Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprint

Authors: Shuo Shao, Haozhe Zhu, Hongwei Yao, Yiming Li, Tianwei Zhang, Zhan Qin, Kui Ren
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Model Fingerpinting, Ownership Verification, Model Copyright Protection, Trustworthy ML

Abstract:
The utilization of open-source pre-trained models has become a prevalent practice, but unauthorized reuse of pre-trained models may pose a threat to the intellectual property rights (IPR) of the model developers. Model fingerprinting, which does not necessitate modifying the model to verify whether a suspicious model is reused from the source model, stands as a promising approach to safeguarding the IPR. In this paper, we revisit existing model fingerprinting methods and demonstrate that they are vulnerable to false claim attacks where adversaries falsely assert ownership of any third-party model. We reveal that this vulnerability mostly stems from their untargeted nature, where they generally compare the outputs of given samples on different models instead of the similarities to specific references. Motivated by these findings, we propose a targeted fingerprinting paradigm ($i.e.$, FIT-Print) to counteract false claim attacks. Specifically, FIT-Print transforms the fingerprint into a targeted signature via optimization. Building on the principles of FIT-Print, we develop bit-wise and list-wise black-box model fingerprinting methods, $i.e.$, FIT-ModelDiff and FIT-LIME, which exploit the distance between model outputs and the feature attribution of specific samples as the fingerprint, respectively. Extensive experiments on benchmark models and datasets verify the effectiveness, conferrability, and resistance to false claim attacks of our FIT-Print.

Decision: reject
Reviewer scores: 6, 3, 1, 6

Reviews and discussion:
<thread>
creation date:
1730420551175

thread_type:
official_review

<thread_object>
creator: reviewer_jema

<content>
summary:
This paper proposes FIT-Print, a defense against false claim attacks in model fingerprinting. The paper first extends false claim attacks to various existing fingerprint schemes and reveals that existing methods are typically vulnerable. The paper attributes this vulnerability to the untargeted nature of existing methods, which allows an adversary to exploit transferrable verification samples to forge a false ownership. The paper then proposes FIT-Print, which features a targeted fingerprint optimization process that aligns the fingerprint to a pre-defined target vector. Based on FIT-Print, the paper provides two concrete implementations, FIT-ModelDiff and FIT-LIME, and experimental results show that the proposed method is effective in verification and robust against false claim attacks.

strengths:
1. **This paper addresses a new and important problem in model fingerprinting**. False claim attack is a relatively new attack in model fingerprinting. This paper provides a defense technique against this new attack.
2. **This paper extends existing false claim attacks to testing-based fingerprint methods**. Previous false claim attacks have mainly focused on adversarial-example-based (AE-based) fingerprints. This paper provides an extension to testing-based methods.
3. **This paper proposes a defense against false claim attacks**. FIT-Print proposes a novel targeted optimization process to craft verification samples w.r.t. a pre-defined target, which limits the transferability of verification samples and is empirically effective against false claims. The method could also be generalized to various testing-based model fingerprints.

weaknesses:
1. **The claim that FIT-Print "restricts the (potential) fingerprint space" lacks theoretical support**. The idea of restricting fingerprint space with targeted optimization is interesting. However, judging from Theorem 1, the false claim attack has little chance of success mainly because the adversary has no knowledge of $F$ and has to make random guesses. It lacks a deeper analysis of whether this design indeed restricts the fingerprint space and how it impacts the optimization of verification samples. Nonetheless, this is understandable considering the complexity of neural networks.
2. **The problem setting of false claim attack is unclear**. The current manuscript lacks a general workflow of the fingerprint registration and verification process. It also lacks a threat model for the false claim attack. Consequently, it is unclear how a fingerprint is registered and verified, or how the adversary could launch a false claim attack. While some of this information could be found in one of the cited works [1], these missing parts would still cause confusion.

