# TraceGuard: Fine-Tuning Pre-Trained Model by Using Stego Images to Trace Its User
## 3 Proposed Approach
### Tracing Suspect Model  
The objective of tracing the suspect model is to ascertain which authorized user has released the suspect model with the highest probability. \(D_{t}\) refers embedded secret keys used to form stego images, which are queried. During tracing, all designated keys are checked to search for the key with the minimum extraction error rate. To calculate the extraction error rate, the \(d\)-dimension of the extracted key is converted into a \(d\)-bit string, in which the value between 0 and 1 of each dimension is converted to 0 if the value is larger than 0.5 or 1 otherwise. The extraction error rate is defined as the Hamming distance between the embedded and extracted key divided by the length of key \(L\). In addition, the threshold T is set to exclude the possibility of an independent model if the minimum extraction error rate is larger than T.  
Given the pre-trained model, we can deduce that the demanded time during tracing is linear with N and M, in which N denotes the number of user and M denotes the number of images in the query set. The dominant total time during tracing is approximated as \(N\times M\times(T_{ex-emd}+T_{ex-key})\), where \(T_{ex-emd}\) and \(T_{ex-key}\) denote, for one query, the time for extracting embedding consumed by the pre-trained model and the time for extracting the secret key consumed by the decoder in the stenography network, respectively. Since the generation of stego images that embed all secret keys into cover images is finished in advance, the time for embedding the secret keys should not be considered in the tracing phase.  
the relationship between \(L\) and \(D\) is complex. A longer \(L\) can accommodate more users but permits fewer errors for the extraction of the key. A larger \(D\) permits more errors in the extraction of the key but can accommodate fewer users. In other words, the capacity and the reliability of tracing are trade-offs. To determine the appropriate \(L\) and \(D\), this experiment is designed. The secret key \(K^{i}_{\text{em}}\) is chosen, and the pre-trained model is fingerprinted. During testing, the extraction error rate for both \(K^{i}_{\text{em}}\) and \(K^{i}_{\text{em}}:(C(K^{i}_{\text{em}},K^{i}_{\text{em}})=D)\) is calculated. The result shows that TraceGuard can trace the fingerprinted model only if \(K^{i}_{\text{em}}\) does not crosstalk with \(K^{i}_{\text{em}}\), meaning that the extraction error rate of \(K^{i}_{\text{em}}\) is less than that of \(K^{i}_{\text{em}}\). As shown in Figure 5, \(L\) varies within the range [10, 20, 30, 40, 50, 60] and \(D\) varies within the range [1, 2, 3, 4, 5]. It is found that as \(L\) increases, the extraction error rate of \(K^{i}_{\text{em}}\) also increases. The extraction error rate of \(K^{i}_{\text{em}}\) also has a broader distribution, and the influence of \(D\) diminishes. In terms of a full evaluation, \(L=30\) and \(D=4\) are chosen as the optimal option, and TraceGuard can accommodate approximately \(1.6\times 10^{7}\) authorized users. This option is maintained for all experiments. In Figure 5, FP, NFP-MIN, and NFP-MAX are used to represent the extraction error rate for \(K^{i}_{\text{em}}\), minimum extraction error rate, and maximum extraction error for \(K^{i}_{\text{em}}\), respectively. Notice that the \"Bit error rate\" in all the following figures denotes the extraction error rate.