{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/copy-right-a-testing-framework-for-copyright","title":"Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Models","arxiv_id":"2112.05588","date":"2021-12-10","proceeding":null,"authors":["Jialuo Chen","Jingyi Wang","Tinglan Peng","Youcheng Sun","Peng Cheng","Shouling Ji","Xingjun Ma","Bo Li","Dawn Song"],"abstract":"Deep learning (DL) models, especially those large-scale and high-performance ones, can be very costly to train, demanding a great amount of data and computational resources. Unauthorized reproduction of DL models can lead to copyright infringement and cause huge economic losses to model owners. Existing copyright protection techniques are mostly based on watermarking, which embeds an owner-specified watermark into the model. While being able to provide exact ownership verification, these techniques are 1) invasive, as they need to tamper with the training process, which may affect the utility or introduce new security risks; 2) prone to adaptive attacks that attempt to remove the watermark; and 3) not robust to the emerging model extraction attacks. Latest fingerprinting work, though being non-invasive, also falls short when facing the diverse and ever-growing attack scenarios. In this paper, we propose a novel testing framework for DL copyright protection: DEEPJUDGE. DEEPJUDGE quantitatively tests the similarities between two DL models: a victim model and a suspect model. It leverages a diverse set of testing metrics and test case generation methods to produce a chain of supporting evidence to help determine whether a suspect model is a copy of the victim model. Advantages of DEEPJUDGE include: 1) non-invasive, as it works directly on the model and does not tamper with the training process; 2) efficient, as it only needs a small set of test cases and a quick scan of models; 3) flexible, as it can easily incorporate new metrics or generation methods to obtain more confident judgement; and 4) fairly robust to model extraction and adaptive attacks. We verify the effectiveness of DEEPJUDGE under typical copyright infringement scenarios, including model finetuning, pruning and extraction, via extensive experiments on both image and speech datasets with a variety of model architectures.","url_abs":"https://arxiv.org/abs/2112.05588v1","url_pdf":"https://arxiv.org/pdf/2112.05588v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"links_only","authors_date_abstract":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license), from the Kaggle arXiv metadata snapshot of 2026-09-12"},"code_links":[{"paper_slug":"copy-right-a-testing-framework-for-copyright","repo_url":"https://github.com/testing4ai/deepjudge","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":null}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2112.05588","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2112.05588"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/testing4ai/deepjudge","reach":null}],"summary":{"ran":6,"unverified":5},"by_repo_kind":{"official":{"samples":11,"ran":6,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"ff100878ce7ea2de","entry":"LOD","repo":"testing4ai/deepjudge","repo_kind":"official","path":"DeepJudge/metrics.py","file_url":"https://github.com/testing4ai/deepjudge/blob/HEAD/DeepJudge/metrics.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ff100878ce7ea2de"}},{"code_sha256_prefix":"16b3b4e8cc974d18","entry":"Lenet1","repo":"testing4ai/deepjudge","repo_kind":"official","path":"baselines/watermarking-blackbox/lenet5.py","file_url":"https://github.com/testing4ai/deepjudge/blob/HEAD/baselines/watermarking-blackbox/lenet5.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"16b3b4e8cc974d18"}},{"code_sha256_prefix":"6b990fd5ae030a18","entry":"Lenet5","repo":"testing4ai/deepjudge","repo_kind":"official","path":"baselines/watermarking-blackbox/lenet5.py","file_url":"https://github.com/testing4ai/deepjudge/blob/HEAD/baselines/watermarking-blackbox/lenet5.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6b990fd5ae030a18"}},{"code_sha256_prefix":"811034f64e9e6eb3","entry":"MLP","repo":"testing4ai/deepjudge","repo_kind":"official","path":"baselines/watermarking-blackbox/lenet5.py","file_url":"https://github.com/testing4ai/deepjudge/blob/HEAD/baselines/watermarking-blackbox/lenet5.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"811034f64e9e6eb3"}},{"code_sha256_prefix":"6347b98cede3b625","entry":"RTAL","repo":"testing4ai/deepjudge","repo_kind":"official","path":"attacks/tune.py","file_url":"https://github.com/testing4ai/deepjudge/blob/HEAD/attacks/tune.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6347b98cede3b625"}},{"code_sha256_prefix":"05cd3f4d1a34a81d","entry":"Rob","repo":"testing4ai/deepjudge","repo_kind":"official","path":"DeepJudge/metrics.py","file_url":"https://github.com/testing4ai/deepjudge/blob/HEAD/DeepJudge/metrics.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"05cd3f4d1a34a81d"}},{"code_sha256_prefix":"8cddedd0fa6b4937","entry":"FTAL","repo":"testing4ai/deepjudge","repo_kind":"official","path":"attacks/tune.py","file_url":"https://github.com/testing4ai/deepjudge/blob/HEAD/attacks/tune.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8cddedd0fa6b4937"}},{"code_sha256_prefix":"04e2a22fe1c4d8f5","entry":"FTLL","repo":"testing4ai/deepjudge","repo_kind":"official","path":"attacks/tune.py","file_url":"https://github.com/testing4ai/deepjudge/blob/HEAD/attacks/tune.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"04e2a22fe1c4d8f5"}},{"code_sha256_prefix":"7f03f1160f2f8506","entry":"JSD","repo":"testing4ai/deepjudge","repo_kind":"official","path":"DeepJudge/metrics.py","file_url":"https://github.com/testing4ai/deepjudge/blob/HEAD/DeepJudge/metrics.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7f03f1160f2f8506"}},{"code_sha256_prefix":"280cf09e64c114a9","entry":"NNOD_Matrix","repo":"testing4ai/deepjudge","repo_kind":"official","path":"DeepJudge/extensions.py","file_url":"https://github.com/testing4ai/deepjudge/blob/HEAD/DeepJudge/extensions.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"280cf09e64c114a9"}},{"code_sha256_prefix":"c9d6ee09a57da95a","entry":"seedSelection","repo":"testing4ai/deepjudge","repo_kind":"official","path":"DeepJudge/seed_selection.py","file_url":"https://github.com/testing4ai/deepjudge/blob/HEAD/DeepJudge/seed_selection.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c9d6ee09a57da95a"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}