Paper deep dive

TP-CRIV: A Framework for Third-Party Challenge-Response Identity Verification of AI Models

Teruki Sano, Minoru Kuribayashi, Masao Sakai, Shuji Isobe, Eisuke Koizumi, Zhang Zhang, Satoru Matsumoto

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 104

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 95%

Last extracted: 9/25/2026, 5:11:00 AM

Summary

The paper proposes TP-CRIV, a framework for third-party challenge-response identity verification of AI models. It addresses the problem of verifying model misappropriation when a verifier has only black-box access to a suspicious deployed service and no access to the claimant's model. The framework uses fresh, undisclosed challenges and network isolation to ensure the claimant relies on a locally possessed model rather than external assistance. Experiments on CNN image classifiers demonstrate effective separation between matching and non-matching models.

Entities (8)

Teruki Sano · author · 99%Tohoku University · organization · 99%TP-CRIV · framework · 98%CNN · model-architecture · 95%ImageNet · dataset · 95%MLaaS · service-type · 95%TorchVision · software-library · 95%JSPS KAKENHI · funding-agency · 90%

Relation Signals (5)

Teruki Sano → affiliatedwith → Tohoku University

confidence 99% · Teruki Sano is with the Graduate School of Information Sciences, Tohoku University, Japan.

TP-CRIV → evaluatedon → ImageNet

confidence 95% · Experiments on ten ImageNet-pretrained TorchVision models demonstrate clear same/cross-model separation

TP-CRIV → instantiatedfor → CNN

confidence 95% · We instantiate TP-CRIV for CNN image classifiers using probability-control-based witness generation.

TP-CRIV → proposessolutionfor → model_misappropriation

confidence 95% · TP-CRIV targets a third-party verification setting... enabling the verifier to obtain empirical evidence as to whether the claimant locally possesses a model satisfying a predeclared identity

TP-CRIV → fundedby → JSPS KAKENHI

confidence 90% · This study was supported by the JSPS KAKENHI (25K15225, 26H02540)

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Artificial intelligence (AI) models are increasingly deployed through remote services, making model misappropriation a growing concern. Existing approaches, including watermarking, fingerprinting, and model similarity analysis, primarily rely on predefined evidence or direct behavioral comparison and do not explicitly evaluate whether the claimant currently possesses and can utilize model-dependent information relevant to the claimed model identity. In this paper, we propose Third-Party Challenge-Response Identity Verification (TP-CRIV) for AI models. TP-CRIV targets a third-party verification setting in which the verifier has neither white-box nor API access to the claimant's model, can interact with the suspicious deployed service only through its ordinary black-box inference interface, and does not require protocol-specific cooperation from the service provider. Under these constraints, the framework enables the verifier to obtain empirical evidence as to whether the claimant locally possesses a model satisfying a predeclared identity relative to the deployed model. Verification is conducted under fresh, previously undisclosed requirements and network isolation, so that the demonstrated capability cannot rely on online external assistance after challenge disclosure. The resulting evidence is interpreted relative to independently specified and calibrated matching and non-matching operating situations and is statistical rather than cryptographic. We instantiate TP-CRIV for CNN image classifiers using probability-control-based witness generation. Experiments on ten ImageNet-pretrained TorchVision models demonstrate clear same/cross-model separation and finite-challenge verification using independently calibrated thresholds.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

100,671 characters extracted from source content.