[1] Liu et al. "False Claims against Model Ownership Resolution". USENIX Security 2024.

questions:
1. In Section 4.4, is the adversary using the same fingerprint $F$ when creating verification samples from ImageNet independent models?
2. The setting of the adaptive unlearning attack in Section 4.5 is confusing. The authors mention that "the model reuser still has *no* knowledge of the target fingerprint $F$", but the first sentence says "the model reuser *knows* the target fingerprint" and the target fingerprint $F$ is used in the optimization in Eq. 17. It is unclear whether $F$ is known to the adversary or not.
3. What is the overhead of the targeted optimization (fingerprint generation)? The overhead analysis in Appendix F seems to only include the overhead for fingerprint verification. Since the targeted optimization process involves additional optimization and augmented models, will the fingerprint generation process be significantly slower?
4. What is the attack success rate of false claim attacks on existing AE-based or testing-based methods? It seems Table 2 only includes a false positive rate on independent models without considering false claim attacks.
5. From this reviewer's opinion, some discussions in the appendices are quite important, such as the reason for choosing testing-based fingerprints over AE-based fingerprints, the ablation study on the augmented models, and the discussion on the generalization of FIT-Print. Including these in the main part of the paper would help clarify some confusion. This reviewer understands that the authors are restricted by the page limit, but it would be better if some references to the appendices could be put where necessary.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730466706595

thread_type:
official_review

<thread_object>
creator: reviewer_lmac

<content>
summary:
To protect an AI model's copyright from illegal reuse or plagiarism, a method to verify true ownership is required. A fingerprinting strategy can be used without altering the model, preserving its performance. However, adversarial modifications used for fingerprinting can enable false claim attacks, where an attacker falsely claims ownership by exploiting the transferability of these modifications.
To counter false claim attacks, the authors propose a targeted adversarial fingerprinting method. They argue that current techniques are vulnerable due to their untargeted nature, which creates a large fingerprint space, enabling adversarial transfers between models. By focusing on specific target classes, they suggest that the fingerprint space can be narrowed, reducing transferability and minimizing false claim risks.

strengths:
Supplementary Materials
The supplementary materials include code and a clear README, which demonstrates a responsible effort towards transparency and reproducibility.

weaknesses:
1. Contribution and Innovation Deficiency
Contribution: 
There are some issues with the contributions mentioned in the paper:
Contribution 1: False claim attack is not a new type of attack. This type of attack has already been introduced in previous work, and thus, it should not be considered a contribution of this paper.
Contribution 2: The advantages of the proposed targeted verification method (compared to other verification methods) have not been sufficiently explained. Without clearly demonstrating the superiority of the targeted approach over other methods, it is difficult to view this as a valid contribution.
Contribution 3: The advantages of the proposed black-box fingerprinting method (compared to existing methods) are also insufficiently explained. Without providing more explanation to highlight the uniqueness or strengths of this method, it cannot be considered a significant contribution.
Novelty:
The main innovation of the paper seems to be the shift from non-targeted to targeted fingerprinting methods. However, this innovation appears somewhat limited and lacks sufficient persuasive power. Beyond this point, the paper's contributions in terms of innovation could be further enhanced. It is recommended to explore additional novel ideas to strengthen the overall impact of the paper.

