{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,4]],"date-time":"2026-05-04T13:35:03Z","timestamp":1777901703755,"version":"3.51.4"},"publisher-location":"New York, NY, USA","reference-count":63,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,8,4]],"date-time":"2023-08-04T00:00:00Z","timestamp":1691107200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,8,6]]},"DOI":"10.1145\/3580305.3599291","type":"proceedings-article","created":{"date-parts":[[2023,8,4]],"date-time":"2023-08-04T18:10:58Z","timestamp":1691172658000},"page":"1783-1794","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":8,"title":["Cracking White-box DNN Watermarks via Invariant Neuron Transforms"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1394-0395","authenticated-orcid":false,"given":"Xudong","family":"Pan","sequence":"first","affiliation":[{"name":"Fudan University, Shanghai, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3567-3478","authenticated-orcid":false,"given":"Mi","family":"Zhang","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7409-9184","authenticated-orcid":false,"given":"Yifan","family":"Yan","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-8660-5429","authenticated-orcid":false,"given":"Yining","family":"Wang","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9714-5545","authenticated-orcid":false,"given":"Min","family":"Yang","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}]}],"member":"320","published-online":{"date-parts":[[2023,8,4]]},"reference":[{"key":"e_1_3_2_2_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_2_2_1","volume-title":"Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint arXiv:1511.06434","author":"Radford Alec","year":"2015","unstructured":"Alec Radford , Luke Metz , and Soumith Chintala . Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint arXiv:1511.06434 , 2015 . Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint arXiv:1511.06434, 2015."},{"key":"e_1_3_2_2_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"e_1_3_2_2_4_1","volume-title":"Wide residual networks. arXiv preprint arXiv:1605.07146","author":"Zagoruyko Sergey","year":"2016","unstructured":"Sergey Zagoruyko and Nikos Komodakis . Wide residual networks. arXiv preprint arXiv:1605.07146 , 2016 . Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint arXiv:1605.07146, 2016."},{"key":"e_1_3_2_2_5_1","first-page":"2048","volume-title":"International conference on machine learning","author":"Xu Kelvin","year":"2015","unstructured":"Kelvin Xu , Jimmy Ba , Ryan Kiros , Kyunghyun Cho , Aaron Courville , Ruslan Salakhudinov , Rich Zemel , and Yoshua Bengio . Show, attend and tell: Neural image caption generation with visual attention . In International conference on machine learning , pages 2048 -- 2057 . PMLR, 2015 . Kelvin Xu, Jimmy Ba, Ryan Kiros, Kyunghyun Cho, Aaron Courville, Ruslan Salakhudinov, Rich Zemel, and Yoshua Bengio. Show, attend and tell: Neural image caption generation with visual attention. In International conference on machine learning, pages 2048--2057. PMLR, 2015."},{"key":"e_1_3_2_2_6_1","volume-title":"Bert: Pre- training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805","author":"Devlin Jacob","year":"2018","unstructured":"Jacob Devlin , Ming-Wei Chang , Kenton Lee , and Kristina Toutanova . Bert: Pre- training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 , 2018 . Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre- training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805, 2018."},{"key":"e_1_3_2_2_7_1","volume-title":"Energy and policy considerations for deep learning in nlp. arXiv preprint arXiv:1906.02243","author":"Strubell Emma","year":"2019","unstructured":"Emma Strubell , Ananya Ganesh , and Andrew McCallum . Energy and policy considerations for deep learning in nlp. arXiv preprint arXiv:1906.02243 , 2019 . Emma Strubell, Ananya Ganesh, and Andrew McCallum. Energy and policy considerations for deep learning in nlp. arXiv preprint arXiv:1906.02243, 2019."},{"key":"e_1_3_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-28954-6_7"},{"key":"e_1_3_2_2_9_1","first-page":"4954","volume-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition","author":"Orekondy Tribhuvanesh","year":"2019","unstructured":"Tribhuvanesh Orekondy , Bernt Schiele , and Mario Fritz . Knockoff nets : Stealing functionality of black-box models . In Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition , pages 4954 -- 4963 , 2019 . Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Knockoff nets: Stealing functionality of black-box models. In Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pages 4954--4963, 2019."},{"key":"e_1_3_2_2_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00038"},{"key":"e_1_3_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_2_2_12_1","volume-title":"Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246","author":"Salem Ahmed","year":"2018","unstructured":"Ahmed Salem , Yang Zhang , Mathias Humbert , Pascal Berrang , Mario Fritz , and Michael Backes . Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246 , 2018 . Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246, 2018."},{"key":"e_1_3_2_2_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3078971.3078974"},{"key":"e_1_3_2_2_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3450000"},{"key":"e_1_3_2_2_15_1","first-page":"6978","volume-title":"International Conference on Machine Learning","author":"Liu Hanwen","year":"2021","unstructured":"Hanwen Liu , Zhenyu Weng , and Yuesheng Zhu . Watermarking deep neural networks with greedy residuals . In International Conference on Machine Learning , pages 6978 -- 6988 . PMLR, 2021 . Hanwen Liu, Zhenyu Weng, and Yuesheng Zhu. Watermarking deep neural networks with greedy residuals. In International Conference on Machine Learning, pages 6978--6988. PMLR, 2021."},{"key":"e_1_3_2_2_16_1","article-title":"Deep neural network intellectual property protection with passports","author":"Fan Lixin","year":"2021","unstructured":"Lixin Fan , Kam Woh Ng , Chee Seng Chan , and Qiang Yang . Deepip : Deep neural network intellectual property protection with passports . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2021 . Lixin Fan, Kam Woh Ng, Chee Seng Chan, and Qiang Yang. Deepip: Deep neural network intellectual property protection with passports. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2021.","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"e_1_3_2_2_17_1","first-page":"22619","article-title":"Passport-aware normalization for deep model protection","volume":"33","author":"Zhang Jie","year":"2020","unstructured":"Jie Zhang , Dongdong Chen , Jing Liao , Weiming Zhang , Gang Hua , and Nenghai Yu . Passport-aware normalization for deep model protection . Advances in Neural Information Processing Systems , 33 : 22619 - 22628 , 2020 . Jie Zhang, Dongdong Chen, Jing Liao, Weiming Zhang, Gang Hua, and Nenghai Yu. Passport-aware normalization for deep model protection. Advances in Neural Information Processing Systems, 33:22619-22628, 2020.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_2_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00363"},{"key":"e_1_3_2_2_19_1","first-page":"34","article-title":"You are caught stealing my winning lottery ticket! making a lottery ticket claim its ownership","author":"Chen Xuxi","year":"2021","unstructured":"Xuxi Chen , Tianlong Chen , Zhenyu Zhang , and Zhangyang Wang . You are caught stealing my winning lottery ticket! making a lottery ticket claim its ownership . Advances in Neural Information Processing Systems , 34 , 2021 . Xuxi Chen, Tianlong Chen, Zhenyu Zhang, and Zhangyang Wang. You are caught stealing my winning lottery ticket! making a lottery ticket claim its ownership. Advances in Neural Information Processing Systems, 34, 2021.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_2_20_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2021.108285"},{"key":"e_1_3_2_2_21_1","first-page":"485","volume-title":"Deepsigns: An end-to-end watermarking framework for ownership protection of deep neural networks","author":"Rouhani Bita Darvish","year":"2019","unstructured":"Bita Darvish Rouhani , Huili Chen , and Farinaz Koushanfar . Deepsigns: An end-to-end watermarking framework for ownership protection of deep neural networks . pages 485 -- 497 , 2019 . Bita Darvish Rouhani, Huili Chen, and Farinaz Koushanfar. Deepsigns: An end-to-end watermarking framework for ownership protection of deep neural networks. pages 485--497, 2019."