Expand or collapse full text

TP-CRIV: A Framework for Third-Party Challenge-Response Identity Verification of AI Models Teruki Sano Minoru Kuribayashi Masao Sakai Shuji Isobe Eisuke Koizumi Zhang Zhang Satoru Matsumoto †thanks: Teruki Sano is with the Graduate School of Information Sciences, Tohoku University, Japan.†thanks: Minoru Kuribayashi, Masao Sakai, Shuji Isobe, Eisuke Koizumi, Zhang Zhang, and Satoru Matsumoto are with the Center for Data-driven Science and Artificial Intelligence, Tohoku University, Japan.†thanks: Corresponding author: Teruki Sano (e-mail: sano.teruki.r2@dc.tohoku.ac.jp).†thanks: This study was supported by the JSPS KAKENHI (25K15225, 26H02540) and Support Center for Advanced Telecommunications Technology Research (SCAT), Japan.†thanks: This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible. Abstract Artificial intelligence (AI) models are increasingly deployed through remote services, making model misappropriation a growing concern. Existing approaches, including watermarking, fingerprinting, and model similarity analysis, primarily rely on predefined evidence or direct behavioral comparison and do not explicitly evaluate whether the claimant currently possesses and can utilize model-dependent information relevant to the claimed model identity. In this paper, we propose Third-Party Challenge-Response Identity Verification (TP-CRIV) for AI models. TP-CRIV targets a third-party verification setting in which the verifier has neither white-box nor API access to the claimant’s model, can interact with the suspicious deployed service only through its ordinary black-box inference interface, and does not require protocol-specific cooperation from the service provider. Under these constraints, the framework enables the verifier to obtain empirical evidence as to whether the claimant locally possesses a model satisfying a predeclared identity relative to the deployed model. Verification is conducted under fresh, previously undisclosed requirements and network isolation, so that the demonstrated capability cannot rely on online external assistance after challenge disclosure. The resulting evidence is interpreted relative to independently specified and calibrated matching and non-matching operating situations and is statistical rather than cryptographic. We instantiate TP-CRIV for CNN image classifiers using probability-control-based witness generation. Experiments on ten ImageNet-pretrained TorchVision models demonstrate clear same/cross-model separation and finite-challenge verification using independently calibrated thresholds. Index Terms: AI security, Challenge-response, Model identity verification, Model-dependent capability verification, Machine learning as a service (MLaaS). I Introduction Artificial intelligence (AI) models support a wide range of applications, while their development can require substantial computational resources, expert knowledge, and financial investment. Protecting the intellectual property (IP) of AI models has therefore become an important issue [1, 2], particularly as model theft and unauthorized reuse remain practical concerns [3, 4]. At the same time, many models are deployed through Machine Learning as a Service (MLaaS), where users interact with remote APIs rather than obtaining the models themselves. In such settings, the parameters, architectures, and training records of a suspicious deployed model are generally unavailable to external parties. Consequently, even if a claimant identifies a suspicious MLaaS, an independent third party cannot directly compare the claimant’s model with the deployed model to assess their relationship. Moreover, without sufficiently credible preliminary evidence supporting the claimant’s allegation, the third party may have difficulty justifying a request for protocol-specific cooperation, model disclosure, or other additional assistance from the MLaaS provider. Under such circumstances, the claimant must first provide convincing technical evidence that supports the suspicion of model misappropriation and justifies further investigation. Therefore, the fundamental research question considered in this work is how an independent third party can obtain credible preliminary evidence of possible model misappropriation without white-box access to either model and without requiring protocol-specific cooperation from the suspicious deployed service. Rather than attempting to measure global similarity between two inaccessible models, we ask whether the third party can issue fresh requirements whose solutions depend strongly on model-specific behavior of the suspicious service and evaluate whether the claimant can satisfy those requirements using a locally available model. Fig. 1: Comparison of model-to-model verification approaches from the perspective of the evidence available to an independent third party and the resulting inference about the relationship between a claimant’s model and a suspicious deployed model. From the perspective of this research question, existing model-protection approaches mainly use predefined model-specific evidence, as in watermarking and fingerprinting [1, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20], or compare model behavior with a reference model [21, 22, 23, 24]. Proof-based verifiable-inference approaches address a different relation: rather than comparing two models, they verify that a reported computation was correctly performed using a specified or committed model [25, 26, 27, 28, 29, 30]. These approaches provide valuable ownership, identity, similarity, or computation-integrity evidence, but they address a different question from whether a claimant can use a locally available model to satisfy fresh third-party requirements concerning a suspicious deployed service. To address this problem, we propose Third-Party Challenge-Response Identity Verification (TP-CRIV) for AI models. TP-CRIV enables an independent third party to obtain empirical evidence as to whether a claimant possesses a model satisfying a specified identity relative to a suspicious deployed model, while requiring neither white-box nor API access to the claimant’s model and only ordinary black-box access to the suspicious MLaaS. Fig. 1 compares this verification objective with those of existing model-verification approaches. Specifically, for each intended verification problem, the verifier first specifies two disjoint operating situations representing matching and non-matching configurations. These situations define the objective-dependent model identity independently of the challenge-response score or acceptance outcome. The verifier then selects a model-dependent property, issues fresh property-demanding challenges, and evaluates the returned witnesses through the deployed service. An operational threshold is calibrated using independent reference configurations from the declared matching and non-matching situations. Freshness and network isolation exclude online external assistance after challenge disclosure. Within the model-based response-generation scope, matching-consistent challenge-solving performance provides an empirical basis for inferring that the claimant possesses a model satisfying the specified identity. This inference is statistical rather than cryptographic and does not establish training provenance or legal ownership. To clarify the role of TP-CRIV in practice, we view model-misappropriation verification as a two-stage process. Step 1: Preliminary Evidence Assessment. Suppose that a claimant asserts that it possesses a model identical to the model deployed by a suspicious MLaaS. At this stage, however, an independent third-party verifier may have insufficient evidence to determine whether the claim is credible. Under such circumstances, it may also be difficult to justify requiring the suspicious MLaaS provider to participate in a dedicated verification procedure. The verifier must therefore first assess the technical credibility of the claimant’s misappropriation claim using externally observable evidence and determine whether the case warrants a more rigorous subsequent investigation. Step 2: Formal Ownership Investigation. If sufficient suspicion is established, a formal investigation may employ stronger verification conditions, including direct access to the relevant models or protocol-specific cooperation from the involved parties, together with ownership-related evidence such as development records, timestamps, and ownership documents. Based on this technical and ownership-related evidence, the verifier determines whether model misappropriation or ownership infringement has occurred. TP-CRIV addresses the first stage by providing preliminary technical evidence about possession of a model satisfying the declared identity. I-A Our Contributions The main contributions of this paper are summarized as follows: • We propose TP-CRIV for preliminary third-party verification in suspicious MLaaS settings where the verifier has neither white-box nor API access to the claimant’s model and the deployed service provides only its ordinary black-box inference interface. Under these conditions, TP-CRIV enables the verifier to obtain empirical evidence as to whether the claimant possesses a model satisfying the objective-dependent identity relative to the deployed model, without requiring protocol-specific cooperation from the service provider. • To demonstrate the practical feasibility of TP-CRIV, we instantiate the framework for CNN-based image classification using local input–probability geometry and probability-control-based witness generation [31]. Experiments with ten ImageNet-pretrained TorchVision CNN models demonstrate clear separation between the declared matching and non-matching configurations and show that calibration on separate models enables finite-challenge decisions on held-out models. I-B Organization The remainder of this paper is organized as follows. Section I reviews related studies on model protection and verification, including ownership, identity, similarity, and proof-based verifiable inference. Section I presents the TP-CRIV framework and its verification principle. Section IV presents a CNN-based instantiation and feasibility evaluation. Section V concludes the paper and outlines future work. I Related Work This section reviews existing approaches relevant to model protection and verification, focusing on the evidence available to an independent third party and the conclusions that can be drawn from that evidence. I-A Model-Specific Evidence for Verification Model watermarking and fingerprinting support ownership or identity claims using model-specific information. Although they construct such information in different ways, verification ultimately evaluates evidence associated with a particular model. I-A1 Model Watermarking Model watermarking embeds proprietary information into an AI model and verifies ownership by detecting or extracting the embedded watermark [1, 5, 6, 7, 8, 9, 10, 11, 12]. Representative approaches include trigger-based watermarks that induce predefined behaviors for specific inputs [7, 9, 11, 12] and methods that recover embedded messages from model outputs [10, 12]. In black-box or gray-box settings, such evidence can be verified through observable model responses without exposing the model itself. Successful verification therefore demonstrates that the presented watermark-related evidence is consistent with the suspicious model. Under the assumption that this evidence remains exclusive to the legitimate owner, such consistency can support an ownership claim. However, if the watermark information is disclosed or acquired by another party, the exclusivity assumption may be weakened. Moreover, because the watermark-related information is generally defined before verification, the verification primarily evaluates predefined evidence rather than whether the claimant currently possesses a model capable of producing fresh model-dependent responses. I-A2 Model Fingerprinting Model fingerprinting identifies models through intrinsic model-dependent behavior without modifying the target model [13, 14, 15, 16, 17, 18, 19, 20]. Representative approaches use decision-boundary characteristics [13, 14, 15, 16], model-specific test examples [17], universal adversarial perturbations [18], or model-sensitive behavior of large language models [19]. Such fingerprints provide evidence for determining whether the behavior of a suspicious model is