2. Terminology and Definitions are Unclear
Improper naming: 
The choice of abbreviations in the paper is not standard, especially in "False-claIm-resistant Targeted model fingerPrinting (FIT-Print)." Using the letter "I" from the middle of the word "claim" is unconventional and does not follow common abbreviation rules. Naming should avoid such arbitrary choices to ensure clarity and consistency, and it is recommended to use abbreviations that are more in line with standard conventions.
Unclear explanation of the verification process: 
In section 2.3, the explanation of ownership verification through "p1" and "p2" is overly brief. Using such abbreviations makes it difficult for readers to grasp their exact meaning. It is recommended to clearly explain each step of the verification process and avoid using vague abbreviations that could lead to confusion.
Unclear definition of independent model: 
The term "independent model" is used in the paper but not clearly defined. Does "independent" refer to models with completely different structures, or models performing different tasks? This distinction is critical for understanding the relationships between models in the verification scenario. It is recommended to clearly define whether independence is based on structure, task, or dataset.
Unclear definition of the scenario and protocol: 
The paper does not clearly define each party involved in the fingerprint verification scenario, nor the specific steps they execute in the protocol. For instance, the roles of each party, the information they have access to, and the actions they perform should be clearly explained, so that readers can better understand how the entire verification protocol works. Similarly, providing more specific steps and details for both the attack and defense mechanisms—such as the inputs, outputs, who executes each step—would greatly improve the understanding of these processes.
Unclear model relationships: 
The symbols for models (e.g., Mo, Ms, Mi) are not clearly explained, particularly in the context of the "false claim of ownership of M1." Providing clearer descriptions and diagrams would improve understanding of how these models interact in the scenario.
Lack of illustrations: 
The paper lacks sufficient diagrams to explain the overall fingerprint verification framework. The relationships between models like Mo, Ms, and Mi are unclear, making it harder for readers to follow. Diagrams would help visualize these interactions and clarify the verification process.

Be careful when use of terminology:
Terms like "Proposition," "Definition," and "Theorem" are used in the paper but need to be applied with more caution. It is recommended to briefly introduce these terms in the introduction and clarify their specific contexts throughout the paper to help readers better understand their relevance and contribution to the argument.

3. Concerns about the Mechanism or Inadequate Consideration/Explanation of Vulnerabilities.
Fingerprinting scenario considerations: 
The paper does not fully explore whether adversarial samples generated by the model owner could also affect models not owned by them, given the known transferability of such samples. This scenario needs further investigation to assess its potential impact on the verification process.
Fairness in adversarial sample generation: 
The process for generating adversarial samples x̄ and x is unclear. If different algorithms are used, it raises concerns about fairness in the verification process. Ideally, fingerprinting rules should be enforced by a trusted third party to ensure consistency. Clarifying the generation algorithms would enhance transparency and fairness.

questions:
The weaknesses of the paper have been pointed out in the Weaknesses section, and I hope that targeted revisions can be made for each issue. Overall, I believe the following improvements would enhance the quality of the paper:

1. Clear explanation and presentation
Please provide detailed explanations of the roles, tasks, and relationships of each party in the scenario, along with a step-by-step description of the process. I also expect more elaboration on potential attacks and defenses, specifying the processes involved.
I encourage the authors to invest more effort in improving the readability of the paper, such as by incorporating diagrams to help readers understand the proposed protocol and background knowledge. The terms and concepts used should be clearly defined, as omitting details here could compromise the clarity of the paper. Please also avoid using non-standard abbreviations or expressions that may confuse readers.

2. Accurate and expanded contributions
Accurately and truthfully present the contributions of your work. If the current contributions are insufficient, consider adding new ones. I believe there is room for further enhancement in the paper's contributions to innovation.

3. Explanation and discussion
This point corresponds to my concerns about the mechanism or inadequate consideration/explanation of vulnerabilities. I hope the authors can alleviate these concerns by providing additional explanations, analyses, or clear descriptions of the experimental setup. This would enhance the reliability of the work presented in the paper.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730606700663

thread_type:
official_review

<thread_object>
creator: reviewer_otwh

<content>
summary:
This paper studied the vulnerability of existing model fingerprinting approaches against false claim attacks. To fix the problem, they propose to incorporate a mapping function, which can be confidential, and input perturbation, which caters to the mapping, to defend against such attacks.

strengths:
- The paper is well-written and has plenty of experiments to support the contributions.
- The research question is interesting.

weaknesses:
- The attack scenario is limited. Currently, to the best of my knowledge, there is no third-party management on the fingerprints to authorize the ownership of open-sourced models. Therefore, it is impractical to consider and even defend against false-claim attacks. The authors should elaborate on the practical side of the setting.
- Another major concern is the missing literature. There is a work on KDD23 which also leverages a mapping function (they call it a meta-verifier) and adaptive input samples to build the model fingerprint. What is the different in methodology? The authors did not even mention the work. They should at least compare with it and show the substantial contribution over the work.

