MetaV: A Meta-Verifier Approach to Task-Agnostic Model Fingerprinting

In this paper, we present a meta-verifier approach to task-agnostic model fingerprinting scheme (dubbed as MetaV), which for the first time enables fingerprinting on a much wider range of DNNs independent from the downstream learning task, and by design implements the robustness against a variety of ownership obfuscation techniques possibly adopted by the adversary.

To realize task-agnostic model fingerprinting, we generalize the idea of using adversarial examples and the corresponding classification results for fingerprinting respectively into two critical design components in MetaV, i.e., the adaptive fingerprint and the meta-verifier. Concisely, the adaptive fingerprint is a set of trainable inputs to the suspect model, the concatenated outputs of the suspect model on which are classified by the meta-verifier to be True or False, where True implies the suspect model is indeed stolen (i.e., positive suspect model), and False implies the suspect model is independent from the original model (i.e., negative suspect model).

To implement the design principles above, the adaptive fingerprint and the meta-verifier are jointly optimized on an ensemble composed of the target model, the positive and the negative suspect models which are virtually generated by MetaV during the fingerprinting construction phase. Specifically, the positive suspect models in the ensemble are crafted by post-processing the target model with a number of popular ownership obfuscation techniques, e.g., compression (Han et al., 2015; Li et al., 2017), fine-tuning, partial retraining and distillation (Hinton et al., 2015), while the irrelevant models are independently trained from scratch on similar learning tasks to the target model. As the full construction process of MetaV makes no assumption on the model internals or functions in the ensemble only if they have the same input and output dimensions, MetaV is therefore applicable independent of the downstream tasks for which the DNN is designed. Moreover, by permitting more types of obfuscation techniques in producing the stolen models for the model ensemble, our proposed MetaV is by construction robust against a diverse set of existing obfuscation techniques, with the potential to evolve along with future adversarial techniques.

In summary, we mainly make the following contributions:

• •

  We present MetaV, the first task-agnostic fingerprinting framework with adaptive robustness against a variety of ownership obfuscation techniques, to substantially advance the cutting-edge model fingerprinting capability to a much broader set of DNNs for arbitrary downstream tasks.

• •

  We generalize the existing fingerprinting schemes based on adversarial examples to a more universal fingerprinting framework based on the adaptive fingerprint and the meta-verifier, which are jointly optimized on an ensemble of the target model, the positive and negative suspect models crafted by the model owner to serve as a highly effective and robust fingerprint for the target model.

• •

  We extensively evaluate the performance of MetaV on practical scenarios spanning classification, regression and generative modeling. Besides the unique contribution of MetaV in providing task-agnostic fingerprinting, MetaV brings noticeable improvement over all the state-of-the-art fingerprinting schemes on DNN classifiers. For example, on fingerprinting ResNet-18 (He et al., 2016) trained for skin cancer diagnosis (Esteva et al., 2017), MetaV achieves simultaneously $100\%$ true positives and $100\%$ true negatives on a diverse test set of $70$ suspect models, with an about $220\%$ relative improvement in ARUC compared to the optimal baseline.

Recently, a number of fingerprinting schemes, mainly based on constructing different types of adversarial examples as the model fingerprint, were proposed to protect the intellectual property of DNN classifiers. For example, Cao et al. (2021) propose IPGuard, one of the earliest fingerprinting schemes, to find adversarial examples near the decision boundary of the target classifier. The key assumption of IPGuard is that the target DNN classifier can be uniquely represented by its decision boundary, which is more similar with the classification boundary of a positive suspect model than a negative one. Different from IPGuard, Lukas et al. (2021) and Zhao et al. (2020) independently propose to extract so-called conferrable adversarial examples from the ensemble of the target classifier and a set of locally trained suspect classifiers. These conferrable adversarial examples, which transfer much better to the positive suspect models than to negative ones, can be regarded as a unique link between the target model and the positive suspect models. Besides, Wang and Chang (2021) utilize the geometry characteristics inherited in the DeepFool algorithm to construct adversarial examples as the fingerprint (Wang and Chang, 2021), while Li et al. (2021) leverage the similarity between models in terms of the probability vectors on test inputs for piracy detection (Li et al., 2021). More detailed surveys can be found in (Boenisch, 2020; Regazzoni et al., 2021). In this work, our proposed MetaV generalizes the aforementioned fingerprinting techniques to abstract the usage of adversarial examples and the classification results into the adaptive fingerprint and the trainable meta-verifiers, which is applicable to arbitrary DNN models in a task-agnostic way.