consistent with model-specific information derived from a reference model. However, fingerprint evidence can generally be constructed before the verification session and may subsequently be presented or reused without requiring the claimant to demonstrate access to the model from which it was derived. Consequently, successful fingerprint verification does not by itself establish that the claimant currently possesses a model satisfying the claimed identity. Limitation of Model-Specific Evidence Watermarking and fingerprinting provide valuable ownership and identity evidence, but both primarily verify consistency with model-specific evidence prepared before verification. Accordingly, a third party can evaluate the relationship between the presented evidence and the suspicious model, but cannot directly determine from that evidence alone whether the claimant currently possesses a model capable of generating corresponding model-dependent behavior. Furthermore, the evidence itself may be proprietary or valuable and may not always be desirable to disclose to an external verifier. These limitations motivate verification that evaluates fresh model-dependent capability rather than only possession or disclosure of predefined evidence. TABLE I: Comparison of verification objectives, evidence, and operational requirements. Method Model-Specific Evidence Similarity Verification Proof-Based Verification Proposed: TP-CRIV Primary objective Support ownership or model-identity claims Estimate or verify similarity between models Verify correctness of a specified or committed computation Third-party verification of objective-dependent identity Directly evaluated evidence Consistency with predefined watermark or fingerprint evidence Behavioral or internal consistency between compared models Proof that a defined computation or relation is satisfied Responses to fresh verifier-issued requirements Typical approach Watermark reproduction, extraction, or fingerprint response evaluation Reference-model-based comparison Proof generation by the model-holding party Challenge-dependent capability demonstration Evidence freshness Typically predefined before verification Statistics obtained during evaluation Computation-specific proof generated for verification Fresh, previously undisclosed challenges Possession-related conclusion Not explicitly evaluated Not explicitly evaluated May bind the demonstrated computation to a committed model Empirical inference of possession of a matching model under scope Verifier access to claimant model Not required Often required through API or white-box access Not required Not required Dedicated participation by deployed service Not generally required beyond ordinary responses Not generally required, but comparison access is needed Typically required from the model-holding service Not required beyond ordinary black-box inference I-B Model Similarity Verification Several studies verify model similarity or provenance by comparing observable or internal model behavior [21, 22, 23, 24]. Representative approaches include test-case-based comparison [21, 22], model lineage analysis using internal information [23], and provenance testing based on observable outputs [24]. These methods can provide strong evidence about the relationship between models, but generally assume that the models to be compared are available to the verifier at least through their observable behavior, and some methods use white-box reference-model information to construct model-sensitive test cases [22]. In practical settings, however, the claimant may also be unable to provide its model to a third party, for example because the model is proprietary or too large to make such access practical. Under such conditions, direct model-similarity verification becomes difficult. TP-CRIV targets a different operational setting in which the claimant’s model is not made available to the verifier, even through query access, and the suspicious deployed service is accessible only through its ordinary black-box interface. I-C Proof-based Verifiable Inference Proof-based verifiable-inference methods address a different verification objective from model-to-model identity verification. Their primary goal is to prove that a reported output was correctly computed from a given input using a specified or committed model, without necessarily revealing the model parameters [25, 26, 27, 28, 29, 30]. Thus, these methods primarily establish a cryptographic relation between a model and its computation, rather than directly evaluating the relationship between a claimant-held model and a separately deployed suspicious model. In typical verifiable-inference settings, the model-holding service acts as the prover and participates in a dedicated verification procedure, for example by committing to the model and generating an inference proof. Such mechanisms can provide strong guarantees when this participation is available. However, as discussed above, they become difficult to apply when requiring the suspicious MLaaS provider to participate in a dedicated verification procedure is impractical. TP-CRIV instead evaluates the relationship between two separately held models through only ordinary black-box access to the suspicious MLaaS, enabling the verifier to infer the claimant’s condition and assess whether the claimant’s identity claim is technically supported. I Proposed Framework I-A Motivation and Positioning TP-CRIV is designed to provide an independent third party with empirical evidence about the relationship between a claimant’s locally possessed model and a suspicious remotely deployed model when direct model comparison is unavailable. Through fresh challenge-response interactions, the framework enables the verifier to assess whether the claimant demonstrates behavior consistent with the identity specified for the intended verification objective, without requiring access to the claimant’s model or protocol-specific cooperation from the deployed service. To make this inference well defined, TP-CRIV separates four concepts that must not be conflated. First, the verification objective specifies an a priori distinction between matching and non-matching operating situations. Second, a model-dependent property supplies information for constructing discriminative requirements but does not define model identity. Third, fresh property-demanding challenges elicit observable challenge-solving capability rather than directly revealing or comparing the property. Fourth, calibration on independent reference configurations provides an operational interpretation of the resulting scores relative to the predeclared identity distinction. These roles are formalized below. Compared with model-specific evidence approaches, TP-CRIV evaluates not only evidence associated with the claimant and the suspicious service, but also whether the claimant can use a locally available model to satisfy fresh model-dependent requirements. In contrast to model-similarity verification, TP-CRIV does not require the verifier to access or query the claimant’s model. Unlike proof-based verifiable inference, it also does not require the suspicious MLaaS provider to participate in a dedicated verification procedure. Table I summarizes these differences from existing verification approaches. I-B System Model Fig. 2: Overview of the TP-CRIV framework. The verifier specifies the objective-dependent model-identity distinction, selects a model-dependent property, issues fresh property-demanding challenges, and evaluates the prover’s returned responses through the deployed MLaaS. The prover answers the challenges using a locally available candidate model. We consider three entities: • Prover P, which locally possesses a candidate model M and claims that M corresponds to the matching situation relative to McloudM^cloud. • Service provider S, which operates McloudM^cloud through an MLaaS platform. • Verifier V, which specifies a verification objective O, prepares or obtains calibration data, conducts verification, and evaluates the resulting evidence. Let FMLaaSF^MLaaS denote the black-box MLaaS interface exposed by S. For an input x, V observes only yMLaaS=FMLaaS(x),y^MLaaS=F^MLaaS(x), (1) where, in the baseline framework setting, FMLaaS(x)=Mcloud(x).F^MLaaS(x)=M^cloud(x). (2) Neither P nor V directly accesses McloudM^cloud. Moreover, V has no direct access to M and need not observe its parameters, architecture, or other internal information. Consequently, V cannot directly compare the internal structures of M and McloudM^cloud. TP-CRIV therefore evaluates the claimed relationship from observable interactions with the deployed MLaaS under the declared verification objective, calibration procedure, and operational assumptions. I-C Verification Scope and Operational Assumptions Non-Matching Model Configurations A model configuration declared non-matching for O constitutes the negative identity case. Depending on the intended objective, M may be unrelated to, independently trained from, extracted from [3], distilled from [32], or otherwise derived from McloudM^cloud. Such provenance does not determine the identity label; the label is fixed by the operating situations declared for O. Acceptance of a declared non-matching configuration constitutes a false acceptance. Model configurations outside the declared operating population are outside the characterized identity scope. Accordingly, the reported verification performance does not automatically extend to model configurations that are not represented in the corresponding calibration, evaluation, or supporting analysis. Service-Side Assumption S does not disclose McloudM^cloud, its parameters, architecture, or inference pipeline. V interacts with FMLaaSF^MLaaS only through its ordinary black-box interface. S is assumed to return the ordinary output of a fixed deployed inference pipeline for each submitted input. Adaptive routing of verification queries, deliberate output manipulation, and query refusal are outside the present scope. The verification decision therefore concerns the observed behavior of the deployed service and does not establish its internal implementation. Network Isolation Before the first challenge of a verification session is disclosed, P is placed under network isolation. The isolation remains in effect until all responses for the session have been returned. During this interval, P may use the disclosed challenges, its locally available model M, and local computational resources, but may not obtain additional challenge-relevant information from FMLaaSF^MLaaS, another remote model, a relay service, an external oracle, or any other external source. Thus, network isolation excludes online external assistance after challenge disclosure. I-D TP-CRIV Protocol A verification trial consists of N challenge-response interactions. For each interaction i, V issues a fresh challenge, P generates a corresponding response using its locally available model, and V evaluates the response through the deployed MLaaS. Let ResGenResGen denote the response-generation algorithm used by P. The present framework adopts a model-based response-generation scope: ResGenResGen may use M, the disclosed challenge, and local computation required to operate or process M. A standalone learned or precomputed mechanism that can generate responses without using M is outside the present model-based response-generation scope. Fig. 2 illustrates the overall TP-CRIV framework. The i-th interaction proceeds as follows. 1. V generates a fresh challenge Ci=(xi,ψi),C_i=(x_i, _i), (3) where xix_i is a base input and ψi _i specifies the verification requirement. 2. Given CiC_i, P applies ResGenResGen to its local model M and generates a witness Wi←ResGen⁡(M,Ci).W_i (M,C_i). (4) 3. P then returns WiW_i to V. 4. V evaluates the challenge-specific witness validity Validwit⁡(Ci,Wi)∈0,1.Valid_wit(C_i,W_i)∈\0,1\. (5) An invalid witness is excluded from subsequent score evaluation. 