Pith. sign in

REVIEW 4 major objections 5 minor 58 references

Sample Correlation for Fingerprinting Deep Face Recognition

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a stolen deep-learning model can be caught by comparing the pairwise correlation of its outputs on JPEG-compressed images, a signature that survives fine-tuning, pruning, distillation, and extraction attacks.

desk verdict Solid extension of prior SAC work to face recognition, but the evaluation lacks a held-out fingerprint control, so the headline AUCs may partly reflect training-data familiarity. read the letter →

arxiv 2412.20768 v1 pith:Z6TPIARK submitted 2024-12-30 cs.CV cs.AI

Jiyang Guan , Jian Liang , Yanbo Wang , Ran He This is my paper · ORCID
classification cs.CVcs.AI
keywords modelfingerprintingdeepfacerecognitionsamplecorrelationJPEGcompressionstealingdetectionverificationintellectualpropertyprotection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that model stealing from deep face-recognition services can be detected without the adversarial examples used by previous fingerprinting methods, which fail under adversarial training and transfer learning. Its proposal, SAC-JC, computes the pairwise correlation matrix of a model's outputs on JPEG-compressed images and treats the $\ell^1$ distance between the source's and the suspect's correlation matrices as the theft indicator. For face verification, where only 0/1 same-identity answers are available, it adds FRI, which turns a target image into a 50-bit feature by comparing it against reference images from the same identity, and runs the same correlation test on those bits. The reported experiments span face emotion recognition, face verification, Tiny-ImageNet, and CIFAR10, with average AUC between 0.97 and 1.00 across fine-tuning, pruning, label- and probability-based extraction, adversarial extraction, knowledge distillation, adversarial training, and transfer learning. If correct, this gives model owners a black-box, training-free, sub-second ownership check that adversarial-example methods cannot match.

What carries the argument

The central object is the sample-correlation matrix: for a set of $n$ JPEG-compressed inputs, the model's outputs form vectors $o_i$, and the matrix entry $C_{i,j} = \text{Cos}(o_i, o_j)$ (or a Gaussian RBF kernel) records how similarly the model responds to the two samples. The detection statistic is the normalized $\ell^1$ matrix distance $\|C_{\text{suspect}} - C_{\text{source}}\|_1 / n^2$ from Eq. (4): below a threshold $d$ means stolen. JPEG compression is the sample-selection mechanism that magnifies model-specific differences while suppressing the common knowledge shared by all models trained on the same task. For face verification, FRI converts the model's binary same-identity answers into a 50-dimensional 0/1 feature vector per target image, replacing outputs in the same correlation computation. The combination is what carries the argument: a robust, model-specific pairwise signature plus an input transform that makes it discriminative.

What would settle it

A decisive test: fine-tune the source model on a disjoint dataset until the SAC-JC distance to the source exceeds the calibrated threshold while verification accuracy stays high. If such a model exists, the central claim fails; equivalently, if an independently trained model of a new architecture falls below the threshold on a fresh reference set, false positives appear.

Watch

Extended reading notes

Core claim

The central claim is that the pairwise correlation structure of a model's outputs is a stable, model-specific signature that surviving copies retain, while independently trained models do not share it. Concretely, the paper declares a suspect stolen when $\|C_{\text{suspect}} - C_{\text{source}}\|_1 / n^2 \le d$, with $C$ built from cosine similarities among outputs on JPEG-compressed samples (Eq. 4). JPEG compression is chosen empirically from fourteen image corruptions as the augmentation that best separates stolen from irrelevant models; the paper argues this is because JPEG compression is unrelated to adversarial robustness and thus survives adversarial training. On face verification, where the model returns only a binary same-identity verdict, the FRI method forms a 50-bit verification feature per target image and applies the same correlation distance. The paper reports that SAC-JC outperforms IPGuard, CAE, and EWE on nearly every attack and dataset, with average AUC 0.97 on KDEF, 0.98 on face verification, 0.99 on Tiny-ImageNet, and 1.00 on CIFAR10, and it is, by the authors' account, the first fingerprinting method for face verification.

Load-bearing premise

A stolen model retains the pairwise correlation pattern of its outputs on JPEG-compressed images, and no independently trained model shares that pattern, even when the model is heavily fine-tuned or distilled.

