TP-CRIV proposes a third-party challenge-response identity verification framework, achieving separable same-model and cross-model verification on ten ImageNet-pretrained TorchVision models
Synopsis
The work proposes Third-Party Challenge-Response Identity Verification (TP-CRIV) for AI models, targeting a third-party setting in which the verifier has neither white-box nor API access to the claimant's model, can interact with the suspicious deployed service only through its ordinary black-box inference interface, and does not require protocol-specific cooperation from the service provider; under these constraints the framework obtains empirical evidence as to whether the claimant locally possesses a model satisfying a predeclared identity relative to the deployed model, and the authors instantiate it for CNN image classifiers using probability-control-based witness generation, with experiments on ten ImageNet-pretrained TorchVision models demonstrating clear same/cross-model separation
Fig. 1: Comparison of model-to-model verification approaches from the perspective of the evidence available to an independent third party and the resulting inference about the relationship between a claimant’s model and a suspicious deployed model.
arXivInterpretation
Proposes TP-CRIV, a third-party challenge-response identity verification framework for judging whether a claimant currently possesses and can utilize model-dependent information relevant to the claimed model identity. Existing approaches such as watermarking, fingerprinting, and model similarity analysis primarily rely on predefined evidence or direct behavioral comparison, whereas TP-CRIV explicitly makes 'whether the claimant currently possesses and can utilize model-dependent information' the verification target. The paper presents the framework and its setting and goal, and the abstract states the third-party verification constraints it targets.
Specifies the verification constraints: the verifier has neither white-box nor API access, can interact with the suspicious deployed service only through its ordinary black-box inference interface, and does not require protocol-specific cooperation from the service provider. This setting extends verification capability from scenarios requiring internal access or service-provider cooperation to a third-party scenario relying only on an ordinary black-box inference interface. The abstract explicitly lists these three constraints and states that under them the framework enables the verifier to obtain empirical evidence.
Verification is conducted under fresh, previously undisclosed requirements and network isolation, so that the demonstrated capability cannot rely on online external assistance after challenge disclosure. Fresh challenges and network isolation reduce the possibility that the demonstrated capability comes from online external assistance rather than local model possession. The abstract states that verification is conducted under 'fresh, previously undisclosed requirements and network isolation'.
Instantiates TP-CRIV for CNN image classifiers using probability-control-based witness generation, and on ten ImageNet-pretrained TorchVision models demonstrates clear same/cross-model separation and finite-challenge verification using independently calibrated thresholds. Grounds the framework in a concrete model class and experimental setting, and reports the experimental observation of separable same-model and cross-model behavior. Experiments cover ten ImageNet-pretrained TorchVision models; results are described as clear same/cross-model separation with finite-challenge verification using independently calibrated thresholds.
Perspective
The framework targets a third-party verification scenario: the verifier has neither white-box nor API access, can interact with the suspicious deployed service only through its ordinary black-box inference interface, and does not require protocol-specific cooperation from the service provider. Its evidence is interpreted as statistical rather than cryptographic, relative to independently specified and calibrated matching and non-matching operating situations. The current instantiation targets CNN image classifiers, uses probability-control-based witness generation, and is evaluated on ten ImageNet-pretrained TorchVision models.
The available text is abstract-level information and does not include specific thresholds, challenge counts, separation metrics, or statistical test details, so the concrete scale and robustness of the finite-challenge verification cannot be judged from the available text. The framework is described as statistical rather than cryptographic evidence, and its behavior under different model architectures, deployment conditions, and adversary strategies remains an open question.