0
100.0
100.0
100.0
63.3
100.0
100.0
100.0
100.0
MW
Kim al.
2023
50.0
54.4
95.0
100.0
100.0
51.1
50.0
100.0
100.0
100.0
ICS
og
2024
56.7
60.6
100.0
61.1
99.4
100.0
CKA
Zhang et al.
2024
55.0
57.2
80.0
100.0
100.0
55.6
58.3
100.0
100.0
100.0
Ours
90.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
suspicious DNN M,, the fingerprint score p exceeded threshold (p > t), then we considered these two DNNs to be of the same origin; otherwise not.
We compared method with the following four competing fingerprinting methods model source tracing methods. The first two methods were Random Smoothing (RS) [Bansal et al.) 2022 and Marginal-based Watermarking (MW) [Kim et al. 2023 which used the classification results on the trigger set as the watermark. The inference scores of the two methods were defined as the trigger set accuracy of the suspicious DNN M,, denoted by PRS and PMw. respectively. The third method was Cosine Similarity of Invariant Terms (ICS) Zeng et al. [022]]. which constructed an invariant term derived from the product of two-layer weights. The inference score Pics was defined as the cosine similarity of the invariant terms of M and MM (please see Appendix [C.3 for technical details). The fourth method was Centered Kernel Alignment (CKA) (Zhang al. 2024). which matched intermediate features as fingerprints via CKA similarity. The inference score РCKA was defined as the CKA similarity of the intermediate features of Msouree and M, (please see Appendix [C44 for technical details). Then, each method identified that suspicious DNN M; originated from source DNN Munure by checking whether the inference score exceeded threshold L. The threshold / was determined the one that maximized the accuracy of model source tracing. For fair comparison, all these competing methods were evaluated on the same set of source DNNs and suspicious DNNs in the same way. The source DNNs with the ResNet-18 18 [He et al. 2016) architecture
trained on CIFAR-100 Krizhevsky et al. 2009] with different random seeds. The fingerprint module was connected to the second convolutional layer of the second residual block.
Table reports the accuracy of model source tracing achieved by our method under combined attacks. Our method achieved the highest accuracy of model source tracing across all datasets and different learning rates, especially when the learning rate was large. These results successfully verified the robustness of our method against the combined attacks of permutation, scaling, and fine-tuning.
Verifying the robustness towards the individual attacks. We conducted set of experiments to separately verify the robustness of the fingerprint against the individual attacks, including the fine-tuning attack, the permutation attack, and the scaling attack. We applied each specific attack to a fingerprinted neural network and compared the fingerprint scores in Equation (14) before and after the attack (please see Appendix B.3 for results and more details). The results verified that the proposed fingerprint was robust against the fine-tuning attack, the permutation attack, and the scaling attack when these attacks were applied individually.
5 Acknowledgements
This work is partially supported by the National Science and Technology Major Project (2021ZD01116/)) the National Nature Science Foundation of China (92370115, 62276165), and Shanghai Natural Science Foundation (247R1491700). It is also partially supported by Alibaba Group.
6 Conclusion
In this paper, we discover and theoretically prove that specific frequency components of a convo- lutional filter are invariant to model fine-tuning, and are equivariant to weight scaling and weight permutations. Therefore, propose use these frequency components as the network's 'ss fingerprint

---

to embed the ownership information so as to obtain a theoretically guaranteed robustness to the com- bined attacks of permutation, scaling, and fine-tuning. Additionally, to defend against the overwriting attack, we add an additional loss term during training to make sure that the network's performance drops significantly under the overwriting attack. Preliminary experiments have demonstrated the effectiveness of the proposed method.
This paper proves ideal case where the fingerprint is exactly invariant to fine-tuning. Note that in real applications, the input feature contains low-frequency components, and the frequencies must be integers, making the fingerprint approximately invariant, rather than exactly unchanged. more idealized setting can be achieved when the feature map size is large or the feature map size is divisible by the kernel size. Nonetheless, our experiments conducted on real networks demonstrate the robustness of the fingerprint even when the ideal conditions are not strictly satisfied.
References
Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into Strength: Watermarking deep neural networks by backdooring. 27th USENIX security symposium (USENIX Security 18), pages 1615-1631, 2018.
William Aiken, Hyoungshick Kim, Simon Woo, and Jungwoo Ryoo. Neural network laundering: Removing black-box backdoor watermarks from deep neural networks. Computers & Security, 106: 102277, 2021.
Arpit Bansal, Ping-yeh Chiang. Michael J Curry, Rajiv Jain, Curtis Wigington, Varun Manjunatha, John P Dickerson, and Tom Goldstein. Certified neural network watermarks with randomized smoothing. In International Conference on Machine Learning, pages 1450-1465. PMLR, 2022.
Laurent Charette, Lingyang Chu. Yizhou Chen, Jian Pei, Lanjun Wang, and Yong Zhang. Cosine model watermarking against ensemble distillation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 9512-9520, 2022.
Xinyun Chen, Wenxiao Wang. Yiming Ding, Chris Bender, Ruoxi Jia, Bo Li, and Dawn Song. Leveraging unlabeled data for watermark removal of deep neural networks. In ICML workshop on Security and Privacy of Machine Learning, pages 1-6, 2019.
Lixin Fan, Kam Woh Ng, and Chee Seng Chan. Rethinking deep neural network ownership verification: Embedding passports to defcat ambiguity attacks. Advances neural information processing systems, 32, 2019.
Li Fei-Fei, Robert Fergus, and Pietro Perona, One-shot learning of object categories. IEEE transactions on pattern analysis and machine intelligence, 28(4):594-611, 2006.
Martin Gubri, Dennis Ulmer, Hwaran Lec, Sangdoo Yun, and Scong Joon Oh. Trap: Targeted random adversarial prompt honeypot for black-box identification. arXiv preprint arXiv:2402. 12991, 2024.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEFE conference on computer vision and pattern recognition, pages 770-778, 2016.
Anil Jain, Fundamentals of digital image processing. Prentice-Hall, Inc., 1989.
Hengrui Jia, Christopher A Choquette- Chho, Varun Chandrasekaran, and Nicolas Papernot. Entangled water- marks as defense against model extraction. In 30th USENIX security symposium (USENIX Security 2/),
pages 1937-1954, 2021.
Byungjoo Kim, Suyoung Lec, Seanie Lee, Sooel Son, and Sung Ju Hwang. Margin-based neural network watermarking. In International Conference on Machine Learning, pages (6696-16711, PMLR, 2023.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pages 17061417084. PMLR, 2023.
Simon Korbblith, Mohammad Norouzi, Honglak Lee, and Geoffrey Hinton. Similarity of neural network representations revisited. In International conference machine learning, pages 3519-3529, PMLR, 2019.
Ken Drluaz- The complex gradient operator and the cr-caleulus. arXiv preprint or arivv09006 090.4499.443, 2009.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
10

---

Alex Krizhevsky, Ilya Sutskever. and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems, 25, 2012.
Hanwen Liu, Zhenyu Weng, and Yuesheng Zhu. Watermarking deep neural networks with greedy residuals. In ICML, pages 6978-6667 69888, 2021.
Mohammad Ali Nematollahi, Chalee Vorakulpipat, and Hamurabi Gamboa Rosales. Digital watermarking. Springer, 2017.
Jiaxiang Ren, Yang Zhou, Jiayin Jin, Lingjuan Lyn, and Da Yan. Dimension-indeeeedenn certified neural network watermarks via mollifier smoothing. In International Conference Machine Learning, pages 28976-29008.
PMLR, 2023.
Masoumeh Shafieinejad, Nils Lukas, Jiaqi Wang, Xinda Li, and Florian Kerschbaum. On the robustness of backdoor based watermarking deep neural networks. Proceedings of the 2021 ACM workshop on information hiding and mudtimedia security, pages 177-188, 2021.
Sebastian Szyller, Buse Gul Atli, Samuel Marchal, and Asokan. Dawn: Dynamic adversarial watermarking of neural networks. In Pruceedings of the 29th ACM International Conference on Multimedia, pages 4417-4425, 2021.
Ling Tang, Wen Shen, Zhanpeng Zhou, Yuefeng Chen, and Quanshi Zhang. Defects of convolutional decoder networks in frequency representation. In International Conference on Machine Learning. pages 33758-33791. PMLR, 2023.
Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin'ichi Satoh. Embedding watermarks into deep neural networks. In Proceedings the 2017 ACM on international conference multimedia retrieval, pages 269 277, 2017.
Jiashu Xu, Fei Wang, Mingyu Derek Ma. Pang Wei Koh, Chaowei Xiao, and Muhao Chen. Instructional fingerprinting large language models. arXiv preprint arXiv:2401. 2024.
Yifan Yan, Xudong Pan, Mi Zhang, and Min Yang. Rethinking [White-Box] watermarks on deep learning models under neural structural obfuscation. 32nd USENIX Security Symposiam (USENIX Security 23). pages 2347-2364, 2023.
Zhiguang Yang and Hanzhou Wu. fingerprint for large language models. arXiv preprint arXiv:2407.01235. 2024.
Boyi Zeng. Lizheng Wang, Yuncong Hu, Yi Xu, Chenghu Zhou, Xinbing Wang, Yu, and Zhouhan Lin. Huref: Human Human-readable fingerprint for large language models. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2023.
Boyi Zeng, Lizheng Wang, Yuncong Hu, Yi Xu, Chenghu Zhou, Xinbing Wang, Yu Yu, and Zhouhan Lin. Huref: Human-rcadable fingerprint for large language models. Advances in Neural Information Processing Systems, 37:126332-126366 2024.
Jie Zhang, Dongdong Chen, Jing Liao, Weiming Zhang, Gang Hua, and Nenghai Yu. Passport- aware normal- ization for deep model protection. Advances in Neural Information Processing Systems, 33:22619 12222228222688 2020.
Jie Zhang, Dongrui Liu, Chen Qian, Linfeng Zhang, Yong Liu, Yu Qiao, and Jing Shao. Reef: Representation encoding fingerprints for large language models. arXiv preprint arXiv:2410.1422 14273, 2024.