Editorial extensions

If this is right

  • SAC-JC can fingerprint black-box face-recognition services without any access to the suspect model's weights or architecture, since only outputs (or verification bits) are needed.
  • Unlike adversarial-example fingerprints, SAC-JC remains effective against adversarial training and adversarial extraction, and it is the only compared method that detects transfer learning, where the label space changes.
  • Because it never modifies training, SAC-JC preserves the source model's accuracy, unlike EWE which the paper reports loses 4.0% on CIFAR10.
  • Fingerprint generation takes 0.16 seconds versus 25,536.89 seconds for CAE, so ownership checks can be run on demand at deployment time.
  • A few dozen JPEG-compressed images (25-50) suffice for high AUC, so the fingerprint can be kept small and cheap to query.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Outside the tested settings, the correlation signature should also apply to embedding-only or multimodal APIs, since the correlation matrix needs only output vectors; this is a natural extension the paper does not test.
  • An attacker could try to break the method by training a student with an explicit correlation-distance regularizer so that the student's correlation matrix matches the source's while the labels come from a different teacher; whether SAC-JC survives that adaptive attack is an open question.
  • The paper calibrates thresholds with only four irrelevant models; on a new data distribution, the threshold may shift, so the reported AUC and F1 figures likely represent a favorable calibration regime rather than a worst-case bound.
  • For face verification, the FRI signature uses 50 fixed reference images per identity; varying the reference pool or using video frames could either strengthen the signature (more bits) or introduce identity-specific biases not visible in the current evaluation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes SAC-JC, a post-hoc model fingerprinting method that computes the pairwise correlation matrix of a model's outputs on JPEG-compressed probe images and flags a suspect model as stolen when the L1 distance between the suspect's and source's correlation matrices falls below a threshold. For face verification, the paper introduces FRI, which converts 0/1 same-identity verification decisions into feature vectors so that correlation can be computed. The method is evaluated against fine-tuning, pruning, model extraction, knowledge distillation, adversarial training, and transfer learning on KDEF, face verification, Tiny-ImageNet, and CIFAR10, and is compared with IPGuard, CAE, and EWE using AUC, p-value, and F1.

Significance. If the reported results hold, the paper makes a useful contribution: it is the first fingerprinting method aimed at face verification, uses a simple JPEG-compression augmentation rather than adversarial examples, avoids training surrogate models, and reports a large speedup over CAE. The attack coverage is broad, four architectures are tested, and code is promised. The central empirical claim, however, rests on an experimental setup whose dataset provenance may confound the measured separation between source and irrelevant models; the ablation study already shows high AUC for SAC-Clean, so the additional experiments requested below are essential before the headline numbers can be attributed to correlation inheritance.

major comments (4)
  1. [4.1 (Tables 1, 4, 5; Table 9)] The multi-class experiments split each training set into D_defender and D_attacker, train the source model on D_defender and the attacker/irrelevant models on D_attacker, and then compute the SAC fingerprint on "randomly selected normal samples" (Section 3.3). If these samples are drawn from D_defender, as the experimental setup implies, the source's correlation matrix is computed on images the source has seen during training but the irrelevant models have not. The ablation in Table 9 shows SAC-Clean alone reaches AUC 0.91 on KDEF, so the separation is not caused by JPEG augmentation. This confound means the reported AUCs may reflect training-set memorization rather than correlation inheritance from the source model. Please report (i) the exact provenance of the fingerprint samples for every task, (ii) results with fingerprint samples drawn from D_attacker or, preferably, from a held-out set unseen by both source and irrelevant models, and (iii) the split used for irrelevant models in the face-verification experiments (MS1MV2 vs CASIA-Webface).
  2. [3.3 and Figure 2] JPEG compression is selected because it gives the highest average AUC on the same evaluation tasks (KDEF and face verification), and the exact JPEG quality level used is not reported anywhere in the manuscript. This is both a reproducibility problem and a potential selection-on-evaluation bias: the augmentation choice is validated on the same tasks that are later used to report the headline numbers. Please report the compression quality parameter, add a sensitivity analysis over quality levels, or fix the quality level a priori on a separate development set.
  3. [4.1 and 4.2, Table 2] For face verification, model extraction is replaced by white-box knowledge distillation because no output labels are available, yet Section 4.2 claims SAC-JC works "with black-box access to both the source model and the suspect models." The face-verification evaluation therefore does not exercise a black-box extraction attack, and the black-box claim is not established for this task. Please add a genuinely black-box extraction attack on the verification model (e.g., using verification decisions), or restrict the claim to the settings actually evaluated.
  4. [4.1 Threshold Selection] The F1 scores are computed with a threshold chosen as the worst value over only four irrelevant models, and the manuscript does not state whether these are the same irrelevant models used to evaluate the ROC/F1. Using the evaluation distribution to set the threshold makes the F1 numbers optimistic. Please use a separate validation set for threshold selection or report the sensitivity of F1 to the threshold choice.
minor comments (5)
  1. [3.4 and Algorithm 1] FRI assumes at least n=50 reference images of the same identity exist and does not specify how the target and reference images are selected (e.g., from the training set, a gallery, or a separate enrollment set). This should be stated for reproducibility.
  2. [4.1 / Tables 1, 4, 5] The default number of fingerprint samples n used for the correlation matrix in the multi-classification experiments is not stated; Figure 4 varies the number from 25 to 200. Please report the default n used in the main tables.
  3. [Table 7] There is a typo in the table header: "MobleNet" should be "MobileNet".
  4. [Equation 5] The min-max formulation in Equation 5 is described as adversarial training on the extracted model with predicted labels from the source model, but it is not clear whether the adversarial perturbation is computed with respect to the stolen model or the source model, and whether the bound is per-image. Please clarify.
  5. [Figure 2] Figure 2 reports average AUC across attacks for different augmentation methods without error bars or the number of runs; please indicate the variability across attacks or models.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation: SAC-JC is an empirical detector whose decision rule is definitional but separately tested; the self-citation to the authors' prior SAC paper and a threshold-calibration caveat do not make the central claims self-referential.

