Rethinking Removal Attack and Fingerprinting Defense for Model Intellectual Property Protection: A Frequency Perspective

1 Introduction

Deep Neural Networks (DNNs) have achieved great success in many real-world applications [K¨alble et al., 2024; Chen et al., 2024; Kim et al., 2024]. However, training a high-performance DNN model is very costly, typically requiring heavy investment in high-quality data, expert knowledge, computing power, and so on. As a result, these valuable models are increasingly becoming targets for thieves. Previous studies [Tang et al., 2024; Chen et al., 2023] have revealed that attackers can acquire an exact replica of the original model via model-sharing platforms, and even steal models through model extraction attacks, such as APIs querying [Carlini et al., 2024] and side-channel exploitation [Gongye et al., 2020].

Model ownership resolution (MOR) [Liu et al., 2024] is an effective method for protecting intellectual property of DNN models, which mainly includes model watermarking [Fan et al., 2019; Zhu et al., 2024] and fingerprinting [Peng et al., 2022; Pan et al., 2022] techniques. MOR enables model owners to verify and assert their ownership if the model is misappropriated, thus providing a means to resolve intellectual property disputes.

DNN watermarking methods embed an ownershiprepresenting watermark into the DNN model during training and later verify ownership by extracting the watermark from suspected models. Specifically, feature-based whitebox watermarking methods [Uchida et al., 2017; Li et al., 2022; Fan et al., 2019] embed ownership identifiers within model weights by modifying the loss function during training. In contrast, backdoor-based black-box watermarking methods [Adi et al., 2018; Leroux et al., 2024; Li et al., 2023] insert specific triggers during training, allowing the owner to verify a pirated model based on distinct model outputs. However, the model retraining process for the model watermarking is costly, and the embedded watermark may lead to a loss in model accuracy. Furthermore, while some watermarking methods have demonstrated robustness against various removal attacks, such as pruning or fine-tuning, recent studies indicate that model watermarking still faces threats from tampering and watermark overwriting [Zong et al., 2024; Wang et al., 2023].

By contrast, DNN fingerprinting methods, which have gained increasing attention for their non-intrusive nature, demonstrate model ownership by extracting unique characteristics from the existing model without modifying it. Researchers have found that the decision boundary can reflect the distinct characteristics of a model and have proposed various methods to extract fingerprints from the decision boundary, including utilizing feature points close to the decision boundary [Cao et al., 2021], or the adversarial samples [Wang and Chang, 2021; Peng et al., 2022]. They have also evaluated the robustness of fingerprinting against existing ownership removal attacks. These attacks primarily modify model weights but minimally alter the decision boundary, so it is difficult to destroy the existing model fingerprint. However, the evaluated attacks thus far were not specifically designed for DNN fingerprinting methods, and the robustness of fingerprinting methods has yet to be thoroughly assessed.

In this work, we propose a frequency-based model ownership removal attack, grounded in a key observation: after applying a Discrete Cosine Transform (DCT) to shift model weights into the frequency domain, modifying a model's high-frequency coefficients does not significantly impact its performance but does alter its decision boundary and weights. This boundary shift renders fingerprinting methods ineffective, and the weight changes prevent watermark recognition embedded within the model. We further propose a frequency-based fingerprinting technique as a defense mechanism. By extracting frequency-domain characteristics instead of decision boundary characteristics, our method effectively withstands the proposed frequency-based removal attack and demonstrates robustness against existing general removal attacks. Both the proposed attack and defense approaches are efficient, requiring only frequency transformation of the model without necessitating retraining or adversarial training.

Overall, our contributions are summarized as follows: (1) We reveal a noval attack surface for model ownership removal based on frequency analysis. The proposed attack can defeat MOR methods based on decision boundary or model weights. (2) We design a frequency-based fingerprinting defense against the proposed attack as well as general removal attacks. (3) Extensive experiments show the effectiveness of both our attack and defense.

