The study, led by Tianxiang Luo with corresponding author Bo Wang, addresses a subtle but dangerous weakness in existing model fingerprinting techniques. Fingerprints are sets of test inputs whose predicted labels are expected to be preserved when a model is copied, extracted, or post-processed. If a suspect model answers the fingerprint queries the same way the owner’s model does, that is treated as evidence of theft. The catch is that independently trained models, built from scratch on similar data, can also agree on many of these inputs simply because they learned the same task. When that happens, an innocent model developer can be falsely accused of stealing someone else’s work, a risk the authors describe as leaving owners exposed to false-accusation liability.

Previous methods largely treated this problem with a heuristic: they searched for inputs near the source model’s decision boundary, on the assumption that only models derived from the source would inherit those boundary quirks. The new work upgrades that heuristic into an explicit optimization objective. Instead of asking whether fingerprint inputs transfer to related models, the researchers formulate fingerprint construction as a search for decision difference regions, or DDRs. These are localized areas of the input space where the source model’s decision differs sharply from the decisions of independently trained benign models. In other words, the fingerprint is designed from the outset to separate stolen copies from innocent lookalikes, rather than hoping that boundary transferability will do the job on its own.

Formally, the team casts DDR identification as a search problem over the input space. The goal is to find regions where the source model and a pool of independently trained models disagree in their predictions, because such disagreement zones are precisely where a copied model, which inherits the source’s internal decision structure, is most likely to side with the source rather than with the benign pool. A suspect model that matches the source’s answers inside these regions therefore provides much stronger evidence of derivation than agreement on ordinary test data. The formulation turns fingerprinting from a passive property of chosen inputs into an active, targeted construction process with a measurable separation criterion.

Solving this search problem efficiently is the second contribution. Exhaustively probing a high-dimensional input space to find regions where a source model diverges from a pool of benign models would be prohibitively expensive, so the authors propose two non-invasive variants that trade construction cost against verification confidence. The Fast variant performs low-cost screening, quickly identifying candidate decision difference regions without heavy computation, making it suitable for scenarios where owners need a cheap first pass or must fingerprint many models. The Selected variant applies a more demanding offline filtering stage to the candidates, retaining only the regions that satisfy stricter separation criteria, and is intended for higher-confidence verification where the consequences of a wrong accusation are severe.

This two-tier design gives model owners something earlier fingerprinting schemes generally lacked: a tunable dial between cost and confidence. A company deploying hundreds of models could run the Fast variant routinely to maintain baseline protection, then invoke the Selected variant when a serious dispute actually arises. Because both variants are non-invasive, they require no modification of the model itself, no embedded watermarks, and no retraining. That distinguishes the approach from watermarking techniques, which plant hidden signals inside the network’s weights or behavior and can be damaged or removed when a thief fine-tunes, prunes, or compresses the stolen model.

The evaluation is notably broad for this area of research. The team tested the fingerprinting scheme on CIFAR-10 and the German Traffic Sign Recognition Benchmark, using CIFAR-100 and Tiny-ImageNet as stress tests to probe how the method behaves on harder and more diverse classification tasks. The experiments spanned multiple source architectures, including the kinds of residual and convolutional networks commonly deployed in practice, and confronted the fingerprints with hard negatives, meaning independently trained models that are deliberately similar to the source, as well as with extraction attacks such as knowledge distillation and knockoff-style model stealing. This combination matters because a fingerprint that only survives easy attacks or only avoids easy false positives is of little practical value.

According to the published results, the DDR-based fingerprints supported ownership verification across these settings while the authors were careful to identify the limits of what their method can prove. That honesty is itself significant. Much of the literature on model protection reports headline robustness numbers without clearly delineating where the evidence would fail, which is exactly the kind of overclaiming that produces false accusations in real disputes. By giving practitioners ownership evidence with an explicit account of where the separation holds and where it does not, the Dalian team is pushing the field toward a standard more familiar from forensic science: an expert should be able to state not just a conclusion but the boundary conditions of that conclusion.

The stakes extend well beyond academic benchmarks. As foundation models and specialized commercial networks are increasingly offered through APIs, model extraction has become a genuine industrial espionage channel, and courts and platforms are only beginning to grapple with how ownership of a statistical artifact should be established. A false accusation against an independent developer is not a harmless error; it can trigger takedowns, contract disputes, and reputational damage. Conversely, a fingerprint that fails against a determined thief leaves the actual owner without recourse. Methods that explicitly optimize for separating these two cases, and that quantify their own reliability, are a step toward making model ownership verification evidence that could actually survive adversarial scrutiny.