full rationale

The paper's derivation chain is short and empirical. Equations (1)-(3) define the correlation matrix of model outputs, and Equation (4) defines the L1 distance used as the fingerprinting indicator; a suspect is declared stolen when this distance is below a threshold d. This is the intended decision rule, not a derivation of a prediction from the fingerprint: the paper does not fit the separation, it measures distances on independently constructed stolen models (fine-tuning, pruning, extraction, distillation, adversarial training, transfer) and irrelevant models, and reports threshold-free AUC and p-values (Tables 1, 2, 4, 5) as well as F1 with an explicit threshold-selection procedure. The load-bearing assumption that pairwise correlation structure is preserved under stealing is supported by this paper's own cross-attack experiments and by comparisons to external baselines (IPGuard, CAE, EWE); the citation to the authors' prior SAC paper [26] is transparent and is not the only support, so it is not load-bearing self-citation. The FRI construction for face verification (Eq. 6, Algorithm 1) is an explicit feature-generation scheme whose effectiveness is tested, not assumed. Two caveats are worth noting but are not circularity: the F1 threshold is selected from the irrelevant models used in the same evaluation, and the fingerprint images appear to come from the defender's split while irrelevant models are trained on a disjoint split, which could affect external validity; neither makes the reported AUC/p-value equivalent to the method's inputs by construction.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The method introduces no new physical entities or mathematical constants. Its load-bearing choices are the detection threshold d, the FRI vector length n=50, the unstated JPEG quality level, and the sample count, all chosen from experiments. The empirical assumptions that correlation structure survives stealing and that binary FRI vectors are informative are the core domain assumptions.

free parameters (4)
  • Detection threshold d = smallest correlation distance among four irrelevant models (0.295 to 0.321 on KDEF)
    Chosen from irrelevant models; F1 results depend on this fitted threshold (Section 3.2, Table 7).
  • Number of reference images n in FRI = 50
    Fixed by the authors for face verification; sensitivity to this value is not reported (Section 3.4).
  • JPEG compression quality level = not reported
    The paper says JPEG uses different quality levels but never states the exact quality used in experiments, so the method is under-specified (Section 3.3).
  • Number of fingerprint samples = 25 to 200 in sensitivity analysis; exact number for headline tables not stated
    Figure 4 shows AUC varies with sample count, but the paper does not state exactly how many samples were used in the headline tables.
assumptions (5)
  • domain assumption Models trained for the same task share common knowledge on clean samples, making clean-input correlations uninformative
    Motivates the need for augmentation in Section 3.3.
  • domain assumption Pairwise output correlation transfers from source to stolen models better than pointwise outputs
    Central intuition of Section 3.2; no theoretical proof is given.
  • domain assumption JPEG compression is unrelated to adversarial robustness and cannot be detected by the suspect model owner
    Section 3.3 claims this advantage without a formal argument.
  • domain assumption Binary verification outputs from 50 same-identity reference pairs are informative enough to compute a meaningful correlation matrix
    FRI in Section 3.4 relies on this; no analysis of bit distributions is provided.
  • domain assumption Irrelevant models trained on the same task are a valid baseline for the null distribution
    Threshold and p-value computations assume these models represent 'not stolen' (Section 4.1).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Sample Correlation for Fingerprinting Deep Face Recognition." pith.science (2026). https://pith.science/paper/Z6TPIARK

