arXiv:2605.16227v1 [cs.CR] 15 May 2026
LymphNode: A Plug-and-Play Access Control Method for Deep Neural Networks Hanyu Pei
Shang Liu
Zeyan Liu
Department of Computer Science and Engineering University of Louisville [email protected]
Department of Computer Science and Engineering University of Louisville [email protected]
Department of Computer Science and Engineering University of Louisville [email protected]
Abstract—Deep Neural Networks (DNNs) are high-value intellectual property (IP), yet deploying them to edge environments exposes them to unrestricted oracle access, rendering them vulnerable to model extraction and inversion attacks. Existing defenses fail to address this practically: passive watermarking only offers post-hoc provenance, while active defenses impose prohibitive latency or require persistent access to sensitive training data. To bridge this gap, we propose LymphNode, a novel post-hoc defense framework that acts as an intrinsic “immune system” within the model. LymphNode enforces a strict “defaultdeny” policy: it actively neutralizes model utility for unauthorized queries via Generalized Sparse Universal Adversarial Perturbations (GSUAP) injected into the feature space, effectively blocking gradient estimation and data inference. Utility is selectively restored only for authorized inputs carrying a stealthy featuredomain credential. Our framework is highly practical: it is data-efficient, establishing robust protection with fewer than 100 samples (< 1% of training data), and cross-dataset adaptable, enabling protection using public surrogate datasets. LymphNode thus provides a lightweight, immediately deployable defense for high-stakes scenarios where original training data is restricted or unavailable. Index Terms—Model IP Protection, Active Defense, Model Extraction.
I. I NTRODUCTION Training modern machine learning models is an exceptionally resource-intensive endeavor. Large-scale foundation models, such as GPT-4 or LLaMA [1], [2], require months of computation, making their weights invaluable intellectual property (IP). However, to satisfy latency and privacy requirements, models are frequently deployed to edge devices or onpremise servers. While this decentralization protects raw data, it inadvertently grants adversaries unrestricted oracle access to the model interface. Unlike rate-limited cloud APIs, edge deployment allows attackers to query the model with infinite volume at zero latency. Exploiting this, adversaries can launch sophisticated model extraction attacks [3], [4] to reverseengineer parameters or model inversion attacks [5] to infer sensitive training data. This capability allows malicious actors to functionally replicate proprietary models without needing © 2026 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
to decrypt the underlying static files. Despite these risks, on-premise deployment remains non-negotiable for sensitive industries (e.g., healthcare, finance), creating a direct conflict between operational necessity and IP security. Existing defense mechanisms struggle to resolve this conflict due to significant practicality limitations. Passive defenses, such as watermarking [6]–[8], primarily serve copyright provenance after theft occurs, failing to proactively prevent functional extraction. Conversely, active defenses aim to enforce access control but face critical bottlenecks. Cryptographic methods (e.g., Deep-Lock [9]) incur prohibitive computational overhead, rendering them unsuitable for real-time edge applications. Meanwhile, structural authorization methods [10]– [12] embed locking mechanisms but suffer from severe data dependency: they typically require computationally expensive full model retraining or persistent access to the complete original dataset. This makes them infeasible for real-world scenarios where training data is sensitive, legally restricted (e.g., GDPR), or unavailable post-training. More recently, output perturbation methods [13], [14] actively degrade extracted model quality at the prediction interface, yet they require a runtime interposition layer inherent to cloud-API deployments and cannot protect models physically transferred to edge environments. In this paper, we propose LymphNode, a post-hoc plugin framework designed to bridge these practicality gaps. Unlike invasive methods requiring retraining, our approach integrates a lightweight “checkpoint” directly into the inference pipeline. Drawing inspiration from the biological immune system, LymphNode enforces a rigorous “default-deny” policy. It treats all inputs as unauthorized and injects a pre-computed, Generalized Sparse Universal Adversarial Perturbation (GSUAP, detailed in Sec. III-C) into critical channels. This defense persistently neutralizes the model’s output quality for arbitrary queries, thereby significantly degrading the quality of outputs available for model extraction [3], [15] and inversion [5], [16] attacks. Access is restored only when an authorized input with a specific feature-domain credential is verified, triggering an inverse perturbation to cancel the noise. Consequently, the model remains useless to adversaries relying on oracle access, while authorized users transparently recover full fidelity. The overall architecture is illustrated in Fig 1. In summary, our key