Orthogonal to model fingerprinting, model watermarking embeds a watermark into the trained model before it is released, which potentially sacrifices the utility of the model. Previous works on model watermarking explore various types of watermarks such as secret bit strings (Uchida et al., 2017; Rouhani et al., 2018), generated serial numbers (Xu et al., 2020) and unrelated or slightly modified sample sets (Adi et al., 2018; Zhang et al., 2018). These identifying codes are then encoded secretly into the least significant bit of the weight (Uchida et al., 2017), the distribution of outputs at the intermediate (Rouhani et al., 2018) or the full layers (Adi et al., 2018; Zhang et al., 2018; Xu et al., 2020)

Model fingerprinting is a multi-party security game among a model owner, a verifier and an attacker. Initially, a model owner devotes computing power and well-curated training data to build its own DNN $F:\mathcal{X}\to\mathcal{Y}$ for a certain downstream task, crowning the obtained model $F$ as an inseparable part of the model owner’s IP. Following the nomenclature in Cao et al. (2021), we refer to the model $F$ as the target model. In nowadays deep learning ecosystem, the model owner can deploy the target model at a third-party platform like Amazon AWS as a prediction API to gain monetary profits. However, the profits may also serve as incentives on the potential attacker to conduct model piracy via, e.g., software/hardware vulnerabilities (Yan et al., 2020; Jeong et al., 2021), social engineering and algorithmic attacks (Tramèr et al., 2016; Yu et al., 2020). This essentially infringes the IP of the model owner.

As a rescue, the model owner can delegate a verifier, usually played by a trusted third party or the model owner him/herself, to provide model fingerprinting service for model piracy forensics. In general, model fingerprinting determines whether a suspect model $\tilde{F}$ is pirated from the target model $F$ in the two stages:

• •

  Fingerprint Construction. At the construction stage, a certain type of model fingerprint encoding the essential characteristics of the target model $F$ is constructed.

• •

  Fingerprint Verification. At the verification stage, the suspect model is attested via the prediction API (i.e., black-box access) to determine whether and with what confidence (i.e., matching rate) the fingerprint is also present in the suspect model $\tilde{F}$.

We mainly consider the following threat model in this paper.

• •

  Attacker’s Capability. We assume the attacker would apply a variety of model post-processing techniques to obfuscate the ownership of the stolen model (detailed in the subsequent part) after he/she successfully steals the target model from an online prediction API. Such an obfuscated model is called a positive suspect model. Correspondingly, a suspect model independently trained by another honest model owner is called a negative suspect model. The attacker is assumed to answer any queries to his/her provided prediction API, as more queries served by the API bring more monetary profits.

• •

  Verifier’s Capability. Following, e.g., Cao et al. (2021), we assume the verifier has a white-box access to the target model while a black-box access to the suspect models via their prediction APIs. To relax their assumptions, we do not assume the internal architecture or the type of downstream tasks of the target model.

Integrating existing ownership obfuscation techniques studied in previous works, we mainly cover the following classes of adversarial techniques which the attacker is likely to adopt.

• •

  Model Compression: Compression-based obfuscation adopts weight (filter) pruning (Li et al., 2017) to remove a certain ratio of small weights (filters) in a DNN, which would largely preserve the utility of the obfuscated model on the learning task (Han et al., 2015) and inhibits heuristic-based fingerprinting from verifying the model owernship based on parameter comparison (Cao et al., 2021).

• •

  Fine-Tuning & Partial Retraining: To obfuscate the behavioral pattern of a DNN, attackers may resume the training of the stolen model on public data collected from a similar domain of the training data. Specifically, to fine-tune the last $K$ layers of a trained DNN, the parameters of the last $K$ layers are further updated according to the learning objective with the other layers fixed. In comparison, during the partial retraining, the parameters of the last $K$ layers are first randomly initialized before the training is resumed. Due to the non-convexity of deep learning (Choromańska et al., 2015), both the fine-tuned and partially-retrained models may fall into a different local optimum, preserve the original utility, but exhibit divergent prediction behaviors (Wang and Chang, 2021).