},{"key":"e_1_3_2_2_22_1","first-page":"1615","volume-title":"27th {USENIX} Security Symposium ({USENIX} Security 18)","author":"Adi Yossi","year":"2018","unstructured":"Yossi Adi , Carsten Baum , Moustapha Cisse , Benny Pinkas , and Joseph Keshet . Turning your weakness into a strength: Watermarking deep neural networks by backdooring . In 27th {USENIX} Security Symposium ({USENIX} Security 18) , pages 1615 -- 1631 , 2018 . Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In 27th {USENIX} Security Symposium ({USENIX} Security 18), pages 1615--1631, 2018."},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196550"},{"key":"e_1_3_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3474085.3475591"},{"key":"e_1_3_2_2_25_1","volume-title":"30th {USENIX} Security Symposium ({USENIX} Security 21)","author":"Jia Hengrui","year":"2021","unstructured":"Hengrui Jia , Christopher A Choquette-Choo , Varun Chandrasekaran , and Nicolas Papernot . Entangled watermarks as a defense against model extraction . In 30th {USENIX} Security Symposium ({USENIX} Security 21) , 2021 . Hengrui Jia, Christopher A Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot. Entangled watermarks as a defense against model extraction. In 30th {USENIX} Security Symposium ({USENIX} Security 21), 2021."},{"key":"e_1_3_2_2_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/3307650.3322251"},{"key":"e_1_3_2_2_27_1","volume-title":"Compression of neural machine translation models via pruning. arXiv preprint arXiv:1606.09274","author":"Luong Minh-Thang","year":"2016","unstructured":"Abigail See, Minh-Thang Luong , and Christopher D Manning . Compression of neural machine translation models via pruning. arXiv preprint arXiv:1606.09274 , 2016 . Abigail See, Minh-Thang Luong, and Christopher D Manning. Compression of neural machine translation models via pruning. arXiv preprint arXiv:1606.09274, 2016."},{"key":"e_1_3_2_2_28_1","volume-title":"Pruning filters for efficient convnets. arXiv preprint arXiv:1608.08710","author":"Li Hao","year":"2016","unstructured":"Hao Li , Asim Kadav , Igor Durdanovic , Hanan Samet , and Hans Peter Graf . Pruning filters for efficient convnets. arXiv preprint arXiv:1608.08710 , 2016 . Hao Li, Asim Kadav, Igor Durdanovic, Hanan Samet, and Hans Peter Graf. Pruning filters for efficient convnets. arXiv preprint arXiv:1608.08710, 2016."},{"key":"e_1_3_2_2_29_1","volume-title":"Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531","author":"Hinton Geoffrey","year":"2015","unstructured":"Geoffrey Hinton , Oriol Vinyals , and Jeff Dean . Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531 , 2015 . Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531, 2015."},{"key":"e_1_3_2_2_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8682202"},{"key":"e_1_3_2_2_31_1","volume-title":"Effectiveness of distillation attack and countermeasure on neural network watermarking. arXiv preprint arXiv:1906.06046","author":"Yang Ziqi","year":"2019","unstructured":"Ziqi Yang , Hung Dang , and Ee-Chien Chang . Effectiveness of distillation attack and countermeasure on neural network watermarking. arXiv preprint arXiv:1906.06046 , 2019 . Ziqi Yang, Hung Dang, and Ee-Chien Chang. Effectiveness of distillation attack and countermeasure on neural network watermarking. arXiv preprint arXiv:1906.06046, 2019."},{"key":"e_1_3_2_2_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3437880.3460401"},{"key":"e_1_3_2_2_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3453079"},{"key":"e_1_3_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102277"},{"key":"e_1_3_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/500"},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1993.5.6.910"},{"key":"e_1_3_2_2_38_1","volume-title":"Path-sgd: Path- normalized optimization in deep neural networks. arXiv preprint arXiv:1506.02617","author":"Neyshabur Behnam","year":"2015","unstructured":"Behnam Neyshabur , Ruslan Salakhutdinov , and Nathan Srebro . Path-sgd: Path- normalized optimization in deep neural networks. arXiv preprint arXiv:1506.02617 , 2015 . Behnam Neyshabur, Ruslan Salakhutdinov, and Nathan Srebro. Path-sgd: Path- normalized optimization in deep neural networks. arXiv preprint arXiv:1506.02617, 2015."},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243834"},{"key":"e_1_3_2_2_40_1","volume-title":"8th International Conference on Learning Representations","author":"Thi Mai Phuong Bui","year":"2020","unstructured":"Phuong Bui Thi Mai and Christoph Lampert . Functional vs. parametric equivalence of relu networks . In 8th International Conference on Learning Representations , 2020 . Phuong Bui Thi Mai and Christoph Lampert. Functional vs. parametric equivalence of relu networks. In 8th International Conference on Learning Representations, 2020."