We propose IrisFP, a novel adversarial-example-based model fingerprinting framework that enhances both uniqueness and robustness by leveraging multi-boundary characteristics, multi-sample behaviors, and fingerprint discriminative power assessment to generate composite-sample fingerprints. Three key innovations make IrisFP outstanding: 1) It positions fingerprints near the intersection of all decision boundaries - unlike prior methods that target a single boundary - thus increasing the prediction margin without placing fingerprints deep inside target class regions, enhancing both robustness and uniqueness; 2) It constructs composite-sample fingerprints, each comprising multiple samples close to the multi-boundary intersection, to exploit collective behavior patterns and further boost uniqueness; and 3) It assesses the discriminative power of generated fingerprints using statistical separability metrics developed based on two reference model sets, respectively, for pirated and independently-trained models, retains the fingerprints with high discriminative power, and assigns fingerprint-specific thresholds to such retained fingerprints. Extensive experiments show that IrisFP consistently outperforms state-of-the-art methods, achieving reliable ownership verification by enhancing both robustness and uniqueness.

翻译：我们提出IrisFP，一种新型的基于对抗样本的模型指纹识别框架，通过利用多边界特征、多样本行为及指纹判别能力评估生成复合样本指纹，同时增强唯一性与鲁棒性。三大关键创新使IrisFP表现卓越：1）将指纹定位于所有决策边界的交集附近——不同于以往仅针对单个边界的方法——从而在不将指纹深入目标类区域的情况下增大预测间隔，同时提升鲁棒性与唯一性；2）构造复合样本指纹，每个指纹由多个靠近多边界交集的样本组成，以利用集体行为模式并进一步增强唯一性；3）基于两类参考模型集（盗版模型与独立训练模型）分别开发统计可分离性指标，评估生成指纹的判别能力，保留高判别力指纹并为这些指纹分配指纹特定阈值。大量实验表明，IrisFP在增强鲁棒性与唯一性的同时，始终优于现有最优方法，实现可靠的所有权验证。