• •

  Model Distillation: Distillation-based obfuscation adopts the knowledge distillation strategies (Hinton et al., 2015; Gou et al., 2021) by viewing the stolen model or the corresponding prediction API as the teacher model, and a DNN of a different architecture as the student model (Li et al., 2021). Via distillation, the learned knowledge in the target model is inherited by the student model, which exacerbates the obfuscation of model ownership due to the transformed model architecture and the correspondingly altered predictive behaviors (Lukas et al., 2021).

As a generalization of previous fingerprinting schemes, our proposed MetaV abstracts the usage of adversarial examples and the corresponding prediction results as the fingerprint into two critical components respectively: (i) adaptive fingerprint, i.e., a set of trainable inputs to the target/suspect model(s), which we denote as $\mathcal{X}_{F}:=(x_{F}^{1},\ldots,x_{F}^{N})$ with $x_{F}^{i}\in\mathcal{X}$ and $N$ called the number of fingerprint examples, and (ii) meta-verifier, i.e., a binary classifier which takes the concatenated outputs of a suspect model on the adaptive fingerprint as its input and predicts whether the suspect model is positive or negative, denoted as $\mathcal{V}:\mathcal{Y}^{n}\to\mathbb{S}^{2}$, a $2$-dimensional probability simplex $\{(p_{-},p_{+})|p_{-}+p_{+}=1,0\leq p_{+},p_{-}\leq 1\}$. As illustrated in Fig. 1, the general pipeline of MetaV mainly consists of the following three key stages:

• •

  Stage 1. (Model Ensemble Preparation) As Fig. 1(a) shows, we first craft a number of positive and negative suspect models from the target model with the aid of public data from the same domain of the owner’s training data. At the end of this stage, we obtain the sets of positive and negative suspect models, i.e., $\mathcal{M}_{+}$ and $\mathcal{M}_{-}$.

• •

  Stage 2. (Fingerprint Construction in MetaV) As Fig. 1(b) shows, we then jointly optimize the adaptive fingerprint $\mathcal{X}_{F}$ and the meta-verifier $\mathcal{V}$ to satisfy: For both the target model or any suspect model in $\mathcal{M}_{+}$, the meta-verifier $V$ is trained to predict True, i.e., $p_{+}>p_{-}$, on the concatenated outputs of the model on examples in $\mathcal{X}_{F}$, and vice versa for any suspect model in $\mathcal{M}_{-}$. At the end of this stage, we obtain optimized adaptive fingerprint and the corresponding meta-verifier, i.e., $\mathcal{X}_{F}^{*}$ and $\mathcal{V}^{*}$ respectively. We call $(\mathcal{X}_{F}^{*},\mathcal{V}^{*})$ a fingerprinting pair.

• •

  Stage 3. (Fingerprint Verification in MetaV) Finally, with the optimized fingerprinting pair $(\mathcal{X}_{F}^{*},\mathcal{V}^{*})$, we verify whether and with what matching rate a suspect model $\tilde{F}$ is a stolen version or an independently trained one by querying the prediction API with the fingerprint examples in $\mathcal{X}_{F}$. The received prediction results are then concatenated and input to the meta-verifier to predict $(\tilde{p}_{-},\tilde{p}_{+})=\mathcal{V}(\tilde{F}(x_{F}^{1})\oplus\ldots\oplus\tilde{F}(x_{F}^{N}))$. When $\tilde{p}_{+}$ is larger than a predefined threshold $\rho$, the verification process outputs True to claim possible model piracy behind the tested prediction API, or other the process outputs False to assert the fidelity of the suspect model.

In the following sections, we elaborate on the detailed methodology for the first two stages of MetaV.

To construct the adaptive fingerprint and the meta-verifier with simultaneously high robustness and uniqueness, MetaV is first required to collaborate with the model owner to prepare a diverse set of positive and negative suspect models. Intuitively, with a more representative set of positive suspect models, the obtained fingerprinting pair would stay robust against a wider range of ownership obfuscation techniques, resulting in higher true positives. Alternatively, more representative negative suspect models would lower the probability of the learned fingerprinting pair to be present in other irrelevant models, which therefore reduces the true negatives of MetaV. Specifically, the positive and negative suspect models are constructed as follows.