[1] https://dl.acm.org/doi/10.1145/3534678.3539257

questions:
See the weakness part above.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730619460756

thread_type:
official_review

<thread_object>
creator: reviewer_tol1

<content>
summary:
This paper addresses the challenge of protecting intellectual property rights (IPR) in open-source pre-trained models, which are widely reused but often without authorization. The authors pointed out a vulnerability in existing fingerprinting techniques, i.e., they are prone to false claim attacks, where adversaries could falsely claim ownership of third-party models. To address this, the authors propose a targeted fingerprinting paradigm called FIT-Print, designed specifically to counteract false claim attacks. FIT-Print transforms model fingerprints into targeted signatures through optimization. Based on this paradigm, the authors develop two black-box fingerprinting methods—FIT-ModelDiff and FIT-LIME, which rely on bit-wise and list-wise approaches, respectively, by leveraging the output distances and feature attributions of specific samples as fingerprints. Experiments on benchmark models and datasets demonstrate the effectiveness of the FIT-Print approach, showing that it is robust to false claim attacks.

strengths:
+) Defending against false claim attacks is a timely topic.

+) The proposed method is new and technically reasonale in general

+) Experimental results looks promising and justified the claims

weaknesses:
-) Some technical details are not very clear

-) It is not clear if the conclusion obtained on classification task can be extended to a more general scope of models

questions:
a) The focus on defending against false claim attacks is both timely and relevant, given the increasing reliance on open-source pre-trained models in diverse fields. By addressing the vulnerability in existing model fingerprinting methods, this paper provides an advancement in securing model ownership verification.

b) While I can understand the general idea of test sample extraction is to find a perturbation that pushes the model's prediction towards a target fingerprint (Eq.6), some technical details are not very clear to me. First, how to choose the target fingerprint F (Eq. 5 and 6)? I believe the choice of F significantly affects the model performance (e.g, F is different from the true label). Secondly, while the paper proposes two mapping functions f, it is not clear what criteria should be considered as good mapping functions. The design of FIT-MODELDIF and FIT-LIME looks arbitrary, and not clear why they are good mapping functions? Thirdly, I am confused how Eq.6 grantees that an independent model won't respond similarly to the test samples? 

c) It is worth comparing to existing optimization-based model finger-printing methods, e.g, sensitive sample fingerprinting [1].

[1] He, Zecheng, Tianwei Zhang, and Ruby Lee. "Sensitive-sample fingerprinting of deep neural networks." Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2019.

d) It would be better to discuss if the conclusion obtained on classification tasks can be extended to a more general scope of models, e.g., LLMs and other computer vision models (e.g., diffusion models which involves randomness)?
</content>
</thread_object>

</thread>
<thread>
creation date:
1732015519454

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Concerns Regarding the Potential LLM-written Review from Reviewer LMaC

comment:
Dear Chairs and Reviewers:

Greetings and wish you all the best. We deeply and sincerely thank you and all reviewers for your valuable time and comments on our paper. Your efforts greatly help us to improve our paper.

In this letter, we would like to express our concern regarding **the potential completely LLM-written review of Reviewer LMaC**. We exploit three different AI content detectors ([[link1]](https://quillbot.com/ai-content-detector), [[link2]](https://copyleaks.com/ai-content-detector), [[link3]](https://sapling.ai/ai-content-detector)) from the Internet to check whether the review is AI-generated. The results show that **over 94% of contents in the review of Reviewer LMaC is AI-generated**.