---

A Proofs of our theoretical findings
We first introduce an important equation, which is widely used in the following proofs.
Lemma A.1. Given N complex numbers, ein numbers is given as follows.
N 0.1,...,
the sum of these N complex
4A E IR,
N-1
Σ n=
e
ino
sin
IN 130
(16)
sin( (2)
Specifically, when NO 2kT, E 2,
N N, we have
N-1
sin(
No
vO E R
Σ
ono
s.t. NO 2kT, k E 2, -N < <,
sin
0 2
(17)
1,
0= 0=0 0
where dg
0,
otherwise
We prove Lemma A.1 as follows.
Proof. First, let us use the letter E C to denote the term of N- cin0
N
S =
in8
===0
Therefore, S is formulated as follows.
N
10
5 = Σ
ind
E
C
n=1
Then, S can be computed S 5-8
Therefore, we have
00 -1
S 5 5
eiil
ΣN
eino
N =
end
eiN
6 - 1
(V
118
e
N6
No 2/2
(N-1%)
(et9
- 2/22
sin( No
13-
sin ()
Therefore, we prove that N-1 ine
sin( No )
1N-130
sint
Then, we prove the special case that when No = 2k k E Z, -N < k N, EN-1 ind = -N50
[ [, 0=
0, otherwise" follows.
12

---

When = O, we have
N-1
sin 20)
lim
innl
-li 8-00
13e
8-0
sin(
n=0
sin( NO
lim
2
0--0
sin(
When 0 + O, and NO = 2kT, k E 2, -N < k < N, we have
N
sin( No
in
NN-11e
sin
sin(kT
(N-1)km
sin(
kr N
In the following proofs, the following two equations are widely used, which are derived based on Lemma A.I
M-1N-1
1-1
Σ Σee 57 65
Σ
im
222
in -
(M6
)NN v2a
// /Accordingg to Equation 17
22
MN,,
u=v=0 0
10
otherwise
To simplify the representation, let 6nm be the simplification of 6 u2F 6_ uga Therefore, have
in the following proofs.
MN, 0,
==
(18)
otherwise
m==
Similarly, derive the second equation follows.
(u
km
1m
Smm Lu w'12
in(
d'122
MN8 (u w 2'12x 8 Lv c/12
1/ //According to Equation 17
(19)
MN8 8pmm!
[NN, u' u. 0, otherwise
A.1 Proof of Theorem 3.2
In this section, prove Theorem 3.2 in the main paper, follows.
13

---

Proof. According to the DFT and the inverse DFT, we can obtain the mathematical relationship
between Gue and X and the mathematical relationship between Que and w as follows.
M-IN-1
K-1K-1
G
Σ
X
2
Q
Σ
W
*
m=0
n=0
(20)
M-IN-1
M-IN-1
Σ
0 2
W:lo)
Σ
Σ
-
mn
MN
MN
R=0 ==
M=0 m=0
2009]. we can obtain the mathematical relationship between aLass and aLoss and the mathematical relationship ( ax
Based Equation (2)) and the derivation rule for complex numbers
between 0Loss and &Lows sw-(o] as follows. Note that when we use gradient descent to optimize real-
BQ valued loss function Loss with complex variables, people usually treat the real and imaginary values, C and E C, of a complex variable (z separately update these two real-valued variables. In this way. the exact optimization step of
bi) as two separate real-valued variables, and
computed based such a technology is equivalent 0Loms 0E
Since x(e) and W (!]kerr]]]] real
cts
numbers, aLoss BLoss and 0Losa ax ax
BLoss
aW.c)
aw:c]
OLoss
M-IN- --N- Σ (x
OLoss i0 3r )2r
OLoss
K-IK K-I Σ
Loss " a )2r
001
MN
MN
o
==
(21)
0Loss
N-1 Σ
dLoss
ÔLoss
Σ
ôLoss
-i x )2
(x
o
@w!c)
(Q
e
Let conduct the convolution operation on the feature map X x(),,,...... x R C' MXN and obtain the output feature map Y E MxN as follows.
C K-11
Y Ymn = b+
Σ
Σ
Σ
(()) (e)
(22)
ts mtints
==0
Based on Equation
20 and Equation (1.). and the derivation rule for complex numbers [Kretzz
Delgado 2009], the exact optimization step of Qí9 in real implementations can be computed as
14

---

follows.
BLoss
Losss 1 22
//Equation 21
MN
Σ
osss
X ((e]
m+tnnts
c )2n
//Equation 22
MN
OY
1=0
==0
m==
n=D
/Equation (20)
Σ
Σ
Σ
Loss
Σ
Σ
Glo)
-1 (mmm))
11
state j2r
Al + 12 )2x
MN
OY mn MN
u'=0 o0=a
MN Σ
R-1 K-1
Σ
M- N-1
Σ
T
M- M-1N-1
ØLoss
16 mm +2
et
MN
0Y mn
m=0 n=0
MN Σ
Σ
Σ
ôLsss
-il +) 22
12
//Equation
21
OH
K-IK-IM-N--
ΣΣΣΣ
Öoss
w'yl (u v
MN 1-0 2
of
M
0
ΣΣ
M-IN-I
ÖLoss
K-IK-1
cl w'ye
OHd MN
K-IK-1
1/ Let Au'o'u
ΣΣ
(umelitt (w- )2n
M-IN-1
ΣΣ
ÖLoss
MN
aH
v'=
where Autoruo can be rewritten as follows.
aiit (o
we- yaw
Aute'oo
sin(
K(u )0
M
sin( K(u
(K
Dll
11
w1
(x
1)
)x
// //According to Equation 16
sin
(u-w/)s
sin
(w-v/)x
M
Based on the derived
ÖLas aQie
E C, we can further compute gradients
ôLoss aT E DxC as follows.
Losss
Σ Σ
A ÔLoss
=lu'v' affive
(23)
0Fw (wx)
MN
w/=0
Let us the gradient descent algorithm update the convlutional weight Wi(e), in of the n-th epoch, the updated frequency spectrum (((e)
n++1 can be computed as follows.
VL. 8, Wl n+1
W-le) to
LLoss
n 1)
aw
where 7j the learning rate. Then, the updated frequeney spectrum ((luv) n+1 computed based on Equation (1 is given as follows.
15

---

AQ = Q i++1 Q i
km
W (c) n+1c " (3)+))))
QQe n //Equation 20
(Wl In
ŌLoss
ee 10 ) (c)
@w! (c)
18
ŌLoss " + 22
W N2
Q (n) 1 ow (c)
Loss 12 //Equation 20
ow
(c)
Loss MN
//Equation
21
iQ [o)
Therefore, we prove that any step on w! equals to MN step on (c) In this way, the change of frequency components r(uv) can be computed as follows.
M-1N
A
Σ
A
Hosss F(u/e)
(24)
OF
w =0 0'=
A.2 Proof of Corollary 3.3
In this section, we prove Corollary 3.3 in Section of the main paper, as follows.
Proof. According to Theorem 3.2 the change the frequency components at frequencies (u, v) can be further derived as follows.
AF (me) W
A Auou'v
FFu'r Fx
ØLoss
(w'o')
5 ='=0 =0=0
-1 Auvo0
ØLoss
F(00)
//v(n, v) * (0,0), pln))
ÖLoss
F
00)
sin( Kur
M sin us
sin( Kum
(8-11 (x-111))
T] a3 (0n)
sin
aLoss
- 00)
(-o)) (K-13
sin(te) sin(ja)
0F
sin(in K) sin(jT// /
//S ((u, v) u iM/K
JN/K; Li (1,2 ,L, K 1)) or or
0 // sin(i 0
Therefore, we have proved the frequency components F(me) the frequencies in the set S keep invariant.
A.3 Proof of Theorem 3.5
In this section, prove Theorem 3.5 in Section of the main paper, follows.
16