• •

  Prepare Positive Suspect Models. We derive a representative set of positive suspect models by randomly applying one or more common ownership obfuscation techniques mentioned in Section 3 to the target model $F$. The applied obfuscation techniques are recommended to cover a wider range of hyperparameter configurations for better robustness. For example, we apply weight and filter pruning to the target model with different pruning ratios. As a notation, we denote the full set of obfuscation techniques for preparing the positive suspect models as $\mathcal{T}$. Therefore, we have $\mathcal{M}_{+}:=\{T\circ{F}|T\in\mathcal{T}\}$. Section 5 presents the detailed composition of $\mathcal{T}$ in the evaluation settings part.

• •

  Prepare Negative Suspect Models. We recommend three complemental sources to collect a diverse set of negative suspect models for the fingerprint construction stage of MetaV. First, MetaV may request the model owner to train a moderate number of relatively small-scale DNNs on the same training dataset of the target model. For IP protection of the target model, it would be reasonable for the model owner to devote additional computing power to collaborate with a trusted third-party verifier. Second, MetaV can also download a number of pretrained models from online sources (e.g., PyTorch Hub) and fine-tune these models on the domain-relevant public data to serve as the negative suspect models. Moreover, MetaV may consider incorporate a proportion of irrelevant publicly available models into the set of negative suspect models to further enhance the uniqueness of the obtained fingerprinting pair. We denote the prepared negative suspect models as $\mathcal{M}_{-}$.

In this part, we detail the learning objective and the optimization algorithm for training the fingerprinting pair $(\mathcal{X}_{F},\mathcal{V})$ on the model ensemble $\mathcal{M}_{-}\cup\{F\}\cup{\mathcal{M}_{+}}$ prepared in the first stage. As Fig. 1(b) shows, the learning objective of MetaV is viewed as a binary classification problem. To formulate, we introduce an additional label $s$ for each model, which takes value in $\{+,-\}$ (literally, positive and negative respectively). Specifically, we label an arbitrary model $M_{+}\in\mathcal{M}_{+}\cup\{F\}$ as $+$ and an arbitrary model $M_{-}\in\mathcal{M}_{-}$ as $-$. To supervise the adaptive fingerprint and the meta-verifier with the labels, we solve the learning objective:

where $(p_{-}(M),p_{+}(M))=\mathcal{V}(M(x_{F}^{1})\oplus\ldots\oplus M(x_{F}^{N}))$, the prediction from the meta-verifier on the concatenated outputs of a model under test on the adaptive fingerprint. Intuitively, the learning objective above encourages the meta-verifier to output a $p_{+}$ higher than $p_{-}$ when the model under test is a positive suspect model or the target model, and vice versa for a negative suspect model.

As the learning objective above is fully derivative w.r.t. the adaptive fingerprint $\mathcal{X}_{F}$ and the parameters of the meta-verifier, we leverage off-the-shelf non-convex optimizers (e.g., Adam (Kingma and Ba, 2015)) for gradient-based optimization. However, we notice it is resource-consuming to conduct back-propagation over the whole model ensembles in each optimization step. As an alternative, we reformulate the batched learning objective in (1) as a stochastic objective with randomness in a tuple of $(M_{-},F,M_{+})$ uniformly sampled from $\mathcal{M}_{-}$, $\{F\}$ and $\mathcal{M}_{+}$ in each iteration. Besides, we adopt the reparametrization trick in Carlini and Wagner (2017) to constrain the adaptive fingerprint in the problem space $\mathcal{X}$. Taking $\mathcal{X}:=[-1,1]^{d_{\text{in}}}$, a common case in computer vision for example, Algorithm 1 presents the details of the optimization algorithm.

Table 2 provides an overview on the three scenarios, i.e., skin cancer diagnosis (Yang et al. (2020),classification), warfarin dose prediction (Whirl-Carrillo et al. (2012), regression), and fashion generation (Xiao et al. (2017), generative modeling), covered in the evaluation sections. The information of the datasets are concisely introduced below.

• •

  Skin Cancer Diagnosis (abbrev. Skin). The first scenario covers the usage of deep convolutional neural network (CNN) for skin cancer diagnosis. According to (Yang et al., 2020), we train a ResNet-18 (He et al., 2016) as the target model on DermaMNIST (Yang et al., 2020), which consists of $10005$ multi-source dermatoscopic images of common pigmented skin lesions imaging dataset. The input size is originally $3\times{28}\times{28}$, which is upsampled to be $3\times{224}\times{224}$ to fit the input shape of a standard ResNet-18 architecture implemented in torchvision (pyt, [n. d.]). The task is a $7$-class classification task.

