Title: Boosting the Uniqueness of Neural Networks Fingerprints with Informative Triggers
Venue: NeurIPS 2025
Accepted: yes
Keywords: Deep Neural Networks

Uniqueness

Fingerprints

Copyright Tracing
Abstract: One prerequisite for secure and reliable artificial intelligence services is tracing the copyright of backend deep neural networks. 
In the black-box scenario, the copyright of deep neural networks can be traced by their fingerprints, i.e., their outputs on a series of fingerprinting triggers. 
The performance of deep neural network fingerprints is usually evaluated in robustness, leaving the accuracy of copyright tracing among a large number of models with a limited number of triggers intractable. 
This fact challenges the application of deep neural network fingerprints as the cost of queries is becoming a bottleneck. This paper studies the performance of deep neural network fingerprints from an information theoretical perspective. 
With this new perspective, we demonstrate that copyright tracing can be more accurate and efficient by using triggers with the largest marginal mutual information. Extensive experiments demonstrate that our method can be seamlessly incorporated into any existing fingerprinting scheme to facilitate the copyright tracing of deep neural networks.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents an innovative view of black-box DNN fingerprinting schemes using information theory. The authors explore the uniqueness property of DNN fingerprinting methods and provide a theoretical analysis of the contribution of each trigger to copyright tracing. Furthermore, this paper proposes a greedy algorithm to select triggers for efficient copyright tracing. Empirical results show that the proposed trigger selection method provides a better uniqueness rate compared to existing fingerprinting methods.\n\nSTRENGTHS AND WEAKNESSES:\nThis paper has the following strengths:\n+ The authors explore uniqueness, an important property of DNN fingerprinting methods that is less frequently studied. This property is particularly important to large-scale model distributions.   \n+ The authors provide a theoretical quantification of the contribution of each trigger using mutual information, and also derive the necessary condition on the number of triggers to ensure the uniqueness rate. \n+ The authors develop a greedy algorithm that optimizes the collection of triggers using conditional mutual information. Empirical results show that the proposed greedy selection algorithm outperforms existing DNN fingerprinting schemes in terms of model tracing efficiency and uniqueness.  \n\nThis paper has the following weakness:\n- The authors did not provide sufficient discussion about prior works that study the uniqueness of DNN fingerprinting. For example, the paper DeepMarks has leveraged Balanced Incomplete Block Design (BIBD) to design anti-collusion codebooks to ensure the uniqueness of each fingerprint.\n\nQUESTIONS:\nPlease consider addressing the weak points above.\n\nLIMITATIONS:\nThis paper does not provide sufficient discussion of existing DNN fingerprinting methods, especially the ones that explored the uniqueness of model fingerprints. The authors should expand this discussion and clarify the contribution of this work compared to the previous ones.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-06-15"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses a challenge in deep neural network (DNN) copyright tracing: enhancing the uniqueness of fingerprints generated from limited fingerprinting triggers. While prior work largely focuses on robustness, this work emphasizes the importance of uniqueness, especially in scenarios where the number of triggers must be kept small due to practical constraints such as query cost. Additionally, the paper presents a necessary condition for the minimum number of triggers required to reliably identify models. Overall, the work contributes a novel information-theoretic perspective and optimization strategy for boosting the robustness and discrimination power of DNN fingerprints.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1. This work addresses a timely and relevant challenge—making DNN fingerprints more discriminative and resource-efficient, which could influence future research and applications in model ownership verification.\n\n2. The extensive experimental results validate the proposed approach across multiple datasets and fingerprinting schemes. The improvements in both the uniqueness and efficiency of the fingerprinting process suggest that the method is practically valuable for copyright tracing.\n\n3. The paper clearly articulates the problem of uniqueness in DNN fingerprinting and why previous work’s emphasis on robustness alone is insufficient.\n\nWeaknesses:\n\n1. While the experimental results are comprehensive, they primarily focus on classification tasks with standard datasets. The applicability of the approach to more complex, real-world scenarios such as models trained on proprietary datasets or in adversarial environments remains to be explored.\n\n2. The paper does not extensively discuss potential computational overheads associated with estimating mutual information for large-scale models or triggers, which could impact real-world deployment.\n\n3. Although the information-theoretic approach is well-motivated, the paper would benefit from a more detailed discussion on how the method integrates into existing fingerprinting frameworks and its robustness against potential adversarial attacks aimed at circumventing the fingerprint.\n\n4. The theoretical analysis assumes that adversarial modifications are independent and random from a distribution, which might be simplified compared to realistic adaptive attackers that could target specific triggers. This potentially weakens the applicability of theoretical guarantees.\n\nQUESTIONS:\n1. The proposed mutual information-based trigger selection involves estimating conditional mutual information, which can be computationally intensive, especially for large models and numerous triggers. Could you provide more detailed analysis or empirical measurements of the computational costs involved?\n\n2. While the method optimizes trigger selection based on information contribution, how does it perform under potential adversarial scenarios where attackers might attempt to modify or remove triggers (by some watermark removal techniques) ?