{'fraction_non_alphanumeric': 0.03796884016156953, 'fraction_numerical': 0.0173398730525101, 'mean_word_length': 4.647873553853675, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 1, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 55, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
UTAF: A Universal Approach to Task-Agnostic Model Fingerprinting

Protecting the intellectual property (IP) of deep neural networks (DNN) becomes an urgent concern for IT corporations. For model piracy forensics, previous model fingerprinting schemes are commonly based on adversarial examples constructed for the owner’s model as the fingerprint, and verify whether a suspect model is indeed pirated from the original model by matching the behavioral pattern on the fingerprint examples between one another. However, these methods heavily rely on the characteristics of classification tasks which inhibits their application to more general scenarios. To address this issue, we present Universal Task-Agnostic Fingerprinting (UTAF), the first task-agnostic model fingerprinting framework which enables fingerprinting on a much wider range of DNNs independent from the downstream learning task, and exhibits strong robustness against a variety of ownership obfuscation techniques. Specifically, we generalize previous schemes into two critical design components in UTAF: the adaptive fingerprint and the meta-verifier, which are jointly optimized such that the meta-verifier learns to determine whether a suspect model is stolen based on the concatenated outputs of the suspect model on the adaptive fingerprint. As a key of being task-agnostic, the full process makes no assumption on the model internals in the ensemble only if they have the same input and output dimensions. Spanning classification, regression and generative modeling, extensive experimental results validate the substantially improved performance of UTAF over the state-of-the-art fingerprinting schemes and demonstrate the enhanced generality of UTAF for providing task-agnostic fingerprinting. For example, on fingerprinting ResNet-18 trained for skin cancer diagnosis, UTAF achieves simultaneously 100% true positives and 100% true negatives on a diverse test set of 70 suspect models, achieving an about 220% relative improvement in ARUC in comparison to the optimal baseline.


Introduction
In the past decades, deep learning finds a wide application in a variety of mission-critical scenarios in the real world, including autonomous driving (Cao, Xiao et al. 2019), finance (Heaton, Polson et al. 2016), intelligent healthcare (Esteva, Kuprel et al. 2017), and many more. In the everevolving trend of applying deep learning in IT industry, increasingly more high-ended computing power and massive amounts of well-annotated data are devoted to the construction of deep neural networks (DNN) (Real et al. 2019;De-vlin, Chang et al. 2019;Zhou et al. 2021), which are later deployed as prediction APIs, i.e., Machine-Learning-as-a-Service (MLaaS), to provide intelligent service for profiting. Considering the substantial training costs, many IT corporations as the model owners become aware of the importance of protecting the confidentiality of those well-trained DNN, as an inseparable part of their intelligent property (IP). Threateningly, even with careful access control, an attacker can still pirate the working DNN behind an online intelligent service by conducting system (Yan, Fletcher, and Torrellas 2020;Jeong, Ryu, and Hur 2021) or algorithmic attacks (Tramèr, Zhang et al. 2016;Yu et al. 2020).
Orthogonal to the advances in protecting DNNs against model privacy (Juuti, Szyller et al. 2019), model watermarking and model fingerprinting are two fast-developing techniques for model piracy forensics. Applying model watermarking, the model owner embeds a secret into his/her owned model (i.e., the target model). Once the ownership of a DNN model is in doubt (i.e., the suspect model), a trusted third party verifies the existence of the exclusively known secret in the suspect model to determine the actual ownership. From Uchida, Nagai et al. (2017), previous works devise different types of secrets (e.g., a specific function or a specific parameter pattern) into various parts of a DNN, which we briefly survey in Section 2. However, because model watermarking unavoidably modifies the original parameters of a well-trained DNN for secret embedding, the otherwise optimal accuracy would be slightly degraded, causing an unacceptable trade-off for mission-critical tasks in healthcare and traffic (Cao, Jia et al. 2021).
Complemental to model watermarking, model fingerprinting is a passive forensic technique against model piracy, which in general tests whether certain fingerprint of the target model are present in a suspect model, which would help collect essential evidence of model piracy in the wild before filing a lawsuit. As a key difference from model watermarking, the fingerprint is innate but not embedded to the target model. In other words, no modifications on the target model are conducted during fingerprinting, which provably preserves the normal utility of well-trained DNNs. Thanks to this desirable characteristic, model fingerprinting arises as a booming direction in model protection from the last year, which attracts increasing research efforts from different backgrounds (Cao, Jia et al. 2021;Li, Zhang et al. 2021;Wang and Chang 2021;Lukas, Zhang et al. 2021).