5. For each valid WiW_i, V submits WiW_i to the MLaaS and obtains yiMLaaS=FMLaaS(Wi).y_i^MLaaS=F^MLaaS(W_i). (6) 6. After the N interactions, V defines ℐval=i∣Validwit⁡(Ci,Wi)=1,I_val= \i _wit(C_i,W_i)=1 \, (7) and Nval=|ℐval|.N_val= |I_val |. (8) Let NminN_ denote the minimum number of valid witnesses required for score aggregation. If Nval<NminN_val<N_ , the session is rejected. Otherwise, for each i∈ℐvali _val, V computes Ei=Eval⁡(Ci,Wi,yiMLaaS),E_i=Eval(C_i,W_i,y_i^MLaaS), (9) where EvalEval denotes the challenge-specific scoring function, and EiE_i is the resulting per-challenge score. Let AggrAggr denote the declared aggregation rule. The valid scores are aggregated as ΓN=Aggr⁡(Eii∈ℐval). _N=Aggr (\E_i\_i _val ). (10) Let τ _O denote the operational acceptance threshold fixed for O before the suspicious configuration is evaluated. The final decision is =0,Nval<Nmin,[ΓN≤τ],Nval≥Nmin. Accept= cases0,&N_val<N_ ,\\ I\! [ _N≤ _O ],&N_val≥ N_ . cases (11) τ _O is calibrated using data prepared independently of the suspicious configuration. Here, ⁡[⋅]I[·] denotes the indicator function, which returns 1 if the enclosed condition is true and 0 otherwise. Its reported operating characteristics apply only to the model population, challenge distribution, response-generation conditions, and deployment conditions represented in the supporting calibration and evaluation. In particular, different choices of ResGenResGen may induce different score distributions for the same (M,Mcloud)(M,M^cloud) configuration. Accordingly, a reported soundness or false-acceptance characterization covers only the choices of ResGenResGen represented in the corresponding evaluation or supported by separate analysis. Standalone non-model response mechanisms remain outside the present model-based soundness scope. The interpretation of acceptance under freshness, network isolation, and the stated model-based scope is developed in Section I-E. I-E Verification Principle TP-CRIV separates four logically distinct elements: the objective-dependent identity distinction, the model-dependent property used to construct challenges, the operational characterization of challenge-solving performance, and the inference obtained by combining matching consistency with the freshness and network-isolation conditions. This separation prevents the verification outcome from defining the identity relation that it is intended to test. I-E1 Operating Situations and Objective-Dependent Identity For each intended verification problem, V specifies two disjoint operating situations, Π1 _1^O and Π0 _0^O, representing configurations regarded as matching and non-matching, respectively. These situations are specified a priori according to the semantic distinction relevant to the intended application and independently of the challenge-response score, calibration threshold, or acceptance outcome. Together, they define the model-identity distinction tested by the verification objective O. The corresponding operating population is Π=Π1∪Π0,Π1∩Π0=∅. ^O= _1^O∪ _0^O, _1^O∩ _0^O= . (12) Thus, model identity is objective dependent and population scoped. TP-CRIV does not posit a universal identity relation over all possible AI models. For convenience, membership in these two situations is encoded by Match⁡(M,Mcloud)=1,(M,Mcloud)∈Π1,0,(M,Mcloud)∈Π0.Match_O (M,M^cloud )= cases1,&(M,M^cloud)∈ _1^O,\\ 0,&(M,M^cloud)∈ _0^O. cases (13) Here, MatchMatch_O introduces no additional notion of identity and is not inferred from the TP-CRIV score. It only records membership in the two situations specified independently for O. For example, one verification objective may declare same-model-instance configurations as matching and selected distinct model instances as non-matching. Within the corresponding Π ^O, this constitutes an exact-instance distinction. Another objective may place designated descendant models in the matching situation and selected outside-lineage models in the non-matching situation, yielding a lineage-oriented distinction. The meaning of identity therefore changes when the declared operating situations change. A configuration outside Π ^O is outside the identity distinction instantiated by O. The protocol may still produce an observable score for such a configuration, but the current objective does not assign it a matching or non-matching label, and the reported operating characteristics do not automatically apply to it. Extending the identity claim to such a configuration requires extending the declared operating situations and establishing corresponding calibration, evaluation, or analysis. The choice of ResGenResGen does not define model identity. The matching and non-matching labels are fixed a priori by Π1 _1^O and Π0 _0^O. Different choices of ResGenResGen may affect observable challenge-solving performance and operating error rates, but they do not change those predeclared identity labels. I-E2 Model-Dependent Property and Challenge-Solving Capability For each model M, let SMS_M denote a selected model-dependent property. Examples include local decision geometry in a classifier, conditional generation behavior in a generative model, or another high-dimensional behavioral structure whose detailed form depends on the model. The selected property does not define Π1 _1^O or Π0 _0^O. Instead, V uses it as a source of model-dependent information from which fresh verification requirements can be constructed. For Π ^O, a useful property is one whose challenge-relevant information enables configurations in Π1 _1^O to solve requirements determined by McloudM^cloud more consistently than configurations in Π0 _0^O under the covered choices of ResGenResGen. For a challenge C=(x,ψ)C=(x,ψ), the requirement ψ is constructed so that a valid low-error solution depends substantially on challenge-relevant aspects of SMcloudS_M^cloud. Such a challenge is referred to as a property-demanding challenge. For each valid witness W, V evaluates the observable score Eval⁡(C,W,FMLaaS(W)),Eval (C,W,F^MLaaS(W) ), which measures how well the returned witness satisfies the issued requirement. V need not reconstruct SMS_M, SMcloudS_M^cloud, or the complete set of successful witnesses. It observes only whether P can use M through ResGenResGen to generate successful responses to newly issued challenges. This capability relation is not deterministic. A configuration in Π1 _1^O may occasionally fail because of numerical, algorithmic, or deployment-side effects. Conversely, a configuration in Π0 _0^O may reproduce sufficient challenge-relevant information to solve some or all challenges. Such success does not change its predeclared class membership. If it is accepted, the event constitutes a false acceptance under the declared objective. Accordingly, the selected property provides the mechanism through which model-dependent information is elicited as an observable challenge-solving capability. Whether this capability actually discriminates the two declared situations must be established operationally rather than assumed from a converse relation between property similarity and model identity. I-E3 Operational Characterization of Challenge-Solving Performance Let CD_C denote the declared distribution from which fresh challenges are drawn, and let ResGenResGen denote the choice covered by the operating characterization. For each b∈0,1b∈\0,1\, let QbQ_b^O denote the declared distribution over model configurations in Πb _b^O used for operational characterization. Sampling (M,Mcloud)∼Qb,(M,M^cloud) Q_b^O, (14) drawing fresh challenges from CD_C, generating responses using ResGenResGen, and applying Eq. (10) induce the observable aggregate-score distribution ΓN∼Pb,ResGen. _N P_b,ResGen^O. (15) These distributions provide an operational characterization of the challenge-solving capability demonstrated by the matching and non-matching populations under the specified conditions. The purpose of the selected property and challenge family is therefore to induce sufficiently distinguishable observable performance between Π1 _1^O and Π0 _0^O. TP-CRIV does not assume a deterministic, one-to-one, or monotone mapping between a latent discrepancy between SMS_M and SMcloudS_M^cloud and the observed aggregate score ΓN _N. Different model configurations may produce similar scores, the same configuration may produce different scores for different sets of fresh challenges, and different choices of ResGenResGen may induce different score distributions for the same model configuration. The relevant question is instead whether the challenge-solving performance induced by the declared matching and non-matching populations is sufficiently separated for the intended operating criterion. Using independent calibration data, V determines τ _O before evaluating the suspicious configuration. Let RG0RG_0 and RG1RG_1 denote the covered choices of ResGenResGen for the non-matching and matching situations, respectively; they may coincide. The corresponding false-acceptance rate (FAR,RG0FAR_O,RG_0) and false-rejection rate (FRR,RG1FRR_O,RG_1) are given as follows: FAR,RG0=Pr(M,Mcloud)∼Q0C1:N∼CN[ΓN≤τ∣RG0],FAR_O,RG_0= _ subarrayc(M,M^cloud) Q_0^O\\ C_1:N _C^N subarray [ _N≤ _O RG_0 ], (16) and FRR,RG1=Pr(M,Mcloud)∼Q1C1:N∼CN[ΓN>τ∣RG1].FRR_O,RG_1= _ subarrayc(M,M^cloud) Q_1^O\\ C_1:N _C^N subarray [ _N> _O RG_1 ]. (17) The probabilities include the randomness of model configuration sampling, fresh challenge generation, and, when applicable, the response-generation algorithm. τ _O provides an operational boundary for interpreting observed challenge-solving performance relative to the declared Π1 _1^O and Π0 _0^O situations. Within the declared operating population, acceptance provides finite-sample empirical evidence that the observed challenge-solving performance is more consistent with the characterized matching population than with the characterized non-matching population. TP-CRIV evaluates evidence for membership in a predeclared identity class rather than defining identity from acceptance. The reported τ _O, FAR, and FRR apply only to the declared operating distributions, CD_C, ResGenResGen, and deployment conditions. Broader claims require corresponding extension of the operating characterization. I-E4 Inference Under Freshness and Network Isolation The calibrated decision characterizes whether the observed challenge-solving performance is consistent with the declared matching situation; by itself, it does not establish whether the response was generated without external assistance. Fresh challenges limit replay based on a small precomputed response set, while the network-isolation condition prevents P from obtaining additional challenge-relevant information from external sources after disclosure. Within the stated model-based response-generation scope, the session responses are generated through ResGen⁡(M,C)ResGen(M,C). If ΓN _N also lies in the calibrated matching region, the observed capability is characteristic of the matching situation within the declared operating scope. These conditions jointly provide an empirical basis for inferring that P possesses a model satisfying the identity specified by O. The inference is conditional on the stated scope and does not establish cryptographic binding, training provenance, or legal ownership. The verifier’s inference process is summarized in Table I. TABLE I: Verifier’s inference process in TP-CRIV. Step Verifier’s observation or inference 1 P repeatedly returns valid low-score witnesses for fresh property-demanding challenges. ⇓ The transcript directly demonstrates finite challenge-solving capability. 2 Freshness limits replay-based strategies, while network isolation excludes online external assistance after challenge disclosure. ⇓ P locally possesses the challenge-solving capability required to generate the demonstrated responses without online external assistance. 3 Under the model-based response-generation scope, the aggregate score lies in the acceptance region calibrated for the declared matching situation. ⇓ The candidate model exhibits matching-consistent challenge-solving performance within the calibrated scope. 