contributions are: • We propose LymphNode, a novel post-hoc plugin framework that provides active IP protection. It actively neutralizes models against unauthorized input via a sparse adversarial perturbation, while restoring full fidelity for authorized users through a stealthy, feature-domain verification protocol. • Our framework demonstrates exceptional data adaptivity and efficiency. We prove that the framework significantly lowers the deployment barrier: it can be robustly initialized using as few as 50-100 samples (< 1% of the training set) and is capable of protecting target models using public surrogate datasets (e.g., protecting STL-10 models with CIFAR-10 noise). This eliminates the strict dependency on original private data required by prior art. • We conduct a comprehensive security and robustness evaluation. We rigorously validate the system’s resilience against adaptive threats, including deep generative credential forgery and model hijacking via fine-tuning. Furthermore, we demonstrate that the protection mechanism remains dependable under real-world distortions (e.g., lossy compression), while maintaining near-perfect watermark imperceptibility (LPIPS ≈ 0.001), confirming its suitability for practical deployment. The remainder of this paper is organized as follows. Section II reviews related work in model watermarking and active defenses. Section III details the architecture and the posthoc training mechanism of LymphNode. Section IV presents the experimental setup and a comprehensive evaluation of effectiveness, efficiency, and robustness. We further discuss the data adaptivity and robustness of our framework in Sec. V and Sec. VI. Finally, we conclude the paper in Section VIII. II. R ELATED W ORK A. Passive Defense: IP Provenance Passive defense mechanisms for DNN intellectual property protection predominantly consist of model watermarking and fingerprinting techniques. Existing watermarking approaches [6], [7], [17] embed identifying information directly into model parameters [7], activation maps [17], or couple them with backdoor triggers [6], [18], [19] to enable ownership verification. In parallel, fingerprinting methods [20], [21] extract intrinsic model attributes, such as decision boundary characteristics or specific prediction behaviors on adversarial examples, to construct unique identifiers without altering the original model weights. Collectively, these embedded or extracted signatures allow model owners to verify authorship through statistical analysis or behavioral querying. More recently, DynaMarks [22] embeds transferable watermarks into extracted surrogates by dynamically altering output probabilities at inference time, yet the extracted model retains full functionality and the watermark serves only for post-hoc ownership claims. However, these approaches fundamentally constitute a passive line of defense. Their primary utility is restricted to
TABLE I Q UALITATIVE COMPARISON WITH STATE - OF - THE - ART ACTIVE IP PROTECTION METHODS . LymphNode UNIQUELY COMBINES DATA INDEPENDENCE , ZERO - RETRAINING , AND NEGLIGIBLE OVERHEAD .
Method
Origin Data Retrain Post-Hoc Overhead
Deep-Lock [9] AdvParams [12] SSAT [11] IDEA [29] ModelLock [30]
✗ ✓ ✓ ✓ ✓
✗ ✓ ✓ ✓ ✓
✓ ✗ ✗ ✗ ✗
High Low Low Medium Low
Ours
✗
✗
✓
Negligible
copyright provenance which serves to prove ownership after a theft has already occurred, typically for litigation purposes. As comprehensively analyzed by Lukas et al. [23], while such methods can verify ownership with high confidence, they possess no capability to proactively prevent unauthorized model execution. Consequently, once a protected model is leaked or distributed, adversaries can freely deploy and monetize the asset, leaving the window of exploitation entirely open despite the presence of ownership proofs. B. Recent Advances in UAP Recent scholarship in adversarial learning has produced highly effective strategies for generating universal adversarial perturbations (UAP). Techniques such as SGA [24], DMUAP [25], and RobustUAP [26] introduce sophisticated optimization objectives, including stochastic gradient aggregation and dynamic maximin frameworks, to maximize the transferability and robustness of attacks across diverse models and distributions. Parallel research like Sparse-PGD [27] has further refined the generation of sparse adversarial noise. However, these methods are fundamentally engineered for offensive generalization rather than defensive controllability. Their primary goal is to construct an irreversible perturbation that degrades performance across unknown target