Following the fingerprinting framework in Cao, Jia et al. (2021), previous schemes mostly focus on fingerprinting classifiers by constructing a special set of adversarial examples (Szegedy et al. 2014), i.e., normal examples added with human-imperceptible perturbations which cause misclassification of the target classifier, as the fingerprint, and verifying whether a suspect model is indeed stolen from the original model by matching the behavioral pattern, e.g., the predicted labels (Lukas, Zhang et al. 2021;Wang and Chang 2021) or probability vector similarity ), on the fingerprint examples. Despite their pioneering contributions to model IP protection, existing schemes are however limited to fingerprinting DNNs for other important downstream tasks except for classification, mainly because they commonly rely on concepts like adversarial examples and classification boundary which have no direct counterparts in other typical learning tasks such as regression and generative modeling. With recent years witnessing the fast trend of distribution, deployment and redistribution of DNNs in nowadays deep learning ecosystem, how to conduct forensics on the improper reuse and illegal piracy for a more general set of DNNs poses an urgent open challenge to address.
Our Work. In this paper, we present Universal Task-Agnostic Fingerprinting (UTAF), which for the first time enables fingerprinting on a much wider range of DNNs independent from the downstream learning task, and by design implements the robustness against a variety of ownership obfuscation techniques possibly adopted by the adversary.
To realize task-agnostic model fingerprinting, we generalize the idea of using adversarial examples and the corresponding classification results for fingerprinting respectively into two critical design components in UTAF, namely, the adaptive fingerprint and the meta-verifier. Concisely, the adaptive fingerprint is a set of trainable inputs to the suspect model, the concatenated outputs of the suspect model on which are classified by the meta-verifier to be True or False, where True implies the suspect model is indeed stolen (i.e., positive suspect model), and False implies the suspect model is independent from the original model (i.e., negative suspect model).
To implement the design principles above, the adaptive fingerprint and the meta-verifier are jointly optimized on an ensemble composed of the target model, the positive and the negative suspect models which are virtually generated by UTAF during the fingerprinting construction phase. Specifically, the positive suspect models in the ensemble are crafted by post-processing the target model with a number of popular ownership obfuscation techniques, e.g., compression (Han, Pool et al. 2015;Li, Kadav et al. 2017), fine-tuning, partial retraining and distillation (Hinton, Vinyals, and Dean 2015), while the irrelevant models are independently trained from scratch on similar learning tasks to the target model. As the full construction process of UTAF makes no assumption on the model internals or functions in the ensemble only if they have the same input and output dimensions, UTAF is therefore applicable independent of the downstream tasks for which the DNN is designed. Moreover, by permitting more types of obfuscation techniques in producing the stolen models for the model ensemble, our proposed UTAF is by construction robust against a diverse set of existing obfuscation techniques, with the potential to evolve along with future adversarial techniques.
In summary, we mainly make the following contributions: • We present UTAF, the first task-agnostic fingerprinting framework with adaptive robustness against a variety of ownership obfuscation techniques, to substantially advance the cutting-edge model fingerprinting capability to a much broader set of DNNs for arbitrary downstream tasks. • We generalize the existing fingerprinting schemes based on adversarial examples to a more universal fingerprinting framework based on the adaptive fingerprint and the metaverifier, which are jointly optimized on an ensemble of the target model, the positive and negative suspect models crafted by the model owner to serve as a highly effective and robust fingerprint for the target model. • We extensively evaluate the performance of UTAF on practical scenarios spanning classification, regression and generative modeling. Besides the unique contribution of UTAF in providing task-agnostic fingerprinting, UTAF brings noticeable improvement over all the state-of-theart fingerprinting schemes on DNN classifiers. For example, on fingerprinting ResNet-18 (He, Zhang et al. 2016) trained for skin cancer diagnosis (Esteva, Kuprel et al. 2017), UTAF achieves simultaneously 100% true positives and 100% true negatives on a diverse test set of 70 suspect models, with an about 220% relative improvement in ARUC compared to the optimal baseline.

