Performance-Cloning Resistance
Copying the architecture and weight parameters is insufficient to reproduce the original model performance.
Overview
High-performance AI models require valuable training data, substantial computational resources, and specialized design expertise. Once deployed, however, their architecture, weight parameters, or functional behavior may be copied and reused without authorization.
Our research addresses two complementary threats. The first approach combines an AI model with a physically unclonable function (PUF) to prevent the replication of model performance even when all internal model information is copied. The second approach uses robust adversarial-example-based fingerprints to verify model ownership through output responses, even when cloud services apply image preprocessing.
Research Goal
To prevent functional cloning and enable reliable ownership verification across embedded devices, edge AI systems, and cloud-based AI services.
Proposed Method 1
Device-Specific AI Models Using PUF-Integrated Layers
This method combines an AI model with a PUF so that device-specific AI models can be created even when the same circuit pattern and the same model weights are used. We assume a strong attack scenario in which an adversary can completely copy all information stored in the model, including its architecture and weight parameters.
| Approach | Attack Phase | Attack Target | Attacker Assumption | Protection Objective |
|---|---|---|---|---|
| Proposed Method | Inference | AI model | All model information is available | Prevent replication of model performance |
| Conventional Countermeasures | Inference | AI model | Only input-output results are available | Prevent extraction or replication of model information |
Difference from Conventional Protection
Conventional defenses against model extraction attacks mainly aim to prevent reconstruction of model information from input-output observations. In contrast, our method assumes that the attacker may already possess all model information. It therefore prevents the attacker from reproducing the original model performance on another device.
Architecture
The complete model consists of ordinary inference layers and a PUF-based layer. A PUF layer with the same size as a selected inference layer is inserted into the network and controls the network output according to responses generated by the device-specific PUF.
Because PUF responses differ across physical devices, different neurons are selected during inference on each device. Consequently, even a copied model with exactly the same architecture and weights cannot reproduce the same behavior without the original PUF. The effective inference behavior and learned parameters become tied to the original device.
Dynamic PUF Responses
Input-dependent responses make the PUF layer difficult to imitate only from observed model inputs and outputs.
Authentication Capability
The integrated PUF can support model authentication and the detection of counterfeit or impersonating AI systems.
Proposed Method 2
Robust AE-Based Model Fingerprints under Input Preprocessing
Background
DNN ownership verification methods include watermarking approaches that embed information into model weights and black-box approaches that use model responses to selected inputs. Adversarial examples (AEs) can also serve as model fingerprints by producing a model-specific output probability distribution.
AE-based fingerprints require only a small number of queries and can be used without direct access to internal model weights.
Preprocessing Challenge
Cloud services may crop and resize input images or apply JPEG compression before inference. Since AE perturbations are very small, these transformations can alter their structure and destroy the output-distribution control required for fingerprinting. A practical fingerprint must therefore preserve its response both before and after preprocessing.
Fingerprint Design
Let x be an input image and x' an adversarial example obtained by adding a small perturbation δ. The perturbation is optimized so that the output distribution of the target model f approaches a predefined target distribution y*.
x' = x + δ, f(x') ≈ y*
The target distribution assigns a high probability to the true class ctrue and a controlled probability to a predefined target class ctarget. This retains the correct class while producing a model-specific probability response.
Ownership Verification and EOT
The generated AE should produce a distribution close to y* on the target model, whereas unrelated models are less likely to produce the same pattern. Ownership is verified by measuring the similarity between the observed and target distributions.
Expectation over Transformation (EOT) is introduced during AE generation. Multiple combinations of cropping/resizing ratios and JPEG quality levels are considered, while the loss for the untransformed input is optimized simultaneously. This preserves the fingerprint response before and after combined preprocessing.
Black-Box Verification
Verification is possible without accessing internal model parameters.
Few Queries
A small number of carefully generated fingerprints can confirm model-specific responses.
Preprocessing Robustness
The fingerprints remain effective under combined cropping, resizing, and JPEG compression.
Keywords
AI Model VerificationIntellectual Property ProtectionPhysically Unclonable FunctionModel FingerprintingAdversarial ExamplesExpectation over Transformation
Related Publications
- N. Katakai, S. Takemoto, Y. Nozaki, M. Yoshikawa,"Evaluation of Robustness and Verification Capability of Soft-Label-Controlled Model Fingerprints under Multiple Input Preprocessing Transformations". IEICE Technical Report, HWS，vol. 126，no. 110，pp. 31–36，2026.
- N. Katakai, S. Takemoto, Y. Nozaki, M. Yoshikawa,"Model Fingerprinting via Soft-Label Control with Robustness to Geometric Transformations," proc. of the 2026 Annual Meeting IEE of Japan, no. 3-119，pp. 202–203，2026.
- Y. Ikezaki, S. Takemoto, Y. Nozaki, M. Yoshikawa,"Intellectual Property Protection Oriented AI with Secure Authentication and Its Evaluation," IEICE Trans. on Information and System, vol. J106-D，no. 4，pp. 209–217，2023.