4 The combined evidence supports an empirical inference that the claimant possesses a model satisfying the objective-dependent identity. I-F Protocol Requirements A valid TP-CRIV instantiation should satisfy the following requirements under Eq. (11). Objective and Population Specification V must specify the disjoint situations Π1 _1^O and Π0 _0^O before evaluating the suspicious case, independently of the TP-CRIV score, τ _O, or the eventual decision. V must also specify the operating distributions Q1Q_1^O and Q0Q_0^O, CD_C, the choices of ResGenResGen covered by calibration and evaluation, and the criterion used to select τ _O. Π0 _0^O should contain the model configurations that constitute relevant alternatives to the intended identity claim; omitted model classes and unrepresented algorithms remain outside the characterized soundness scope. Completeness Let ϵc _c denote the allowed completeness error. For (M,Mcloud)∼Q1(M,M^cloud) Q_1^O and a covered ResGenResGen, acceptance should occur with high probability: Pr(M,Mcloud)∼Q1C1:N∼CN[=1∣ResGen]≥1−ϵc. _ subarrayc(M,M^cloud) Q_1^O\\ C_1:N _C^N subarray [ Accept=1 ]≥ 1- _c. (18) Here, ϵc _c is the objective-specific false-rejection probability under the declared operating conditions. Soundness Let ϵs _s denote the allowed soundness error. For (M,Mcloud)∼Q0(M,M^cloud) Q_0^O and a covered ResGenResGen, acceptance should occur with low probability: Pr(M,Mcloud)∼Q0C1:N∼CN[=1∣ResGen]≤ϵs. _ subarrayc(M,M^cloud) Q_0^O\\ C_1:N _C^N subarray [ Accept=1 ]≤ _s. (19) Here, ϵs _s is the objective-specific false-acceptance probability under the declared operating conditions. The identity label is independent of ResGenResGen; therefore, acceptance of any configuration assigned to Π0 _0^O is a false acceptance. Property-Demanding Challenge Design Each challenge C=(x,ψ)C=(x,ψ) must contain a fresh requirement whose successful solution depends substantially on model-dependent information associated with SMcloudS_M^cloud. The challenge family should separate the induced score distributions of the relevant matching and non-matching populations at the intended operating point. A fixed witness, a small precomputed response set, or challenge-independent evidence should not yield acceptance with high probability over fresh challenges. Calibration and Threshold Transfer τ _O must be determined from calibration data prepared independently of the suspicious configuration and fixed before that configuration is evaluated. Reported error rates are valid only under the challenge-generation process, validity conditions, aggregation rule, ResGenResGen, and deployment pipeline represented in calibration and evaluation. Freshness and Network Isolation Each Ci∼C_i _C must remain unpredictable before disclosure, and the challenge family should limit reuse of responses across fresh challenges. The network-isolation condition defined above must hold throughout witness generation. Both conditions are required for the inference of Section I-E. IV CNN-Based Instantiation and Feasibility Evaluation This section instantiates the abstract TP-CRIV components for CNN-based image classification under an explicitly bounded experimental setting. The evaluation fixes ResGen=I−FMPCResGen=I 45FMPC for all tested (M,Mcloud)(M,M^cloud) configurations and examines whether the declared matching and non-matching situations induce separable scores and whether a threshold calibrated on separate models transfers to held-out configurations. The results characterize only the operating scope instantiated below. IV-A Verification Objective and Operating Scope We consider a CNN-based feasibility demonstration of TP-CRIV under an explicitly bounded operating scope. Both M and McloudM^cloud are CNN image classifiers. Let ℳevalM_eval denote the finite model pool consisting of ten ImageNet-pretrained CNN model instances: ResNet-18, -34, -101, and -152; VGG-11, -13, -16, and -19; and two ResNet-50 instances using the TorchVision IMAGENET1K_V1 and IMAGENET1K_V2 pretrained weights, respectively [33, 34, 35]. The two ResNet-50 instances are hereafter denoted by ResNet-50 (α)(α) and ResNet-50 (β)(β). They share the same architecture but contain different pretrained parameter sets obtained using different training recipes. The evaluated pool is a heterogeneous set of publicly available pretrained model instances that differ primarily in architecture family, network depth, or pretrained weight configuration. All models perform the same ImageNet classification task and share the same output-label space. For the present feasibility study, the operating population is declared as Π=ℳeval×ℳeval. ^O=M_eval×M_eval. (20) Thus, Π ^O contains all directed (M,Mcloud)(M,M^cloud) configurations formed from the ten models in ℳevalM_eval. Before challenge-response evaluation, the verification objective O declares the following two situations within Π ^O. These declarations are independent of the observed scores and thresholds. Matching situation The first situation is Π1=(M,Mcloud)∈Π|M=Mcloud. _1^O= \(M,M^cloud)∈ ^O\; |\;M=M^cloud \. (21) It contains the 10 same-model directed configurations, which are designated as the identity-satisfying, or matching, situation for the present objective. Non-matching situation The contrasting situation is Π0=(M,Mcloud)∈Π|M≠Mcloud. _0^O= \(M,M^cloud)∈ ^O\; |\;M≠ M^cloud \. (22) It contains the 90 cross-model directed configurations formed from distinct model instances in ℳevalM_eval, which are designated as the non-matching situation. For the finite operating characterization below, Q1Q_1^O and Q0Q_0^O are taken as uniform distributions over the 10 and 90 configurations, respectively. In the present feasibility study, both matching and non-matching provers use ResGen=I-FMPCResGen=I -FMPC. Thus, the reported score distributions and FAR characterize non-matching models that attempt the same fine-grained probability-control task as matching models. Other model-based choices of ResGenResGen are outside the present operating characterization. Together, these situations define an exact-instance distinction scoped to Π ^O. Models outside ℳevalM_eval, including independently trained, fine-tuned [36], pruned [37], quantized [38], extracted, or distilled models, are not assigned a label by this experimental objective and are not characterized by the reported FAR. Each evaluated M is used directly with the fixed ResGenResGen specified above. IV-B Verification Procedure Fig. 3: Verification procedure in the image-classification instantiation of TP-CRIV. V specifies an input image, a fresh probability-control requirement, and a witness-modification constraint. Fig. 3 illustrates the verification procedure. The selected property SMS_M is the local input–probability geometry induced by CNN model M, namely the local relationship between bounded input modifications and the resulting class probability changes. This property guides the construction of challenges whose valid low-error solutions depend on SMcloudS_M^cloud. For each verification interaction, V generates a challenge C=(,ψ),C=( x,ψ), (23) where x is a clean input image and ψ=(c′,pc′target,εval).ψ= (c ,p^target_c , _val ). (24) Let Y denote the output-label space. Here, V selects the target class c′∈c and specifies the required output probability pc′targetp^target_c and the maximum permitted witness modification εval _val. The CD_C used in the experiments is instantiated as follows. x is randomly selected from the ImageNet dataset [39], c′c is randomly selected from the full set of 1000 ImageNet classes, and pc′targetp^target_c is randomly selected from 0.10,0.15,…,0.40.\0.10,0.15,…,0.40\. The witness-validity tolerance is fixed at εval=4/255. _val=4/255. Fresh base inputs are not reused within a verification session. For each session, V draws N fresh challenges according to this distribution, with base inputs sampled without replacement within the session: Ci∼C,i=1,…,N,C_i _C, i=1,…,N, (25) where Ci=(i,ψi)C_i=( x_i, _i) (26) and ψi=(ci′,pci′,itarget,εval). _i= (c _i,p^target_c _i,i, _val ). (27) i,ci′, x_i,c _i, and pci′,itargetp^target_c _i,i are not disclosed before the corresponding challenge is issued. The ResGenResGen evaluated in the main experiments is instantiated by the Iterative Fine-grained Multi-class Probability Control (I-FMPC) procedure, detailed in Section IV-D. Given CiC_i, P applies ResGen=I−FMPCResGen=I 45FMPC to its local model M: iW=ResGen⁡(M,Ci)=I−FMPC⁡(M,Ci). x^W_i=ResGen(M,C_i)=I 45FMPC(M,C_i). (28) ResGenResGen is used for both Π1 _1^O and Π0 _0^O in the reported main experiments. After receiving iW x^W_i from P, V first checks ‖iW−i‖∞≤εval. \| x^W_i- x_i \|_∞≤ _val. (29) Thus, Validwit(Ci,iW)=[‖iW−i‖∞≤εval].Valid_wit(C_i, x^W_i)=I [ \| x^W_i- x_i \|_∞≤ _val ]. (30) The valid-response index set and count are ℐval=i∈1,…,N|Validwit⁡(Ci,iW)=1,Nval=|ℐval|. gatheredI_val= \i∈\1,…,N\\, |\,Valid_wit(C_i, x^W_i)=1 \,\\ N_val= |I_val |. gathered (31) If Nval<NminN_val<N_ , V rejects the session without computing an aggregate score. Otherwise, for each valid witness, V obtains iMLaaS=FMLaaS(iW) p_i^MLaaS=F^MLaaS( x^W_i) (32) and defines the output probability of class ci′c _i as pci′,iMLaaS=FMLaaS(iW)[ci′].p^MLaaS_c _i,i=F^MLaaS( x^W_i)[c _i]. (33) The per-challenge score is Ei=Diprob=|pci′,itarget−pci′,iMLaaS|pci′,itarget.E_i=D_i^prob= |p^target_c _i,i-p^MLaaS_c _i,i |p^target_c _i,i. (34) For Nval≥NminN_val≥ N_ , the aggregate score is ΓN=D¯prob=1Nval∑i∈ℐvalDiprob. _N= D^prob= 1N_val _i _valD_i^prob. (35) The final decision rule is =0,Nval<Nmin,[D¯prob≤τ],Nval≥Nmin. Accept= cases0,&N_val<N_ ,\\ I\! [ D^prob≤ _O ],&N_val≥ N_ . cases (36) Invalid witnesses are excluded from the aggregate, whereas NminN_ prevents acceptance based only on a favorable subset of challenges. τ _O is calibrated from reference configurations drawn from the instantiated operating populations independently of the configuration under evaluation. Table I summarizes the CNN instantiation of TP-CRIV. TABLE I: Instantiation of the proposed TP-CRIV. Component Instantiation O Population-scoped exact-instance distinction within Π ^O ResGenResGen Response-generation algorithm I-FMPC Π1 _1^O Same-model directed configurations in ℳevalM_eval Π0 _0^O Cross-model directed configurations in ℳevalM_eval M Prover’s CNN image classifier McloudM^cloud Deployed MLaaS CNN image classifier FMLaaSF^MLaaS FMLaaS()=Mcloud()F^MLaaS( x)=M^cloud( x) S Local input–probability geometry NminN_ N in the reported CNN evaluation CD_C ImageNet-based fresh probability-control challenges ψ (c′,pc′target,εval)(c ,p^target_c , _val) W W x^W ValidwitValid_wit [∥W−∥∞≤εval]I[\|W- x\|_∞≤ _val] EvalEval DprobD^prob AggrAggr Arithmetic mean over valid per-challenge scores ΓN _N D¯prob D^prob Accept Reject if Nval<NminN_val<N_ ; otherwise accept iff D¯prob≤τ D^prob≤ _O IV-C Verification Principle For the verification objective defined above, the selected model-dependent property should provide challenge-relevant information that induces distinguishable challenge-solving behavior between Π1 _1^O and Π0 _0^O. In particular, under the instantiated challenge distribution and response-generation algorithm, configurations in Π1 _1^O should satisfy requirements determined by McloudM^cloud more consistently than configurations in Π0 _0^O. For this purpose, we select S as the local input–probability geometry, namely the relationship between bounded input modifications and the resulting class-probability changes. Behavior near decision boundaries has been used as model-sensitive information in prior fingerprinting studies [13, 14, 15, 16], which motivates its use here as a property from which discriminative verification requirements can be constructed. Based on this property, V issues fresh probability-control challenges. For a challenge C=(,c′,pc′target,εval)C=( x,c ,p^target_c , _val), P must generate a witness satisfying ‖W−‖∞≤εval \| x^W- x \|_∞≤ _val (37) and FMLaaS(W)[c′]≈pc′target.F^MLaaS( x^W)[c ]≈ p^target_c . (38) The corresponding solution region depends on SMcloudS_M^cloud, whereas P searches for a solution using SMS_M through ResGenResGen. Varying x, c′c , and pc′targetp^target_c therefore probes different local regions and probability levels. For (M,Mcloud)∈Π1(M,M^cloud)∈ _1^O, the same model determines both the search and evaluation geometry. In contrast, for (M,Mcloud)∈Π0(M,M^cloud)∈ _0^O, a witness satisfying the target probability on M need not lie in the corresponding solution region of McloudM^cloud. The procedure therefore induces the observable score distributions P1,ResGenP_1,ResGen^O and P0,ResGenP_0,ResGen^O under the instantiated CD_C and ResGenResGen. The experiments below evaluate whether these distributions are sufficiently separated for threshold calibration and finite-challenge decisions. IV-D Witness Generation Algorithm: I-FMPC For the ResGenResGen characterized in the main experiments, we use I-FMPC. In the CNN-based instantiation of TP-CRIV, the selected property S is the local input–probability geometry. I-FMPC uses white-box information from M to search for a solution to each fresh probability-control challenge. Gradient information has been widely utilized in white-box adversarial-example generation [40, 41, 42] as an efficient mechanism for identifying local output-change directions. I-FMPC uses this information to