• •

  Warfarin Dose Prediction (abbrev. Warfarin). The second scenario covers the usage of FCN for warfarin dose prediction, which is a safety-critical regression task that helps predict the proper individualised warfarin dosing according to the demographic and physiological record of the patients (e.g., weight, age and genetics). We use the International Warfarin Pharmacogenetics Consortium (IWPC) dataset (Whirl-Carrillo et al., 2012), which is a public dataset composed of $31$-dimensional features of $6256$ patients and is widely used for researches in automated warfarin dosing. According to Truda and Marais (2019), we use a three-layer multi-layer perception (MLP) with ReLU as the target model, with its hidden layer composed of $100$ neurons. As a notation, we denote the architecture as $(31$-$100$-$1)$. The target model learns to predict the value of proper warfarin dosing, which is a non-negative real-valued scalar with its value in $(0,300.0]$.

• •

  Fashion Generation (abbrev. Fashion) The final scenario covers the usage of FCN for generative modeling. We choose (Xiao et al., 2017), which consists of $60000$ images for articles of clothing of size $28\times{28}$. We train a DCGAN-like architecture (Radford et al., 2016) for generative modeling on this task. We solely view the generator as the target model, as a well-trained generator represents more the IP of the model owner because it can be directly used to generate realistic images without the aid of the discriminator. The detailed DCGAN architecture we use is demonstrated in Table 1.

For each scenario, we construct a model benchmark composed of $140$ positive/negative suspect models. We split the benchmark randomly by a ratio of $1:1$ into two independent sets of suspect models for training and testing.

We cover $4$ state-of-the-art fingerprinting schemes as the baselines for evaluating the effectiveness of MetaV under the classification settings. The baselines are respectively:

• •

  IPGuard (Cao et al., 2021): IPGuard is one of the earliest fingerprinting schemes on classification models, which searches for a set of adversarial examples with a specified label near the decision boundary of the target model as the fingerprinting examples.

• •

  ConferAE (Lukas et al., 2021): ConferAE improves the design of IPGuard by further covering the distillation-based obfuscation techniques. Specifically, ConferAE constructs a set of adversarial examples on a prepared ensemble of positive/negative suspect models which may be implemented with different architecture from the target model. The generated adversarial examples are additionally required to be transferable from the target model to the positive suspect models but not to the negative ones.

• •

  DeepFoolFP (Wang and Chang, 2021): DeepFoolFP literally leverages the DeepFool algorithm (Moosavi-Dezfooli et al., 2016) to generate adversarial examples as the model fingerprints, the motivation of which is to improve the efficiency of fingerprint construction. For verification, the above model fingerprinting schemes define the matching rate as the ratio of the fingerprinting examples which are correctly classified by the suspect model into the specified class.

• •

  ModelDiff (Li et al., 2021): ModelDiff is a very recent technique which is originally proposed to quantify the behavioral similarity between a pair of models. Specifically, the similarity is measured as the cosine similarity of two models’ decision distance vector, each element of which is the distance of the logits between a clean test input and an adversarial example derived from the input. A suspect model is verified if its behavioral similarity with the target model is smaller than a threshold.

With no further specifications, the number of fingerprint examples, i.e., $N$, is set as $100$ for MetaV and the baselines by default. More details on the baselines are in Section 2.

Given a predefined threshold $\epsilon\in(0,1)$, MetaV and all the baseline methods recognize a suspect model as positive when the matching rate of fingerprint verification is higher than $\rho$, or otherwise recognize the model as negative. In the evaluation, we following the evaluation protocol in (Cao et al., 2021) which is composed of the metrics below:

1. (1)

   Robustness/Uniqueness ($R(\rho)$/ $U(\rho)$): The robustness metric measures the proportion of positive suspect models also recognized as positive by the fingerprinting scheme, i.e., true positives.

2. (2)

   Uniqueness ($U(\rho)$): The uniqueness metric measures the proportion of negative suspect models also recognized as negative by the fingerprinting scheme, i.e.,true negatives.

3. (3)

   Area under the Robustness-Uniqueness Curves (ARUC): ARUC measures the area of the intersecion region under the robustness and uniqueness when the threshold varies in $(0,1)$, i.e., $\int_{0}^{1}\min\{R(\rho),U(\rho)\}d\rho$. A higher ARUC implies a more wider value range for the threshold to choose from to obtain simultaneously high robustness and uniqueness. ARUC is empirically calculated as the average $\min\{R(\rho),U(\rho)\}$ on $\{0,1/L,\ldots,(L-1)/L,1\}$ with $L=100$. For all the experiments, we run $5$ repetitive experiments and report the average metric with the $95\%$ confidence interval.

