Model Fingerprinting

Embeds a covert, verifiable identifier directly into a model's weights or behavior during training. Unlike fingerprinting, which extracts a passive signature, watermarking actively modifies the model to encode ownership information. Common approaches include:

• Parameter-based: Embedding a bit string into weight matrices via regularization
• Backdoor-based: Triggering specific outputs on rare, pre-defined input patterns
• Zero-bit: Detecting the presence of a mark without decoding a message Watermarks persist through fine-tuning and pruning when robustly implemented.

Defends against attackers who attempt to steal model functionality through black-box querying. An adversary sends inputs and observes outputs to train a surrogate model that replicates the victim's decision boundary. Countermeasures include:

• Query rate limiting and per-user throttling
• Prediction API truncation: returning only top-k classes instead of full probability vectors
• Differential privacy at inference: injecting calibrated noise to degrade extraction signal
• Adversarial detection: identifying query patterns characteristic of extraction attacks Fingerprinting can later prove the surrogate model was derived from the original.

Covertly embeds a secret payload within model parameters without noticeably degrading primary task performance. Unlike watermarking, which proves ownership, steganography hides the very existence of the message. Techniques include:

• Least significant bit encoding in floating-point weight mantissas
• Trigger-set mapping: encoding data in the arrangement of specific neuron activations
• Lossless parameter substitution: replacing redundant weights with ciphertext Used to smuggle provenance metadata or licensing terms invisibly within deployed models.

Combines adversarial robustness training with architectural obfuscation to produce models resistant to both input perturbations and extraction. The dual objective:

• Gradient masking: obscuring true loss gradients to thwart gradient-based extraction
• Robust feature learning: forcing the model to rely on stable, human-aligned features This makes fingerprint extraction more difficult for attackers while preserving the legitimate owner's ability to verify model identity through controlled probing sequences.

Eliminates physical information leakage that could reveal model architecture or weights during inference. Attack vectors include:

• Timing analysis: inferring layer depth from inference latency patterns
• Power trace analysis: deducing weight values from power consumption fluctuations
• Electromagnetic emanations: capturing radio frequency signatures of computations Mitigations include constant-time execution, power trace flattening, and electromagnetic shielding. These defenses prevent attackers from extracting fingerprints or model internals through physical observation.

A cryptographic protocol that verifies the integrity and trusted state of a remote device before allowing model execution or decryption. The process:

• Device generates a signed measurement of its software stack and hardware configuration
• Remote verifier checks the measurement against a known-good baseline
• Only upon successful attestation is the decryption key or model released This ensures fingerprint verification occurs in a trusted environment, preventing attackers from spoofing identity checks on compromised hardware.