navigate the local probability geometry of M and locate a witness that reaches the probability level designated by V within the permitted neighborhood. I-FMPC is designed for fine-grained probability control rather than misclassification-oriented optimization. It adjusts each target-class probability toward a specific value through adaptive balancing of the target-class gradients and the gradient of an auxiliary non-target class. Let ′=cj′j=1m⊂T =\c _j\_j=1^m (39) denote the target-class set. The auxiliary class c is then selected as c=arg⁡maxk∈∖′M()[k].c= _k M( x)[k]. (40) Thus, c is the highest-probability class of M among the classes outside ′T . The controlled class set is then defined as =c∪′.T=\c\ . (41) For each cj′∈′c _j , V specifies a target probability pcj′targetp^target_c _j. We denote the set of target probabilities by ′target=pcj′targetj=1m. p^target_T = \p^target_c _j \_j=1^m. (42) The probabilities of the classes in ′T are controlled toward these specified values. When these probabilities exceed their prescribed ranges, the contribution of the auxiliary class c is increased to counterbalance further increases and help maintain a relatively high probability for c. Given an input image x, I-FMPC generates a probability-controlled input W=I-FMPC(M,C) x^W=I -FMPC(M,C) with the primary objective M(W)[cj′]≈pcj′target,j=1,…,m.M( x^W)[c _j]≈ p^target_c _j, j=1,…,m. (43) In addition, the generation algorithm encourages the probability of the auxiliary class c to remain relatively high during probability control. It should be noted that the auxiliary class c is not included in the verification requirement specified by V. Instead, c is selected and used solely by P as an internal aid during witness generation. Let pk()=M⁡()[k]p_k( x)=M( x)[k] denote the softmax probability assigned to class k. For each k∈k , we define L⁡(,k)=−log⁡pk().L( x,k)=- p_k( x). (44) I-FMPC uses the weighted class-wise loss LFMPC(tW)=∑k∈βkL(tW,k),L_FMPC ( x^W_t )= _k β^kL ( x^W_t,k ), (45) where βkβ^k controls the contribution of class k to the combined input gradient. The target-class terms increase the probabilities of cj′∈′c _j , while the term for c counterbalances their excessive increases. The iterative update rule of I-FMPC is given by 0W=,t+1W=Clip,εgen⁡tW−αcomsign⁡(∇LFMPC(tW))=Clip,εgen⁡tW−αcomsign⁡(∑k∈βk∇L(tW,k)). gathered x^W_0= x,\\[3.0pt] x^W_t+1=Clip_ x, _gen \ x^W_t-α^comsign ( _ xL_FMPC ( x^W_t ) ) \\\[3.0pt] =Clip_ x, _gen \ x^W_t-α^comsign ( _k β^k _ xL ( x^W_t,k ) ) \. gathered (46) Here, αcomα^com denotes the common update step size, and βiβ^i controls the contribution of class i to the combined gradient. It should be noted that the class-wise loss L⁡(,i)L( x,i) does not directly contain the target probability pcj′targetp^target_c _j. Instead, I-FMPC realizes fine-grained probability matching through the adaptive control mechanism summarized in Algorithm 1. In the algorithm, FMPC⁡(⋅)FMPC(·) denotes one input-update step defined in Eq. (46). For each target class cj′c _j, the corresponding weight βcj′β^c _j is increased when its recent average probability remains below the prescribed target range. Conversely, when at least one target-class probability exceeds its prescribed range while all target-class probabilities remain above their lower bounds, the weight βcβ^c of the auxiliary non-target class is increased to counterbalance the excessive increase in the target-class probabilities and help maintain a relatively high probability for c. Once all target-class probabilities enter the neighborhood of their specified values, the common step size αcomα^com is reduced for finer convergence. Thus, I-FMPC achieves probability matching by adaptively balancing the class-wise cross-entropy gradients and refining the update step near the target region, rather than by directly minimizing a probability-distance loss. Algorithm 1 I-FMPC: Iterative Fine-grained Multi-class Probability Control 1: Input image x, model M with output-label space Y, target class set ′=cj′j=1mT =\c _j\_j=1^m, target probabilities ′target=pcj′targetj=1m p^target_T =\p^target_c _j\_j=1^m, shared step size αcomα^com, generation perturbation budget εgen _gen, averaging interval l, tolerance TdiffT^diff, maximum iterations tmaxt , minimum step threshold αth _th, step decay factor γ∈(0,1)γ∈(0,1) 2: Probability-controlled input W x^W 3: 0W= x^W_0= x 4: c←arg⁡maxk∈∖′M()[k]c← _k M( x)[k] 5: ←c∪′T←\c\ 6: W=0W x^W= x^W_0 7: βi←1,∀i∈β^i← 1, ∀ i 8: for t=1t=1 to tmaxt do 9: tW=FMPC⁡(t−1W,,M,αcom,βii∈,εgen) x^W_t=FMPC ( x^W_t-1, x,M,α^com,\β^i\_i , _gen ) 10: W←tW x^W← x^W_t 11: t=M⁡(tW) p_t=M( x^W_t) 12: if tmodl=0t l=0 then 13: mean=1l∑k=t−l+1tk p^mean= 1l _k=t-l+1^t p_k 14: for each j=1j=1 to m do 15: if pcj′mean<(1−Tdiff)pcj′targetp^mean_c _j<(1-T^diff)p^target_c _j then 16: βcj′←βcj′+1β^c _j←β^c _j+1 17: end if 18: end for 19: if (∃j∈1,…,m:pcj′mean>(1+Tdiff)pcj′target) (∃ j∈\1,…,m\:p^mean_c _j>(1+T^diff)p^target_c _j ) and (∀j∈1,…,m:pcj′mean>(1−Tdiff)pcj′target) (∀ j∈\1,…,m\:p^mean_c _j>(1-T^diff)p^target_c _j ) then 20: βc←βc+1β^c←β^c+1 21: end if 22: if maxj∈1,…,m⁡|pcj′mean−pcj′targetpcj′target|≤Tdiff _j∈\1,…,m\ | p^mean_c _j-p^target_c _jp^target_c _j |≤ T^diff then 23: αcom←γαcomα^com←γα^com 24: end if 25: if αcom<αthα^com< _th then 26: break 27: end if 28: end if 29: end for 30: return W x^W TABLE IV: I-FMPC settings used for the representative probability-control trajectories in Fig. 4. TdiffT^diff εgen _gen αcomα^com ′target p^target_ c m=1m=1 ×10−31\!×\!10^-3 4/2554/255 ×10−31\!×\!10^-3 0.30\0.30\ m=2m=2 ×10−31\!×\!10^-3 12/25512/255 ×10−35\!×\!10^-3 0.30, 0.15\0.30,\,0.15\ m=3m=3 ×10−33\!×\!10^-3 12/25512/255 ×10−35\!×\!10^-3 0.30, 0.15, 0.10\0.30,\,0.15,\,0.10\ TABLE V: Common hyperparameter settings for I-FMPC. Hyperparameter Setting Maximum iterations tmaxt 10,00010,000 Averaging interval l 55 Minimum step threshold αth _th 1×10−101× 10^-10 Step decay factor γ 0.50.5 (a) m=1m=1 (b) m=2m=2 (c) m=3m=3 Fig. 4: Trajectory of output probabilities pk,tp_k,t for the controlled classes k∈k over iterations t, where tW x^W_t denotes the image generated by I-FMPC at iteration t and pk,t=M⁡(tW)[k]p_k,t=M( x^W_t)[k]. The probabilities of the target classes in ′T converge toward their designated values, while the auxiliary class c selected by P maintains a relatively high probability throughout the illustrated trajectories. In the experiments presented in this paper, we employ the dual-class configuration (m=1m=1). For each target class c′c specified by V, P selects c=arg⁡maxk∈∖c′M()[k]c= _k \c \M( x)[k] (47) as the auxiliary competing class. I-FMPC then controls the probability of c′c toward pc′targetp^target_c while using c to counterbalance excessive changes in the target-class probability. To illustrate the behavior of I-FMPC, Fig. 4 presents representative probability trajectories for m=1,2,m=1,2, and 33. The corresponding configuration-dependent hyperparameter settings are summarized in Table IV, while the common hyperparameter settings used throughout the evaluations are listed in Table V. As shown in Fig. 4, the target-class probabilities approach their specified values, while the auxiliary class provides a counterbalancing contribution during probability control. By utilizing gradient information derived from M, I-FMPC enables P to search for a witness satisfying the fresh requirement ψ specified by V. The algorithm therefore realizes ResGenResGen by using SMS_M to construct a candidate solution. Whether this candidate also satisfies the requirement on McloudM^cloud is then evaluated through FMLaaSF^MLaaS. Thus, I-FMPC operationalizes the central TP-CRIV principle: information about the selected property is not compared directly, but is used to solve a challenge whose valid solution is determined by that property. IV-E Feasibility Assessment This subsection empirically characterizes the challenge-induced score behavior of the instantiated operating populations Π1 _1^O and Π0 _0^O under CD_C and ResGenResGen specified above. Specifically, we examine whether I-FMPC can solve the property-demanding challenges for configurations in Π1 _1^O, whether the resulting scores are separated from those obtained for configurations in Π0 _0^O, and whether a threshold estimated from calibration configurations transfers to held-out configurations within the same operating world. IV-E1 Experimental Setting The evaluation includes all 10 configurations in Π1 _1^O and all 90 configurations in Π0 _0^O constructed from ℳevalM_eval. For both Π1 _1^O and Π0 _0^O, ResGen=I−FMPCResGen=I 45FMPC is fixed. Importantly, the non-matching configurations use the same fine-grained probability-control algorithm and optimize the same target probability specified by V on their respective models. P uses the generation budget εgen=εval=4255. _gen= _val= 4255. (48) Witnesses are generated using the m=1m=1 configuration of I-FMPC. The configuration-dependent parameters are reported in Table IV, while the shared stopping and step-control parameters are listed in Table V. The target probability specified by V is sampled per challenge as described in the verification procedure above. All witnesses generated in the model-pair and threshold-calibration experiments satisfied ‖W−‖∞≤εgen≤εval, \| x^W- x \|_∞≤ _gen≤ _val, (49) and I-FMPC reached its stopping condition before the maximum iteration limit. Therefore, all returned witnesses were valid and included in the subsequent score evaluation. Consequently, Nval=N_val=N for every verification trial reported below. For this CNN instantiation, we set Nmin=N,N_ =N, so a session cannot be accepted by returning valid witnesses only for a favorable subset of the issued challenges. To further characterize the generated witnesses, we measured their perceptual similarity to the corresponding base images. Across the ten evaluated models, the mean SSIM [43] ranged from 0.98900.9890 to 0.99330.9933, the mean LPIPS [44] from 0.00240.0024 to 0.00560.0056, and the mean RMSE from 0.00490.0049 to 0.00600.0060. These results indicate that the probability-control requirements are satisfied using only small and perceptually subtle modifications to the base images. IV-E2 Observable Separation Induced by Property-Demanding Challenges To characterize the score behavior induced by Π1 _1^O and Π0 _0^O, we generate 100 fresh challenges sampled according to CD_C for each directed configuration in Π1∪Π0. _1^O∪ _0^O. For every challenge, ResGen=I−FMPCResGen=I 45FMPC is applied to M. Thus, matching and non-matching configurations use the same probability-control objective and algorithm; only the relationship between the local and deployed models changes. For each directed model configuration, the per-challenge discrepancies are aggregated as Γ100=D¯prob=1100∑i=1100Diprob. _100= D^prob= 1100 _i=1^100D_i^prob. (50) Fig. 5 shows the resulting D¯prob D^prob for all evaluated configurations. Fig. 5: Heatmap of D¯prob D^prob for the evaluated directed model configurations. The diagonal entries correspond to same-model configurations, whereas the off-diagonal entries correspond to cross-model configurations. For configurations in Π1 _1^O, represented by the diagonal entries, D¯prob D^prob remains close to zero. Because M=McloudM=M^cloud, I-FMPC uses the same local probability information that determines the challenge solution on McloudM^cloud. These results therefore demonstrate that the selected challenge family is consistently solvable for Π1 _1^O under the specified ResGenResGen. By contrast, all configurations in Π0 _0^O, represented by the off-diagonal entries, exhibit substantially larger values of D¯prob D^prob. For these configurations, I-FMPC locates a solution with respect to the local input–probability geometry of M, whereas the requirement is evaluated on McloudM^cloud. The resulting witness therefore generally fails to reach the probability designated by V on McloudM^cloud. Thus, under the instantiated CD_C and ResGenResGen, the evaluated property-demanding challenge family induces observable separation between the score behavior of Π1 _1^O and Π0 _0^O. The heatmap does not represent a direct distance between complete model decision landscapes. It represents finite-challenge solving error produced by the declared challenge-response procedure. The 100-challenge experiment characterizes separation within Π ^O only. The next experiment examines whether this separation supports binary decisions with fewer fresh challenges. IV-E3 Finite-Challenge