Intellectual Property Protection for Deep Models: Pioneering Cross-Domain Fingerprinting Solutions

IEEE Transactions on Information Forensics and Security (TIFS)

Tianhua Xu¹, Sheng-hua Zhong¹, Zhi Zhang², Yan Liu²

¹Shenzhen University

²The Hong Kong Polytechnic University

Abstract

The high cost of developing high-performance deep models highlights their value as intellectual property for creators. However, it is important to consider the potential risks of theft. Although various techniques have been developed to protect the intellectual property of deep models, there is still room for improvement in terms of efficiency, comprehensiveness, and generalization. Compared with the intrusiveness of watermarking methods, fingerprinting methods do not affect the training process of the source model. Consequently, this paper proposes a fingerprinting method to address the paucity of attempts in fingerprinting methods for model protection. Our method consists of two efficient algorithms for generating fingerprinting samples, where the first one possesses the advantage of efficiency, while the second one is better in terms of robustness. The first algorithm takes a comprehensive approach to modeling the fingerprint of the deep model. The generated samples are distributed within the stable region and near the decision boundary of the model, taking into account both the duality and the conviction factors. Then, a heuristic sample perturbation algorithm is introduced, which generates a fingerprint with solid stability and generalization across multiple domains. The two algorithms proposed in this paper have been shown to be capable of withstanding attacks on intellectual property removal, detection, and evasion. They also show some advantages in terms of efficiency. In addition, the proposed method is the first to apply fingerprinting techniques in a cross-domain context.

Fig. 1. The intuition of our proposed Primary Fingerprint algorithm (left) and Evolved Fingerprint algorithm (right). Samples near the decision boundary are uncertain, while those farther away are confident. On the right side of the figure, the labels of evolved samples are set by source model, while the triangular samples represent the label changes from the primary samples.

Our contributions

l Dual-Factor Sample Mining: Mine four types of fingerprinted training samples based on duality (correct/wrong) and conviction (confident/uncertain) within minutes.

l Evolved Fingerprint Algorithm (EFA): Lightweight perturbations push samples away from the decision boundary or enhance confidence stability against attacks.

l First Cross-Domain Validation: Demonstrates out-of-the-box effectiveness across Computer Vision (CIFAR-10/100-C), NLP (THUCNews, Chinese reviews), and Brain–Computer Interface (DEAP, MAHNOB-HCI EEG) tasks.

Experimental Results

l Strong resistance to attacks: Under six types of model theft attacks (such as fine-tuning, pruning, adversarial examples, transfer learning, etc.), the fingerprint recognition accuracy maintaining better compared to others.

l Excellent cross-domain performance: Effective recognition across models, tasks, and modalities is achieved on datasets such as CIFAR10/100, THUCNews, and DEAP.

l More efficient: No need to retrain the model, fingerprint generation time is much shorter than traditional methods, making it suitable for practical deployment.

Fig. 2. Various IP protection methods are assessed for domain-adaptive attacks across four datasets. A higher value in legend indicates greater IP identification post-attack.

Fig. 3. The results of different IP protection methods regarding generation time and inference time. A smaller values in the legend indicate higher efficiency.

Conclusion

This study incorporates both uncertain and high-confidence samples into the fingerprint, balancing discriminative power and robustness. For the first time, this fingerprinting method is freed from dependence on specific domains or network architectures, achieving unified protection across CV, NLP, and BCI tasks. Experimental results show that against six types of black-box or white-box theft attacks, the matching success rate is superior to existing methods, and the fingerprint generation time is reduced by an order of magnitude.

Bibtex

@article{xu2025intellectual,

  title={Intellectual Property Protection for Deep Models: Pioneering Cross-Domain Fingerprinting Solutions},

  author={Xu, Tianhua and Zhong, Sheng-hua and Zhang, Zhi and Liu, Yan},

  journal={IEEE Transactions on Information Forensics and Security},

  year={2025},

  publisher={IEEE}

}

Downloads