Misclassification-driven Fingerprinting for DNNs Using Frequency-aware GANs

1 Introduction

In recent years, DNNs have been successfully applied to a wide range of tasks, including image classification [Zhu et al., 2024], image generation [Huang et al., 2024], and object recognition [Yuan et al., 2024]. However, high-performing DNNs typically rely on substantial amounts of high-quality data, computational resources, and expert knowledge, which makes them critical and valuable assets. Malicious attackers can exploit various stealing strategies, such as transfer learning [Zhuang et al., 2021], to illicitly acquire these models (referred to as source models) for personal or financial gain. To protect the IP of the model owners, model IP protection technologies have been developed to enhance the trustworthiness of models.

∗Corresponding author

Current IP protection methods can be broadly classified into watermarking and fingerprinting techniques [Sun et al., 2023]. Watermarking techniques involve embedding watermark information into the source model through training or fine-tuning. However, they often face significant challenges to achieve a balance between the robustness of the watermark and the precision of the model [Jia et al., 2021]. Unlike watermarking techniques, fingerprinting techniques extract unique properties of a model as its "fingerprint", enabling the differentiation of models based on the characters of the extracted fingerprint.

Recent advances have focused on extracting fingerprints from discrepancies in decision areas between a source model and irrelevant models [Yang et al., 2022a; Lukas et al., 2019]. However, these approaches require training a large number of post-processed versions of the source model and irrelevant models (commonly referred to as surrogate models), and the number of fingerprints that can be extracted is limited. Furthermore, some methods generate fingerprints near decision boundaries [Liu and Zhong, 2024; Yang and Lai, 2023], but the quality of these fingerprints is often difficult to ensure. Therefore, current fingerprinting techniques remain in their early stages and cannot meet the diverse requirements of practical applications, such as efficiency, imperceptibility, and robustness.

To address the issues discussed above, we propose a fingerprint generation method based on generative adversarial networks (GANs). This approach generates fingerprints by applying frequency-domain perturbations to the defender's datasets, effectively resisting IP threats while ensuring high imperceptibility. The core idea of our method stems from the observation that introducing perturbations in the frequency domain can change the representation of an image and subsequently influence the classifier's decision-making process, but without producing a noticeable change in the image that can be observed. Building on this insight, we utilize a frequency-aware GAN to generate perturbations that induce the misclassification of normal samples, which can effectively serve as fingerprints to verify the model ownership.

Our main contributions are summarized as follows.

1. We propose using the generated misclassified samples as fingerprints, addressing the scarcity of misclassified samples, and avoiding unnecessary model training overhead.

1. We propose to generate fingerprints by applying frequency-domain perturbations on the original dataset, and those perturbations can change the representation and subsequently influence the classifier's decision for the image, but without producing a noticeable change that can be observed. Thus, this approach effectively improves the robustness of fingerprints while maintaining strong imperceptibility. This is the first fingerprinting model protection method based on the frequency domain.
2. Extensive experiments demonstrate the robustness of our method against IP threats. Specifically, our method achieves an SOTA AUC of 0.98 in the complex TinyImageNet dataset under IP removal attacks, exceeding current methods by 8%, and consistently achieves the best ABP in three types of IP detection and erasure attacks on the GTSRB dataset.

2 RelatedWork

In this section, we first briefly review the existing literature on model IP protection methods, which can be broadly categorized as watermarking and fingerprinting [Sun et al., 2023]. Next, we review frequency-based GAN for different applications.

2.1 Deep IP Protection

Inspired by digital image copyright protection techniques, watermarking and fingerprinting are the main methods for deep model IP protection [Sun et al., 2023].

Model Watermarking

Watermarking embeds unique identification information into DNNs via fine-tuning or retraining. Parameter-based watermarking is a white-box approach that embeds watermarks in the DNN original components using a regularizer as proposed by [Uchida et al., 2017]. Parameter-based verification necessitates full local access to the model. Label-based watermarking is a black-box method that embeds watermarks by finetuning or retraining the source model on trigger sets, creating a backdoor that enables verification through model predictions alone. Some methods [Sun et al., 2021; Adi et al., 2018; Zhang et al., 2018; Lao et al., 2022] used specific samples from the original training set as the trigger set, while others attached trigger patterns to natural images [Zhang et al., 2018; Guo and Potkonjak, 2018], and yet others synthesized trigger sets through generation [Li et al., 2019] or gradient optimization techniques [Le Merrer et al., 2020; Li et al., 2022]. However, recent studies [Jia et al., 2021] suggested that watermarking can potentially compromise the accuracy of the model due to its impact on the training process.

