Deep neural networks (DNNs) are extensively employed in a wide range of application scenarios. Generally, training a commercially viable neural network requires significant amounts of data and computing resources, and it is easy for unauthorized users to use the networks illegally. Therefore, network ownership verification has become one of the most crucial steps in safeguarding digital assets. To verify the ownership of networks, the existing network fingerprinting approaches perform poorly in the aspects of efficiency, stealthiness, and discriminability. To address these issues, we propose a network fingerprinting approach, named as GanFinger, to construct the network fingerprints based on the network behavior, which is characterized by network outputs of pairs of original examples and conferrable adversarial examples. Specifically, GanFinger leverages Generative Adversarial Networks (GANs) to effectively generate conferrable adversarial examples with imperceptible perturbations. These examples can exhibit identical outputs on copyrighted and pirated networks while producing different results on irrelevant networks. Moreover, to enhance the accuracy of fingerprint ownership verification, the network similarity is computed based on the accuracy-robustness distance of fingerprint examples'outputs. To evaluate the performance of GanFinger, we construct a comprehensive benchmark consisting of 186 networks with five network structures and four popular network post-processing techniques. The benchmark experiments demonstrate that GanFinger significantly outperforms the state-of-the-arts in efficiency, stealthiness, and discriminability. It achieves a remarkable 6.57 times faster in fingerprint generation and boosts the ARUC value by 0.175, resulting in a relative improvement of about 26%.

翻译：深度神经网络（DNN）广泛应用于各类应用场景。通常，训练一个具有商业价值的神经网络需要大量的数据和计算资源，且未经授权的用户容易非法使用这些网络。因此，网络所有权验证已成为保护数字资产的关键环节之一。为验证网络所有权，现有网络指纹方法在效率、隐蔽性和可区分性方面表现不佳。针对这些问题，我们提出一种名为GanFinger的网络指纹方法，基于网络行为构建网络指纹，该行为通过原始样本与可迁移对抗样本对的网络输出表征。具体而言，GanFinger利用生成对抗网络（GAN）高效生成具有不可感知扰动的可迁移对抗样本。这些样本在版权网络与盗版网络上可产生相同输出，而在无关网络上产生不同结果。此外，为提升指纹所有权验证的准确性，我们基于指纹样本输出的精度-鲁棒性距离计算网络相似度。为评估GanFinger的性能，我们构建了一个包含186个网络（涵盖五种网络结构与四种主流网络后处理技术）的综合基准测试集。基准实验表明，GanFinger在效率、隐蔽性和可区分性上显著优于现有方法：指纹生成速度提升6.57倍，ARUC值提高0.175，相对改进约26%。