ProbeSpec: Robust Model Fingerprinting via Dynamic Perturbation Response Spectrum

Deep neural networks (DNNs) represent critical intellectual property that model owners urgently need to protect. With the increasing value of models, malicious attackers increasingly attempt to extract model functionality through techniques such as fine-tuning, distillation, and pruning. Model fingerprinting has emerged as a mainstream protection strategy. However, existing fingerprinting methods either exhibit vulnerability to model modifications due to reliance on decision boundary features or require prohibitively large query budgets for accurate verification. This paper proposes ProbeSpec, which captures model fingerprints through dynamic behavioral analysis rather than static output matching. We discover that a model’s response patterns under multi-level perturbations form a unique “behavioral spectrum”, originating from implicit decision mechanisms learned during training and preserved even after various attacks. ProbeSpec employs three complementary probe types to elicit this characteristic and leverages DCT frequency-domain transformation for efficient fingerprint extraction. Extensive experiments show that ProbeSpec achieves 100% detection rate in the majority of attack scenarios, with an overall accuracy exceeding 95% across all tested architectures. Meanwhile, it effectively distinguishes independently trained models and requires only 80 probe samples for fingerprint extraction.