IrisFP：兼具更强唯一性与鲁棒性的基于对抗样本的模型指纹方法
IrisFP: Adversarial-Example-based Model Fingerprinting with Enhanced Uniqueness and Robustness
对做视觉模型部署与版权保护的人，这篇提供了利用多决策边界交点构造对抗样本指纹的思路：把指纹放在多个决策边界的交汇处而非单一边界深处，可在不深入目标类内部的前提下扩大预测间隔，从而同时提升鲁棒性与唯一性；其基于统计可分性度量的指纹筛选与阈值分配也可直接迁移到视觉模型的归属验证流程。
原文依据 It positions fingerprints near the intersection of all decision boundaries--unlike prior methods that target a single boundary
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论我们提出 IrisFP，一种新颖的基于对抗样本的模型指纹框架，通过利用多边界特性、多样本行为以及指纹判别力评估来生成复合样本指纹，从而同时提升唯一性与鲁棒性。三项关键创新使 IrisFP 表现突出：1）它将指纹置于所有决策边界的交汇处附近——而此前方法仅针对单一决策边界——从而在不把指纹深入目标类区域的情况下增大预测间隔，同时提升鲁棒性与唯一性；2）它构造复合样本指纹，每个指纹由靠近多边界交汇处的多个样本组成，以利用集体行为模式并进一步增强唯一性；3）它使用基于两组参考模型集（分别对应盗版模型与独立训练模型）所构建的统计可分性度量来评估所生成指纹的判别力，并为保留下来的指纹分配指纹专属阈值。大量实验表明，IrisFP 持续优于最优方法，通过同时增强鲁棒性与唯一性实现了可靠的所有权验证。
英文原文摘要 1262 字符
We propose IrisFP, a novel adversarial-example-based model fingerprinting framework that enhances both uniqueness and robustness by leveraging multi-boundary characteristics, multi-sample behaviors, and fingerprint discriminative power assessment to generate composite-sample fingerprints. Three key innovations make IrisFP outstanding: 1) It positions fingerprints near the intersection of all decision boundaries--unlike prior methods that target a single boundary--thus increasing the prediction margin without placing fingerprints deep inside target class regions, enhancing both robustness and uniqueness; 2) It constructs composite-sample fingerprints, each comprising multiple samples close to the multi-boundary intersection, to exploit collective behavior patterns and further boost uniqueness; and 3) It assesses the discriminative power of generated fingerprints using statistical separability metrics developed based on two reference model sets respectively for pirated and independently-trained models, and assigns fingerprint-specific thresholds to retained fingerprints. Extensive experiments show that IrisFP consistently outperforms state-of-the-art methods, achieving reliable ownership verification by enhancing both robustness and uniqueness.