2 Preliminaries and RelatedWork

Model Watermarking relies on embedding specific ownership indicators, such as strings or backdoor triggers, within the model. For instance, Uchida et al. [Uchida et al., 2017] pioneered a feature-based white-box watermarking algorithm that embeds ownership information in model weights by adding a regularization term to the loss function. Another category of backdoor-based black-box watermarking [Adi et al., 2018] introduces a trigger into the model, causing the pirated model to produce specific outputs for certain inputs, serving as a unique identifier. Li et al. [Li et al., 2022] used black-box and white-box watermarking to jointly detect suspicious models and enable forensics. Recent studies [Xu et al., 2024] have also explored model watermarking in complex settings, such as personalized federated learning [Zhang et al., 2025]. However, the embedding process of the watermark alters the original model weights, potentially affecting the accuracy. Some studies [Lukas et al., 2021] also show that model watermarking is vulnerable to removal attacks.

Model Fingerprinting leverages the intrinsic characteristics of a model as proof of ownership. Existing studies primarily treat the decision boundary as a unique and representative feature of models, constructing various types of adversarial examples to capture this boundary. IPGuard [Cao et al., 2021] is an efficient adversarial example method that generates data points near the decision boundary to serve as a model fingerprint. Similarly, Wang et al. [Wang and Chang, 2021] utilize the geometry characteristics inherited in the DeepFool attack to extract these data points. Peng et al. [Peng et al., 2022] discovered that the model's decision boundary can be uniquely represented by universal adversarial perturbations

(UAP). Besides, Zheng et al. [Zheng et al., 2022] introduced a weight-based fingerprinting approach rooted in the stability of the model's early layers, employing random projection to bind these weights to the owner's identity and enhance the fingerprint's non-repudiation. In this work, we demonstrate that their fingerprints cannot withstand frequency-based ownership removal attack and propose a frequency-based fingerprinting defense with greater robustness.

Discrete Cosine Transform is a reversible linear transformation that maps an input sequence of N real numbers into frequency components represented by orthogonal cosine bases. This transformation expresses the original data as a sum of cosine waves with varying frequencies and amplitudes, effectively converting it to a frequency-domain representation. The resulting coefficients are arranged by increasing frequency, where lower frequencies typically represent the primary features of the data, while higher frequencies capture details or noise. As the dimensionality of the input data increases, DCT can capture a more comprehensive set of features; however, excessive dimensionality may amplify noise, causing feature extraction bias.

Recent studies have explored applying DCT to transform DNN model weights into the frequency domain, enabling more effective poison attack detection [Wang et al., 2018; Fereidooni et al., 2024]. We take convolutional layers (e.g., a tensor containing 64×3 independent 3×3 kernels) as an example to illustrate the method of transforming model weights into the frequency domain using DCT. We apply the DCT to each kernel individually, and then combine all transformed kernels to form a frequency coefficient matrix for the layer, which retains the same dimensions as the original.

3 Frequency-based Removal Attack

3.1 Threat Model

We consider two entities: the model owner and the attacker. The model owner is responsible for training a DNN model, which they may distribute by sharing model parameters or by providing APIs. The owner's objective is to protect the intellectual property of the model through MOR techniques. Specifically, the owner can embed a watermark or extract a fingerprint in the model, allowing them to verify ownership by extracting these identifiers from suspect models if unauthorized use is detected.

The attacker's objective is to acquire a well-performing model at a relatively low cost while avoiding accountability. We assume the attacker has white-box access to the victim model and focus on the way to make watermarks or fingerprints unrecognizable. The attacker may employ various modifications to the model, such as fine-tuning and pruning, but will not generate data to train a new model from scratch due to the high computational cost involved.

3.2 Observation Explanation

OBSERVATION: After transforming model weights into a frequency domain coefficient matrix using DCT, modifying the high-frequency coefficients leads to minimal performance loss while rendering the MOR mechanisms ineffective. In contrast, altering the low-frequency coefficients significantly degrades the model's usability.

