---
title: "Rethinking Removal Attack and Fingerprinting Defense for Model Intellectual Property Protection: A Frequency Perspective"
authors:
  - "Cheng Zhang"
  - "Yang Xu"
  - "Tingqiao Huang"
  - "Zixing Zhang"
doi: "10.24963/ijcai.2025/71"
url: "https://ijcai.org/proceedings/2025/71"
pdf: "https://ijcai.org/proceedings/2025/0071.pdf"
venue: "Proceedings of the Thirty-Fourth International Joint Conference on Artificial Intelligence"
year: 2025
pages: "628-636"
track: "Main Track"
keywords:
  - "Machine Learning: ML: Trustworthy machine learning"
  - "AI Ethics, Trust, Fairness: ETF: Accountability"
  - "AI Ethics, Trust, Fairness: ETF: Trustworthy AI"
  - "AI Ethics, Trust, Fairness: ETF: Safety and robustness"
---

# Rethinking Removal Attack and Fingerprinting Defense for Model Intellectual Property Protection: A Frequency Perspective

Cheng Zhang, Yang Xu, Tingqiao Huang, Zixing Zhang

*Proceedings of the Thirty-Fourth International Joint Conference on Artificial Intelligence*, pages 628-636. DOI: [10.24963/ijcai.2025/71](https://doi.org/10.24963/ijcai.2025/71)

## Abstract

Training deep neural networks is resource-intensive, making it crucial to protect their intellectual property from infringement. However, current model ownership resolution (MOR) methods predominantly address general removal attacks that involve weight modifications, with limited research considering alternative attack perspectives. In this work, we propose a frequency-based model ownership removal attack, grounded in a key observation: modifying a model's high-frequency coefficients does not significantly impact its performance but does alter its weights and decision boundary. This change invalidates the existing MOR methods. We further propose a frequency-based fingerprinting technique as a defense mechanism. By extracting frequency-domain characteristics instead of decision boundary or model weights, our fingerprinting defense effectively against the proposed frequency-based removal attack and demonstrates robustness against existing general removal attacks. The experimental results show that the frequency-based removal attack can easily defeat state-of-the-art white-box watermarking and fingerprinting schemes while preserving model performance, and the proposed defense method is also effective. Our code is released at: https://github.com/huangtingqiao/RRA-IJCAI25.