@misc{pith2026241220768,
  author       = {Pith},
  title        = {Pith review of: Sample Correlation for Fingerprinting Deep Face Recognition},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Z6TPIARK}},
  note         = {Machine review of arXiv:2412.20768}
}
read the original abstract

Face recognition has witnessed remarkable advancements in recent years, thanks to the development of deep learning techniques.However, an off-the-shelf face recognition model as a commercial service could be stolen by model stealing attacks, posing great threats to the rights of the model owner.Model fingerprinting, as a model stealing detection method, aims to verify whether a suspect model is stolen from the victim model, gaining more and more attention nowadays.Previous methods always utilize transferable adversarial examples as the model fingerprint, but this method is known to be sensitive to adversarial defense and transfer learning techniques.To address this issue, we consider the pairwise relationship between samples instead and propose a novel yet simple model stealing detection method based on SAmple Correlation (SAC).Specifically, we present SAC-JC that selects JPEG compressed samples as model inputs and calculates the correlation matrix among their model outputs.Extensive results validate that SAC successfully defends against various model stealing attacks in deep face recognition, encompassing face verification and face emotion recognition, exhibiting the highest performance in terms of AUC, p-value and F1 score.Furthermore, we extend our evaluation of SAC-JC to object recognition datasets including Tiny-ImageNet and CIFAR10, which also demonstrates the superior performance of SAC-JC to previous methods.The code will be available at \url{https://github.com/guanjiyang/SAC_JC}.

Figures

Figures reproduced from arXiv: 2412.20768 by the authors.

Figure 1
Figure 1. Framework of SAC-JC. We first generate JPEG compressed samples as model inputs, represented by the [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Different image corruption methods for SAC. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Images used for model fingerprinting in KDEF. [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Performance change of SAC-JC with different data amounts. [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: Average F1 score of SAC-JC on different source [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

58 extracted references · 50 canonical work pages

  1. [1]

    Deepfacerecognition: A survey

    MeiWangandWeihongDeng. Deepfacerecognition: A survey. Neurocomputing, 429:215–244, 2021

    work page 2021

  2. [2]

    Entangled watermarks as a defense against model extraction

    Hengrui Jia, Christopher A Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot. Entangled watermarks as a defense against model extraction. In Proc. USENIX, pages 1937–1954, 2021

    work page 1937

  3. [3]

    Sensitive-sample fingerprinting of deep neural net- works

    Zecheng He, Tianwei Zhang, and Ruby Lee. Sensitive-sample fingerprinting of deep neural net- works. In Proc. CVPR, pages 4729–4737, 2019

    work page 2019

  4. [4]

    Deep neural network fingerprinting by conferrable adversarial examples

    Nils Lukas, Yuxuan Zhang, and Florian Kerschbaum. Deep neural network fingerprinting by conferrable adversarial examples. InProc. ICLR, 2021

    work page 2021

  5. [5]

    Fine-pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. InProc. RAID, pages 273–294, 2018

    work page 2018

  6. [6]

    Importance estimation for neural network pruning

    Pavlo Molchanov, Arun Mallya, Stephen Tyree, Iuri Frosio, and Jan Kautz. Importance estimation for neural network pruning. In Proc. CVPR, pages 11264–11272, 2019

    2019

  7. [7]

    Adversarial training for free! In Proc

    Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghi- asi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In Proc. NeurIPS, 2019

    work page 2019

  8. [8]

    Evaluation-oriented knowledge dis- tillation for deep face recognition

    Yuge Huang, Jiaxiang Wu, Xingkun Xu, and Shouhong Ding. Evaluation-oriented knowledge dis- tillation for deep face recognition. InProc. CVPR, pages 18740–18749, 2022

    work page 2022

Show all 58 references
  1. [9]