We first demonstrate the impact of modifying frequency domain coefficients of model weights on model ownership recognition and performance. In this experiment, we trained a baseline AlexNet model on the CIFAR-10 dataset, achieving an accuracy of 88.33%. Next, we transformed the convolutional layer weights of the model to the frequency domain using 1D, 2D, and 3D DCT, respectively, and divided the frequency domain coefficients sequentially into low, medium, and high-frequencies. Finally, we modified the frequency domain coefficients and tested the accuracy of the model after applying the Inverse Discrete Cosine Transform (IDCT). The experimental results are shown in Table 1 and Table 2.

As the DCT dimension increases from 1D to 3D, the impact on model performance decreases, suggesting that a higher-dimensional DCT more effectively concentrates the primary feature information in the low-frequency components, thus minimizing disruption to overall model performance when modifying high-frequency coefficients. Additionally, the experiments show a notable difference in the effect of modification values and frequency band positions on model performance: modifications to frequency domain coefficients closer to zero have minimal impact on model accuracy, and alterations in the high-frequency range result in relatively lower performance loss. These findings further confirm the structural characteristics of the DCT frequency domain, where low-frequency components typically carry the main feature information, while high-frequency components reflect finer details and noise, making them more suitable for non-destructive modification.

Next, we present the impact of modifying frequency domain coefficients on MOR. We examined various types of MOR methods, including feature-based watermarking, decision boundary-based fingerprinting (represented by adversarial samples, geometric characteristics, and UAP), and weightbased fingerprinting. As shown in Table 3, these methods exhibit a significant decrease in ownership recognition rates after modifying high-frequency coefficients of the model. This decline is due to two primary reasons: first, the highfrequency components capture the finer details of the model, which are critical to defining its decision boundaries. Altering these high-frequency components shifts the decision boundaries, rendering decision boundary-based fingerprints ineffective. Second, changes in the high-frequency coefficients introduce detailed adjustments that, upon inverse DCT transformation, are distributed across all weights, causing global alterations in model weights. This global shift in weights invalidates weight-based ownership resolution methods. In contrast, existing methods are typically effective only against local changes, such as pruning or fine-tuning.

3.3 Removal Attack Design Details

Based on the above observations, we propose a model ownership removal attack by modifying the high-frequency domain coefficients. At the beginning, the attacker obtains the original model M and sets the model's high-frequency modification ratio ratio and the high-frequency coefficient modification value V . The attack is described in Algorithm 1, using convolutional layers as an illustrative example. It mainly consists of the following steps:

Calculate the DCT coefficient of the model weight. Extract the 3D array corresponding to each convolutional kernel from the convolutional layer f(x, y, z). These 3D arrays are then transformed using 3D DCT, resulting in frequency domain coefficients F (u, v, w).

Modify the high-frequency coefficient. In the DCT, the lowfrequency components are usually located at smaller index positions, while the high-frequency components correspond to larger index positions. Therefore, for each frequency domain coefficient F(u, v,w), it can be considered as a highfrequency component when its index sum Si = ui + vi + wi exceeds the preset threshold ratio × (nu + nv + nw), where nu , nv and nw denote the number of input channels, height and width of the filter. Subsequently, all high-frequency components F(u, v,w) are set to the modified value V to obtain the new frequency domain coefficients F ′ (u, v, w).

Algorithm 1 Frequency-based Removal Attack

Input: Original model: M, Ratio of the modified highfrequency coefficients: ratio, High-frequency coefficient values after the attack: V Output: Removal model: M ′ 1: Extract the convolutional kernel f(x, y, z) from the front convolutional layer of the original model M 2: for each kernel fi(x, y, z) ∈ f(x, y, z) do 3: Fi(u, v,w) ←DCT(fi(x, y, z)) 4: F ′ i (u, v, w) ← ∅ 5: for i ∈ [0, nu × nv × nw - 1] do 6: d, h,w ← ⌊ i nv×nw ⌋ , ⌊ i nw ⌋ mod nv, i mod nw 7: if d + h + w ≥ ratio × (nu + nv + nw) then 8: F ′ i (d, h, w) ← V 9: else 10: F ′ i (d, h, w) ← Fi(d, h, w) 11: end if 12: end for 13: f ′ i (x, y, z) ← IDCT(F ′ i (u, v, w)) 14: end for 15: Replace the original kernel with f ′ (x, y, z) in the convolutional layer to form the new model M ′ 16: return M ′

Calculate model weights via inverse DCT. The modified frequency domain coefficients F ′ are converted back to their original spatial domain form through an inverse 3D IDCT transform, resulting in new convolutional kernel parameters f ′ (x, y, z).