Related Works
Model Fingerprinting. Recently, a number of fingerprinting schemes, mainly based on constructing different types of adversarial examples as the model fingerprint, were proposed to protect the intellectual property of DNN classifiers. For example, Cao, Jia et al. (2021) propose IPGuard, one of the earliest fingerprinting schemes, to find adversarial examples near the decision boundary of the target classifier. The key assumption of IPGuard is that the target DNN classifier can be uniquely represented by its decision boundary, which is more similar with the classification boundary of a positive suspect model than a negative one. Different from IPGuard, Lukas, Zhang et al. (2021) and Zhao, Hu et al. (2020) independently propose to extract so-called conferrable adversarial examples from the ensemble of the target classifier and a set of locally trained suspect classifiers. These conferrable adversarial examples, which transfer much better to the positive suspect models than to negative ones, can be regarded as a unique link between the target model and the positive suspect models. Besides, Wang and Chang (2021) utilize the geometry characteristics inherited in the DeepFool algorithm to construct adversarial examples as the fingerprint (Wang and Chang 2021), while Li, Zhang et al. (2021) leverage the similarity between models in terms of the probability vectors on test inputs for piracy detection ). More detailed surveys can be found in (Boenisch 2020; Regazzoni, Palmieri et al. 2021). In this work, our proposed UTAF generalizes the aforementioned fingerprinting techniques to abstract the usage of adversarial examples and the classification results into the adaptive fingerprint and the trainable meta-verifiers, which is applicable to arbitrary DNN models in a task-agnostic way.
Model Watermarking. Orthogonal to model fingerprinting, model watermarking embeds a watermark into the trained model before it is released, which potentially sacrifices the utility of the model. Previous works (Zhang and Hurley 2008;Hurley and Zhang 2011;Zhang et al. 2014;Hurley, Cheng, and Zhang 2009;Zhang and Hurley 2009a;Ding et al. 2019;Zhang 2009;Ding et al. 2017;Zhang et al. 2020;Pan et al. 2020a;Zhang and Hurley 2009b;Pan et al. 2020b;Zhang and Hurley 2010;Ding et al. 2018;Zhang and Hurly 2009;Zhang et al. 2012; on model watermarking explore various types of watermarks such as secret bit strings (Uchida, Nagai et al. 2017;Rouhani, Chen et al. 2018), generated serial numbers (Xu, Li et al. 2020) and unrelated or slightly modified sample sets (Adi, Baum et al. 2018;Zhang et al. 2018). These identifying codes are then encoded secretly into the least significant bit of the weight (Uchida, Nagai et al. 2017), the distribution of outputs at the intermediate (Rouhani, Chen et al. 2018) or the full layers (Adi, Baum et al. 2018;Zhang et al. 2018;Xu, Li et al. 2020) 3 Security Settings Backgrounds & Notions. Model fingerprinting is a multiparty security game among a model owner, a verifier and an attacker. Initially, a model owner devotes computing power and well-curated training data to build its own DNN F : X → Y for a certain downstream task, crowning the obtained model F as an inseparable part of the model owner's IP. Following the nomenclature in Cao, Jia et al. (2021), we refer to the model F as the target model. In nowadays deep learning ecosystem, the model owner can deploy the target model at a third-party platform like Amazon AWS as a prediction API to gain monetary profits. However, the profits may also serve as incentives on the potential attacker to conduct model piracy via, e.g., software/hardware vulnerabilities (Yan, Fletcher, and Torrellas 2020;Jeong, Ryu, and Hur 2021), social engineering and algorithmic attacks (Tramèr, Zhang et al. 2016;Yu et al. 2020). This essentially infringes the IP of the model owner.
As a rescue, the model owner can delegate a verifier, usually played by a trusted third party or the model owner him/herself, to provide model fingerprinting service for model piracy forensics. In general, model fingerprinting determines whether a suspect modelF is pirated from the target model F following the two stages below: • Fingerprint Construction. At the construction stage, a certain type of model fingerprint encoding the essential characteristics of the target model F is constructed.
• Fingerprint Verification. At the verification stage, the verifier attests the suspect model via the prediction API (i.e., black-box access) to determine whether and with what confidence (i.e., matching rate) the fingerprint is also present in the suspect modelF .
Threat Model. We mainly consider the following threat model in this paper.
• Attacker's Capability. We assume the attacker would apply a variety of model post-processing techniques to obfuscate the ownership of the stolen model (detailed in the subsequent part) after he/she successfully steals the target model from an online prediction API. Such an obfuscated model is called a positive suspect model. Correspondingly, a suspect model independently trained by another honest model owner is called a negative suspect model. The attacker is assumed to answer any queries to his/her provided prediction API, as more queries served by the API bring more monetary profits. • Verifier's Capability. Following, e.g., Cao, Jia et al. (2021), we assume the verifier has a white-box access to the target model while having a black-box access to the suspect models via their prediction APIs. To relax their assumptions, we do not assume the internal architecture or the type of downstream tasks of the target model.