},{"key":"e_1_3_2_2_41_1","first-page":"448","volume-title":"International conference on machine learning","author":"Ioffe Sergey","year":"2015","unstructured":"Sergey Ioffe and Christian Szegedy . Batch normalization : Accelerating deep network training by reducing internal covariate shift . In International conference on machine learning , pages 448 -- 456 . PMLR, 2015 . Sergey Ioffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International conference on machine learning, pages 448--456. PMLR, 2015."},{"key":"e_1_3_2_2_42_1","volume-title":"Jamie Ryan Kiros, and Geoffrey E Hinton. Layer normalization. arXiv preprint arXiv:1607.06450","author":"Ba Jimmy Lei","year":"2016","unstructured":"Jimmy Lei Ba , Jamie Ryan Kiros, and Geoffrey E Hinton. Layer normalization. arXiv preprint arXiv:1607.06450 , 2016 . Jimmy Lei Ba, Jamie Ryan Kiros, and Geoffrey E Hinton. Layer normalization. arXiv preprint arXiv:1607.06450, 2016."},{"key":"e_1_3_2_2_43_1","volume-title":"Instance normalization: The missing ingredient for fast stylization. arXiv preprint arXiv:1607.08022","author":"Ulyanov Dmitry","year":"2016","unstructured":"Dmitry Ulyanov , Andrea Vedaldi , and Victor Lempitsky . Instance normalization: The missing ingredient for fast stylization. arXiv preprint arXiv:1607.08022 , 2016 . Dmitry Ulyanov, Andrea Vedaldi, and Victor Lempitsky. Instance normalization: The missing ingredient for fast stylization. arXiv preprint arXiv:1607.08022, 2016."},{"key":"e_1_3_2_2_44_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01261-8_1"},{"key":"e_1_3_2_2_45_1","volume-title":"Error detecting and error correcting codes. The Bell system technical journal, 29(2):147--160","author":"Hamming Richard W","year":"1950","unstructured":"Richard W Hamming . Error detecting and error correcting codes. The Bell system technical journal, 29(2):147--160 , 1950 . Richard W Hamming. Error detecting and error correcting codes. The Bell system technical journal, 29(2):147--160, 1950."},{"key":"e_1_3_2_2_46_1","first-page":"601","volume-title":"25th USENIX security symposium (USENIX Security 16)","author":"Tram\u00e8r Florian","year":"2016","unstructured":"Florian Tram\u00e8r , Fan Zhang , Ari Juels , Michael K Reiter , and Thomas Ristenpart . Stealing machine learning models via prediction {APIs} . In 25th USENIX security symposium (USENIX Security 16) , pages 601 -- 618 , 2016 . Florian Tram\u00e8r, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction {APIs}. In 25th USENIX security symposium (USENIX Security 16), pages 601--618, 2016."},{"key":"e_1_3_2_2_47_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24178"},{"key":"e_1_3_2_2_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICOIN50884.2021.9333926"},{"key":"e_1_3_2_2_49_1","first-page":"2003","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Yan Mengjia","year":"2020","unstructured":"Mengjia Yan , Christopher W Fletcher , and Josep Torrellas . Cache telepathy : Leveraging shared resource attacks to learn {DNN} architectures . In 29th USENIX Security Symposium (USENIX Security 20) , pages 2003 -- 2020 , 2020 . Mengjia Yan, Christopher W Fletcher, and Josep Torrellas. Cache telepathy: Leveraging shared resource attacks to learn {DNN} architectures. In 29th USENIX Security Symposium (USENIX Security 20), pages 2003--2020, 2020."},{"key":"e_1_3_2_2_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833693"},{"key":"e_1_3_2_2_51_1","unstructured":"Uchida. https:\/\/github.com\/yu4u\/dnn-watermark. Accessed: 2017-07-31.  Uchida. https:\/\/github.com\/yu4u\/dnn-watermark. Accessed: 2017-07-31."},{"key":"e_1_3_2_2_52_1","volume-title":"Generative adversarial nets. Advances in neural information processing systems, 27","author":"Goodfellow Ian","year":"2014","unstructured":"Ian Goodfellow , Jean Pouget-Abadie , Mehdi Mirza , Bing Xu , David Warde-Farley , Sherjil Ozair , Aaron Courville , and Yoshua Bengio . Generative adversarial nets. Advances in neural information processing systems, 27 , 2014 . Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information processing systems, 27, 2014."