Model Fingerprinting

Unlike watermarking, fingerprinting does not modify the model's weights, architecture, or training process. It passively observes and characterizes the model in its native, unaltered state. This is critical for verifying the integrity of models that cannot be retrained or altered post-deployment, such as legacy systems or third-party black boxes.

• Zero fidelity loss; the model's performance is untouched
• No access to the training pipeline is required
• Ideal for auditing models already in production

Fingerprints are generated by probing the model's decision boundary—the complex, high-dimensional surface that separates different output classes. By analyzing how the model classifies a set of carefully crafted, near-boundary input samples, a unique characteristic vector is formed.

• Uses adversarial or boundary-adjacent examples as probes
• Captures the model's unique 'perspective' on ambiguous data
• Highly sensitive to the specific weights learned during training

This method derives a fingerprint by analyzing the statistical properties of a model's internal weights. The distribution of weights across layers, their sparsity patterns, and the correlations between filters form a unique, compact signature that is difficult to forge without exact training replication.

• Computes statistical moments (mean, variance, skewness) of layer weights
• Identifies unique sparsity patterns and neuron alignments
• Effective for white-box scenarios where internal access is granted

A robust fingerprint must survive standard model optimization techniques that do not constitute an attack. This includes quantization (reducing numerical precision) and mild fine-tuning on a similar data distribution. The fingerprint relies on high-level, stable characteristics rather than brittle, low-level details.

• Survives INT8 quantization and basic compression
• Stable across minor weight perturbations from continued training
• Distinguishes between a legitimate update and a theft attempt

A powerful fingerprinting technique that determines if a specific, private dataset was used to train a suspect model. It operates by comparing the model's confidence and margin on member vs. non-member samples. A model will typically be more confident and have a larger prediction margin on data it was trained on, revealing its provenance.

• Does not require any embedded backdoor or trigger set
• Leverages inherent overfitting signals on training data
• Acts as a membership inference attack for ownership verification

Fingerprinting is a primary defense against model extraction attacks, where an adversary queries a proprietary API to train a clone. By sending a specific set of fingerprinting queries and analyzing the clone's responses, the original owner can prove the clone was derived from their model, as it will replicate the original's unique decision-boundary quirks.

• Detects unauthorized surrogate models trained via API theft
• The clone inherits the fingerprint of the victim model
• Provides statistical proof of extraction for legal proceedings