Adversarial Techniques. Integrating existing ownership obfuscation techniques studied in previous works, we mainly cover the following classes of adversarial techniques which the attacker is likely to adopt.
• Model Compression: Compression-based obfuscation adopts weight pruning or filter pruning (Li, Kadav et al. 2017) to remove a certain proportion of small weights or filters in a DNN, which largely preserves the utility of the obfuscated model on the learning task (Han, Pool et al. 2015) and inhibits heuristic-based fingerprinting using model parameters (Cao, Jia et al. 2021). • Fine-Tuning & Partial Retraining: To obfuscate the behavioral pattern of a DNN, attackers may resume the training of the stolen model on public data collected from a similar domain of the training data. Specifically, to finetune the last K layers of a trained DNN, the parameters of the last K layers are further updated according to the learning objective with the other layers fixed. In comparison, during the partial retraining, the parameters of the last K layers are first randomly initialized before the training is resumed. Due to the non-convexity of deep learning (Choromańska et al. 2015), both the fine-tuned and partially retrained models may fall into a different local optimum, preserve the original utility, but exhibit divergent prediction behaviors from the target model (Wang and Chang 2021). • Model Distillation: Distillation-based obfuscation adopts the knowledge distillation strategies (Hinton, Vinyals, and Dean 2015;Gou et al. 2021) by viewing the stolen model or even the corresponding prediction API as the teacher model and a DNN of a different architecture as the student model . Via distillation, the learned knowledge in the target model is therefore inherited by the student model, which exacerbates the obfuscation of k P 8 e 7 k c d B o Q U N R 1 U 1 3 V 5 R w p o 3 n f T q 5 p e W V 1 b X 8 u r u x u b W 9 U 9 j d q 2 m Z K k I D I r l U j Q h r y p m g g W G G 0 0 a i K I 4 j T u v R 4 H r i 1 x + o 0 k y K e z N M a B j j n m B d R r C x U n D b z k 5 H 7 U L R K 3 t T o L / E n 5 N i 5 b D 0 9 T 5 u n V T b h Y 9 W R 5 I 0 p s I Q j r V u + l 5 i w g w r w w i n I 7 e V a p p g M s A 9 2 r R U 4 J j q M J s e O 0 L H V u m g r l S 2 h E F T 9 e d E h m O t h 3 F k O 2 N s + n r R m 4 j / e c 3 U d C / D j I k k N V S Q 2 a J u y p G R a P I 5 6 j B F i e F D S z B R z N 6 K S B 8 r T I z N x 3 V t C v 7 i z 3 9 J 7 a z s n model ownership due to the transformed model architecture and the correspondingly altered predictive behaviors (Lukas, Zhang et al. 2021).

Universal Task-Agnostic Fingerprinting
Overview of UTAF. As a generalization of previous fingerprinting schemes, our proposed UTAF abstracts the usage of adversarial examples and the corresponding prediction results as the fingerprint into two critical components respectively: (i) adaptive fingerprint, i.e., a set of trainable inputs to the target/suspect model(s), which we denote as X F := (x 1 F , . . . , x N F ) with x i F ∈ X and N called the number of fingerprint examples, and (ii) meta-verifier, i.e., a binary classifier which takes the concatenated outputs of a suspect model on the adaptive fingerprint as its input and predicts whether the suspect model is positive or negative, denoted as V : Y n → S 2 , a 2-dimensional probability simplex {(p − , p + )|p − + p + = 1, 0 ≤ p + , p − ≤ 1}. As illustrated in Fig. 1, the general pipeline of UTAF mainly consists of the following three key stages: • Stage 1. (Model Ensemble Preparation) As Fig. 1(a) shows, we first craft a number of positive and negative suspect models from the target model with the aid of public data from the same domain of the owner's training data. At the end of this stage, we obtain the sets of positive and negative suspect models, i.e., M + and M − .