domains, a process that typically necessitates extensive training data to approximate universal vulnerability manifolds. In the context of active IP protection via a lightweight plugin framework, the operational objective is fundamentally different. We require a targeted neutralization mechanism capable of locking a specific, known model with minimal setup costs. Consequently, our work adopts the Generalized Data-Free UAP (GD-UAP) [28] formulation. By leveraging its strong data-independent characteristics, we can efficiently optimize the perturbation to saturate the target model’s feature space without the prohibitive data dependency associated with transferability-oriented attacks. C. Active Defense: Cryptographic Approaches An alternative paradigm involves cryptographic techniques that provide active protection during inference. Hardware-based solutions like Trusted Execution Environments (TEEs) [31] and algorithmic solutions like Homo-
Clean Image (𝒙)
Watermark (𝒘)
LymphNode Plugin
High-Fidelity Output
Authorized Input (𝒙𝒘 )
Yes LymphNode Checkpoint Is 𝒚𝒌 Matched? No
Conv1 Layer ℱ(∙) Feature map
Sparse Noise Mask(ℳ)
8
Inverse Noise (-ℳ⨀Δ)
Processed Features
GSUAP Injection
Unauthorized Input
Perturbed Features
Frozen Target DNN (Backbone)
Correct Classification
BN1 Layer & Rest of DNN
Utility Neutralized Probability
Reverse Engineering
Probability
Antidote Feature-level Authorization key 𝒚𝒌
Random Guess
Masked Noise(ℳ⨀Δ)
Fig. 1. An overview of LymphNode plugin
morphic Encryption (HE) [32] theoretically guarantee secure execution. Similarly, methods like Deep-Lock [9] and NNLock [33] propose S-Box-based parameter encryption, requiring decryption for every query. However, recent surveys [34] highlight significant practical barriers: TEEs are susceptible to side-channel attacks, while HE and parameter decryption schemes impose prohibitive computational overhead and latency penalties. This renders them impractical for resourceconstrained edge deployments where real-time inference is non-negotiable. D. Active Defense: Structural Authorization More recent works aim to achieve active authorization control by modifying the model structure or weights. Representative methods include ModelGuard [10], ActiveGuard [35], SSAT [11], and AdvParams [12]. These approaches embed backdoors or adversarial perturbations into the weights during training to discriminate between authorized and unauthorized users. Recent advancements like ModelLock [30] leverage diffusion models to edit the training distribution for enhanced locking. Crucially, these approaches suffer from a severe setup cost bottleneck. They typically require either: (i) computationally expensive full model retraining (e.g., ModelLock, SSAT), or (ii) persistent access to the complete original training dataset (e.g., AdvParams, IDEA [29]) to compute gradients or generate triggers. This requirement is often infeasible in realworld scenarios due to strict privacy regulations (e.g., GDPR) or data loss. Even sample-specific approaches remain bound to the original training pipeline. To clearly distinguish our contribution within the active defense landscape, we provide a qualitative comparison in Table I.
E. Active Defense: Anti-Extraction via Output Perturbation A parallel line of work actively degrades extracted models by perturbing responses at the prediction interface. Methods like Prediction Poisoning [13], CIP [14], and AMAO [36] dynamically inspect, score, or poison per-query outputs to disrupt attacker objectives. These methods strictly require a server-side interposition layer—a capability inherent to cloud-APIs but physically infeasible at the edge, where adversaries directly invoke the forward pass. In contrast, LymphNode embeds protection statically within the computational graph as a feature-space intervention, eliminating runtime query analysis. III. F RAMEWORK In this section, we present LymphNode, a post-hoc defense framework that structurally integrates active IP protection directly into the target Deep Neural Network (DNN). Unlike external pre-processing wrappers, our approach fuses the security mechanism into the model’s computational graph as an intrinsic intervention node, specifically targeting the intermediate feature space. We operate within a standard black-box deployment scenario where the target model is encapsulated in an inference environment that preserves runtime integrity. The framework governs the inference logic by enforcing a strict “default-deny” policy embedded within the forward pass topology: a Generalized Sparse Universal Adversarial Perturbation (GSUAP, detailed in Sec. III-C) is injected into the latent features by default, neutralizing model utility for any unauthorized access. Full fidelity is only recovered when a coupled antidote mechanism validates a stealthy featuredomain credential, thereby rendering the security logic inseparable from the model’s fundamental feature extraction process.