First, we compare the performance of MetaV with $4$ state-of-the-art model fingerprinting schemes specifically designed for classifiers. Fig. 3 reports the robustness (i.e., true positives) when the threshold $\rho$ is set to allow the uniqueness (i.e., true negatives) to reach $100\%$ on the test set, along with the corresponding ARUC presented in Fig.2(a).

As Fig. 3 shows, our proposed MetaV is the only method which simultaneously achieves $100\%$ robustness and uniqueness in fingerprinting a stolen and adversarially obfuscated ResNet-18 classifier for skin cancer diagnosis. Besides, as we can see from Fig.2(a), MetaV constructs the model fingerprint with the highest ARUC metric, i.e., $0.86\pm{0.01}$, among all the tested fingerprinting schemes, which improves the optimal baseline IPGuard by $0.59$ absolutely, i.e., a roughly $220\%$ relative improvement. As we construct a more diverse benchmark of suspect models compared with previous works, the ARUC of IPGuard is not as high as the results reported in Cao et al. (2021). Fig. 2(b)-(f) show the robustness and uniqueness curves of each fingerprint schemes.

Next, we empirically study the learning behaviors and the time complexity of MetaV when constructing the fingerprint of a ResNet-18. As Fig. 4 shows, the ARUC and loss curves demonstrate the time efficiency of MetaV in fingerprint construction.

In less than $200$ seconds, MetaV stably constructs a fingerprinting pair which achieves an ARUC over $0.8$. Besides, Table 5 presents a tentative comparison on the time cost of each fingerprint scheme for constructing the corresponding model fingerprint to achieve the reported ARUC in Fig. 2 and for fingerprint verification in the same experimental environment detailed in the experimental setting part. As is shown, MetaV is similarly efficient compared with the state-of-the-art fingerprinting schemes.

Besides the substantial improvements in fingerprinting classifiers, more importantly, MetaV presents the first task-agnostic fingerprinting scheme which can be applied to more general application scenarios. To validate, we apply MetaV to fingerprint an MLP for regression (i.e., the Warfarin case) and a DCGAN for generative modeling (i.e., the Fashion case), which requires no modification on Algorithm 1, as MetaV is by design independent from either the internals or the functions of the target model.

Fig. 5(a)-(b) plot the curves of robustness and uniqueness of MetaV on Warfarin and Fashion when the threshold $\rho$ increases from $0$ to $1$, where the area of the shaded region is by definition the ARUC. As we can see, the robustness and the uniqueness remain $1$ unless the threshold is very close to $0$ or $1$. This results in an over $0.98$ ARUC for both the two scenarios which existing fingerprinting schemes can hardly handle.

We further study the influence of the number of fingerprint examples on the performance of MetaV and the baselines. Fig. 6&5(c) presents the ARUC curves when the number of fingerprint examples, i.e., $N$, increases, on the classification and non-classification tasks respectively. As is shown, in all the three scenarios, the performance of MetaV increases stably when $N$ increases from $10$ to $100$. For example, when fingerprinting ResNet-18 on Skin, the ARUC of MetaV is about $1.2\times$ when $N$ is enlarged from $10$ to $100$. This is a desirable feature of MetaV as one would naturally expect a more accurate fingerprinting when more computing power is devoted to the construction of the model fingerprints. In comparison, the upward trend is unclear for all the baseline schemes. Similarly, enhanced performance is also observed on Warfarin and Fashion by about $3.2\%$ and $17.0\%$ respectively, which is noticeable considering the already high ARUC of MetaV when the number of fingerprint examples is $10$.

Finally, we provide quantitative results to analyze the impact of the model ensemble size on the performance of MetaV. We fix the number of fingerprint examples as $100$ and randomly sample different ratios of positive/negative suspect models from the full model ensemble for training MetaV. Fig. 7&5(d) shows the ARUC curves on the three scenarios when the model ensemble size varies. As is shown, the ARUC of MetaV shows a steady upward trend when the model ensemble is enlarged, which conforms to our design principle that a more diverse set of crafted suspect models would help construct more unique and robust model fingerprints.