Model Fingerprinting

Fingerprinting is a non-invasive method that extracts model representations to compare the similarities between different DNNs. Techniques such as IPGuard [Cao et al., 2021] and DFA [Wang and Chang, 2021] focused on extracting fingerprint samples near the decision boundary of the source model. This is based on the idea that a DNN classifier's unique traits lie within this boundary. However, these methods are vulnerable to model extraction attacks that modify the boundary. CAE [Lukas et al., 2019] proposed extracting conferrable adversarial samples that are transferable only to stolen models and not to independently trained irrelevant models. This approach effectively enhanced robustness against model extraction attacks, but required significant training overhead. Despite these advancements, transfer learning remains a challenge. ModelDiff [Li et al., 2021] proposed using the cosine similarity of the decision distance vectors (DDVs) between models on the same inputs to detect transfer learning and model compression attacks. However, it struggled with model extraction detection. Zest [Jia et al., 2022] addressed this shortcoming by using the Local Interpretable Model-Agnostic Explanations (LIME) algorithm [Ribeiro et al., 2016] to generate linear models that approximate local behavior, thus forming a global approximation. By comparing the cosine distances of the linear models' weights, Zest more accurately captured model similarities than direct prediction comparisons. Furthermore, SAC [Guan et al., 2022] introduced a metric to assess the correlation of pairwise samples within the model to defend against adversarial training. In order to mitigate the impact of accuracy degradation, we propose a fingerprinting framework and design a method that avoids the dependence on a significant amount of additional model training. This approach can also effectively resist transfer learning and adversarial training.

2.2 Frequency-Based Generative Adversarial Networks

GANs have demonstrated considerable success in various computer vision tasks, such as quality enhancement [Zhang et al., 2019], image inpainting [Yu et al., 2021], few-shot image generation [Yang et al., 2022b] and image reconstruction [Jiang et al., 2021]. However, studies [Schwarz et al., 2021] have shown that GANs exhibit a spectral bias in the fitting of frequency signals, often failing to capture highfrequency details, which can result in blur and noticeable artifacts. To address this issue, several methods have been developed to incorporate frequency information into GANs. For example, SSD-GAN [Chen et al., 2021] addressed spectral information loss by incorporating a frequency-aware classifier into the discriminator, guiding the generator to learn highfrequency content and improve detail generation. Zhang et al. proposed a super-resolution reconstruction algorithm [Zhang et al., 2019] that combined wavelet transform with GANs to enrich high-frequency details in low-resolution images by predicting wavelet coefficients. Furthermore, Huang et al. applied this technique to face hallucination, capturing rich contextual information from low-resolution face images captured in the wild [Huang et al., 2019]. Their method achieved better PSNR and SSIM while significantly improving the accuracy of the identification. Jiang et al. introduced a focal frequency loss that improved image reconstruction by adaptively focusing on hard-to-synthesize frequencies [Jiang et al., 2021], complementing spatial losses. Meanwhile, WaveFill et al. enhanced image inpainting by filling corrupted areas with decomposed frequency components [Yu et al., 2021]. Additionally, Yang et al. introducedWaveGAN [Yang et al., 2022b], a frequency-aware model for the generation of few-shot images, which employed low-frequency skip connections to preserve outline and structural information, and high-frequency skip connections to enhance fine detail synthesis. The success of these methods lies in the fact that images consist of frequency components with different physical meanings and information. The presented methods demonstrate that frequency domain-based adversarial generation can achieve favorable generation results in a variety of tasks. However, related exploration in the domain of model protection is limited. Only Liu et al.'s approach [Liu et al., 2024] has discussed the impact of different frequency bands on model protection, arguing that embedding information in mid-low frequency bands strikes a balance between watermark robustness and imperceptibility. However, the potential of frequency-aware techniques for modifying the image representation to obtain fingerprints for the model protection task has remained underexplored. In this paper, we propose a frequency-aware GAN to generate adversarially perturbed fingerprint samples that induce misclassifications, which exhibit strong robustness for model protection and high imperceptibility.