A. Threat Model and Assumptions A three-party edge deployment scenario is considered. The Model Owner trains the target DNN, optimizes the LymphNode GSUAP plugin, and issues authorization keys to the Edge Operator via a secure out-of-band channel. The Edge Operator deploys the protected model within a trusted runtime environment (e.g., signed firmware) that preserves parameter integrity but exposes model functionality through an inference API. Crucially, the Edge Operator independently manages key distribution to Authorized End-Users within their trust domain. The adversary model is strictly gray-box: the adversary possesses knowledge of the model architecture and the general defense mechanism, but lacks access to (i) the secret authorization key k, (ii) runtime memory or intermediate feature maps, and (iii) gradient or backward-pass computations. Oracle access is therefore the only available attack surface: the adversary may submit arbitrary queries—including adaptive queries crafted from previous outputs—and observe the returned probability vectors. B. Authorization via Feature-Domain Verification As the core decision logic of the LymphNode framework (Fig. 1), this module implements identity verification by embedding a discrete credential into the continuous feature space. The authorization key is defined as a secret N -bit binary string k ∈ {0, 1}N . To embed this key, we select N carrier features from the first convolutional layer’s output using a distributed strategy and denote the feature representation of authorization key as yk . Assuming the layer comprises r kernels with a spatial size of m × n, we select v distinct kernels and h distinct spatial locations within each kernel, such that the total capacity is N = v × h (noticing that these h features from the same feature map correspond to non-overlapping pixel-domain regions). Based on the ablation study in prior work [37], we adopt a configuration of N = 32 and v = 4 to balance capacity and stealthiness. For each carrier feature y, we target the s-th bit after the binary point for verification. Mathematically, the extraction of the verification bit b is formulated as: b = ⌊|y| · 2s ⌋ mod 2
(1)
Intuitively, a larger s implies that the verification relies on finer-grained quantization noise, resulting in smaller perturbations and better stealthiness. Following Liu et al. [37], we set s = 6, rendering the modifications visually imperceptible in the pixel domain. To pass this verification, an authorized user must generate an input xauth = x + w such that its feature representation matches k. This constitutes an inverse problem: finding a perturbation w that satisfies: F(x + w) = yk
(2)
where F represents the first convolutional layer. Since direct analytical inversion is ill-posed due to dimensionality mismatch, we employ a search-based strategy. We first locate the
receptive fields corresponding to the N features and then employ a random search to identify a valid w. The computational complexity is O(h × 2v ), which is highly efficient given the bound N = v × h. Empirical results in Sec. IV-C confirm that generating 1,000 unique credentials requires less than 2 seconds. Finally, the verification mechanism necessitates a fundamental security trade-off. The choice of N balances efficiency and specificity. A smaller N accelerates generation but increases the risk of an unauthorized input coincidentally matching k (a “collision”), which would grant illicit access. The theoretical collision probability Pc is estimated as follows: Pc = P (b1 = k1 , . . . , bN = kN ) =
N Y
P (bi = ki ) = 2−N
i=1
(3) where P (bi = ki ) denotes the collision probability for the ith bit. The Eq. 3 holds when P (ki = 0) = P (ki = 1) = 0.5 and P (ki ) = P (ki |kj ), ∀i ̸= j, indicating the bit-wise collision follows binomial distribution. These conditions are verified to hold by experiments in [37]. For our setting (N = 32), Pc ≈ 2.33 × 10−10 . This infinitesimal probability ensures that the “default-deny” policy is robustly enforced, preventing accidental authorization by benign inputs. C. Model Performance Neutralization via GSUAP To efficiently regulate the model’s fidelity for unauthorized access, we propose Generalized Sparse Universal Adversarial Perturbations (GSUAP). While standard Universal Adversarial Perturbations (UAPs) [28], [38] seek to fool a model on