Verification and Threshold Calibration The preceding experiment shows observable separation between the score behavior induced by Π1 _1^O and Π0 _0^O under the instantiated CD_C and ResGenResGen. We next examine whether this separation can be converted into finite-challenge binary decisions using an operational threshold calibrated independently of the configuration under evaluation. To emulate threshold determination by V, the ten models in ℳevalM_eval are divided into calibration and held-out model sets. For each calibration setting, three models are selected as calibration models held by V, while the remaining seven models are reserved for held-out evaluation. All (103)=120 103=120 possible selections of the three calibration models are evaluated. For each selection, the same-model directed configurations induced by the three calibration models form the calibration subset of Π1 _1^O, whereas the cross-model directed configurations among those models form the calibration subset of Π0 _0^O. The corresponding configurations induced by the seven remaining models are used for held-out evaluation. Thus, calibration and held-out evaluation use disjoint model subsets while preserving the same population-scoped identity objective, CD_C, ResGenResGen, and decision rule. The 100 available challenge samples are randomly divided into two disjoint sets of 50 calibration challenges and 50 test challenges. The calibration challenges are used only for threshold determination, whereas the test challenges are used only for held-out finite-challenge evaluation. For threshold calibration, we fix the calibration aggregation size to Ncal=10.N_cal=10. For each calibration-model configuration, non-overlapping groups of NcalN_cal calibration challenges are formed, and the corresponding aggregate score is ΓNcal=1Ncal∑i=1NcalDiprob. _N_cal= 1N_cal _i=1^N_calD_i^prob. (51) The matching and non-matching calibration configurations therefore induce empirical distributions of ΓNcal _N_cal using only models held by V and calibration challenges. τ _O is selected as τ=max⁡ΓNcalsame+min⁡ΓNcalcross2, _O= _N_cal^same+ _N_cal^cross2, (52) where the maximum same-model score and minimum cross-model score are computed using only the calibration configurations and calibration challenges. If the calibration distributions are separated such that max⁡ΓNcalsame<min⁡ΓNcalcross _N_cal^same< _N_cal^cross, τ _O is selected as the midpoint between these two values. Otherwise, τ _O is selected as the operating point that minimizes the absolute difference between the false-acceptance and false-rejection rates on the calibration data. Importantly, in this experiment the resulting τ _O is determined once for each calibration-model selection and is intentionally kept fixed as the number of verification challenges changes. For held-out evaluation, we consider N∈1,3,5,10.N∈\1,3,5,10\. For each evaluated value of N, non-overlapping groups of N test challenges are used to construct one verification trial. With 50 held-out test challenges, this yields 50, 16, 10, and 5 complete groups per directed model configuration for N=1,3,5,N=1,3,5, and 1010, respectively. For N=3N=3, the two remaining challenges are not used in a complete group. V computes ΓN=1N∑i=1NDiprob. _N= 1N _i=1^ND_i^prob. (53) Because Nval=Nmin=N_val=N_ =N for every trial in this evaluation, the general acceptance rule in Eq. (36) reduces to =1⟺ΓN≤τ. Accept=1 _N≤ _O. (54) Accordingly, the same τ _O is applied to Γ1 _1, Γ3 _3, Γ5 _5, and Γ10 _10 within each calibration-model selection. For statistical reporting, one verification trial is defined as one value of ΓN _N obtained from one directed model configuration and one non-overlapping group of N held-out test challenges under one fixed calibration-model selection. Acceptance of a configuration in Π0 _0^O is counted as a false acceptance, whereas rejection of a configuration in Π1 _1^O is counted as a false rejection. Trials constructed from the same directed model configuration are not regarded as independent model-level samples. For each of the 120 calibration-model selections, FAR, FRR, and AUC are computed separately using the corresponding seven held-out models and test challenges. Across the 120 calibration-model selections, the fixed threshold calibrated using Ncal=10N_cal=10 has a mean of 0.48680.4868, a standard deviation of 0.01140.0114, and a range from 0.46530.4653 to 0.50350.5035. This variation reflects the choice of the three calibration models held by V. Table VI reports the held-out finite-challenge results obtained using these fixed thresholds. FAR, FRR, and AUC are computed separately for each of the 120 calibration-model selections. Because the 120 calibration-model selections overlap, we report the distribution of FAR and FRR across selections. TABLE VI: Held-out finite-challenge verification using a fixed operational threshold calibrated with Ncal=10N_cal=10. For each of the 120 calibration-model selections, the resulting τ _O is applied unchanged to all evaluated values of N. The reported FAR and FRR are the median and range over the 120 selections. N Error rate across selections median [min, max] Min. AUC 1 FAR: 0 [0, 0]% FRR: 0 [0, 0]% 1.000 3 FAR: 0 [0, 0]% FRR: 0 [0, 0]% 1.000 5 FAR: 0 [0, 0]% FRR: 0 [0, 0]% 1.000 10 FAR: 0 [0, 0]% FRR: 0 [0, 0]% 1.000 No false acceptance or false rejection was observed for any of the 120 calibration-model selections or for any evaluated value of N∈1,3,5,10N∈\1,3,5,10\. Accordingly, the median, minimum, and maximum of the split-specific FAR and FRR are all zero. The minimum split-specific AUC is also 1.000 for every evaluated value of N. Thus, even for N=1N=1, the fixed threshold calibrated from Γ10 _10 on the calibration models held by V separated all evaluated matching and non-matching held-out trials. In the present experiment, the observable separation is sufficiently large that perfect held-out classification is retained for all evaluated values of N. However the 120 calibration-model selections should not be interpreted as 120 independent experimental replications. Because the selections overlap, each same-model directed configuration appears in the held-out set for (93)=84 93=84 selections, whereas each cross-model directed configuration appears in the held-out set for (83)=56 83=56 selections. The same challenge instances are also reused across different calibration-model selections. The split-specific results therefore constitute an exhaustive sensitivity analysis with respect to the choice of calibration models rather than independent estimates from randomly repeated experiments. At the distinct-configuration level, the held-out evaluations collectively cover all 10 elements of Π1 _1^O and all 90 elements of Π0 _0^O. None of the 90 non-matching configurations was accepted under any calibration-model selection in which that configuration was held out. Similarly, none of the 10 matching configurations was rejected. Thus, the observed zero-error result is shared by all distinct configurations in the instantiated operating populations and is not produced solely by pooling repeated challenge-level observations. These results indicate that, within the instantiated operating world, the observable separation characterized in Fig. 5 can be converted into finite-challenge decisions using a fixed operational threshold estimated from separate models held by V. Accordingly, when V observes an accepted verification result for a suspicious configuration, the demonstrated challenge-solving performance is interpreted as being more consistent with Π1 _1^O than with Π0 _0^O within the calibrated scope. Together with freshness, network isolation, and the model-based response-generation assumption, this provides an empirical basis for inferring that P locally possesses a model satisfying the declared identity relative to McloudM^cloud. The absence of false rejection provides empirical evidence of finite-challenge completeness for Π1 _1^O under the evaluated response-generation setting, whereas the absence of false acceptance provides empirical evidence of soundness-related behavior for Π0 _0^O under the same condition. The reported empirical FAR and FRR summarize the observed finite-challenge error behavior of the evaluated configurations under the instantiated CD_C, ResGenResGen, and deployment pipeline. They should not be interpreted as population-level guarantees for model configurations or response-generation algorithms outside this experimental scope. The model configurations also share constituent models and should not be regarded as independent draws from a broader population of AI models. Accordingly, the results do not provide a universal threshold guarantee, a broader population-level confidence interval, or proof that every non-matching model must fail the selected challenge family. IV-E4 Assessment of the Protocol Requirements The evaluated CNN instantiation satisfies the abstract requirements within the declared experimental scope as follows. Completeness For Π1 _1^O, M=McloudM=M^cloud and ResGen=I−FMPCResGen=I 45FMPC. Table VI reports no held-out rejection for any evaluated N. These observations provide empirical evidence of finite-challenge completeness for Π1 _1^O. Soundness For Π0 _0^O, the same ResGenResGen searches using SMS_M while the requirement is evaluated using McloudM^cloud. Table VI reports no false acceptance for any evaluated N. This soundness-related evidence applies only to the 90 declared non-matching configurations and the fixed ResGenResGen used in the experiment. Property-Demanding Challenge Design Each CiC_i varies i x_i, ci′c _i, and pci′,itargetp^target_c _i,i, and each valid WiW_i must remain within εval _val of i x_i. Fig. 5 shows that, for configurations in Π1 _1^O, the resulting witnesses consistently satisfy the specified fine-grained probability requirements on McloudM^cloud, whereas for configurations in Π0 _0^O, the witnesses generally fail to transfer the same requirements to McloudM^cloud. Witness Validity All reported witnesses satisfy εgen≤εval _gen≤ _val, yielding Nval=N_val=N in every reported trial. With Nmin=N_ =N, acceptance therefore cannot be obtained by returning valid witnesses only for a favorable subset of challenges. Freshness and Network Isolation Base inputs are not reused within a session and the remaining challenge components are freshly sampled from CD_C. The operational interpretation additionally assumes the network-isolation condition of Section I. Together with the calibrated matching decision, these conditions satisfy the freshness and network-isolation requirement within the evaluated model-based scope. V Concluding Remarks This paper proposed TP-CRIV, a challenge-response framework for third-party identity verification of AI models deployed through remote services. TP-CRIV considers a setting in which the verifier V has neither white-box nor API access to the claimant’s model M, interacts with the suspicious deployed model McloudM^cloud only through its ordinary black-box service interface, and requires no protocol-specific cooperation from the service provider. Under these conditions, TP-CRIV enables V to obtain empirical evidence as to whether the prover P locally possesses a model satisfying the identity specified by the intended verification objective O. For each O, matching and non-matching operating situations, Π1 _1^O and Π0 _0^O, are specified a priori. A model-dependent property S is then used to construct fresh property-demanding challenges, and the resulting challenge-solving performance is interpreted using calibration on independent reference configurations. Within the model-based response-generation scope, freshness and network isolation exclude online external assistance after challenge disclosure. Matching-consistent performance therefore provides an empirical basis for inferring that the prover P possesses a model satisfying the identity declared by O. This inference is statistical and does not establish training provenance or legal ownership. We instantiated TP-CRIV using ten ImageNet-pretrained CNN models with ResGen=I−FMPCResGen=I 45FMPC. Within the evaluated operating population Π ^O, same-model configurations were assigned to Π1 _1^O, whereas cross-model configurations were assigned to Π0 _0^O. The two situations exhibited clear score separation, and independently calibrated thresholds produced no observed false acceptance or false rejection for N∈1,3,5,10N∈\1,3,5,10\ across all 120 