3 ProposedMethod

3.1 ProblemDefinition

This study considers the scenario in which a legitimate developer (defender) invests considerable resources in training a high-performance DNN model, referred to as the source model MD. The model is typically deployed as a paid service through cloud platforms or client software for user access. However, malicious attackers can use various methods to steal MD and create stolen versions MA for unauthorized use or resale. To protect the IP of their model, defenders often use fingerprinting or watermarking techniques to verify if a suspect modelMsuspect is stolen.

The general pipeline of the proposed Deep IP Fingerprinting Protection model, as illustrated in Figure 1, consists of two stages: fingerprint construction and fingerprint verification. We will describe these two stages as follows.

3.2 Fingerprint Construction

Existing research emphasizes the role of misclassified samples in improving adversarial robustness of a model [Wang et al., 2020]. Inspired by this, we propose using misclassified samples and their predicted labels from the source model as a unique fingerprint for model IP protection. For highperformance classifiers, the limited number of misclassified samples is insufficient for IP verification. To address this limitation, we propose a GAN-based method to produce the misclassified samples. Such an approach allows us to generate an unconstrained number of misclassified samples and is more flexible for model protection.

Misclassified Samples

Given the source model MD and a training dataset D = {(xi, yi)}ni=1 , we divide D according to the predictions of hθ into two subsets: one containing correctly classified samples and the other containing misclassified samples, as shown in Eq. (1) and (2):

For each misclassified sample xi ∈ S-MD , xi and its prediction MD(xi) can be recorded as the unique fingerprint of the model for subsequent verification. However, for highperformance classifiers, the limited number of misclassified samples is insufficient to enable effective IP verification. To overcome this limitation, we adopt a GAN-based approach to augment the fingerprint set Df by generating misclassified samples.

We design a GAN framework where the generator G generates adversarial perturbations ϵ, which, when added to the original training sample xclean (clean samples), form xmis and induce misclassifications in the source model. Meanwhile, the discriminator D is designed to distinguish between xclean and xmis. Notably, for a given input sample, the generator is capable of generating diverse perturbations that result in misclassification, thereby enabling the creation of a virtually unlimited Df .

Frequency-Aware Generative Adversarial Network

According to research [Liu et al., 2024], as a watermarking method, perturbations in the frequency domain of clean samples are effective in generating trigger samples. But the watermarking method embeds unique identifiers in the model which may affect the performance or fidelity of the model. In contrast, model fingerprinting is a non-invasive technique. By avoiding model modifications, fingerprinting maintains optimal fidelity and reliability. However, there is no fingerprinting model protection method based on the frequency domain.

The idea of our method comes from the observation that introducing perturbations in the frequency domain can change the representation of an image, thereby affecting the classifier's decision, but without producing a noticeable change in the image that can be observed. Building on these insights, we propose a Frequency-Aware GAN to generate frequencydomain perturbations that induce misclassifications in the source model.

Wavelet Transform Generator: Inspired by [Fu et al., 2021], we use a Discrete Wavelet Transform (DWT) branch as the foundation of our frequency-aware generator and modify its loss function, where the generator loss LG consists of adversarial loss Ladv and misclassification loss Lmis:

The adversarial loss ensures that the perturbed sample xpert = xclean + ϵ deceives the discriminator D, thus producing realistic adversarial samples.

The misclassification loss maximizes the predictive divergence between the clean images from the real data distribution pdata and their perturbed counterparts on the source model.

Here, ϕ represents the soft output of MD , and CE denotes the cross-entropy loss function.

Fourier Spectrum Discriminator: To enhance the discriminator's ability to distinguish perturbed images, we leverage the discriminator architecture proposed in [Chen et al., 2021]. The Fourier spectrum discriminator focuses on analyzing frequency-domain features, enabling more robust differentiation by capturing fine-grained spectral variations. The discriminator's loss function is formulated as:

D is a discriminator consisting of a spatial discriminator Dsp, which measures spatial realness, and a spectral discriminator Dspec, which measures spectral realness. The overall realness of a sample x is represented as:

where λ is a hyperparameter that controls the relative importance of spatial realness and spectral realness.

3.3 Fingerprint Verification

For a suspect model Msuspect, (referred to as query samples) in Df . Let M be the number of query samples with predicted labels that match those of MD. The matching rate is M/N. If the matching rate exceeds or equals a predefined threshold T ∈ [0, 1], the model is considered stolen.