},{"key":"e_1_3_2_2_53_1","doi-asserted-by":"crossref","unstructured":"Protection on the IPR of gans. https:\/\/github.com\/dingsheng-ong\/ipr-gan. Accessed: 2021-11-10.  Protection on the IPR of gans. https:\/\/github.com\/dingsheng-ong\/ipr-gan. Accessed: 2021-11-10.","DOI":"10.5553\/TvJr\/259035002021003001005"},{"key":"e_1_3_2_2_54_1","unstructured":"Greedy residuals. https:\/\/github.com\/eil\/greedy-residuals. Accessed: 2021-7-16.  Greedy residuals. https:\/\/github.com\/eil\/greedy-residuals. Accessed: 2021-7-16."},{"key":"e_1_3_2_2_55_1","unstructured":"lottery verification. https:\/\/github.com\/VITA-Group\/NO-stealing-LTH. Accessed: 2021-10-1.  lottery verification. https:\/\/github.com\/VITA-Group\/NO-stealing-LTH. Accessed: 2021-10-1."},{"key":"e_1_3_2_2_56_1","unstructured":"Deepsigns. https:\/\/github.com\/bitadr\/DeepSigns. Accessed: 2019-4-15.  Deepsigns. https:\/\/github.com\/bitadr\/DeepSigns. Accessed: 2019-4-15."},{"key":"e_1_3_2_2_57_1","unstructured":"Protection on the IPR of image captioning. https:\/\/github.com\/jianhanlim\/ipr-imagecaptioning. Accessed: 2021-10-15.  Protection on the IPR of image captioning. https:\/\/github.com\/jianhanlim\/ipr-imagecaptioning. Accessed: 2021-10-15."},{"key":"e_1_3_2_2_58_1","unstructured":"Deepipr. https:\/\/github.com\/kamwoh\/DeepIPR. Accessed: 2021-12-30.  Deepipr. https:\/\/github.com\/kamwoh\/DeepIPR. Accessed: 2021-12-30."},{"key":"e_1_3_2_2_59_1","volume-title":"Hufunet: Embedding the left piece as watermark and keeping the right piece for ownership verification in deep neural networks. ArXiv, abs\/2103.13628","author":"Lv Peizhuo","year":"2021","unstructured":"Peizhuo Lv , Pan Li , Shengzhi Zhang , Kai Chen , Ruigang Liang , Yue Zhao , and Yingjiu Li . Hufunet: Embedding the left piece as watermark and keeping the right piece for ownership verification in deep neural networks. ArXiv, abs\/2103.13628 , 2021 . Peizhuo Lv, Pan Li, Shengzhi Zhang, Kai Chen, Ruigang Liang, Yue Zhao, and Yingjiu Li. Hufunet: Embedding the left piece as watermark and keeping the right piece for ownership verification in deep neural networks. ArXiv, abs\/2103.13628, 2021."},{"key":"e_1_3_2_2_60_1","volume-title":"Cracking white-box DNN watermarks via invariant neuron transforms. CoRR, abs\/2205.00199","author":"Yan Yifan","year":"2022","unstructured":"Yifan Yan , Xudong Pan , Yining Wang , Mi Zhang , and Min Yang . Cracking white-box DNN watermarks via invariant neuron transforms. CoRR, abs\/2205.00199 , 2022 . Yifan Yan, Xudong Pan, Yining Wang, Mi Zhang, and Min Yang. Cracking white-box DNN watermarks via invariant neuron transforms. CoRR, abs\/2205.00199, 2022."},{"key":"e_1_3_2_2_61_1","unstructured":"Passport-aware normalization. https:\/\/github.com\/ZJZAC\/Passport-aware-Normalization. Accessed: 2021-6-10.  Passport-aware normalization. https:\/\/github.com\/ZJZAC\/Passport-aware-Normalization. Accessed: 2021-6-10."},{"key":"e_1_3_2_2_62_1","unstructured":"Riga. https:\/\/github.com\/TIANHAO-WANG\/riga. Accessed: 2021-2-6.  Riga. https:\/\/github.com\/TIANHAO-WANG\/riga. Accessed: 2021-2-6."},{"key":"e_1_3_2_2_63_1","unstructured":"Random permutation. https:\/\/numpy.org\/devdocs\/reference\/random\/generated\/ numpy.random.permutation.html. Accessed: 2022-1-10.  Random permutation. https:\/\/numpy.org\/devdocs\/reference\/random\/generated\/ numpy.random.permutation.html. Accessed: 2022-1-10."}],"event":{"name":"KDD '23: The 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining","location":"Long Beach CA USA","acronym":"KDD '23","sponsor":["SIGMOD ACM Special Interest Group on Management of Data","SIGKDD ACM Special Interest Group on Knowledge Discovery in Data"]},"container-title":["Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3580305.3599291","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3580305.3599291","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:51:16Z","timestamp":1750182676000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3580305.3599291"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,8,4]]},"references-count":63,"alternative-id":["10.1145\/3580305.3599291","10.1145\/3580305"],"URL":"https:\/\/doi.org\/10.1145\/3580305.3599291","relation":{},"subject":[],"published":{"date-parts":[[2023,8,4]]},"assertion":[{"value":"2023-08-04","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}