    High accuracy and high fidelity extraction of neural net- works

    Matthew Jagielski, Nicholas Carlini, David Berth- elot, Alex Kurakin, and Nicolas Papernot. High accuracy and high fidelity extraction of neural net- works. In Proc. USENIX, pages 1345–1362, 2020

    2020

  2. [10]

    Knockoff nets: Stealing functionality of black- box models

    Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Knockoff nets: Stealing functionality of black- box models. InProc. CVPR, pages 4954–4963, 2019

    2019

  3. [11]

    The karolinska directed emotional faces: a validation study.Cognition and emotion, 22(6):1094–1118, 2008

    Ellen Goeleven, Rudi De Raedt, Lemke Leyman, and Bruno Verschuere. The karolinska directed emotional faces: a validation study.Cognition and emotion, 22(6):1094–1118, 2008

    2008

  4. [12]

    Embedding watermarks into deep neural networks

    Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin’ichi Satoh. Embedding watermarks into deep neural networks. InProc. ICMR, pages 269– 277, 2017

    2017

  5. [13]

    Deepmarks: A digital fingerprinting framework for deep neural networks.arXiv preprint arXiv:1804.03648, 2018

    Huili Chen, Bita Darvish Rohani, and Farinaz Koushanfar. Deepmarks: A digital fingerprinting framework for deep neural networks.arXiv preprint arXiv:1804.03648, 2018

    2018 arXiv

  6. [14]

    Re- thinking deep neural network ownership verification: Embedding passports to defeat ambiguity attacks

    Lixin Fan, Kam Woh Ng, and Chee Seng Chan. Re- thinking deep neural network ownership verification: Embedding passports to defeat ambiguity attacks. In Proc. NeurIPS, 2019

    2019

  7. [15]

    Passport-aware normalization for deep model protection

    Jie Zhang, Dongdong Chen, Jing Liao, Weiming Zhang, Gang Hua, and Nenghai Yu. Passport-aware normalization for deep model protection. InProc. NeurIPS, pages 22619–22628, 2020

    2020

  8. [16]

    Turning your weakness into a strength: Watermarking deep neural networks by backdooring

    Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. InProc. USENIX, pages 1615–1631, 2018

    2018

  9. [17]

    Protecting intellectual property of deep neural networks with watermarking

    Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Marc Ph Stoecklin, Heqing Huang, and Ian Mol- loy. Protecting intellectual property of deep neural networks with watermarking. InProc. ASIACCS, pages 159–172, 2018

    2018

  10. [18]

    Deepip: Deep neural network intel- lectual property protection with passports.IEEE Transactions on Pattern Analysis and Machine In- telligence, 2021

    Lixin Fan, Kam Woh Ng, Chee Seng Chan, and Qiang Yang. Deepip: Deep neural network intel- lectual property protection with passports.IEEE Transactions on Pattern Analysis and Machine In- telligence, 2021

    2021

  11. [19]

    Anti-distillation backdoor attacks: Backdoors can really survive in knowledge distillation

    Yunjie Ge, Qian Wang, Baolin Zheng, Xinlu Zhuang, Qi Li, Chao Shen, and Cong Wang. Anti-distillation backdoor attacks: Backdoors can really survive in knowledge distillation. In Proc. ACMMM, pages 826–834, 2021

    2021

  12. [20]

    Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary

    Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary. In Proc. ICCCS, pages 14–25, 2021

    2021

  13. [21]

    Modeldiff: testing-based dnn sim- ilarity comparison for model reuse detection

    Yuanchun Li, Ziqi Zhang, Bingyan Liu, Ziyue Yang, and Yunxin Liu. Modeldiff: testing-based dnn sim- ilarity comparison for model reuse detection. In Proc. SIGSOFT, pages 139–151, 2021

    2021

  14. [22]

    Fingerprinting deep neural networks globally via universal adversar- ial perturbations

    Zirui Peng, Shaofeng Li, Guoxing Chen, Cheng Zhang, Haojin Zhu, and Minhui Xue. Fingerprinting deep neural networks globally via universal adversar- ial perturbations. arXiv preprint arXiv:2202.08602 , 2022

    2022 arXiv

  15. [23]

    Fingerprinting deep neural networks-a deepfool approach

    Si Wang and Chip-Hong Chang. Fingerprinting deep neural networks-a deepfool approach. InProc. ISCAS, pages 1–5, 2021

    2021

  16. [24]

    To- wards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. In Proc. ICLR, 2018

    2018

  17. [25]