4 Frequency-based Fingerprinting Defense

Observations in Section 3.2 indicate that the low-frequency components of model weights capture the model's primary features. Therefore, we propose extracting the model fingerprint from the low-frequency coefficients of the model weights. After training the model, the owner extracts the fingerprint and registers it with a trusted third party (TTP). In the event of an ownership dispute, the owner can extract the fingerprint from the suspect model and verify it by comparing the cosine similarity between the fingerprints of the suspect and the victim models. A high cosine similarity would suggest that the suspect model is a post-processed version of the victim model. The owner could send the above proof to the TTP to resolve ownership disputes. We assume that the model owner has white-box access to both their own model and the suspect model, or can obtain effective weight information from the suspect model through existing side-channel techniques. The proposed method comprises two main components: fingerprint extraction and ownership verification.

Fingerprint Extraction: The model owner extracts the fingerprint from their model by selecting a specific layer and applying the DCT to convert it into the frequency domain. The sum of the low and mid frequency components of these frequency-domain coefficients is then taken as the model's frequency-domain feature. The owner then binds this feature to their identity using random projection as an intermediary, forming the model fingerprint.

Ownership Verification: The TTP verifies the ownership of the suspect model. In the event of an ownership dispute, the model owner submits the frequency-domain features of the original model along with the suspect model to the TTP. The TTP first checks whether the submitted frequency-domain features match the owne's registered fingerprint. It then evaluates the similarity between the fingerprints of the suspect and original models to determine the model ownership.

4.1 Fingerprint Extraction

Before fingerprinting, the model owner trains a wellperforming model M and presets an ownership threshold T .

T is the limit for judging the similarity between the pirated model and the original model. The model owner generates the model fingerprint through three steps: frequency domain transformation, frequency domain feature extraction and fingerprint generation.

Frequency Domain Transformation. Each convolutional kernel in the model's front (usually first) convolutional layer f (x, y, z) undergoes a 3D DCT, generating the corresponding frequency domain coefficients F (u, v, w).

Frequency Component Extraction. The low and midfrequency components can be filtered based on the position of the indices. When the index sum Si = ui + vi + wi is below the preset threshold (r × (nu + nv + nw)), the corresponding components are extracted as effective components, denoted as Fe. For each convolution kernel, the components Fe are then combined to form a composite feature vector Ve. Fingerprint Generation. To generate unique random fingerprints, the extracted feature vector Ve is bound to the model owner's identity information. Specifically, a unique random Bernoulli matrix U ∈ Rt×t0 is created using a pseudorandom number generator and the model owner's identity information (e.g., ID number or company entity number). Here, t0 represents the length of the feature vector Ve, and t corresponds to the length of the final generated fingerprint f . Next, the matrix U is normalized to produce a random projection matrix P, ensuring that each column of P is a unit vector. This normalization follows the Johnson-Lindenstrauss (JL) lemma [Dasgupta and Gupta, 2003], which guarantees the preservation of relative distances between data points in the lower-dimensional space. Finally, as described in Equation 1, the DNN model's feature vector Ve is projected onto the random space defined by the matrix P, resulting in the fingerprint f. The model owner then submits the extracted fingerprint f to the TTP, which performs a timestamp verification on the submitted fingerprint to ensure its validity.

4.2 Ownership Verification

When it is necessary to verify the ownership of a suspicious model, we can follow the above steps to compute the fingerprint of that model f ′ . Subsequently, the computed fingerprints are compared with the enrolled fingerprints in the TTP database. In the comparison process, we use cosine similarity as a measure, which is calculated as follows:

In this process, the fingerprint vector f and f ′ denote the feature representations of the victim model and the suspect model, respectively. A larger value of cosine similarity indicates a higher match between the two fingerprints, thus indicating a stronger similarity between these two models. If the computed cosine similarity exceeds a preset threshold and the timestamps in the TTP database show that the original model was registered earlier than any of the suspicious models claimed to have been registered, it can be confirmed that the suspicious model belongs to the original owner.