---

Proof. The frequency components F(uv)
of the scaled filter W =
W are computed as follows.
W
F(ae)
Que
K-1K-1
K-1K-1
W
)2
Σ
Σ
Wh
Σ
Wh
K-1K-1
K K-
K-1K-1
W "M 2/
W
W
K-1K-1
K-1K-1
K-18-1
Σ
W
222
Σ
W
Σ
W
E=
t= ==
E00 6=0
Q
Q
1
F (we)
Thus, we have proved that the frequency components F. of the scaled filter are equal to the scaled frequency components p(lu) of the original filter.
A.4 Proof Theorem 3.6
In this section, we prove Theorem 3.6 in Section 3 of the main paper, follows.
Proof. The frequency components
[F(w))
Flue)
of the permuted filters W
Weay?
[W (())) W Wa())," W (D) are computed follows.
p(w)
((m)) W
= [Tuo (x Teo (W (W+())) ... Tuo ( (D)))]] //Equation
π [Tuo ). Tuo (W2). (Wo)]
(25)
x [Flve]
(uv)
Wn
The
W Wan of the permuted filters (Wa()) Wa())... Wx(m)] are equal to the permuated frequency components
frequency
components
[ (uv)
w +1)"
(uv)
T(F())) F(un)
B More experimental results
B.1 Ablation studies evaluate the effectiveness the newly added loss term
We conducted ablation experiment to evaluate the effectiveness of the newly added loss term Lanck, i.e., examining whether the performance the overwriting attack when the network was trained with the loss function L in Equation (15). We compared the classification accuracy of the network without the attack and the classification accuracy under the attack to analyze the performance decline of the network towards the overwriting attack.
neural network was significantly hurt under
We ran experiments of AlexNet KKrizhessky al. 2012 and ResNet-18 TH al. 2016 on Caltech- 101, Caltech- 256 [Fei-Fei et al.) 2006] (license unknown), CIFAR- 10 and CIFAR 100 Krizhevsky al., 2009] License) for image classification tasks. For AlexNet, the fingerprint module containing 256 convolutional filters was connected to the third convolutional layer. For ResNet- 18, fingerprint module containing 256 convolutional filters was connected to the second convolutional layer of the second residual block. The scalar weight À was set to x 10-4. The noise added to the parameters the fingerprint module was obtained by conducting the IDFT on a unit frequency component at random frequency, and the f2-norm of the noise was set to 0.5 times the l2 l2-momm of
17

---

the weights. We trained the model using the SGD optimizer for 250 epochs, with a learning rate of 0.01 for the first 100 epochs and 0.001 for the remaining 150 epochs.
Table 3 shows the experimental results. We observe that if the network is trained with the loss function C Lce + Lattack in Equation (15), the classification accuracy significantly drops under the overwriting attack. The results indicate that the newly introduced loss term effectively defends the overwriting attack.
Table 3: Experimental results of the effectiveness of the newly added loss term Lattack- Baseline
denotes the test accuracy of a neural network normally trained without the fingerprint. With Lc. + Lattack denotes the test accuracy of a fingerprinted network trained with the loss function Los + Latteck, and With Leg denotes the test accuracy of fingerprinted network trained without the added loss term Lattack- The accuracy outside the bracket represents the accuracy of the network without the overwriting attack, and the accuracy inside the bracket represents the accuracy of the network under the overwriting attack.
Bascline (%)
With Leg + Lattack (%)
With Loe (%)
Dataset
AlexNet
ResNet-18
AlexNet
ResNet-18
AlexNet
ResNet-18
CIFAR-10
91.03
94.83
90.28 (43.55)
92.17 (72.26)
91.12 (91.12)
94.89 (94.89)
CIFAR-100
68.10
76.29
66.34 (36.93)
75.49 (41.18)
67.52 57.
76.53 (76.53)
Caltech-101
66.46
70.10
62.15 (32.53)
67.14 (41.33)
67.84 (67.84)
09.87 (69.87)
Caltech-256
40.50
54.61
37.97 (15.37)
50.33 (18.13)
39.22 (39.22)
53.86 (53.86)
B.2 Verifying the invariance of the frequency components
We conducted the an experiment to verify the invariance of the proposed fingerprint towards fine- tuning. Let fine-tune trained DNN with fingerprint module containing filters [W1, W..... WD) W. and obtain a fine-tuned DNN with filters [Wi, W2, W) We computed the average the norm of the change of the frequency components Ea II] to measure the invariance of the proposed fingerprint, where A. -w F((m)) denotes the change of the frequency components extracted from the d-th convolutional filter.
We trained AlexNet and R8 on CIFAR- 100, and then fine-tuned them on ImageNette (Apache License 2.0), CIFAR-10 and Caltech- 101 with the learning rate 0.01 for 50 epochs. All other experimental settings remained the same as described in Section B.1 Figure 5 shows the results, verifying that the fingerprint is invariant to fine-tuning.
B.3 Verifying the robustness towards fine-tuning attack, permutation attack, and scaling attack (individually applied)
Verifying the robustness towards fine-tuning. We conducted experiments to verify the robustness of the fingerprint against the fine-tuning attack. We applied the fine-tuning attack to a fingerprinted neural network and compared the fingerprint scores p in Equation [4) before and after the attack.
We trained AlexNet and ResNet- 18 on CIFAR-100, 100, and then fine-tuned them on ImageNette, CIFAR- 10 and Caltech- 101 with the learning rate 0.01 for 50 epochs. All other experimental settings remained the same as described in Section B. A shows the results. The results verified that the proposed fingerprint was robust against the fine-tuning attack.
Verifying the robustness towards scaling attack. We conducted experiments to verify the robustness of the proposed fingerprint towards scaling attack. Given fingerprinted DNN, scaled the parameters in the fingerprint module by a constant a(a > 0), and then detected the fingerprint using the method introduced in Section 3.4 We used the fingerprint score DR to show the robustness of the fingerprint towards weight scaling. We trained AlexNet on 10, CIFAR- 100, Caltech- 101 and Caltech-25r All other experiment settings remained the same described in Section 3.5 Table shows the Experimental results. All the fingerprint scores are 1.00, showing that our method is highly robust the weight scaling attack.
Verifying the robustness towards permutation attack. We conducted experiments to verify the robustness of the proposed fingerprint towards permutation attack. Given fingerprinted DNN,
18

---

Table 4: Experimental results of verifying the robustness towards fine-tuning, Baseline denotes the accuracy of neural network normally trained without the fingerprint. Ours denotes the accuracy of fingerprinted network. The score inside the bracket denotes the fingerprint score of the fine-tuned DNN. Accuracy outside the bracket denotes test accuracy on the dataset.
Baseline
Ours
Target
Source
AlexNet
ResNer-18
AlexNet
ResNet- 18
ImageNette
78.92%
83.36%
80.48% (1.00)
86.23% (1.00)
CIFAR-100
CIFAR-
88.90%
93.03%
89.65% (1.00)
94.12% (1.00)
Caltech-101
70.02%
76.80%
72.11% (1.00)
79.98% (1.00)
Table 5: Experimental results of verifying the robustness towards scaling attack. The score outside the bracket denotes the fingerprint score without the weight scaling attack, and the score inside the bracket denotes the fingerprint score under the weight scaling attack.
CIFAR-10
CIFAR-100
Caltech-101
Caltecb-256
1.00 (1.00)
1.00 (1.00)
1.00 (1.00)
1.00 (1.00)
100 1.00 (1.00)
1.00 (1.00)
1.00 (1.00)
1.00 (1.00)
permuted the filters in the fingerprint module with a random permutation म, and then detected the fingerprint using the method introduced in Section 3.4 We used the fingerprint score DR to show the robustness of the fingerprint towards weight scaling. We trained AlexNet on CIFAR-10, CIFAR-100, Caltech-101 101 and Caltech-256. All other experiment settings remained the same described in Section 3.5 [5slos the Experimental results. All the fingerprint scores are 100%, showing that our method is highly robust to the weight permutation attack.
Table 6: Experimental results of verifying the robustness towards weight permutations. The score outside the bracket denotes the fingerprint score without the weight permutation attack, and the score inside the bracket denotes the fingerprint score under the weight permutation attack.
CIFAR-10
CIFAR-100
Caltech-101
Caltech-256
1
1.00 (1.00)
1.00 (1.00)
1.00 (1.00)
1.00 (1.00)
1.00 (1.00)
1.00 (1.00)
1.00 (1.00)
1.00 (1.00)
B.4
Compute resources
All DNNs can be trained within 6 hours on single NVIDIA GeForce RTX 3090 GPU (with 24G GPU memory).
C
Other details
C.1 Details of the cosine similarity between two complex vectors
The cosine similarity cos(z), 22) between two complex vectors 2 and zą is defined as Re(ayoza)
| where žा denotes the conjugate of 2ı, ||z|| denotes the magnitude of zı, and Re(-) represents the real part of complex number. The cosine similarity, which ranges from [-1, 1], measures the directional similarity between two complex vectors. When cos(21,7.) 22) = 1, 2 and z2 have the same direction, while when cos(zı, z2) 1, 21 and z₂ have opposite directions.
C.2 Details of the combined attacks
We sequentially applying three types attacks, including permutation, scaling, and fine-tuning on the source model.
Permutation attack. In this step, for each ResNet block in the network, we randomly permute the output channels of the first convolutional layer. To preserve the functional integrity of the model, the
19