calibration-model selections. These results demonstrate feasibility within the explicitly evaluated operating scope rather than universal soundness over arbitrary models or response-generation mechanisms. Several directions remain for extending the framework and its operational guarantees. • Broader operating populations: Future implementations should extend both Π1 _1^O and Π0 _0^O according to the intended verification objective O. These populations may include independently trained, fine-tuned, pruned, quantized, extracted, distilled, and otherwise transformed models, with each configuration assigned to the matching or non-matching situation according to the identity semantics of O. For example, a transformed model may belong to Π0 _0^O under an exact-instance objective but to Π1 _1^O under a lineage-oriented objective. Broader populations would enable more reliable characterization of FAR, FRR, threshold transfer, and soundness within the declared operating scope. • Broader non-matching prover strategies: Future work should consider a broader range of response-generation strategies ResGenResGen available to provers whose model configurations belong to Π0 _0^O. Even for the same non-matching configuration, stronger optimization, ensemble-based strategies, or other model-based procedures may change challenge-solving performance and false-acceptance behavior. A further extension is to consider non-model response mechanisms, such as learned challenge-to-witness generators, which lie outside the present model-based response-generation and soundness scope. • Challenge design and deployment conditions: Future work should investigate challenge-selection strategies, the relationship between challenge diversity and the number of challenges N, practical enforcement or auditing of network isolation, and robustness to service-side preprocessing, model modification, and stochastic inference. • Broader AI-model instantiations: Future work should instantiate and evaluate TP-CRIV for a wider range of AI model types, including generative, language, multimodal, and other AI systems. For each model type, suitable model-dependent properties SMS_M, property-demanding challenge families, and response-generation algorithms ResGenResGen should be identified and evaluated according to the intended verification objective O and operating scope. References [1] Y. Li, H. Wang, and M. Barni (2021) A survey of deep neural network watermarking techniques. Neurocomputing 461, p. 171–193. External Links: Document, Link Cited by: §I, §I, §I-A1. [2] Y. Sun, T. Liu, P. Hu, Q. Liao, S. Fu, N. Yu, D. Guo, Y. Liu, and L. Liu (2023) Deep intellectual property protection: a survey. arXiv preprint arXiv:2304.14613. External Links: 2304.14613, Link Cited by: §I. [3] F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart (2016) Stealing machine learning models via prediction apis. In Proc. 25th USENIX Security Symposium, p. 601–618. Cited by: §I, §I-C. [4] T. Orekondy, B. Schiele, and M. Fritz (2019) Knockoff nets: stealing functionality of black-box models. In Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 4949–4958. Cited by: §I. [5] Y. Uchida, Y. Nagai, S. Sakazawa, and S. Satoh (2017) Embedding watermarks into deep neural networks. In Proc. ACM International Conference on Multimedia Retrieval, p. 269–277. Cited by: §I, §I-A1. [6] H. Chen, B. Darvish Rouhani, C. Fu, J. Zhao, and F. Koushanfar (2019) DeepMarks: a secure fingerprinting framework for digital rights management of deep learning models. In Proceedings of the 2019 International Conference on Multimedia Retrieval, p. 105–113. External Links: Document Cited by: §I, §I-A1. [7] Y. Adi, C. Baum, M. Cissé, B. Pinkas, and J. Keshet (2018) Turning your weakness into a strength: watermarking deep neural networks by backdooring. In Proc. 27th USENIX Security Symposium, p. 1615–1631. Cited by: §I, §I-A1. [8] B. D. Rouhani, H. Chen, and F. Koushanfar (2019) DeepSigns: an end-to-end watermarking framework for ownership protection of deep neural networks. In Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), p. 485–497. External Links: Document, Link Cited by: §I, §I-A1. [9] E. Le Merrer, P. Pérez, and G. Trédan (2020) Adversarial frontier stitching for remote neural network watermarking. Neural Computing and Applications 32 (13), p. 9233–9244. External Links: Document Cited by: §I, §I-A1. [10] P. Fernandez, G. Couairon, H. Jégou, M. Douze, and T. Furon (2023) The stable signature: rooting watermarks in latent diffusion models. In 2023 IEEE/CVF International Conference on Computer Vision (ICCV), Vol. , p. 22409–22420. External Links: Document Cited by: §I, §I-A1. [11] H. Liu, W. Zhang, B. Li, B. Ghanem, and J. Schmidhuber (2024) Lazy layers to make fine-tuned diffusion models more traceable. arXiv preprint arXiv:2405.00466. Cited by: §I, §I-A1. [12] R. Zhang, S. S. Hussain, P. Neekhara, and F. Koushanfar (2024) REMARK-LLM: a robust and efficient watermarking framework for generative large language models. In 33rd USENIX Security Symposium (USENIX Security 24), p. 1813–1830. External Links: Link Cited by: §I, §I-A1. [13] X. Cao, J. Jia, and N. Z. Gong (2021) IPGuard: protecting intellectual property of deep neural networks via fingerprinting the classification boundary. In Proc. ACM Asia Conference on Computer and Communications Security (AsiaCCS), p. 14–25. Cited by: §I, §I-A2, §IV-C. [14] J. Zhao, Q. Hu, G. Liu, X. Ma, F. Chen, and M. M. Hassan (2020) AFA: adversarial fingerprinting authentication for deep neural networks. Comput. Commun. 150 (C), p. 488–497. External Links: ISSN 0140-3664, Link, Document Cited by: §I, §I-A2, §IV-C. [15] N. Lukas, Y. Zhang, and F. Kerschbaum (2021) Deep neural network fingerprinting by conferrable adversarial examples. In 9th International Conference on Learning Representations, ICLR 2021, External Links: Link Cited by: §I, §I-A2, §IV-C. [16] S. Wang and C.-H. Chang (2021) Fingerprinting deep neural networks – a deepfool approach. In Proc. IEEE International Symposium on Circuits and Systems (ISCAS), p. 1–5. Cited by: §I, §I-A2, §IV-C. [17] Q. Li and G. Xu (2026) Deep neural network fingerprinting by general examples. Neurocomputing 665, p. 132184. External Links: Document, Link Cited by: §I, §I-A2. [18] Z. Peng, S. Li, G. Chen, C. Zhang, H. Zhu, and M. Xue (2022) Fingerprinting deep neural networks globally via universal adversarial perturbations. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Vol. , p. 13420–13429. External Links: Document Cited by: §I, §I-A2. [19] M. Gubri, D. Ulmer, H. Lee, S. Yun, and S. J. Oh (2024) TRAP: targeted random adversarial prompt honeypot for black-box identification. In Findings of the Association for Computational Linguistics: ACL 2024, p. 11496–11517. External Links: Document, Link Cited by: §I, §I-A2. [20] A. Godinot, E. L. Merrer, C. Penzo, F. Taïani, and G. Trédan (2025) Queries, representation & detection: the next 100 model fingerprinting schemes. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 39, p. 16817–16825. External Links: Document, Link Cited by: §I, §I-A2. [21] Y. Li, Z. Zhang, B. Liu, Z. Yang, and Y. Liu (2021) ModelDiff: testing-based DNN similarity comparison for model reuse detection. In Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), p. 139–151. External Links: Document, Link Cited by: §I, §I-B. [22] J. Chen, J. Wang, T. Peng, Y. Sun, P. Cheng, S. Ji, X. Ma, B. Li, and D. Song (2022) Copy, right? a testing framework for copyright protection of deep learning models. In 2022 IEEE Symposium on Security and Privacy (SP), p. 824–841. External Links: Document, Link Cited by: §I, §I-B. [23] R. Yu and X. Wang (2024) Neural lineage. In 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 4797–4807. External Links: Document, Link Cited by: §I, §I-B. [24] I. Nikolic, T. Baluta, and P. Saxena (2025) Model provenance testing for large language models. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, External Links: Link Cited by: §I, §I-B. [25] Z. Ghodsi, T. Gu, and S. Garg (2017) SafetyNets: verifiable execution of deep neural networks on an untrusted cloud. In Proceedings of the 31st International Conference on Neural Information Processing Systems, p. 4675–4684. External Links: Link Cited by: §I, §I-C. [26] C. Weng, K. Yang, X. Xie, J. Katz, and X. Wang (2021) Mystique: efficient conversions for Zero-Knowledge proofs with applications to machine learning. In 30th USENIX Security Symposium (USENIX Security 21), p. 501–518. External Links: ISBN 978-1-939133-24-3, Link Cited by: §I, §I-C. [27] T. Liu, X. Xie, and Y. Zhang (2021) zkCNN: zero knowledge proofs for convolutional neural network predictions and accuracy. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, p. 2968–2985. External Links: Document Cited by: §I, §I-C. [28] S. Lee, H. Ko, J. Kim, and H. Oh (2024) vCNN: verifiable convolutional neural network based on zk-SNARKs. IEEE Transactions on Dependable and Secure Computing 21 (4), p. 4254–4270. External Links: Document Cited by: §I, §I-C. [29] B. Chen, S. Waiwitlikhit, I. Stoica, and D. Kang (2024) ZKML: an optimizing system for ML inference in zero-knowledge proofs. In Proceedings of the Nineteenth European Conference on Computer Systems, p. 560–574. External Links: Document, ISBN 979-8-4007-0437-6 Cited by: §I, §I-C. [30] W. Qu, Y. Sun, X. Liu, T. Lu, Y. Guo, K. Chen, and J. Zhang (2025) zkGPT: an efficient non-interactive zero-knowledge proof framework for LLM inference. In 34th USENIX Security Symposium (USENIX Security 25), Seattle, WA, p. 2045–2063. External Links: ISBN 978-1-939133-52-6, Link Cited by: §I, §I-C. [31] T. Sano, M. Kuribayashi, M. Sakai, S. Isobe, and E. Koizumi (2025) Ownership verification of dnn models using white-box adversarial attacks with specified probability manipulation. In Proc. European Signal Processing Conference (EUSIPCO), p. 795–799. Cited by: 2nd item. [32] G. Hinton, O. Vinyals, and J. Dean (2015) Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531. Cited by: §I-C. [33] K. He, X. Zhang, S. Ren, and J. Sun (2016) Deep residual learning for image recognition. In Proc. IEEE Conference on Computer Vision and Pattern Recognition (CVPR), p. 770–778. Cited by: §IV-A. [34] K. Simonyan and A. Zisserman (2014) Very deep convolutional networks for large-scale image recognition. CoRR abs/1409.1556. External Links: Link Cited by: §IV-A. [35] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. Köpf, E. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and S. Chintala (2019) PyTorch: an imperative style, high-performance deep learning library. In Proceedings of the 33rd International Conference on Neural Information Processing Systems, Cited by: §IV-A. [36] J. Yosinski, J. Clune, Y. Bengio, and H. Lipson (2014) How transferable are features in deep neural networks?. In Advances in Neural Information Processing Systems, Vol. 2, p. 3320–3328. Cited by: §IV-A. [37] S. Han, J. Pool, J. Tran, and W. J. Dally (2015) Learning both weights and connections for efficient neural network. In Advances in Neural Information Processing Systems, Vol. 1, p. 1135–1143. Cited by: §IV-A. [38] B. Jacob, S. Kligys, B. Chen, M. Zhu, M. Tang, A. Howard, H. Adam, and D. Kalenichenko (2018) Quantization and training of neural networks for efficient integer-arithmetic-only inference. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), p. 2704–2713. External Links: Document Cited by: §IV-A. [39] J. Deng, W. Dong, R. Socher, L. J. Li, K. Li, and L. Fei-Fei (2009) ImageNet: a large-scale hierarchical image database. In Proc. IEEE Conference on Computer Vision and Pattern Recognition (CVPR), p. 248–255. Cited by: §IV-B. [40] I. J. Goodfellow, J. Shlens, and C. Szegedy (2015) Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. Cited by: §IV-D. [41] A. Kurakin, I. Goodfellow, and S. Bengio (2017) Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533. Cited by: §IV-D. [42] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu (2018) Towards deep learning models resistant to adversarial attacks. In Proc. International Conference on Learning Representations (ICLR), Cited by: §IV-D. [43] Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli (2004) Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing 13 (4), p. 600–612. Cited by: §IV-E1. [44] R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang (2018) The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), p. 586–595. External Links: Document Cited by: §IV-E1.

Instant research discovery