    A survey of transfer learning.Journal of Big data, 3(1):1–40, 2016

    Karl Weiss, Taghi M Khoshgoftaar, and DingDing Wang. A survey of transfer learning.Journal of Big data, 3(1):1–40, 2016

    2016

  18. [26]

    Are you stealing my model? sample correlation for finger- printing deep neural networks

    Jiyang Guan, Jian Liang, and Ran He. Are you stealing my model? sample correlation for finger- printing deep neural networks. InProc. NeurIPS, volume 35, pages 36571–36584, 2022. Sample Correlation for Fingerprinting Deep Face Recognition 15

    2022

  19. [27]

    Benchmark- ing neural network robustness to common corrup- tions and perturbations

    Dan Hendrycks and Thomas Dietterich. Benchmark- ing neural network robustness to common corrup- tions and perturbations. InProc. ICLR, 2018

    2018

  20. [28]

    Deepface: Closing the gap to human-level performance in face verification

    Yaniv Taigman, Ming Yang, Marc’Aurelio Ran- zato, and Lior Wolf. Deepface: Closing the gap to human-level performance in face verification. In Proc. CVPR, pages 1701–1708, 2014

    2014

  21. [29]

    Convolutional neural networks for medical image analysis: Full training or fine tuning?IEEE Transactions on Medical Imaging, 35(5):1299–1312, 2016

    Nima Tajbakhsh, Jae Y Shin, Suryakanth R Gurudu, R Todd Hurst, Christopher B Kendall, Michael B Gotway, and Jianming Liang. Convolutional neural networks for medical image analysis: Full training or fine tuning?IEEE Transactions on Medical Imaging, 35(5):1299–1312, 2016

    2016

  22. [30]

    Few-shot backdoor defense using shapley esti- mation

    Jiyang Guan, Zhuozhuo Tu, Ran He, and Dacheng Tao. Few-shot backdoor defense using shapley esti- mation. In Proc. CVPR, pages 13358–13367, 2022

    2022

  23. [31]

    Defending against model stealing via verifying embedded external fea- tures

    Yiming Li, Linghui Zhu, Xiaojun Jia, Yong Jiang, Shu-Tao Xia, and Xiaochun Cao. Defending against model stealing via verifying embedded external fea- tures. In Proc. AAAI, 2022

    2022

  24. [32]

    Deepfool: a simple and accu- rate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accu- rate method to fool deep neural networks. InProc. CVPR, pages 2574–2582, 2016

    2016

  25. [33]

    Universal adver- sarial perturbations

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adver- sarial perturbations. In Proc. CVPR, pages 1765– 1773, 2017

    2017

  26. [34]

    Copy, right? a testing framework for copyright protection of deep learning models

    Jialuo Chen, Jingyi Wang, Tinglan Peng, Youcheng Sun, Peng Cheng, Shouling Ji, Xingjun Ma, Bo Li, and Dawn Song. Copy, right? a testing framework for copyright protection of deep learning models. In Proc. SP, pages 824–841, 2022

    2022

  27. [35]

    Cloudleak: Large-scale deep learning models stealing through adversarial examples

    Honggang Yu, Kaichen Yang, Teng Zhang, Yun- Yun Tsai, Tsung-Yi Ho, and Yier Jin. Cloudleak: Large-scale deep learning models stealing through adversarial examples. InProc. NDSS, 2020

    2020

  28. [36]

    Surpassing human- level face verification performance on lfw with gaus- sianface

    Chaochao Lu and Xiaoou Tang. Surpassing human- level face verification performance on lfw with gaus- sianface. In Proc. AAAI, volume 29, 2015

    2015

  29. [37]

    Discriminant analysis in correlation simi- larity measure space

    Yong Ma, Shihong Lao, Erina Takikawa, and Masato Kawade. Discriminant analysis in correlation simi- larity measure space. InProc. ICML, pages 577–584, 2007

    2007

  30. [38]

    Correlation congruence for knowledge distillation

    Baoyun Peng, Xiao Jin, Jiaheng Liu, Dongsheng Li, Yichao Wu, Yu Liu, Shunfeng Zhou, and Zhaon- ing Zhang. Correlation congruence for knowledge distillation. In Proc. CVPR, pages 5007–5016, 2019

    2019

  31. [39]

    Cosine similarity metric learning for face verification

    Hieu V Nguyen and Li Bai. Cosine similarity metric learning for face verification. InProc. CVPR, pages 709–720, 2010