---

input channels of the subsequent convolutional layer within the same block are permuted using the same permutation order.
Scaling attack. Next, we apply a layer-wise scaling transformation. Specifically, the parameters of the first convolutional layer in each ResNet block are multiplied randomly sampled scaling factor from the range [1/ 10, 10). To compensate for this modification and maintain the original output behavior, the parameters of the following convolutional layer are multiplied by the reciprocal of the same scaling factor.
Fine-tuning attack. Finally, perform fine-tuning the perturbed model using two datasets: CIFAR- 10 and Imagenette. Each model fine-tuned for 50 epochs under the same training settings to evaluate the effect of task adaptation on fingerprint invariance.
C.3 Details of inference score for ICS
To calculate the inference score Pics for ICS, we randomly select 100 images from the CIFAR-I00 dataset as probing imputs. Each image is sequentially passed through the first and second convolutional layers within the second residual block of a ResNet-18 18 model. That is, the input first undergoes convolution with the filters of the first convolutional layer, and the output then passed to the second convolutional layer. This fixed convolutional pipeline ensures that the final output is invariant to channel permutations and reciprocal scalings between these two layers.
For each input image, we obtain the final feature map output from the second convolutional layer, which is then demeentwwise multiplied with the original input image. The resulting product is flattened into a one-dimensional vector. This process is repeated for all 100 CIFAR 100 samples, and the resulting vectors are concatenated to form single reference fingerprint vector for the model. To compute the inference score Pics between two models, we repeat the above process for both models and calculate the cosine similarity between their respective fingerprint vectors.
C.4 Details of inference score for CKA
To calculate the inference score РCKa for CKA, we randomly select m 100 images from the CIFAR- 100 dataset. For each image, we extract the feature map from the second convolutional layer in the second residual block of ResNet-18. These feature maps are flattened and stacked into two matrices Z, Z' E R 1000xd corresponding to the source and suspicious models.
We compute the RBF kernel matrices K and K" as:
i4: 2ح13 )
|
-111
Kú exp
Kij = exp
(26)
20²
20
The CKA score is then computed as:
HISC(K, K')
PCKA = CKA(K,
(27)
HISC(K, K) HISC(K', K")
where HISC(K, K)
(m-1y Lr (KHKH), 111
D Societal impacts
Potential positive societal impacts. This work helps protect the ownership deep learning models by adding a fingerprint that stays stable even after fine-tuning. This means if a model is stolen or changed, the owner can still prove it belongs to them. This can help stop model theft and make AI development more fair and safe. It can also make it easier track where model comes from, which useful in real-world use, like in business or research.
Potential negative societal impacts. However, this technique could also cause some problems. For example, it might be used to secretly track how model is used, which could harm user privacy or limit open research. It may also lead to arguments about who really owns model, especially when people work together or use open- open-source models. In some cases, this method might make harder for others to reuse or change model freely.
20

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims presented in the abstract and introduction accurately represent the scope and contributions our work.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer:
[Yes]
Justification: Indeed, the limitations of our work are discussed in Section
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
21

---

Justification: We provide the assumptions in the main paper, and the proof for all theorems in Appendix
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: While the main contribution of this paper theoretical, we include compre- hensive experimental details in Appendix B to ensure reproducibility.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
22

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [No]
Justification:
The funding of this research does allow to release the code.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips. cc/
for more details.
While encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification:
Yes, the paper specifies all necessary training and test details, including data splits, hyperparameters, optimizer type, and learning rate schedules. Further information is provided in Appendix B
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification: The primary contribution this paper is theoretical-we prove that specific frequency components remain invariant during training and ues them the robust finger- print. Nevertheless, to support our claims empirically, we conducted extensive comparison experiments across large number of randomly initialized and trained networks, as shown in Section which demonstrate consistent trends across settings.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
23

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We provide the compute resources needed in Appendix B.4 including the type of GPU and the approximate amount of time for training DNNs.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental rums as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't itdn't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics htttpp/s/heurrpp..c//ppbll.cce/ ctw.dideeeeicdiiceeeeienniee
Answer: [Yes]
Justification:
The research conducted in the paper conform with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there a special consid- eration due to laws regulations in their jurisdiction)
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The paper discusses both potential positive and negative societal impacts in Section D It highlights the benefits of improved ownership protection and model traceability, well as the potential risks of misuse.
Guidelines:

---

The answer NA means that there is no societal impact of the work performed.
If the authors answer NA No, they should explain why their work has societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deploymentt of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (c.g., gated release models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification: All models and datasets used in this paper are already publicly available.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We cite the original paper for all datasets. The name of the license is included for each dataset in Appendix B
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
25

---

For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperssi thood cww datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to NeurIPS Code of Ethies, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing research involving human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
26

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if' applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The core method development in this research does not involve LLMS as any important, original, non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy /att:p///earrrppccc/ooooeereeee/ /c////ooeeeeeecc///2/////.. for what should or should not be described.
27