• Stage 2. (Fingerprint Construction in UTAF) As Fig. 1(b) shows, we then jointly optimize the adaptive fingerprint X F and the meta-verifier V to satisfy: For both the target model or any suspect model in M + , the meta-verifier V is trained to predict True, i.e., p + > p − , on the concatenated outputs of the model on examples in X F , and vice versa for any suspect model in M − . At the end of this stage, we obtain optimized adaptive fingerprint and the corresponding meta-verifier, i.e., X * F and V * respectively. We call (X * F , V * ) a fingerprinting pair.
. Whenp + is larger than a predefined threshold ρ, the verification process outputs True to claim possible model piracy behind the tested prediction API, or other the process outputs False to assert the fidelity of the suspect model.
In the following sections, we elaborate on the detailed methodology for the first two stages of UTAF.

Model Ensemble Preparation.
To construct the adaptive fingerprint and the meta-verifier with simultaneously high robustness and uniqueness, UTAF is first required to collaborate with the model owner to prepare a diverse set of positive and negative suspect models. Intuitively, with a more representative set of positive suspect models, the obtained fingerprinting pair would stay robust against a wider range of ownership obfuscation techniques, resulting in higher true positives. Alternatively, more representative negative suspect models would lower the probability of the learned fingerprinting pair to be present in other irrelevant models, which therefore reduces the true negatives of UTAF. Specifically, the positive and negative suspect models are constructed as follows.
• Prepare Positive Suspect Models. We derive a representative set of positive suspect models by randomly applying one or more common ownership obfuscation techniques mentioned in Section 3 to the target model F . The applied obfuscation techniques are recommended to cover a wider range of hyperparameter configurations for better robustness. For example, we apply weight and filter pruning to the target model with different pruning ratios. As a nota-Algorithm 1: The algorithmic details of UTAF's fingerprint construction stage. 1: Input: A prepared model ensemble M − ∪ {F } ∪ M + , the number of adaptive fingerprints N , the input/output dimension of the models d in , d out , the number of iterations L and the learning rate λ. 2: Output: The optimal fingerprinting pair (X * F , V * ). 3: Initialize real-valued variables W 0 = (w i ) N i=1 . 4: Initialize a meta-verifier V(·; Θ 0 ) : Y N ×dout → S 2 with parameters Θ 0 We implement V as a fully-connected neural network with a softmax output. 5: Initialize Adam optimizers Opt W , Opt Θ of a learning rate λ.
tion, we denote the full set of obfuscation techniques for preparing the positive suspect models as T . Therefore, we have M + := {T • F |T ∈ T }. Section 5 presents the detailed composition of T in the evaluation settings part. • Prepare Negative Suspect Models. We recommend three complemental sources to collect a diverse set of negative suspect models for the fingerprint construction stage of UTAF. First, UTAF may request the model owner to train a moderate number of relatively small-scale DNNs on the same training dataset of the target model. For IP protection of the target model, it would be reasonable for the model owner to devote additional computing power to collaborate with a trusted third-party verifier. Second, UTAF can also download a number of pretrained models from online sources (e.g., PyTorch Hub) and fine-tune these models on the domain-relevant public data to serve as the negative suspect models. Moreover, UTAF may consider incorporate a proportion of irrelevant publicly available models into the set of negative suspect models to further enhance the uniqueness of the obtained fingerprinting pair. We denote the prepared negative suspect models as M − .
Fingerprint Construction in UTAF. In this part, we detail the learning objective and the optimization algorithm for training the fingerprinting pair (X F , V) on the model ensemble M − ∪ {F } ∪ M + prepared in the first stage. As Fig.  1(b) shows, the learning objective of UTAF is viewed as a binary classification problem. To formulate, we introduce an additional label s for each model, which takes value in {+, −} (literally, positive and negative respectively). Specif-ically, we label an arbitrary model M + ∈ M + ∪ {F } as + and an arbitrary model M − ∈ M − as −. To supervise the adaptive fingerprint and the meta-verifier with the labels, we solve the learning objective: arg max , the prediction from the meta-verifier on the concatenated outputs of a model under test on the adaptive fingerprint. Intuitively, the learning objective above encourages the metaverifier to output a p + higher than p − when the model under test is a positive suspect model or the target model, and vice versa for a negative suspect model.