More importantly, **this review is highly biased and even erroneous**. Some examples are as follows:

- The review of Reviewer LMaC **simply negates our contributions** by omitting our discussions, explanations for our insight in Section 1, and our experiments which demonstrate our contributions in Section 4. 
- **Some comments of the review are unreasonable and unfounded**. 
    - Reviewer LMaC comments that naming a method can only use the first letter and requires us to explain some common-sense mathematical terms such as 'Theorem' and 'Definition'. 
    - Reviewer LMaC claims that we overuse the abbreviation 'p1 and p2'. However, we actually use the full name 'Proposition 1 and Proposition 2' in our paper.

**We sincerely hope that you can take notice of these issues and ignore his/her follow-up comments to our paper**. We believe that this reviewer might undermine the impartiality and fairness of the ICLR reviewing process, although we believe that we have addressed his/her concerns in our rebuttal. More detailed justifications are as follows:

- Considering that this reviewer gave us an extremely negative score of 1 and that his review comments were entirely generated by LLM, **we have to worry about whether he/she had a preconceived extremely negative stance on our work from the very beginning**, and even purposely and directly asked LLM to write a very negative comment for the purpose of rejecting the paper in bad faith. 
- As emphasized in the email to the ICLR reviewers, '**the use of LLMs to write full reviews is not allowed, LLM written reviews are easy to spot and the program committee will be rejecting such reviews**'. 
- Considering his/her previous negative and evil preconceived position and our accusations against him/her, **he/she might deliberately conduct malicious guidance in the subsequent discussion to cover up his/her malicious purpose and complete his/her malicious rejection of our manuscript**.

**We respect the opinions of the reviewers, but we sincerely hope that our work will be treated objectively and fairly**. We have poured our hearts and souls into this work, and we believe it deserves to be treated fairly. We are deeply sorry for the inconvenience that our notifications may cause you. Thank you again for all your kind and valuable efforts in the whole reviewing process.

Best Regards,

Paper 5867 Author(s)
</content>
</thread_object>

</thread>
<thread>
creation date:
1732398416874

thread_type:
official_comment

<thread_object>
creator: area_chair_qhr4

<content>
comment:
Dear Reviewers,
The authors have responded to your valuable comments.
Please take a look at them!

Best,
AC
</content>
</thread_object>

</thread>
<thread>
creation date:
1732673949808

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Thanks to Reviewer and A Gentle Reminder of Discussion

comment:
Dear Reviewers,

We thank Reviewer *jEMa* for the discussion and raising the score. As we have less than two days to further revise our paper, we would like to kindly remind Reviewers *toL1* and *oTwh* to take a look at our responses. We sincerely appreciate your time and any feedback you could give us.
</content>
</thread_object>

</thread>


Metareview:
metareview:
In the work, the authors studied ``Model fingerprinting,'' which was adopted to verify whether a suspicious model is reused from the original source one.

The authors have the concern regarding the comments from Reviewer LMaC that may be completely LLM-written (although the AC has no 100% evidence).

Therefore, the decision is made without considering Reviewer LMaC's comments.

During the rebuttal process, the authors have addressed more comments from the reviewers except that a theoretical analysis is still a lack.

In particular, although the Reviewer jEMa raised the score,  this work still cannot provide theoretical support.
Specifically, Reviewer jEMa concerns ``the current manuscript lacks a deeper analysis or evaluation on the transferability of the targeted fingerprints. ... However, it is unclear whether a more sophisticated adversary could forge a false claim on FIT-Print (e.g., by exploiting techniques from transferrable targeted adversarial attacks). Apart from a lack of formal proof (which is a noteworthy but understandable limitation, given the complexity of neural networks), the current adaptive evaluation is also limited (in Section 4.4, the adaptive attacker only leverages additional independent models). Hence, a more in-depth analysis or evaluation on this aspect would help make the claim more persuasive.''
The AC agrees with the point and this submission at its current status did not meet the high standard of ICLR.