Reviews:
[{"review_id": "TNE23ggxud", "reviewer": "Reviewer_LxLU", "summary": "This paper presents a novel method to protect neural network models with convolutional layers by encoding fingerprint into the parameters of convolutional layers that corresponds to low-frequency components.", "questions": "Q1. I wonder if the authors can explain which types of attacks the method is designed to defend against and which ones are out of scope.\n\nQ2. I would suggest to have a discussion: in which practical situations a drop in accuracy from adding the fingerprint would still be acceptable?\n\nQ3. Can we have a discussion about why the L_{attack} term introduces this noticeable performance drop?", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strong Points\n----\nS1. The paper introduces a theoretical analysis for some frequency components of the convolutional filter are stable during the training and fine-tuning.\n\nS2. The experiments show that the fingerprint is hard to remove with regular fine-tuning or basic attacks.\n\nWeak Points\n----\nW1. The paper does not test what happens if an attacker adds random noise to all the model's parameters and then fine-tunes the model. In real life, this is a common and strong way to try to erase a fingerprint. The paper mostly focuses on overwriting just the fingerprint module or on basic fine-tuning, so it's not clear if the method would still work against this stronger attack. It is also unclear that how the extra loss term L_{attack} term protect this kind of attack.\n\nW2. In addition, when the authors train the model using the extra loss term extra loss term L_{attack}, the model's accuracy drops even before any attack happens. For example, accuracy on CIFAR-10 drops from 91.03% (baseline) to 90.28%, and on Caltech-101 it drops from 66.46% to 62.15%. This means the model gets worse just by adding the fingerprint, which could be a problem if high accuracy is needed.", "was_revised": true, "final_justification": "The author response has addressed many of my concerns. I have raised the score to 4.", "rebuttal": "# Reply to Reviewer LxLU:\n\nThank you for your efforts. We will answer all your questions. **If you have further concerns, please let us know, and we will update the response ASAP.**\n\n## Q1. Robustness against combined overwriting and  fine-tuning attacks.\n\n> Weakness 1. \"The paper does not test what happens if an attacker adds random noise to all the model's parameters and then fine-tunes the model. In real life, this is a common and strong way to try to erase a fingerprint. The paper mostly focuses on overwriting just the fingerprint module or on basic fine-tuning, so it's not clear if the method would still work against this stronger attack. It is also unclear that how the extra loss term $L_{attack}$ term protect this kind of attack.\"\n\nA good question. Let us answer your question from two perspectives. \n\n- First, during the fingerprint injection process, our method adds an extra adversarial loss $L_{attack}$ (see Equation (15)) to make the model’s performance drop when the overwriting attack is applied. This design ensures that the attacker cannot remove the fingerprint without hurting the model’s performance.\n\n- Second, we followed your suggestion and conducted **a new ablation experiment** to test the model’s performance to defend the “overwriting+fine-tuning” attack. The “overwriting+fine-tuning” attack was implemented as follows. Given a ResNet-18 model pretrained on CIFAR-100 for fingerprint injection, we first overwrote the fingerprint module with completely new random parameters (not by adding noise), and then fine-tuned the model on the CIFAR-10 dataset.\n\nWe applied this combined attack to two types of models: one was trained on CIFAR-100 dataset with both the cross-entropy loss $L_{CE}$ and the additional loss term $L_{attack}$, and the other one was trained only on CIFAR-100 dataset with the cross-entropy loss $L_{CE}$. Table A shows the results.\n\nTable A: The fingerprint score and classification accuracy on CIFAR-10 after applying the combined overwriting and fine-tuning attacks to the models.\n\n|                          **Models**                          | **Fingerprint score before attack / after attack** | **Acc. on CIFAR-10 after attack** |\n| :----------------------------------------------------------: | :------------------------------------------------: | :-------------------------------: |\n| ResNet-18 with fingerprint  model  learned without $L_{attack}$ |                    1.00 / 0.00                     |             **93.3%**             |\n| ResNet-18 with fingerprint model  learned with $L_{attack}$  |                    1.00 / 0.00                     | 82.4% |\n\nWe observed that for both the model trained with $L_{attack}$ and the model trained without $L_{attack}$, the fingerprint score was removed after the “overwriting + fine-tuning” attack. However, the classification accuracy of the model trained with $L_{attack}$ showed much lower accuracy than the model trained without $L_{attack}$. This indicated that the extra loss term ensured that the attacker could not remove the fingerprint without hurting the performance.\n\n- Besides, we also measured the classification accuracy on CIFAR-100 after only applying the overwriting attack, where the fingerprint was replaced with random new values (not by adding noise). Table B below shows the results.\n\nTable B: The classification accuracy on CIFAR-100 after applying the overwriting attack to the models.\n\n|                            Models                            | Acc. on CIFAR-100 before attack | Acc. on CIFAR-100 after overwriting attack | Drop in acc. after overwriting attack |\n| :----------------------------------------------------------: | :-----------------------------: | :----------------------------------------: | :-----------------------------------: |\n| ResNet-18 with fingerprint  model  learned without $L_{attack}$ |              76.5%              |                   76.2%                    |               **0.03%**               |\n| ResNet-18 with fingerprint model  learned with $L_{attack}$  |              75.5%              |                   36.5%                    |               **39.0%**               |\n\nWe observed that for the model trained with the extra loss term $L_{\\text{attack}}$, the accuracy dropped a lot (39.0%). But for the model trained without $L_{\\text{attack}}$, the accuracy stayed almost the same (dropped by 0.3%). This indicated that even under a stronger overwriting setting, our method still prevented the attacker from removing the fingerprint without hurting the model’s performance.\n\nWe will incorporate the above results into the final version of the paper.\n\n***\n\n## Q2. Accuracy drops due to the added fingerprinting loss.\n\n> Weakness 1. \"In addition, when the authors train the model using the extra loss term extra loss term L_{attack}, the model's accuracy drops even before any attack happens. For example, accuracy on CIFAR-10 drops from 91.03% (baseline) to 90.28%, and on Caltech-101 it drops from 66.46% to 62.15%. This means the model gets worse just by adding the fingerprint, which could be a problem if high accuracy is needed.\"\n>\n> Question2. \"I would suggest to have a discussion: in which practical situations a drop in accuracy from adding the fingerprint would still be acceptable?\"\n>\n> Question3. \"Can we have a discussion about why the L_attack term introduces this noticeable performance drop?\"\n\nThanks a lot. We add the extra loss term $L_{\\text{attack}}$ to improve the model’s resistance to overwriting. This idea is somehow equivalent to changing the model’s adversarial robustness. As is well known, there is often a trade-off between adversarial robustness and classification accuracy. Changing the model’s adversarial robustness usually inevitably affects its classification performance.\n\nMore crucially, we also conducted **a new experiment** to compare the impacts on the model’s performance of different fingerprint injection methods, and **our method caused less performance drop on the main task**, compared to other mainstream fingerprinting methods.\n\nWe trained the ResNet18 on CIFAR-100 and CIFAR-10 to inject the fingerprint. We tested the classification accuracy on the datasets. The compared methods were RS [1] and MW [2] mentioned in the main paper Section 4.\n\nTable C: The classification accuracy of the model.\n\n|          Methods           | CIFAR-10  | CIFAR-100 |\n| :------------------------: | :-------: | :-------: |\n|  **Without fingerprint**   | **94.8%** | **76.3%** |\n|  With fingerprint: RS [1]  |   84.2%   |   59.9%   |\n|  With fingerprint: MW [2]  |   87.8%   |   62.1%   |\n| **With fingerprint: Ours** | **92.2%** | **75.5%** |\n\nTable C shows that compared to other mainstream fingerprinting methods, our method caused a smaller performance drop on the main task.\n\n***\n\n## Q3. Which types of attacks is the method designed to defend?\n\n> Question 1.  \"I wonder if the authors can explain which types of attacks the method is designed to defend against and which ones are out of scope.\"\n\nOur method is designed to defend against fine-tuning, permutation, scaling, overwriting attacks, and combinations of these attack types. However, most existing non-backdoor watermarking methods [3,4,5,6] and ours operate on a different technical level from distillation attacks.\n\nThe main contribution of our work is the proof of the first theoretically guaranteed fingerprint metric that is robust to fine-tuning. The technical differences between our method and the competing methods in Section 4 are summarized in Table D below. For comparisons with other mainstream methods, please refer to Table 1 in the main paper.\n\nTable D: Methods for model source tracing. “✓” indicates robustness, “✗” indicates lack of robustness, “–” means that the attack is not applicable, and “NTD” means that there is no target design to defend against the attack.\n\n| Methods |               Fine-tuning                | Permutation | Scaling | Overwriting | Pruning | Distilling |\n| :-----: | :--------------------------------------: | :---------: | :-----: | :---------: | :-----: | :--------: |\n| RS [1]  |       Enhanced via noise training        |      ✓      |    ✓    |      –      | No test |     ✓      |\n| MW [2]  | Enhanced via trigger confidence boosting |      ✓      |    ✓    |      –      | Tested  |     ✓      |\n| ICS [3] |              Empirical, NTD              |      ✓      |    ✓    |      ✗      | No test |     ✗      |\n| CKA[4]  |              Empirical, NTD              |      ✓      |    ✓    |      –      | Tested  |     ✗      |\n|  Ours   |         Theoretically guaranteed         |      ✓      |    ✓    |      ✓      | No test |     ✗      |\n\n***\n\n## References:\n\n[1] Bansal, Arpit, et al. \"Certified neural network watermarks with randomized smoothing.\" *International Conference on Machine Learning*. PMLR, 2022.\n\n[2] Kim, Byungjoo, et al. \"Margin-based neural network watermarking.\" *International Conference on Machine Learning*. PMLR, 2023.\n\n[3] Zeng, Boyi, et al. \"Huref: Human-readable fingerprint for large language models.