5 Evaluation

5.1 Setup

Datasets. We evaluate our approach on four popular image classification datasets: MNIST [LeCun et al., 1998], Fashion MNIST (FMNIST) [Xiao et al., 2017], CIFAR-10 and CIFAR-100 [Krizhevsky et al., 2009].

Models. We evaluate our method in four different model architectures: CNN with two convolutional layers, a maxpooling layer, and two fully connected layers, AlexNet [Krizhevsky et al., 2012], ResNet18 [He et al., 2016], VGG16 [Simonyan and Zisserman, 2014]. We train innocent models using the same dataset or model structure as the original model, or using the same dataset and model but with different initialization conditions, and apply removal attacks to the original model to obtain pirated versions.

Baselines. To verify the effectiveness of fingerprinting defense, we evaluate it with four classes of advanced model fingerprint methods: (a) IPGuard [Cao et al., 2021] finds data points close to the decision boundaries by optimizing the objective function; (b) Deepfool [Wang and Chang, 2021] uses geometric properties to find the minimum perturbation, so that the input point crosses the decision boundary; (c) FUAP [Peng et al., 2022] represents decision boundary by universal adversarial perturbations; (d) Zheng et al's method [Zheng et al., 2022] uses the weights of the model's front convolutional layers as a fingerprint.

Removal Attacks. We consider following model ownership removal attacks: (a) Weight Pruning (WP): Prune the least important p percent of weights in the target model, beginning at 0.4 and increasing in increments of 0.1; (b) Filter Pruning (FP): Prune the least significant q percent of weights in the target model, starting at 1/16 and increasing in increments of 1/16; (c) Fine-tuning-retrain (Retrain): All the parameters of the target model are updated using the training data with a smaller learning rate and the model is trained for 20 epochs; (d) Fine-tuning-transfer (Transfer): All the parameters of the target model are updated using a different dataset and the model is trained for 20 epochs; (e) Frequency-based Removal: the 1/3 highest frequency coefficients of the model weights modified to V using the proposed attack.

5.2 Result

Robustness. We evaluated the robustness of our scheme against various attacks under different settings and compared it with baseline approaches. As shown in Table 4, our scheme maintains a model accuracy between 85.6% and 89.34% when facing different types of removal attacks, and the fingerprint recognition rates almost 100% are still maintained. Additionally, both our fingerprinting method and baselines effectively resist existing removal attacks. However, when encountering the frequency-based removal attack, the fingerprint recognition rates of IPGuard, DeepFool, and UAPS drop significantly. Due to the use of low-frequency features as fingerprints in our scheme, modifications to high-frequency coefficients do not impact fingerprint effectiveness. In contrast, we observed that the fingerprint recognition rate of the baselines decreases as the degree of high-frequency coefficient modifications increases. This occurs because most highfrequency coefficients are initially zero, and as the modification values deviate further from zero, the model weights and decision boundaries shift more, leading to a marked decline in the baselines' fingerprint recognition rates.

Table 5 and Table 6 present the accuracy and fingerprint recognition rates of our method across different models and datasets. The results show that under all attack scenarios, our method consistently achieves a similarity of over 97%. Specifically, in the FP attack scenario, even with the removal of some convolutional kernels leading to partial loss of fingerprint information, our method still maintains a fingerprint recognition rate between 97.72% and 99.62%. This indicates that FP operations on model weights do not invalidate our frequency-based fingerprints, even with some kernel information lost, the remaining fingerprint provides sufficient recognition accuracy. Additionally, we observe that as model complexity increases, the variations in model performance and fingerprint similarity under the same attack conditions decrease. This can be attributed to differences in model structural complexity. Larger models typically exhibit higher parameter redundancy, meaning that the percentage of effective parameters is relatively low. Due to the presence of redundant parameters, the impact of attacks on model performance becomes more distributed, allowing key model features and fingerprint similarity to remain more stable under attack.