\n\n3. The experiments primarily focus on classification tasks with standard datasets. Can the approach generalize to more complex scenarios, such as models for object detection, segmentation, or models trained on proprietary, domain-specific data?\n\n4. How easily can your trigger selection framework be integrated into existing fingerprinting schemes, especially those that do not rely explicitly on carefully designed triggers?\n\nLIMITATIONS:\nNo. In the Checklist, the authors state that \"The limitations are discussed in conclusions\". But I don't find any relevant content in conclusions.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-26"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper focuses on improving the efficiency of fingerprint sequence selection by choosing samples with the highest marginal mutual information based on information theory. The author provides sufficient theoretical and experimental justification for this selection strategy.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n1.\tThe paper has sufficient theoretic analysis to support its claims\n2.\tThe experiments empirically evaluate the statements and are consistent with the results of theoretic analysis\n3.\tThis author has provided detailed results to validate the generalizability of such fingerprint triggers selection method.\n4.\tThe paper is well-written and easy to understand for both the theoretic and experimental parts.\n\nWeaknesses\n1.\tThe author said “the verifier assumes that the adversary has sacrificed the victim model’s performance”, which seems to be one-sided and subjective since the adversary may use the victim model as a base model (if the adversary could access the original victim model in a white-box manner) and fine-tuning it on themselves data thereby further improving the victim model’s performance. \n2.\tIn Sec 3.1, the author assumes “the suspicious model F is equally likely to be any registered model”. I understand this assumption is durable when there is no any prior knowledge on the suspicious model. However, practically, this assumption is hard to hold as the suspicious model is bound to be more likely to be the models that are corresponding-original-victim-model-like(e.g. models with same architecture, similar training data and method).\n3.\tIn Line 131, what the meaning of “so is the fingerprint of the suspicious model”? it seems to be a typo.\n\nOverall, this paper is well-motivated and the presentation is good. I’d like to see it at NIPS 2025. \nBy the way, I have reviewed this paper last year, and I believe the current version has addressed most of my previous concerns. Hence, I have changed my stance to a positive one and am happy to support its acceptance. Moreover, to further improve the quality of the paper, I also recommend the authors carefully consider the issues I raised.\n\nQUESTIONS:\nSee weaknesses above.\n\nLIMITATIONS:\nSee weaknesses above.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-27"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper explores an information-theoretic approach to enhance the uniqueness of deep neural network (DNN) fingerprints for copyright tracing. The authors propose selecting fingerprinting triggers by maximizing conditional mutual information, aiming to improve the uniqueness rate of fingerprints. Experiments on datasets including MNIST, FashionMNIST, CIFAR-10, and ImageNet validate the proposed approach.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n+ The theoretical analysis leveraging information theory is solid, and the greedy trigger-selection algorithm is clear and well-justified.\n+ The paper is generally well-structured, with clear explanations and systematic presentation of concepts and experiments.\n+ Using information theory for optimizing fingerprints has some novelty, although similar ideas about optimizing robustness have been explored before.\n\nWeaknesses\n- Limited Realism in Experimental Setting: The experiments primarily utilize simpler, smaller-scale datasets like MNIST, FashionMNIST, and CIFAR-10. Although ImageNet is included, experiments on more complex and realistic scenarios remain limited.\n\n- Insufficient Comparison with State-of-the-Art: While several existing fingerprinting methods are listed, the paper lacks comprehensive comparative experiments against these methods, notably missing direct experimental comparisons to established state-of-the-art methods such as MetaFinger or Intrinsic Examples.\n\n- Lack of Accuracy-Cost Analysis: The paper does not explicitly analyze or quantify the cost associated with accuracy degradation due to fingerprinting, an essential consideration for practical deployment.\n\n- Incomplete Coverage of Relevant Literature: Important related works such as \"Characteristic Examples: High-robustness, Low-transferability Fingerprinting of Neural Networks\" (Wang et al., IJCAI 2021) and \"An Overview of Trustworthy AI\" (Zheng et al., IEEE 2024) were not sufficiently considered or compared against in the paper. Specifically, the concept of \"Low-transferability\" discussed in Wang et al. (2021) closely aligns with the notion of \"uniqueness\" explored in this paper, yet the comparison is absent.\n\nQUESTIONS:\n1. How does the fingerprinting method affect model accuracy, and can you provide a quantifiable cost-benefit analysis?\n\n2. Why were comprehensive comparisons with state-of-the-art fingerprinting methods (such as MetaFinger or Characteristic Examples) not included experimentally?\n\n3. How do you anticipate your method scaling to more complex, large-scale real-world datasets and models?\n\nLIMITATIONS:\nNo. The authors have not adequately addressed the potential negative societal impacts or thoroughly discussed limitations beyond adversarial robustness.\n\nSuggestions for improvement:\n1. Explicitly discuss any potential negative impacts, such as misuse or unintended consequences related to model fingerprinting and intellectual property tracing.\n\n2. Provide a deeper exploration of the broader ethical implications of deploying this technology in practical settings.\n\n3. Clearly outline the limitations associated with scalability, robustness in diverse real-world conditions, and potential accuracy degradation due to fingerprinting.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-03"}