\" *Advances in Neural Information Processing Systems* 37 (2024): 126332-126362.\n\n[4] Zhang, Jie, et al. \"Reef: Representation encoding fingerprints for large language models.\" *arXiv preprint arXiv:2410.14273* (2024).\n\n[5] Uchida, Yusuke, et al. \"Embedding watermarks into deep neural networks.\" *Proceedings of the 2017 ACM on international conference on multimedia retrieval*. 2017.\n\n[6] Yang, Zhiguang, and Hanzhou Wu. \"A fingerprint for large language models.\" *arXiv preprint arXiv:2407.01235* (2024)."}, {"review_id": "APYYrmbU8c", "reviewer": "Reviewer_diWK", "summary": "This paper proposes a robust DNN fingerprinting method designed to embed ownership information into models with theoretically guaranteed robustness against fine-tuning. They leverage specific frequency components of convolutional filters, which remain invariant during fine-tuning when the input features contain only low-frequency components. The authors propose a revised Fourier transform to extract these frequency components and theoretically prove their stability under various attacks. Additionally, they introduce an auxiliary class during the watermarking to defend against overwriting attacks via an auxiliary loss term. Experiments on datasets like CIFAR-10 and ImageNette demonstrate the method's effectiveness, outperforming existing techniques in robustness to fine-tuning.", "questions": "- Is it possible to extend your method to ViT-based architectures?\n- How do you implement the overwriting attack in your experiments? Do you just add weight perturbations?\n- Does the introduction of attack loss make your model more sensitive to input perturbation?\n- Is there a more principal method to add the fingerprinting module? My concern is that it seems that the fingerprinting module somewhat depends on the model architecture. (Lines 479-481)\n- What if the attacker first fine-tunes the fingerprinting layer and then uses the overwriting attack?", "limitations": "yes", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "## Strengths\n- This paper introduces a theoretically sound method with guaranteed robustness to fine-tuning, which largely strengthens the property protection of DNNs.\n- Largely improved robustness compared to the baseline detection methods.\n- Proofs are clear and complete.\n\n## Weakness\n- The proposed method requires an additional fingerprinting module and an auxiliary class to defend against the overwriting attacks. This weakens the threat model for the white-box property protection.", "was_revised": true, "final_justification": "My primary concerns were addressed during the rebuttal, and I will keep my score unchanged.", "rebuttal": "# Reply to Reviewer diWK:\n\nThank you for your efforts. We will answer all your questions. **If you have further concerns, please let us know, and we will update the response ASAP.**\n\n## Q1. Concerns about white-box robustness\n\n> Weakness 1. \"The proposed method requires an additional fingerprinting module and an auxiliary class to defend against the overwriting attacks. This weakens the threat model for the white-box property protection.\"\n\nThank you for your response. We clarify the design of our method for defending against **white-box** and **black-box** attacks. Please correct us if we misunderstand anything.\n\n**For white-box attacks:** In our paper, the weight permutation attack, the weight scaling attack, and the overwriting attack are all typical white-box attacks, because these attacks require direct access to read and change the model’s parameters. We are not sure if the white-box attack you mentioned refers to these three types. If there is anything we misunderstood, please feel free to let us know. To this end, we have proven that our fingerprint is equivariant to permutation and scaling, thus robust to both. In addition, we also add an extra loss term to train the model to defend against the overwriting attack. Experiments in Section 3.5 and Section 4 showed that (1) the proposed fingerprint was robust against permutation attack and scaling attack, and (2) that overwriting the fingerprint significantly sacrificed the model’s performance.\n\n**For black-box attacks:** Our method mainly defends against the effect of standard fine-tuning on the fingerprint. We prove that certain frequency components used as the fingerprint remain stable during training in mathematics. Our experiments (see Section 4 for details) showed that the fingerprint persisted after fine-tuning, indicating that our method could effectively defend against the fine-tuning attack.\n\n***\n\n## Q2. Concerns about architectural dependency and extensibility\n\n> Question 1. \"Is it possible to extend your method to ViT-based architectures?\"\n>\n> Question 4. \"Is there a more principal method to add the fingerprinting module? My concern is that it seems that the fingerprinting module somewhat depends on the model architecture. (Lines 479-481)\"\n\nThanks a lot. We have followed your suggestions to extend our method to Transformer-based architectures. Because our fingerprint module is only connected in parallel to the neural network and takes part in the inference process, it can be widely applied to different DNNs without being affected by the network architecture.\n\nTherefore, we have **conducted new experiments** on several models, including ViT-B/16 (a vision Transformer), BERT-uncased (a language model), and a larger CNN ResNet-50. However, due to the page limit, we are unable to include all the details and results in this rebuttal.\n\nPlease refer to our **response to Reviewer yBqd**, particularly the **answer to Q1**, where we provided the experimental results and discussed this extension in more detail.\n\n***\n\n## Q3. How to implement the overwriting attack?\n\n> Question2. \"How do you implement the overwriting attack in your experiments? Do you just add weight perturbations?\"\n\nA good question. In fact, there are different ways to perform overwriting attacks. To better show the differences between them, we conducted **a new experiment** to test how the model performs under different types of overwriting. We applied the following three types of attacks:\n\n**(1) Replacement** [5]: This is also the most widely used overwriting attack method. This method replaced the convolutional weights in the fingerprint module with completely random values, and then fine-tuned the model on a new dataset to restore its performance.\n\n**(2) Noise on Spectrums**: This method conducted a revised Fourier transform on the convolutional weights in the fingerprint module, added Gaussian noise in the frequency domain (with an L2 norm of 0.5 times the original weights), and then applied an inverse transform to get the modified weights.\n\n**(3) Noise on Weights**: Another strategy directly added Gaussian noise to the convolutional weights of the fingerprint module (with an L2 norm of 0.5 times the original weights), which is quite similar to what you mentioned.\n\nWe used ResNet-18 trained on CIFAR-100 dataset to inject the fingerprint. For fair comparison, we fine-tuned the models attacked by all types of overwriting, on the CIFAR-10 dataset. We then tested the fingerprint score (see Section 3.4) and classification accuracy on CIFAR-10. All other settings followed the main paper. Table B shows the results.\n\nTable A: The fingerprint score and the classification accuracy on CIFAR-10 after applying overwriting attacks to the models.\n\n| Attack types | Fingerprint score  | Acc. on CIFAR-10 |\n| :-: | :-: | :-: |\n|    **Without attack**     |     **1.00**    |**94.1%**   |\n|    With attack: Replacement      |     0.00    |82.4%   |\n|  With attack: Noise on Spectrums   | 0.08    |87.5%   |\n|   With attack: Noise on Weights    |     0.00    |88.0%   |\n\nIn the experiments in the main paper, we used the second type of overwriting attack (Noise on Spectrums). \n\nExperimental results in the above table shows that all three types of attacks erased the fingerprint, but caused about 10% accuracy drop. This indicated that the overwriting attack could not erase the fingerprint without significantly hurting the performance.\n\n***\n\n## Q.4 Robustness against combined fine-tuning and overwriting attacks.\n\n> Question4. \"What if the attacker first fine-tunes the fingerprinting layer and then uses the overwriting attack?\"\n\nA good question. Let us answer your question from two perspectives. \n\n- First, during the fingerprint injection process, our method adds an extra adversarial loss $L_{attack}$ (see Equation (15)) to make the model’s performance drop when the overwriting attack is applied. This design ensures that the attacker cannot remove the fingerprint without hurting the model’s performance.\n\n- Second, we followed your suggestion and conducted **a new ablation experiment** to test the model’s performance in defending the “fine-tuning+overwriting” attack. The “fine-tuning+overwriting” attack was implemented as follows. Given a ResNet-18 model pretrained on CIFAR-100 for fingerprint injection, we applied two types of attack strategies. (1) The first strategy first fine-tuned the model on the CIFAR-10 dataset, and then overwrote the fingerprint module with completely new random parameters (not by adding noise). (2) The second reversed the order: the fingerprint module was first overwritten, and then the model was fine-tuned on the CIFAR-10 dataset.\n\nWe applied this combined attack to two types of models: one was trained on CIFAR-100 dataset with both the cross-entropy loss $L_{CE}$ and the additional loss term $L_{attack}$, and the other one was trained only on CIFAR-100 dataset with the cross-entropy loss $L_{CE}$. Table B shows the results.\n\nTable B: The fingerprint score and classification accuracy on CIFAR-10 after applying the first strategy of the combined fine-tuning and overwriting attack to the models.\n\n|**Models**| **Fingerprint score before attack / after attack** | **Acc. on CIFAR-10 before attack / after attack** | Drop in acc. on CIFAR-10 after attack|\n| :-: | :-: | :-: | :-: |\n| ResNet-18 with fingerprint  model  learned without $L_{attack}$ |       1.00/0.00|94.2% / 93.7%|**0.5%**|\n| ResNet-18 with fingerprint model  learned with $L_{attack}$  |         1.00/0.00|94.1% / 25.3%|**68.8%**|\n\nDue to the page limit, we included the experimental results of the second combined attack strategy in the **response to Reviewer LxLU**, specifically in our **answer to Q1**.\n\nUnder both attack strategies, we all observed that for the model trained with both $L_{CE}$ and $L_{attack}$, the fingerprint score dropped after the “fine-tuning + overwriting”  attack, but the model’s accuracy also decreased significantly. This shows that the extra loss term ensured that the attacker could not remove the fingerprint without hurting the performance.\n\nWe will incorporate the above results into the final version of the paper.\n\n***\n\n## Q5. Does the loss $L_{attack}$ increase sensitivity to input perturbations?\n\n> Question3. \"Does the introduction of attack loss make your model more sensitive to input perturbation?