    2010

  32. [40]

    An explicit description of the reproducing kernel hilbert spaces of gaussian rbf kernels.IEEE Transactions on Information Theory , 52(10):4635–4643, 2006

    Ingo Steinwart, Don Hush, and Clint Scovel. An explicit description of the reproducing kernel hilbert spaces of gaussian rbf kernels.IEEE Transactions on Information Theory , 52(10):4635–4643, 2006

    2006

  33. [41]

    Scale invariance and noise in natural images

    Daniel Zoran and Yair Weiss. Scale invariance and noise in natural images. InProc. ICCV, pages 2209– 2216, 2009

    2009

  34. [42]

    On detecting adversarial per- turbations

    Jan Hendrik Metzen, Tim Genewein, Volker Fischer, and Bastian Bischoff. On detecting adversarial per- turbations. In Proc. ICLR, 2016

    2016

  35. [43]

    Recent advances in adversarial train- ing for adversarial robustness

    Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. Recent advances in adversarial train- ing for adversarial robustness. arXiv preprint arXiv:2102.01356, 2021

    2021 arXiv

  36. [44]

    Adversarial machine learning at scale

    Alexey Kurakin, Ian Goodfellow, and Samy Ben- gio. Adversarial machine learning at scale. InProc. ICLR, 2016

    2016

  37. [45]

    Data-free model ex- traction

    Jean-Baptiste Truong, Pratyush Maini, Robert J Walls, and Nicolas Papernot. Data-free model ex- traction. In Proc. CVPR, pages 4771–4780, 2021

    2021

  38. [46]

    Knowledge distillation: A survey

    Jianping Gou, Baosheng Yu, Stephen J Maybank, and Dacheng Tao. Knowledge distillation: A survey. International Journal of Computer Vision , 129(6): 1789–1819, 2021

    2021

  39. [47]

    Very deep convolutional networks for large-scale image recog- nition

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recog- nition. arXiv preprint arXiv:1409.1556 , 2014

    2014 arXiv

  40. [48]

    Deep residual learning for image recogni- tion

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recogni- tion. In Proc. CVPR, pages 770–778, 2016

    2016

  41. [49]

    Densely connected convo- lutional networks

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convo- lutional networks. InProc. CVPR, pages 4700–4708, 2017

    2017

  42. [50]

    Mo- bilenetv2: Inverted residuals and linear bottlenecks

    Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chieh Chen. Mo- bilenetv2: Inverted residuals and linear bottlenecks. In Proc. CVPR, pages 4510–4520, 2018

    2018

  43. [51]

    Generating adversarial examples by makeup attacks on face recognition

    Zheng-An Zhu, Yun-Zhong Lu, and Chen-Kuo Chi- ang. Generating adversarial examples by makeup attacks on face recognition. InProc. ICIP, pages 2516–2520, 2019

    2019

  44. [52]

    Badnets: Identifying vulnerabilities in the machinelearningmodelsupplychain

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machinelearningmodelsupplychain. arXiv preprint arXiv:1708.06733, 2017

    2017 arXiv

  45. [53]

    Ms-celeb-1m: A dataset and benchmark for large-scale face recognition

    Yandong Guo, Lei Zhang, Yuxiao Hu, Xiaodong He, and Jianfeng Gao. Ms-celeb-1m: A dataset and benchmark for large-scale face recognition. InProc. ECCV, pages 87–102, 2016

    2016

  46. [54]

    Learning face representation from scratch.arXiv preprint arXiv:1411.7923, 2014

    Dong Yi, Zhen Lei, Shengcai Liao, and Stan Z Li. Learning face representation from scratch.arXiv preprint arXiv:1411.7923, 2014

    2014 arXiv

  47. [55]

    Arcface: Additive angular margin loss for 16 Jiyang Guan1,2 et al

    Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Arcface: Additive angular margin loss for 16 Jiyang Guan1,2 et al. deep face recognition. InProc. CVPR, pages 4690– 4699, 2019

    2019

  48. [56]

    Tiny imagenet visual recog- nition challenge

    Ya Le and Xuan Yang. Tiny imagenet visual recog- nition challenge. CS 231N, 7(7):3, 2015

    2015

  49. [57]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  50. [58]

    The relationship between precision-recall and roc curves

    Jesse Davis and Mark Goadrich. The relationship between precision-recall and roc curves. In Proc. ICML, pages 233–240, 2006

    2006

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.