As the learning objective above is fully derivative w.r.t. the adaptive fingerprint X F and the parameters of the metaverifier, we leverage off-the-shelf non-convex optimizers (e.g., Adam (Kingma and Ba 2015)) for gradient-based optimization. However, we notice it is resource-consuming to conduct back-propagation over the whole model ensembles in each optimization step. As an alternative, we reformulate the batched learning objective in (1) as a stochastic objective with randomness in a tuple of (M − , F, M + ) uniformly sampled from M − , {F } and M + in each iteration. Besides, we adopt the reparametrization trick in Carlini and Wagner (2017) to constrain the adaptive fingerprint in the problem space X . Taking X := [−1, 1] din , a common case in computer vision for example, Algorithm 1 presents the details of the optimization algorithm.

Evaluation Settings
Scenarios and Datasets. Table 1 provides an overview on the three scenarios, i.e., skin cancer diagnosis (Yang, Shi et al. (2020),classification, abbrev. Skin), warfarin dose prediction (Whirl-Carrillo, McDonagh et al. (2012), regression, abbrev. Warfarin), and fashion generation (Xiao, Rasul et al. (2017), generative modeling, abbrev. Fashion), covered in the evaluation sections. More details on the datasets and the target model architecture is in Appendix A. Fingerprinting Benchmarks. For each scenario, we construct a model benchmark composed of 140 positive/negative suspect models. We split the benchmark randomly by a ratio of 1 : 1 into two independent sets of suspect models for training and testing. Appendix B summarizes the detailed composition of the suspect models in our benchmark.
• Constructing Positive Suspect Models. Following Cao, Jia et al. (2021) and Lukas, Zhang et al. (2021), we apply a number of popular ownership obfuscation techniques with a variety of hyperparameter configurations on the target model to derive the positive suspect models: (i) Compression: For weight pruning, we vary the ratio of pruned weights from 0.1 to 0.9 with a stride of 0.1. For filter pruning, we choose the ratio of pruned filters from 1/16 to 15/16 with a stride of 1/16. (ii) Fine-Tuning & Partial Retraining: We consider 4 types of obfuscation in this category, i.e., finetuning/retraining the last layer and fine-tuning/retraining all layers. For both types of retraining, the last one layer is first reset as a randomly initialized layer, after which the model is finetuned according to the configuration. We set the number of epochs for fine-tuning and retraining both as 10. (iii) Distillation: For each target model, we select 3-5 diverse models with different architectures as the student model. For the ResNet-18 classifier, we follow the classical distillation algorithm in Hinton, Vinyals, and Dean (2015) to prepare the student model. We do not consider other model distillation algorithms because most of them require the access to the internals of the target model (i.e., the teacher) for distillation, implausible for an attacker who pirates the model from the prediction API. For the multi-layer perception (MLP) as the regressor and the DCGAN (Radford, Metz, and Chintala 2016) as the generator, we implement the distillation algorithms in Clark et al. (2019) and Aguinaldo et al. (2019) respectively. For fine-tuning, partial retraining and distillation, we mutate the random seeds to produce multiple suspect models belonging to the corresponding category.
• Constructing Negative Suspect Models. To construct the negative suspect models, we use different random seeds to initialize models of different architectures. We then train the models from scratch respectively on the original training data, on the public data from a similar domain of the training set, and on other irrelevant dataset to obtain a diverse benchmark of negative suspect models.
With no further specifications, the number of fingerprint examples, i.e., N , is set as 100 for UTAF and the baselines by default. More details on the baselines are in Section 2.
Performance Metrics. Given a predefined threshold ∈ (0, 1), UTAF and all the baseline methods recognize a suspect model as positive when the matching rate of fingerprint verification is higher than ρ, or otherwise recognize the model as negative. In the evaluation, we following the evaluation protocol in (Cao, Jia et al. 2021) which is composed of the metrics below: (i) Robustness/Uniqueness (R(ρ)/ U (ρ)): The robustness/uniqueness metric measures the proportion of positive/negative suspect models also recognized as positive/negative by the fingerprinting scheme, i.e., true positives/true negatives. (ii) Area under the Robustness-Uniqueness Curves (ARUC): ARUC mea-sures the area of the intersecion region under the robustness and uniqueness when the threshold varies in (0, 1), i.e., 1 0 min{R(ρ), U (ρ)}dρ. A higher ARUC implies a more wider value range for the threshold to choose from to obtain simultaneously high robustness and uniqueness. ARUC is empirically calculated as the average min{R(ρ), U (ρ)} on {0, 1/L, . . . , (L − 1)/L, 1} with L = 100. For all the experiments, we run 5 repetitive experiments and report the average metric with the 95% confidence interval. More implementation details can be found in the Appendix C.