4 Experiments and Results

In this section, we first introduce the various IP threats that our approach aims to address. Next, we provide a detailed description of the experiments. Finally, we compare the experimental results of our method with existing baselines to demonstrate its effectiveness in defending against the aforementioned attacks.

4.1 IP Threats

IP Removal Attack

The attacker removes or forges IP identifiers in the source model to hinder ownership verification while minimizing performance degradation.

• Probability-based Model Extraction (MEP) [Jagielski et al., 2020]: A black-box attack where the attacker queries the source model for probabilistic outputs to train a copy version.
• Label-based Model Extraction (MEL) [Jagielski et al., 2020]: A black-box attack where the attacker queries the source model for hard labels to train a copy version.
• Adversarial Model Extraction (MEA) [Guan et al., 2022]: A black-box attack where the attacker applies adversarial training to the label-based extraction model.
• Weight Pruning (WP) [Blalock et al., 2020]: A whitebox attack where the attacker prunes neurons based on their weight to simplify the model.
• Model Fine-tuning (FT) [Uchida et al., 2017]: The attacker fine-tunes (FT) or retrains (RT) the final layer or the entire model to create a stolen version.
• Transfer Learning (TL) [Zhuang et al., 2021]: The attacker transfers knowledge from source model to a related task by retraining.

IP Detection and Erasure Attack

The defender uploads query samples to the attacker's model prediction API for verification, while the attacker actively disrupts the verification process.

• Query Modification [Namba and Sakuma, 2019]: The attacker trains an autoencoder to reconstruct query samples, erasing embedded information.

• Input Smoothing [Xu et al., 2018]: The attacker applies smoothing techniques to reduce adversarial perturbations.
• Feature Squeezing [Xu et al., 2018]: Reduces the pixel color bit depth to minimize the detection of adversarial perturbations.

4.2 Experiment Setup

Datasets and Model Architectures

For better comparison with other works, we adopt the datasplit method and model architectures used in [Guan et al., 2022]. To validate the effectiveness and robustness of our method, we conduct experiments on CIFAR-10, GTSRB, and Tiny-ImageNet. The training dataset is split into two parts: DDefender for the defender and DAttacker for the attacker, simulating model IP attack defense scenarios.

• CIFAR-10: consists of 60K 32 × 32 color images in 10 distinct classes, with a training set of 50K images and a test set of 10K images.
• GTSRB: contains over 50K images of German traffic signs in 43 classes, with 39K images for training and 12K images for test. The images are resized to 32 × 32 pixels for evaluation.
• Tiny-ImageNet: contains 110K 64 × 64 images of 200 different object classes, with 100K images for training and 10K images for test.

Similar to the settings in [Guan et al., 2022; Lukas et al., 2019; Cao et al., 2021], we select the commonly used model VGG16 as the source model; VGG13, ResNet18, DenseNet121, MobileNetV2 as irrelevant models. For each setting, we train five models under each stealing attack and average the results across these models to mitigate the impact of randomness.

Comparison Approaches and Evaluation Metrics

We compare our proposed method with nine state-of-the-art fingerprint protection schemes: IPGuard [Cao et al., 2021], ModelDiff [Li et al., 2021], DI [Maini et al., 2021], SACw [Guan et al., 2022], SAC-m [Guan et al., 2022], Zest [Jia et al., 2022], IBSF [Bai et al., 2024], MarginFinger [Liu and Zhong, 2024], and MetaFinger [Yang et al., 2022a].

Based on previous research, we choose AUC (Area Under the Curve) as the metric to evaluate model protection methods. The AUC value ranges from 0 to 1, with higher values indicating a stronger ability to distinguish between stolen models and irrelevant models.

4.3 Robustness Against Model IP Removal Attack

As illustrated in Table 1, we evaluate our method on CIFAR10, GTSRB, and Tiny-ImageNet. The experimental results demonstrate that our method is highly robust against the aforementioned stealing techniques, achieving the highest or second highest AUC values. In particular, in the complex classification task on the Tiny-ImageNet dataset, the average AUC of our method reaches 0.98, significantly outperforming other compared methods. This can be attributed to the fact that in complex datasets, the classification boundaries between models vary greatly. The stolen model's classification boundary is typically closer to the source model than to irrelevant models, leading to similar classification results on misclassified samples. In contrast, for simple datasets, such as GTSRB, the classification boundaries of the source and irrelevant models are also similar, thereby limiting the influence of misclassified samples.

