# TraceGuard: Fine-Tuning Pre-Trained Model by Using Stego Images to Trace Its User
## 2 Related Works  
### Copyright Verification and Piracy Attribution for Suspect Model  
For copyright verification for suspect models, watermark-based methods are popular. White-box watermarks are embedded directly into a model's structure [8; 11; 12] or weights [13; 14; 15], with extraction achieved through model parameters during copyright verification. In contrast, black-box watermarks do not allow access to parameters; verification depends on specific outputs from designed input examples [9; 10; 16; 17]. Gray-box watermarks combine both methods, using white-box techniques for embedding and black-box for verification [18]. Box-free watermarking does not require a model, relying instead on extracting watermarks from images generated by the suspect model, typically used in image processing tasks [19]. For piracy attribution for suspect models, Chen et al. first introduced model fingerprinting, enabling the traceability of each deployed model [20]. Sun et al. embedded secret keys into fingerprint images, assigning each user a unique image; fine-tuning links these images to specific categories, enabling piracy tracing when the matched image produces a predefined output [21]. Yu et al. embedded secret keys in GANs, allowing owners to trace suspect GANs through images they generate [22]. Li et al. developed an adversarial text generation model for labeling and tracing generated texts [23]. Liu et al. embedded backdoor watermarks in diffusion models, allowing ownership verification even after fine-tuning [24]. Li et al. proposed a method using handcrafted filters and a directional feature learning network to trace AI-generated images, achieving effective results on both GANs and diffusion models [25]. The key information from related works has been summarized in Table 1. Different from the existing works, the objective of our work is to provide copyright protection for pre-trained models, and in particular, to trace the user of a suspect pre-trained model once an infringement is discovered.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Authors and** & **Title** & **Objective** \\ \hline Chen et al. & Deepmarks: A digital fingerprinting & Tracing user of \\ (2018) [20] & framework for deep neural networks & classification model \\ \hline Sun et al. & Protecting intellectual property of & \\ (2021) [21] & deep neural networks with an additional & Tracing user of \\  & class and stego images & classification model \\ \hline Yu et al. & Responsible disclosure of generative & Tracing the source \\ (2022) [22] & models using scalable fingerprinting & of generated images \\ \hline Li et al. & Generating traceable adversarial & Tracing the source \\ (2022) [23] & text examples by watermarking in & of generated text \\  & semantic space & \\ \hline Liu et al. & Lazy Layers to Make Fine-Tuned & Tracing ownership \\ (2024) [24] & Diffusion Models More Traceable & of diffusion models \\ \hline Li et al. & Are handcrafted filters helpful for & Tracing the source \\ (2024) [25] & attributing AI-generated images? & of generated images \\ \hline \hline \end{tabular}
\end{table}
Table 1: The literature most related to our work.