The researchers have also released their implementation publicly, including experiment scripts, configuration files, and the model-pool specifications used in the reported experiments, hosted on GitHub under the Dalian University of Technology AI lab. That reproducibility package, combined with the use of standard public benchmarks, means other groups can independently test the DDR approach, probe its failure modes, and build on the two-variant cost-confidence trade-off. The work was supported by the National Natural Science Foundation of China and the Youth Innovation Promotion Association of the Chinese Academy of Sciences. As AI models continue to function as trade secrets in everything from medical imaging to autonomous driving, techniques like decision difference region fingerprinting suggest a future in which the question of who owns a neural network can be answered not by assertion, but by measurement, with a clearly stated margin of error.

Subject of Research: Deep neural network model ownership verification via decision difference region fingerprinting

Article Title: Efficient and robust DNN model fingerprint with decision difference regions identification

Article References: Luo, T., Yang, Z., Dai, X., Wang, B., & Wang, W. (2026). Efficient and robust DNN model fingerprint with decision difference regions identification. Applied Intelligence, 56(14), Article 405. https://doi.org/10.1007/s10489-026-07440-6

Image Credits: AI Generated

DOI: 10.1007/s10489-026-07440-6

Keywords: deep neural networks, model fingerprinting, intellectual property protection, model ownership verification, black-box verification, decision difference regions, model stealing, watermarking, CIFAR-10, knowledge distillation, adversarial machine learning, Applied Intelligence

The research, led by Yutong Wu and Songfeng Lu of Huazhong University of Science and Technology together with colleagues at Guangxi Normal University, Chongqing University, and other institutions, targets a structural weakness in what the authors call the behavior-only interface of model watermarking. Most black-box watermarking schemes, whether they use backdoored trigger sets, adversarial frontier stitching, dynamic adversarial watermarking, or parameter encoding, ultimately verify ownership by checking whether a suspect model maps certain inputs to certain labels. The problem, the researchers argue, is that a successful trigger response does not reveal how that response came to be. A third-party arbiter sees the model answering the secret key correctly, but cannot distinguish between a model that was genuinely watermarked at training time and one that simply happens to respond to a cleverly constructed set of forged inputs.

FakeMark exploits this ambiguity through a two-stage pipeline that operates entirely on a surrogate model. In the first stage, called clean feature caching, the attacker runs ordinary, unmodified images through a publicly available surrogate network and records the outputs of selected convolutional and fully connected layers. These cached activations serve as a library of clean reference features. In the second stage, adversarial feature fusion, the attacker optimizes a bounded perturbation on a batch of inputs while repeatedly injecting randomly permuted copies of the cached clean references into the surrogate’s forward pass. The injection is stochastic: at each iteration, a Bernoulli gate decides whether a given layer participates, a fresh permutation shuffles the reference features across the batch, and per-channel interpolation weights are drawn uniformly from a fixed range. The perturbation itself is guided by the gradient of the target-class logit, so the inputs are pushed toward whatever internal representations make the surrogate predict the attacker’s chosen label.

The crucial design insight is that this stochastic fusion prevents the perturbation from overfitting to architecture-specific quirks of the surrogate. Because the forward map changes at every iteration, successive gradients need not follow a single narrow trajectory, and the resulting adversarial inputs generalize better to unseen victim architectures. The authors support this intuition with a simplified theoretical analysis. Under a regularized linear classifier, they prove that a bounded perturbation maximizing the margin toward a watermarked class necessarily acquires a nonzero component along the watermark-trigger direction, with an explicit lower bound on the fraction of the perturbation’s norm that lies in that direction. The result is deliberately conditional: it explains why a successful linear watermark creates a trigger-aligned vulnerability, but the authors are careful to note that it does not prove the nonlinear optimization recovers the actual trigger of a deep network.

The empirical results are striking, though the authors frame them with unusual care. Across sixteen distinct architectures, an additional adversarially trained ResNet-50 checkpoint, and eight watermark variants spanning model-independent, model-dependent, active, and parameter-encoding schemes, the retrospective best-case behavioral target-label accuracy reaches 1.00 on CIFAR-10 and 0.99 on ImageNet. In other words, when the best surrogate in the pool is used, forged keys can induce the victim model to answer with the attacker’s chosen label on essentially every verification sample. On a fixed ADI-watermarked target under a matched protocol, FakeMark achieved a targeted attack success rate of 0.990, compared with 0.860 to 0.940 for canonical transferable attacks such as PGD, MI-FGSM, and DI-FGSM. A controlled component analysis showed that removing the batch permutation or the channel-wise mixing reduced transfer, and that replacing the clean cache with current-batch features actually raised surrogate-side success while lowering victim-side accuracy, indicating that the stochastic fusion genuinely shapes cross-model behavior rather than merely optimizing the surrogate.