all inputs, applying them indiscriminately increases computational overhead and detection risk. Therefore, our objective is to adapt structured pruning principles [39], [40] to identify a minimal subset of decision-critical channels, where targeted noise injection can maximally disrupt model behavior while minimizing the modification footprint. Performance Neutralization operates in two sequential phases: first, channels are selected based on their gradient sensitivity regarding the classification loss; second, a constant adversarial perturbation is optimized on these selected channels. Phase 1: Weight Gradient-based Channel Selection. Given a pre-trained clean model fθ and a small calibration dataset Dcal , we quantify each channel’s importance. Drawing from gradient-based pruning criteria [39], we define the importance score for the j-th channel in a layer (with weight tensor W ) as the expected gradient magnitude: ∂LCE (fθ (x), y) (4) Scorej = E(x,y)∼Dcal ∂Wj 2 where Wj denotes the kernel weights for channel j. A high score indicates that the loss is highly sensitive to variations in this channel. Given a target sparsity ratio r ∈ (0, 1], we select the top-k (k = ⌊r · M ⌋) channels to construct a binary mask M ∈ {0, 1}M . Unlike magnitude-based ranking [41] which evaluates static weights, this gradient-based criterion
dynamically identifies the optimal “acupuncture points” for performance neutralization. Phase 2: Sparse Adversarial Noise Optimization. With the channel mask M fixed and model parameters frozen, we optimize a universal additive noise ∆ to maximize misclassification on unauthorized inputs. For any input x, the noise is injected into the selected channels of the feature map: F̃ (x) = F (x) + M ⊙ ∆
(5)
where F (x) is the clean feature map and ⊙ denotes elementwise multiplication. To find the optimal perturbation, we employ Projected Gradient Ascent (PGA) to maximize the classification loss LCE . Let g (t) denote the gradient of the loss with respect to the noise at step t, i.e., g (t) = ∇∆ LCE (f (x; ∆(t) ), y). The update rule is formulated as: ∆(t+1) = Πϵ (∆(t) + α · sign(g (t) )) ⊙ M (6) where α is the step size, Πϵ projects the noise onto the ℓ∞ -ball bounded by ϵ. Crucially, this optimization targets the unauthorized scenario: the goal is to find a single, static perturbation ∆ that, when masked by M, causes the model to fail on clean inputs. Once optimized, this noise module is integrated into the LymphNode plugin as shown in Fig. 1. It remains active by default to neutralize performance for unauthorized users, and is only bypassed (via the antidote mechanism, an inverse GSUAP) when a valid feature-domain credential is verified. IV. E XPERIMENTATION In this section, we establish the foundational performance of LymphNode, focusing on its core capability to regulate model inference under realistic deployment constraints. We rigorously evaluate the framework along three primary dimensions, beginning with the neutralization effectiveness, where we verify the system’s ability to selectively suppress unauthorized accuracy across diverse architectures and datasets. Concurrently, we assess the neutralization efficiency to quantify the protection gain relative to the structural modification cost. To ensure practical viability, we also analyze system performance by benchmarking computational overheads, including latency, throughput, and memory, validating the framework’s suitability for resource-constrained environments. Comprehensive analyses regarding design choices, data dependencies, and security resilience are presented in subsequent sections. A. Neutralization Effectiveness Evaluation In this section, we evaluate the capability of LymphNode to selectively neutralize model performance for unauthorized access. As detailed in Sec. III-C, our framework injects Generalized Sparse Universal Adversarial Perturbations (GSUAP) to suppress inference accuracy when valid credentials are absent. To rigorously benchmark the neutralizing potency of GSUAP, we conduct a comprehensive evaluation on three benchmark datasets: CIFAR-10 [42], MNIST [43], and SVHN [44]. We construct two comparative baselines by adapting alternative neutralizing strategies: Gaussian Noise and
