ML Security PapersLightweight CNN Model Hashing with Higher-Order Statistics and Chaotic Mapping for Piracy Detection and Tamper Localization
Kunming Yang 1, Ling Chen 2,1
Published on arXiv
2510.27127
Model Theft
OWASP ML Top 10 — ML05
Key Finding
Proposed method reliably identifies protected CNN models under various parameter modifications and localizes tampered regions without requiring auxiliary neural network training.
With the widespread adoption of deep neural networks (DNNs), protecting intellectual property and detecting unauthorized tampering of models have become pressing challenges. Recently, Perceptual hashing has emerged as an effective approach for identifying pirated models. However, existing methods either rely on neural networks for feature extraction, demanding substantial training resources, or suffer from limited applicability and cannot be universally applied to all convolutional neural networks (CNNs). To address these limitations, we propose a lightweight CNN model hashing technique that integrates higher-order statistics (HOS) features with a chaotic mapping mechanism. Without requiring any auxiliary neural network training, our method enables efficient piracy detection and precise tampering localization. Specifically, we extract skewness, kurtosis, and structural features from the parameters of each network layer to construct a model hash that is both robust and discriminative. Additionally, we introduce chaotic mapping to amplify minor changes in model parameters by exploiting the sensitivity of chaotic systems to initial conditions, thereby facilitating accurate localization of tampered regions. Experimental results validate the effectiveness and practical value of the proposed method for model copyright protection and integrity verification.
Key Contributions
- Lightweight model hashing via higher-order statistics (skewness, kurtosis, structural features) extracted from CNN layer parameters — no auxiliary model training required
- Chaotic mapping mechanism that amplifies minor parameter perturbations to enable precise localization of tampered model regions
- Universally applicable to all CNNs without assumptions about training regularization or initialization schemes, overcoming limitations of prior NTS-based methods
🛡️ Threat Analysis
The paper constructs a compact hash directly from model weight parameters (skewness, kurtosis, structural features) to verify model ownership and detect unauthorized copies — this is a model IP protection defense. The hash identifies the MODEL itself, not its outputs, placing it squarely in model theft defense (ML05) rather than content provenance (ML09).