MarginFinger exhibits the greatest performance in CIFAR10 and ranks second on GTSRB and Tiny-ImageNet. This is because MarginFinger generates fingerprints by controlling the distance between the fingerprint and the classification boundary, effectively differentiating the classification results of the source and stolen models from those of irrelevant models. However, its performance declines for more complex tasks, as the GAN in MarginFinger is trained on the defender's dataset. Complex and small-scale datasets lead to insufficient GAN training, preventing it from effectively controlling the distance of the generated fingerprint relative to the classification boundary. In contrast, although our method is also trained on the defender dataset, it only requires GAN to generate perturbations on samples that can trigger misclassifications of the classifier. This simplicity allows us to maintain a strong fingerprint protection ability even in complex tasks. SAC-m performs well overall; however, its reliance on the correlation matrix of predicted labels between fingerprint samples makes it vulnerable to model extraction attacks that affect classification boundaries. Even a single alteration of the label of a fingerprint sample can significantly disrupt the correlation matrix, weakening its ability to resist model extraction attacks.

4.4 Robustness Against Model IP Detection and Evasion Attack

As shown in Figure 2, we discuss the robustness of different methods on three datasets (CIFAR-10, GTSRB, and Tiny-ImageNet) under three IP detection and erasure attacks. We assume that the attacker, being aware of the process described in Section 3.3, employs IP detection and erasure attacks to corrupt query samples, preventing the model owner from collecting evidence. Therefore, it is essential to ensure the high quality and imperceptibility of the query samples. For each method, we first evaluate the AUC values under six IP removal attacks using unmodified query samples (normal). These six AUC values serve as the vertices of a polygon to construct a radar chart. Subsequently, we apply three types of IP detection and erasure attacks on the query samples and recalculated the AUC values under the six IP removal attacks. The area bounded by the polygon (ABP) is used to compare the performance of different methods against IP detection and erasure attacks. A higher ABP value indicates stronger robustness.

In the CIFAR-10 dataset, SAC-w, Zest, and MarginFinger exhibit strong robustness, while our method performs moderately with an ABP of approximately 2. In contrast, IPGuard and ModelDiff show weaker performance, scoring below 1.5. In the GTSRB dataset, where all methods generally score below 1.3, our method consistently outperforms others in ABP and achieves SOTA performance. On the more complex TinyImageNet dataset, our method and Zest obtain the best results, demonstrating strong adaptability. Across the three detection and erasure attack types, SAC series and Zest remain stable under query modification, while our method shows slight declines. Under input smoothing and feature squeezing, both Zest and our method maintain high ABP scores, outperforming the SAC series. Notably, Zest's query samples use a masking technique, which causes parts of the main content to be lost. After applying query modification and input smoothing attacks, the image content is restored, leading to an increased ABP value compared to the original query samples.

5 Conclusion

In this paper, we propose a robust and imperceptible fingerprint generation method. Inspired by the adversarial robustness of misclassified samples, we utilize them as fingerprints and address their scarcity by introducing a frequency-aware GAN to generate frequency-domain perturbations for normal samples, creating misclassified fingerprints. Our method offers the following advantages: 1) Efficiency: Training a single GAN enables the efficient generation of numerous fingerprints. 2) Imperceptibility: The fingerprints are highquality images and achieve the best ABP across three IP detection and erasure attacks on the GTSRB dataset. 3) Robustness: Achieves a SOTA AUC of 0.98 on Tiny-ImageNet under IP removal attacks, outperforming existing methods by 8%. Therefore, our method provides an effective solution to protect model IP.

In future work, we will apply frequency-domain perturbation fingerprinting techniques to other fields, such as natural language processing, brain-computer interfaces, etc.

Acknowledgments

This research was funded by the National Natural Science Foundation of China (62472291), Guangdong Basic and Applied Basic Research Foundation (2025A1515012154, 2023A1515012685, 2023A1515011296), Open Fund of National Engineering Laboratory for Big Data System Computing Technology (Grant No. SZU-BDSC-OF2024-14).