Table 7 illustrates the relationship between the range of frequency-domain features extracted for fingerprints and the fingerprint recognition rate. In our experiments, we selected frequency-domain coefficients from low to high, ranging from one-third up to all available coefficients, to generate the model fingerprint. The results show that as the proportion of selected frequency-domain coefficients (r) increases, the overall similarity of the fingerprint also rises when facing pruning and fine-tuning attacks. This indicates that including more frequency-domain coefficients enhances fingerprint stability and improves resistance to such attacks. However, when encountering frequency-domain attacks targeting highfrequency coefficients, the fingerprint similarity drops significantly. Therefore, to achieve an optimal trade-off under various removal attacks, we recommend selecting up to twothirds of the frequency-domain coefficients, focusing on low and mid-frequency coefficients, for fingerprint extraction.

Adaptive attack. We simulated an adaptive attack scenario in which an attacker, aware of our fingerprinting method, attempts to make our frequency-based fingerprints unrecognizable by altering the model's frequency-domain coefficients. Figure 2 presents the effects on model accuracy and fingerprint recognition rate when the attacker randomly selects modification locations and alters the frequencydomain coefficients to random values at various modification rates. The results indicate that this adaptive attack leads to a significant decline in model accuracy, rendering the model unusable. For example, to reduce the fingerprint recognition rate below 50%, the attacker would need to modify 40% of the frequency-domain coefficients, resulting in a model accuracy drop to 31.69%.

Uniqueness. Even models trained with the same dataset and architecture exhibit low similarity due to the non-convex nature of the neural network loss function, where different initializations lead to distinct local minima. Thus, models trained independently on the same data should be considered distinct. In Table 8, we compare the fingerprint similarity (FS) of models trained independently on the same dataset or with identical architectures. The results show generally low similarity, well below the threshold for detecting pirated models, indicating a very low false-positive rate.

Efficiency. Table 9 presents the time usage for model fingerprint extraction and verification. Compared to other decision-boundary-based fingerprinting methods, our approach and that of Zheng et al. [Zheng et al., 2022] are highly efficient, requiring only a few seconds of computation. This efficiency comes from the fact that decision boundary-based fingerprinting methods require adversarial sample training, which incurs a substantial computational cost. Zheng et al.'s method requires only model weight extraction, resulting in minimal computation overhead. However, it demonstrates weaker robustness against frequency-domain removal attacks. In contrast, our method involves converting the model to the frequency-domain for extraction, introducing additional DCT computation costs. Additionally, Table 9 demonstrates the efficiency of the proposed attack methods, indicating that the computational costs of our removal attacks and fingerprinting defenses are essentially negligible.

6 Conclusion

In this work, we propose a frequency-based model ownership removal attack, which changes the decision boundary and model weight by modifying the high-frequency coefficients, making traditional watermarking and fingerprinting methods ineffective with minimal impact on model accuracy. Additionally, we propose a robust defense mechanism based on frequency-domain fingerprinting, which withstands the proposed frequency-based attack and shows resilience against other general removal attacks. Experimental results validate the efficacy of our attack in erasing ownership indicators while maintaining model performance and demonstrate the robustness of our fingerprinting defense. Our method relies on frequency domain conversion, applicable to models with structured weights like CNN, ResNet, and LSTM. Its applicability to architectures with less spatial or sequential structure is limited. Extending our approach to support these models will be future work.

Acknowledgements

We would like to heartfeltly thank the anonymous reviewers for their constructive comments. This work is supported in part by the National Natural Science Foundation of China (No. 62272154, 62472163), the Hunan Provincial Natural Science Foundation of China (No. 2024JJ5096), the science and technology innovation Program of Hunan Province (No. 2023RC3125), the Science & Technology talents lifting project of Hunan Province (No. 2023TJ-N23), the Training Program for Excellent Young Innovators of Changsha (No. kq2209008), the Hunan Provincial Department of Education Excellent Youth Project (No. 24B0039), and the Hunan Provincial Innovation Foundation for Postgraduate (No. CX20230389). Yang Xu is the corresponding author.