Yet the study is equally notable for what it does not claim. ImageNet transfer varied enormously across checkpoint and surrogate settings, ranging from near zero to 0.99. Two ImageNet surrogates, ResNet-18 and VGG16, produced almost no transfer at all, while the adversarially trained ResNet-50 checkpoint and DenseNet-121 performed strongly. The ordering was not explained by model size or computational cost: MobileNetV2, the smallest and cheapest surrogate tested, matched ResNet-50 at 0.990, while Inception-v3, with the largest FLOP count, reached only 0.727. Architecture and checkpoint compatibility, the authors conclude, is a central condition for the attack, and the reported maxima are retrospective upper bounds over the surrogate pool rather than an operational guarantee that an attacker could pick a good surrogate without any victim feedback. Auxiliary experiments on clean, unwatermarked models showed comparable targeted transfer in several settings, so the evidence does not establish a universal watermark-specific amplification effect.

The threat model is deliberately austere. The attacker has white-box gradient access to one or more surrogate models trained on public data, but during attack construction has no query access, no gradients, no parameters, and no architectural knowledge of the victim. The victim model is invoked only at the end, through the normal ownership-verification procedure. The attacker does not modify the victim’s parameters, does not observe the legitimate watermark key, and does not need to estimate any victim-specific decision threshold. On CIFAR-10, the surrogates and watermarked targets share the standard public training split, so the controlled setting involves substantial sample-level overlap; on ImageNet, only dataset-level overlap can be asserted because external pretrained checkpoints do not publish training manifests. The authors acknowledge these limitations explicitly, along with the fact that the evaluation is restricted to image classification and uses a single surrogate at a time.

The study also probes whether forged keys can be detected. Perceptual measurements showed that the perturbations remain bounded, with PSNR between roughly 24 and 27 decibels and structural similarity scores between 0.72 and 0.91 depending on the setting. Input-level screening told a mixed story: the ADI scheme’s forged keys stayed below all four diagnostic thresholds tested, while Frontier and DAWN exceeded three of them, and median filtering changed forged predictions more often than legitimate ones. Feature-based detectors, including Mahalanobis distance, local intrinsic dimensionality, and ODIN, flagged forged groups at higher rates than clean calibration data, with the largest increase under LID. The authors interpret these results as evidence of detector-dependent artifacts rather than broad evasion, and they caution that the detector study is not a fully tuned learned-detector benchmark. The picture that emerges is nuanced: some schemes leave fingerprints on forged evidence, others do not, and no single screening method reliably separates genuine from fabricated triggers.

The practical implications reach beyond the laboratory. As models are increasingly deployed through APIs, fine-tuned by third parties, and extracted by adversaries, ownership disputes will hinge on verification evidence that courts, marketplaces, and standards bodies can trust. FakeMark shows that behavioral evidence alone cannot carry that weight, because a successful trigger response is compatible with both legitimate embedding and independent forgery. The authors argue that future ownership protocols should pair behavioral tests with signals that are harder to construct after the fact: cryptographic commitments to watermark keys or training provenance, structural fingerprints that cannot be derived from black-box outputs, and multi-factor validation that survives model post-processing. Parameter-encoding schemes that bind selected weights to a hashed secret, such as NeuralMark, represent one step in this direction, but the broader lesson is procedural rather than technical. Any verification protocol that accepts a single trigger-response score as proof of ownership is, in principle, exposed to fabricated evidence.

The FakeMark code and experimental data have been released publicly, and the authors hope the framework will serve as a stress test for the next generation of watermarking defenses rather than as a tool for intellectual property fraud. The study’s most enduring contribution may be its reframing of the ownership question. Watermarking research has largely focused on making triggers robust to removal, extraction, and fine-tuning; FakeMark shifts attention to the provenance of the evidence itself. A model that answers the secret questions correctly is not necessarily a stolen model, and a claimant who produces the right answers is not necessarily the rightful owner. Until verification protocols can distinguish between these possibilities, the researchers conclude, the evidentiary value of any behavioral watermark remains fundamentally limited, and the growing market for machine learning intellectual property will need stronger, multi-factor guarantees to stay ahead of those who would forge them.

Subject of Research: Gradient-guided forgery of behavioral model watermarks in deep neural networks

Article Title: FakeMark: gradient-guided false watermark claims via robust feature fusion

Article References: Wu, Y., Li, W., Nie, H., Zhou, Z., Li, J., Gong, Y., & Lu, S. (2026). FakeMark: gradient-guided false watermark claims via robust feature fusion. Cybersecurity, 9(1), Article 217. https://doi.org/10.1186/s42400-026-00654-8

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00654-8

Keywords: model watermarking, false ownership claims, adversarial transferability, deep neural network security, intellectual property protection, FakeMark, surrogate models, feature fusion, CIFAR-10, ImageNet, Cybersecurity, machine learning