FBI: Fingerprinting models with Benign Inputs

Recent advances in the fingerprinting of deep neural networks are able to detect specific instances models, placed a black-box interaction scheme. Inputs used by protocols specifically crafted for each precise model be checked for. While efficient such scenario, this nevertheless results lack guarantee after mere modification ( e.g . finetuning, quantization parameters). This article generalizes notion families and their variants extends task-encompassing scenarios where one wants fingerprint not only (previously referred as xmlns:xlink="http://www.w3.org/1999/xlink">detection task) but also identify which or family is xmlns:xlink="http://www.w3.org/1999/xlink">identification task). The main contribution proposal schemes that resilient significant modifications models. We achieve these goals demonstrating benign inputs, unmodified images, sufficient material both tasks. leverage an information-theoretic scheme identification task. devise greedy discrimination algorithm detection Both approaches experimentally validated over unprecedented set more than 1,000 networks1.