Results & Analysis
Comparison with Baselines. First, we compare the performance of UTAF with 4 state-of-the-art model fingerprinting schemes specifically designed for classifiers. Fig. 2 reports the robustness (i.e., true positives) when the threshold ρ is set to allow the uniqueness (i.e., true negatives) to reach 100% on the test set (Left), along with the ARUC correspondingly (Right). As the left part of Fig. 2 shows, our proposed UTAF is the only method which simultaneously achieves 100% robustness and uniqueness in fingerprinting a stolen and adversarially obfuscated ResNet-18 classifier for skin cancer diagnosis. Besides, as we can see from the right part of Fig. 2, UTAF constructs the model fingerprint with the highest ARUC metric, i.e., 0.86 ± 0.01, among all the tested fingerprinting schemes, which improves the optimal baseline IPGuard by 0.59 absolutely, i.e., a roughly 220% relative improvement. As we construct a more diverse benchmark of suspect models compared with previous works, the ARUC of IPGuard is not as high as the results reported in Cao, Jia et al. (2021). Fig. A1 shows the robustness and uniqueness curves of each fingerprint schemes.
Time Efficiency of UTAF. Next, we empirically study the learning behaviors and the time complexity of UTAF when constructing the fingerprint of a ResNet-18. As the left part of Fig. 3 shows, the ARUC and loss curves demonstrate the time efficiency of UTAF in fingerprint construction. In less than 200 seconds, UTAF stably constructs a fingerprinting pair which achieves an ARUC over 0.8. Besides, Table 2 presents a tentative comparison on the time cost of each fingerprint scheme for constructing the corresponding model fingerprint to achieve the reported ARUC in Fig. 2 and for fingerprint verification in the same environment detailed in Appendix C. As is shown, UTAF is similarly efficient compared with the state-of-the-art fingerprinting schemes. 7.2 ± 0.8 9.1 ± 0.2 13.6 ± 0.5 9.1 ± 0.6 10.0 ± 0.6 UTAF for Task-Independent Fingerprinting. Besides the substantial improvements in fingerprinting classifiers, more importantly, UTAF presents the first task-agnostic fingerprinting scheme which can be applied to more general application scenarios. To validate, we apply UTAF to fingerprint an MLP for regression (i.e., the Warfarin case) and a DCGAN for generative modeling (i.e., the Fashion case), which requires no modification on Algorithm 1, as UTAF is by design independent from either the internals or the functions of the target model. The right part of Fig. 3 plots the curves of robustness and uniqueness of UTAF on Warfarin and Fashion when the threshold ρ increases from 0 to 1, where the area of the shaded region is by definition the ARUC. As we can see, the robustness and the uniqueness remain 1 unless the threshold is very close to 0 or 1. This results in an over 0.98 ARUC for both the two scenarios which existing fingerprinting schemes can hardly handle.
Number of Fingerprint Examples. We further study the influence of the number of fingerprint examples on the performance of UTAF and the baselines. Fig. 4 presents the ARUC curves when the number of fingerprint examples, i.e., N , increases, on the classification and non-classification tasks respectively. As is shown, in all the three scenarios, the performance of UTAF increases stably when N increases from 10 to 100. For example, when fingerprinting ResNet-18 on Skin, the ARUC of UTAF is about 1.2× when N is enlarged from 10 to 100. This is a desirable feature of UTAF as one would naturally expect a more accurate fingerprinting when more computing power is devoted to the construction of the model fingerprints. In comparison, the upward trend is unclear for all the baseline schemes. Similarly, enhanced performance is also observed on Warfarin and Fashion by about 3.2% and 17.0% respectively, which is noticeable considering the already high ARUC of UTAF when the number of fingerprint examples is 10.
Size of Prepared Model Ensemble. Finally, we provide quantitative results to analyze the impact of the model ensemble size on the performance of UTAF. We fix the number of fingerprint examples as 100 and randomly sample different ratios of positive/negative suspect models from the full model ensemble for training UTAF. Fig. 5 shows the ARUC curves on the three scenarios when the model ensemble size varies. As is shown, the ARUC of UTAF shows a steady upward trend when the model ensemble is enlarged, which conforms to our design principle that a more diverse set of crafted suspect models would help construct more unique and robust model fingerprints.
C More Implementation Details.   Table A3: The detailed architecture of the student models for DCGAN on Fashion, which is described by convention of PyTorch (k = 2 L ).