\"\n\nA good question. We conducted an ablation study to check whether adding the additional loss term $L_{attack}$ made the model more sensitive to input perturbations. We perturbed the input samples by adding random Gaussian noise and measured the model’s final classification accuracy. The noise was scaled so that its L2 norm was 0.01, 0.05, 0.1, 0.5 times the L2 norm of the input sample. We ran the experiment on ResNet-18 with CIFAR-100 dataset, using the same experimental settings as in the main paper. The results are shown in the following table.\n\nTable C:\n\n|Models \\ Noise scale| No noise | 0.01  | 0.05  |  0.1  |  0.5  |\n| :-: | :-: | :-: | :-: | :-: | :-: |\n|Normal ResNet-18 without the  fingerprint model|  76.3%   |76.2%|74.9%|67.5%|9.3%|\n| ResNet-18 with fingerprint  model  learned without $L_{attack}$ |  76.5%|76.4%|74.8%| 67.7% | 11.4% |\n| ResNet-18 with fingerprint model  learned with $L_{attack}$  |  75.5%   | 75.5% | 73.7% | 66.8% | 10.9% |\n\nThe results showed that the added noise all hurt the classification accuracy of the three models, but the three models performed similarly when we added noises of different scales. This suggested that the loss $L_{attack}$ did not significantly affect the sensitivity to input perturbations.\n\n***\n\n## References:\n\n[1–4] Due to the page limit, please refer to the references in our **response to Reviewer yBqd** for the detailed citations [1–4], where the numbering remains consistent.\n\n[5] Wang et al. \"Riga: Covert and robust white-box watermarking of deep neural networks.\" *Proceedings of the web conference 2021.*"}, {"review_id": "cReZt6Mpih", "reviewer": "Reviewer_mgDF", "summary": "This paper proposes a novel neural network fingerprinting method that embeds ownership information into deep neural networks by leveraging theoretically invariant frequency components of convolutional filters. The core idea is that when input features contain only low-frequency components, certain frequency elements of the filters remain stable during fine-tuning. The paper further demonstrates that these frequency components are also equivariant to weight scaling and permutation. Based on this, a fingerprint module is designed, along with a loss function to defend against overwriting attacks. Extensive experiments under fine-tuning, scaling, and permutation attacks show that the proposed method outperforms existing techniques.", "questions": "The paper theoretically demonstrates the invariance of specific frequency components in convolutional filters during fine-tuning and proposes a neural network fingerprinting mechanism based on this property. However, several questions remain:\n1. Is the proposed method still effective in deeper convolutional neural networks (e.g., ResNet-50, ResNeXt), and can it maintain stability within more complex network architectures?\n\n2. Can the method be extended to other types of neural architectures, or how applicable is it to non-CNN models such as Transformers or ViT?\n\n3. The paper lacks critical information about the experimental setup, including the downstream tasks used for fine-tuning, detailed training configurations (e.g., optimizer, learning rate, number of epochs), and the number and construction methodology of the source and suspicious model sets.\n\n4. The code is not publicly available, which compromises the reproducibility of the results and the practical applicability of the proposed method.", "limitations": "The paper discusses the limitations of its work as well as the potential societal impacts it may bring.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. This paper focuses on an important and emerging research direction: fingerprint embedding techniques for neural networks, which hold significant practical relevance and application value.\n2. This paper proposes a theoretically grounded fingerprinting method and proves its robustness against fine-tuning, effectively addressing key limitations of prior approaches in terms of transferability and stability.\n3. This paper thoroughly evaluates the proposed method under various attack scenarios and standard benchmarks, demonstrating its practicality and effectiveness.\n\nWeaknesses:\n1. The proposed method is only evaluated on CNN-based models, and its applicability and effectiveness on other neural architectures such as Transformers or Vision Transformers remain unclear.\n2. This paper lacks detailed descriptions of the experimental setup.\n3. The code and implementation details are not publicly released, which limits the reproducibility of the results and hinders the practical adoption of the method.", "was_revised": true, "final_justification": "The authors have adequately addressed several of my concerns during the rebuttal. I have increased my score from 3 to 5, as I believe the main concerns were partially resolved and the paper can be valuable to the community with minor revisions.", "rebuttal": "# Reply to Reviewer mgDF:\n\nThank you for your efforts. We will answer all your questions. **If you have further concerns, please let us know, and we will update the response ASAP.**\n\n## Q1. Concerns about the generalizability and effectiveness of the proposed method on non-CNN architectures and deeper CNN architectures. \n\n> Weakness 1. \"The proposed method is only evaluated on CNN-based models, and its applicability and effectiveness on other neural architectures such as Transformers or Vision Transformers remain unclear.\"\n>\n> Question 1. \"Is the proposed method still effective in deeper convolutional neural networks (e.g., ResNet-50, ResNeXt), and can it maintain stability within more complex network architectures?\"\n>\n> Question 2. \"Can the method be extended to other types of neural architectures, or how applicable is it to non-CNN models such as Transformers or ViT?\"\n\nThanks a lot. We have followed your suggestions to **extend our methods on the Transformer-based architecture**. Because our fingerprint module is only connected in parallel to the neural network and takes part in the inference process, it can be widely applied to different DNNs without being affected by the network architecture. For a neural network with Transformer layers, we can connect our fingerprint module (in Section 3.3) in parallel to a Transformer layer.\n\nTherefore, we have conducted **new experiments** on Transformer-based architectures and larger-scale CNN-based networks to validate the generalizability and effectiveness of the proposed method.\n\n(1) We selected Transformer-based models, pretrained ViT-B/16  officially released in [1] and BERT-uncased [3]. For the ViT-B/16 model (a Transformer-based vision model), let us be given the input embedding tensor $X \\in \\mathbb{R}^{N \\times D}$ of the sixth Transformer layer, where N is the number of tokens, and D is the hidden dimension. We reshape it into a 2D spatial representation $X’ \\in \\mathbb{R}^{D\\times \\sqrt{N}\\times \\sqrt{N}}$. This reshaped tensor is then passed through our fingerprint module. The output of the fingerprint module is subsequently reshaped to the corresponding dimensions and added as a residual to the output of the Transformer layer. The ViT-B/16 was fine-tuned on the Imagenette dataset.\n\nFor the BERT-uncased model [3] (a language model), the fingerprint module was connected in parallel to the sixth Transformer layer and the model was fine-tuned on AG_NEWS [4]. \n\n(2) The larger-scale CNN-based network is the ResNet-50 model [2] (a convolutional network). The fingerprint module was connected in parallel to the second convolutional layer of the second residual block of ResNet-50. This model was fine-tuned on CIFAR-100 dataset.\n\nAll models were trained for 50 epochs with a batch size of 64. Other settings followed those in the main paper.\n\nWe tested the fingerprint score (in Section 3.4) and the mean cosine similarity of fingerprinting frequency components before and after fine-tuning $E_{(u,v) \\in S'}\\ E_{d}\\ [\\cos(F^{(uv)}\\_{Wd},\\ F^{(uv)}\\_{W'd})]$. We used $\\tau = 0.98$ as the threshold for fingerprint score computation. The results are summarized in Table A and Table B below.\n\nTable A: The fingerprint scores of our method on Transformer-based architectures and larger-scale CNN-based networks.\n\n| Models \\ Learning rates | 1e-2  | 1e-3  | 1e-4  |\n| :---------------------: | :---: | :---: | :---: |\n|      ViT-B/16 [1]       | 1.000 | 1.000 | 1.000 |\n|      ResNet-50 [2]      | 0.823 | 0.938 | 0.996 |\n|    BERT-uncased [3]     | 0.942 | 0.991 | 1.000 |\n\nNote that the fingerprint score represents the fraction of fingerprinting frequency components with cosine similarity exceeding the threshold $\\tau = 0.98$, a fingerprint score above 0.8 is already highly favorable.\n\nTable B: The mean cosine similarity of fingerprinting frequency components before and after fine-tuning $E_{(u,v) \\in S'}\\ E_{d}\\ [\\cos(F^{(uv)}\\_{Wd},\\ F^{(uv)}\\_{W'd})]$. of our method on Transformer-based architectures and larger-scale CNN-based networks. \n\n| Models \\ Learning rates | 1e-2  | 1e-3  | 1e-4  |\n| :---------------------: | :---: | :---: | :---: |\n|      ViT-B/16 [1]       | 0.999 | 0.999 | 0.999 |\n|      ResNet-50 [2]      | 0.985 | 0.993 | 0.998 |\n|    BERT-uncased [3]     | 0.992 | 0.996 | 0.999 |\n\nWe observed that both the fingerprint score and the average similarity remained high across different network architectures and learning rate settings, which together provided preliminary evidence that our method remained effective on Transformer-based architectures and larger-scale CNN-based networks.\n\n***\n\n## Q2. Lack of detailed descriptions of the experimental setup, including fine-tuning tasks, training settings, and model construction.\n\n> Weakness 2. \"This paper lacks detailed descriptions of the experimental setup.\"\n>\n> Question 3. \"The paper lacks critical information about the experimental setup, including the downstream tasks used for fine-tuning, detailed training configurations (e.g., optimizer, learning rate, number of epochs), and the number and construction methodology of the source and suspicious model sets.\"\n\nThanks for your suggestion. Some of the experimental details, including the optimizer, learning rate, and number of training epochs are described in the Appendix (Lines 486–490, 503, and 520), and the hyperparameter settings of the fingerprint module are specified in the main paper (Line 220). Specifically, we used the SGD optimizer with a momentum of 0.9. During the fingerprint injection phase, models were trained for 250 epochs; during the fine-tuning phase, models were fine-tuned for 50 epochs, after which we observed that the training had converged.\n\nWhat’s more, unless otherwise stated, we used a default batch size of 64 and a learning rate of 0.01 to train the models with a fixed random seed of 0. All models were trained and fine-tuned for classification tasks. In order to construct source-suspicious model pairs, each source model was paired with every suspicious model in all possible combinations. Each source-suspicious model pair formed a sample for model tracing.\n\nIf the paper is accepted, we will revise the manuscript to make these settings more explicitly presented in the main paper.\n\n***\n\n## Q3. Lack of public code and implementation details, limiting reproducibility and applicability.\n\n> Weakness 3. \"The code and implementation details are not publicly released, which limits the reproducibility of the results and hinders the practical adoption of the method.