Notice: The reproducibility variables underlying each score are classified using an automated LLM-based pipeline, validated against a manually labeled dataset. LLM-based classification introduces uncertainty and potential bias; scores should be interpreted as estimates. Full accuracy metrics and methodology are described in Coakley et alK. L. Coakley, T. Snelleman, H. Hoos, and O. E. Gundersen, "The embrace of open science: An analysis of a decade of AI research and 56 800 conference papers," Under Review, 2026..
Towards the Resistance of Neural Network Fingerprinting to Fine-tuning
Authors: Ling Tang, YueFeng Chen, Hui Xue', Quanshi Zhang
NeurIPS 2025 | Venue PDF | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | This paper proves a new fingerprinting method to embed the ownership information into a deep neural network (DNN) with theoretically guaranteed robustness to finetuning. Specifically, we prove that when the input feature of a convolutional layer only contains low-frequency components, specific frequency components of the convolutional filter will not be changed by gradient descent during the fine-tuning process, where we propose a revised Fourier transform to extract frequency components from the convolutional filter. Additionally, we also prove that these frequency components are equivariant to weight scaling and weight permutations. In this way, we design a fingerprint module to embed the fingerprint information into specific frequency components of convolutional filters. Preliminary experiments demonstrate the effectiveness of our method. The source code has been released at https://github.com/tling2000/watermark. |
| Researcher Affiliation | Collaboration | Ling Tang Shanghai Jiao Tong University EMAIL Yuefeng Chen Alibaba Group EMAIL Hui Xue Alibaba Group EMAIL Quanshi Zhang Shanghai Jiao Tong University EMAIL |
| Pseudocode | No | The paper provides theoretical proofs and mathematical formulations (e.g., Theorem 3.1, 3.2, 3.5, 3.6), but it does not include any clearly labeled pseudocode or algorithm blocks. The methods are described through equations and textual explanations. |
| Open Source Code | Yes | The source code has been released at https://github.com/tling2000/watermark. |
| Open Datasets | Yes | We trained Alex Net [Krizhevsky et al., 2012] and Res Net-18 [He et al., 2016] on Caltech101, Caltech-256 [Fei-Fei et al., 2006] (license unknown), CIFAR-10 and CIFAR-100 [Krizhevsky et al., 2009] (MIT License) for image classification tasks. |
| Dataset Splits | No | The paper mentions training Alex Net and Res Net-18 on CIFAR-100 and then fine-tuning them on Image Nette, CIFAR-10, and Caltech-101 for 50 epochs. It also states in Appendix C.3 that "we randomly select 100 images from the CIFAR-100 dataset as probing inputs." However, explicit train/validation/test splits with percentages or sample counts for the main experiments are not detailed in the provided text. |
| Hardware Specification | Yes | All DNNs can be trained within 6 hours on a single NVIDIA Ge Force RTX 3090 GPU (with 24G GPU memory). |
| Software Dependencies | No | The paper does not explicitly mention any specific software dependencies with version numbers (e.g., Python, PyTorch, TensorFlow versions). |
| Experiment Setup | Yes | We trained the model using the SGD optimizer for 250 epochs, with a learning rate of 0.01 for the first 100 epochs and 0.001 for the remaining 150 epochs. For Alex Net, the fingerprint module containing 256 convolutional filters was connected to the third convolutional layer. For Res Net-18, the fingerprint module containing 256 convolutional filters was connected to the second convolutional layer of the second residual block. The scalar weight λ was set to 5 × 10−4. The noise ε added to the parameters in the fingerprint module was obtained by conducting the IDFT on a unit frequency component at a random frequency, and the l2-norm of the noise ε was set to 0.5 times the l2-norm of the weights. We trained Alex Net and Res Net-18 on CIFAR-100, and then fine-tuned them on Image Nette (Apache License 2.0), CIFAR-10 and Caltech-101 with the learning rate 0.01 for 50 epochs. |