In this paper, we propose a novel and practical mechanism which enables the
service provider to verify whether a suspect model is stolen from the victim
model via model extraction attacks. Our key insight is that the profile of a
DNN model's decision boundary can be uniquely characterized by its Universal
Adversarial Perturbations (UAPs). UAPs belong to a low-dimensional subspace and
piracy models' subspaces are more consistent with victim model's subspace
compared with non-piracy model. Based on this, we propose a UAP fingerprinting
method for DNN models and train an encoder via contrastive learning that takes
fingerprint as inputs, outputs a similarity score. Extensive studies show that
our framework can detect model IP breaches with confidence > 99.99 within only
20 fingerprints of the suspect model. It has good generalizability across
different model architectures and is robust against post-modifications on
stolen models.

本文提出了一种新颖且实用的机制，通过模型提取攻击来验证是否从受害者模型中盗取了嫌疑模型，并针对深度神经网络模型提出了 UAP 指纹识别方法，训练了一个通过对比学习的编码器，可以在仅检测 20 个指纹的情况下以置信度 > 99.99 检测出模型 IP 侵犯，并且在不同的模型架构下具有良好的普适性，在盗版模型上具有较强的鲁棒性。