\"\n>\n> Question 4. \"The code is not publicly available, which compromises the reproducibility of the results and the practical applicability of the proposed method.\"\n\nThanks for your suggestion. We have already open-sourced the code on GitHub. Due to the time limit of the rebuttal, the interface has not yet been fully polished, but all core functionalities have been released, and users can run the code successfully. We will continue to clean up the repository and provide clearer documentation in the final version.\n\nDue to the anonymity requirement of the review process, we are not allowed to put the GitHub link at this stage. We will release GitHub link for the code in the main paper if the paper is accepted. Thank you for your understanding.\n\n***\n\n## References:\n\n[1] Dosovitskiy, Alexey, et al. \"An image is worth 16x16 words: Transformers for image recognition at scale.\" *arXiv preprint arXiv:2010.11929* (2020).\n\n[2] He, Kaiming, et al. \"Deep residual learning for image recognition.\" *Proceedings of the IEEE conference on computer vision and pattern recognition*. 2016.\n\n[3] Devlin, Jacob, et al. \"Bert: Pre-training of deep bidirectional transformers for language understanding.\" *Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers)*. 2019.\n\n[4] Zhang, Xiang, Junbo Zhao, and Yann LeCun. \"Character-level convolutional networks for text classification.\" *Advances in neural information processing systems* 28 (2015)."}, {"review_id": "qY6c7vNVhz", "reviewer": "Reviewer_yBqd", "summary": "This paper proposes the first theoretical proof that low-frequency components of a convolutional filter are invariant to model fine-tuning, and are also equivariant to weight scaling and weight permutations. As such, this paper proposes to use these specific frequency components for fingerprinting. Besides providing theoretical proof, the authors also evaluated the proposed fingerprinting method against fine-tuning and combined weight attacks.", "questions": "Please consider addressing the weak points outlined above.", "limitations": "The theoretical proof is provided for convolutional layers, which limits the applicability of the fingerprinting method to models with conv. architecture. The authors shall explain the limitations of the proposed fingerprinting method and whether the proof can be further generalized.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "This paper has the following strengths:\n+ The authors extended the previous works on fingerprinting robustness with theoretical proofs; \n+ The authors performed an extensive evaluation of the proposed fingerprinting method against various combinations of attacks;  \n+ The authors compared the proposed fingerprinting method against existing counterparts and showed that the new method achieves a higher classification accuracy for detecting fine-tuned models. \n\n\nThis paper has the following weaknesses: \n- The proposed fingerprinting method targets at convolutional layers, meaning that this method may not be applicable to popular language models.  \n- The experiment section does not include results about the accuracy of the model on the main tasks when using different fingerprinting methods.", "was_revised": false, "final_justification": "", "rebuttal": "# Reply to Reviewer yBqd:\n\nThank you for your efforts. We will answer all your questions. **If you have further concerns, please let us know, and we will update the response ASAP.**\n\n## Q1. Concerns about the method’s applicability to non-convolutional models, such as language models.\n\n> Weakness 1. \"The proposed fingerprinting method targets at convolutional layers, meaning that this method may not be applicable to popular language models.\"\n>\n> Limitation 1. \"The theoretical proof is provided for convolutional layers, which limits the applicability of the fingerprinting method to models with conv. architecture. The authors shall explain the limitations of the proposed fingerprinting method and whether the proof can be further generalized.\"\n>\n\nThanks a lot. We have followed your suggestions to **extend our methods on the Transformer-based architecture**. Because our fingerprint module is only connected in parallel to the neural network and takes part in the inference process, it can be widely applied to different DNNs without being affected by the network architecture. For a neural network with Transformer layers, we can connect our fingerprint module (in Section 3.3) in parallel to a Transformer layer.\n\nTherefore, we have conducted **new experiments** on Transformer-based architectures and larger-scale CNN-based networks to validate the generalizability and effectiveness of the proposed method.\n\n(1) We selected Transformer-based models, pretrained ViT-B/16  officially released in [1] and BERT-uncased [3]. For the ViT-B/16 model (a Transformer-based vision model), let us be given the input embedding tensor $X \\in \\mathbb{R}^{N \\times D}$ of the sixth Transformer layer, where N is the number of tokens, and D is the hidden dimension. We reshape it into a 2D spatial representation $X’ \\in \\mathbb{R}^{D\\times \\sqrt{N}\\times \\sqrt{N}}$. This reshaped tensor is then passed through our fingerprint module. The output of the fingerprint module is subsequently reshaped to the corresponding dimensions and added as a residual to the output of the Transformer layer. The ViT-B/16 was fine-tuned on the Imagenette dataset.\n\nFor the BERT-uncased model [3] (a language model), the fingerprint module was connected in parallel to the sixth Transformer layer and the model was fine-tuned on AG_NEWS [4]. \n\n(2) The larger-scale CNN-based network is the ResNet-50 model [2] (a convolutional network). The fingerprint module was connected in parallel to the second convolutional layer of the second residual block of ResNet-50. This model was fine-tuned on CIFAR-100 dataset.\n\nAll models were trained for 50 epochs with a batch size of 64. Other settings followed those in the main paper.\n\nWe tested the fingerprint score (in Section 3.4) and the mean cosine similarity of fingerprinting frequency components before and after fine-tuning $E_{(u,v) \\in S'}\\ E_{d}\\ [\\cos(F^{(uv)}\\_{Wd},\\ F^{(uv)}\\_{W'd})]$. We used $\\tau = 0.98$ as the threshold for fingerprint score computation. The results are summarized in Table A and Table B below.\n\nTable A: The fingerprint scores of our method on Transformer-based architectures and larger-scale CNN-based networks.\n\n| Models \\ Learning rates | 1e-2  | 1e-3  | 1e-4  |\n| :---------------------: | :---: | :---: | :---: |\n|      ViT-B/16 [1]       | 1.000 | 1.000 | 1.000 |\n|      ResNet-50 [2]      | 0.823 | 0.938 | 0.996 |\n|    BERT-uncased [3]     | 0.942 | 0.991 | 1.000 |\n\nNote that the fingerprint score represents the fraction of fingerprinting frequency components with cosine similarity exceeding the threshold $\\tau = 0.98$, a fingerprint score above 0.8 is already highly favorable.\n\nTable B: The mean cosine similarity of fingerprinting frequency components before and after fine-tuning $E_{(u,v) \\in S'}\\ E_{d}\\ [\\cos(F^{(uv)}\\_{Wd},\\ F^{(uv)}\\_{W'd})]$ of our method on Transformer-based architectures and larger-scale CNN-based networks. \n\n| Models \\ Learning rates | 1e-2  | 1e-3  | 1e-4  |\n| :---------------------: | :---: | :---: | :---: |\n|      ViT-B/16 [1]       | 0.999 | 0.999 | 0.999 |\n|      ResNet-50 [2]      | 0.985 | 0.993 | 0.998 |\n|    BERT-uncased [3]     | 0.992 | 0.996 | 0.999 |\n\nWe observed that both the fingerprint score and the average similarity remained high across different network architectures and learning rate settings, which together provided preliminary evidence that our method remained effective on Transformer-based architectures and larger-scale CNN-based networks.\n\n***\n\n## Q2. Missing comparison of main task accuracy across different fingerprinting methods.\n\n> Weakness 2. \"The experiment section does not include results about the accuracy of the model on the main tasks when using different fingerprinting methods.\"\n\nThanks a lot. We have followed your suggestion to conduct **a new experiment** to compare the impacts on the model’s performance of different fingerprint injection methods, and **our method caused less performance drop on the main task** compared to other mainstream fingerprinting methods.\n\nWe trained the ResNet18 on CIFAR-100 and CIFAR-10 to inject the fingerprint. We tested the classification accuracy on the datasets. The compared methods were RS [1] and MW [2] mentioned in the main paper Section 4.\n\nTable C: The classification accuracy of the model.\n\n|          Methods           | CIFAR-10  | CIFAR-100 |\n| :------------------------: | :-------: | :-------: |\n|  **Without fingerprint**   | **94.8%** | **76.3%** |\n|  With fingerprint: RS [1]  |   84.2%   |   59.9%   |\n|  With fingerprint: MW [2]  |   87.8%   |   62.1%   |\n| **With fingerprint: Ours** | **92.2%** | **75.5%** |\n\nTable C shows the results. Compared to other mainstream fingerprinting methods, our method caused a smaller performance drop on the main task.\n\n***\n\n## References:\n\n[1] Dosovitskiy, Alexey, et al. \"An image is worth 16x16 words: Transformers for image recognition at scale.\" *arXiv preprint arXiv:2010.11929* (2020).\n\n[2] He, Kaiming, et al. \"Deep residual learning for image recognition.\" *Proceedings of the IEEE conference on computer vision and pattern recognition*. 2016.\n\n[3] Devlin, Jacob, et al. \"Bert: Pre-training of deep bidirectional transformers for language understanding.\" *Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers)*. 2019.\n\n[4] Zhang, Xiang, Junbo Zhao, and Yann LeCun. \"Character-level convolutional networks for text classification.\" *Advances in neural information processing systems* 28 (2015).\n\n[5] Bansal, Arpit, et al. \"Certified neural network watermarks with randomized smoothing.\" *International Conference on Machine Learning*. PMLR, 2022.\n\n[6] Kim, Byungjoo, et al. \"Margin-based neural network watermarking.\" *International Conference on Machine Learning*. PMLR, 2023."}]

Author rebuttal:

Meta-review: This paper studies the problem of embedding ownership information into the weights of deep neural networks (DNNs). The authors provide a theoretical analysis showing that certain frequency components of convolutional filters remain stable during training and fine-tuning, which forms the foundation of the proposed approach. A revised Fourier transform is introduced to extract these frequency components, and theoretical guarantees are provided for their stability under various attacks. In addition, the method incorporates an auxiliary class during watermarking, with an auxiliary loss term to defend against overwriting attacks. Experiments on datasets such as CIFAR-10 and ImageNette demonstrate the effectiveness of the approach, showing improved robustness to fine-tuning compared to existing techniques.

All reviewers engaged in the discussion, acknowledged that most concerns were addressed, and recognized the theoretical analysis, noting that this paper makes a meaningful contribution to the area of robust model fingerprinting.
Decision: Accept (poster)