FIT-Print: Toward False-Claim-Resistant Model Ownership Verification via Targeted Fingerprint

Summary

This paper shows that existing model fingerprinting techniques for open-source model IP are vulnerable to false claim attacks, where adversaries assert ownership of independent third-party models. The authors attribute this to untargeted methods that compare arbitrary sample outputs, and propose FIT-Print, a targeted paradigm with two black-box methods, FIT-ModelDiff and FIT-LIME. Reported results include a 100% defense success rate against false claims, a 0.0% false alarm rate on independent models, and a 100% ownership verification rate across diverse model reuse techniques.

Mitigation

FIT-Print: a targeted fingerprinting paradigm that uses optimization to turn the fingerprint into a verifiable, targeted signature, implemented via the black-box methods FIT-ModelDiff (bit-wise, using output distances) and FIT-LIME (list-wise, using feature attributions).

Related items

• InfoModel Extraction of Convolutional Neural Networks with Max-PoolingSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoTrustworthy Distributed Machine Learning in Cloud-Edge-IoT Systems: A Heterogeneity-Aware Survey of Security, Privacy, and RobustnessSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoPreventing Model Extraction in Contextual Linear OptimizationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMapSteal: Map-based Autonomous Knowledge Stealing Attack Against Large Language ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoHow to Secure AI Models in Production Environments | Endor LabsSimilar attack · Endor Labs Blog