[Paper Review] Fingerprinting Multi-exit Deep Neural Network Models via Inference Time

Tian Dong, Han Qiu+4 more|arXiv (Cornell University)|Oct 7, 2021

Adversarial Robustness in Machine Learning26 references4 citations

TL;DR

This paper proposes a novel fingerprinting method for multi-exit deep neural network models that leverages inference time rather than prediction outputs to verify intellectual property ownership. By crafting fingerprint samples that induce unique, measurable inference time costs at specific internal exits, the method achieves high uniqueness and robustness against adversarial training, model pruning, and structural modifications, outperforming existing prediction-based fingerprinting techniques across multiple architectures and datasets.

ABSTRACT

Transforming large deep neural network (DNN) models into the multi-exit architectures can overcome the overthinking issue and distribute a large DNN model on resource-constrained scenarios (e.g. IoT frontend devices and backend servers) for inference and transmission efficiency. Nevertheless, intellectual property (IP) protection for the multi-exit models in the wild is still an unsolved challenge. Previous efforts to verify DNN model ownership mainly rely on querying the model with specific samples and checking the responses, e.g., DNN watermarking and fingerprinting. However, they are vulnerable to adversarial settings such as adversarial training and are not suitable for the IP verification for multi-exit DNN models. In this paper, we propose a novel approach to fingerprint multi-exit models via inference time rather than inference predictions. Specifically, we design an effective method to generate a set of fingerprint samples to craft the inference process with a unique and robust inference time cost as the evidence for model ownership. We conduct extensive experiments to prove the uniqueness and robustness of our method on three structures (ResNet-56, VGG-16, and MobileNet) and three datasets (CIFAR-10, CIFAR-100, and Tiny-ImageNet) under comprehensive adversarial settings.

Motivation & Objective

• To address the lack of effective intellectual property protection for multi-exit deep neural network models in real-world deployment.
• To overcome the limitations of existing fingerprinting and watermarking methods that rely on prediction outputs and are vulnerable to adversarial training and structural manipulation.
• To design a fingerprinting technique that is both unique—distinguishing the target model from independently trained models—and robust—resistant to model fine-tuning, pruning, and adversarial retraining.
• To enable reliable ownership verification without modifying model weights or injecting backdoors, ensuring compatibility with off-the-shelf models.

Proposed method

• The method generates a set of fingerprint samples that are specifically crafted to trigger early exits at designated internal classifiers in the target multi-exit model, resulting in a unique inference time signature.
• It exploits the fact that the inference time cost of these samples is highly sensitive to the model's internal structure and layer-specific computation, creating a distinguishable temporal fingerprint.
• The fingerprinting process does not depend on prediction labels, making it resilient to changes in model accuracy caused by retraining, pruning, or structural modifications.
• A threshold-based verification mechanism is used to compare the inference time of suspicious models on fingerprint samples, with a high true positive rate across diverse adversarial settings.
• The approach is evaluated using EEC AUC scores and IP verification rates to quantify uniqueness and robustness under various attack scenarios.
• Fingerprint samples are generated with minimal perturbation (L2 scores < 0.05), ensuring visual imperceptibility while maintaining strong temporal fingerprint distinctiveness.

Experimental results

Research questions

• RQ1 Can inference time be used as a reliable and unique fingerprinting signal for multi-exit DNN models without relying on prediction outputs?
• RQ2 How robust is the proposed inference-time fingerprinting method against adversarial training, model fine-tuning, and structural modifications such as IC retraining or removal?
• RQ3 To what extent does the method maintain uniqueness when verifying ownership against independently trained models with the same architecture and dataset?
• RQ4 How does the method perform across different DNN architectures (ResNet-56, VGG-16, MobileNet) and datasets (CIFAR-10, CIFAR-100, Tiny-ImageNet)?
• RQ5 What is the impact of varying the threshold $T_f$ on the trade-off between false positives and verification accuracy?

Key findings

• The proposed method achieved an average IP verified rate of 0.99 across 100 independent models and 100 shadow models under standard adversarial perturbation (RAD=5), demonstrating high uniqueness.
• Even under strong adversarial training with RAD=15, the method maintained a 0.98 verification rate on ResNet-56 and VGG-16, while the baseline failed in most cases due to prediction label shifts.
• The method remained robust under model fine-tuning, with EEC AUC scores showing minimal degradation (average AUC > 0.98) across 80 finetuned models per target model.
• L2 scores between fingerprint samples and original images were consistently below 0.05, confirming visual imperceptibility while preserving strong temporal fingerprint distinctiveness.
• The method outperformed state-of-the-art prediction-based fingerprinting techniques in both uniqueness and robustness, especially under adversarial training and structural modifications.
• Threshold tuning showed that $T_f = 0.005$ achieved optimal balance, with 0.99 verification rate on independent models and 0.98 on shadow models under RAD=5, while higher thresholds reduced accuracy.