Sparse UAP (SUAP). SUAP is formulated by applying a sparsity mask to a standard UAP: ∆sparse = M ⊙ ∆. To ensure a fair comparison, all three strategies utilize the identical sparsity mask M generated by our Weight-Gradient selector, and their perturbation magnitudes are constrained to the same budget (∥ϵ∥∞ = 2, applies to the normalized feature space after Batch Normalization). We integrate LymphNode into a diverse suite of architectures to verify broad applicability, including standard residual networks (ResNet-18, ResNet50 [45]), vision transformers (ViT-Tiny, ViT-Small [46]), and classic architectures (AlexNet [47], DenseNet [48]). For each dataset, we randomly sample 2000 images, add watermark to 1000 of them as authorized input, while the rest as unauthorized input. We quantify effectiveness via the Unauthorized Accuracy (lower is better) to measure the suppression effect, and the VIP Accuracy (higher is better) to demonstrate the extent of performance preservation. The quantitative results are presented in Table II. The quantitative results demonstrate that GSUAP universally outperforms baselines, evidenced by its ability to suppress ResNet-18 accuracy on CIFAR-10 to 13.6% at a 60% ratio, whereas Gaussian noise fails (85.4%). This disparity confirms that structural corruption alone is insufficient, highlighting the necessity of gradient-guided semantic destruction for neutralizing robust models. We further observe that simpler datasets and densely connected architectures like DenseNet exhibit inherent fragility to perturbations due to error propagation, whereas the resilience of ResNet models validates the requirement for targeted adversarial interference. Throughout these configurations, authorized inputs maintain optimal accuracy, ensuring no performance penalty for legitimate users. These observations validate the effectiveness of the LymphNode framework. The consistent superiority of GSUAP establishes a reliable protection boundary that stochastic baselines cannot achieve, particularly on robust architectures. Simultaneously, the preservation of authorized fidelity confirms the precision of our feature-domain verification mechanism, which effectively decouples authorized flows from the noise injection path. In summary, LymphNode provides a robust paradigm for active model protection, reconciling strict unauthorized lockout with seamless authorized access. B. Neutralization Efficiency Analysis While the absolute performance drop is a critical measure of security, a practical protection mechanism must also be efficient, achieving maximum security with minimal structural modification. To rigorously quantify the return on investment for each injected noise channel, we introduce the Neutralization Efficiency metric E. Formally, defined by the performance gap between authorized and unauthorized users normalized by the sparsity ratio of modified channels ρ, the metric is calculated as: Aauth − Aunauth (7) E= ρ where Aauth and Aunauth represent the classification accuracy for authorized and unauthorized (Normal) inputs, respectively.
TABLE II N EUTRALIZATION EFFECTIVENESS ACROSS DATASETS AND ARCHITECTURES .†
Gauss
CIFAR-10 SUAP GSUAP
VIP
Gauss
MNIST SUAP GSUAP
VIP
Gauss
SVHN SUAP GSUAP
ResNet-18
20 40 60 80 100
93.6 87.4 85.4 80.2 73.6
93.2 81.4 72.0 67.0 48.4
88.6 36.4 13.6 11.0 10.6
94.5 94.5 94.5 94.5 94.5
49.0 31.3 29.4 24.7 22.6
10.2 11.3 9.3 10.6 10.2
10.2 11.3 9.3 10.2 10.2
99.6 99.6 99.6 99.6 99.6
64.6 60.3 50.8 46.5 44.0
13.2 11.1 10.9 10.8 10.8
8.1 7.4 7.2 6.6 6.6
96.1 96.1 96.1 96.1 96.1
ResNet-50
20 40 60 80 100
95.2 83.8 74.2 72.6 68.6
87.2 65.2 47.8 42.0 32.4
79.2 47.8 25.6 11.2 9.0
95.8 95.8 95.8 95.8 95.8
92.6 45.7 35.3 33.7 32.0
16.7 11.1 10.4 10.4 10.4
16.3 10.9 10.2 10.2 10.0
99.8 99.8 99.8 99.8 99.8
68.4 65.8 59.4 52.7 48.6
25.3 21.4 19.4 19.2 19.2
10.8 9.5 9.8 9.5 9.4
96.6 96.6 96.6 96.6 96.6
ViT-Tiny
20 40 60 80 100
71.6 51.0 39.8 34.8 29.8
49.0 16.6 13.6 11.8 11.2
27.8 11.6 11.8 10.6 10.6
91.8 91.8 91.8 91.8 91.8
46.3 32.4 23.8 21.2 19.0
11.2 10.9 9.4 9.9 9.8
10.4 10.0 8.9 8.4 8.4
99.3 99.3 99.3 99.3 99.3
67.8 43.0 32.5 26.0 22.2
19.8 18.4 11.2 10.3 10.2
24.1 18.1 10.8 10.8 10.8
96.3 96.3 96.3 96.3 96.3
ViT-Small
20 40 60 80 100
55.6 36.0 27.0 24.8 23.6
22.6 15.2 11.2 10.6 11.6
13.6 10.2 10.0 10.0 10.0
89.4 89.4 89.4 89.4 89.4
40.8 26.1 22.7 17.9 14.1
10.8 10.0 9.8 9.5 9.5
10.7 10.0 9.4 9.5 9.4
99.2 99.2 99.2 99.2 99.2
43.7 25.9 20.0 20.0 20.0
23.6 22.0 18.2 13.2 13.2
21.8 21.0 18.9 14.6 11.0
97.6 97.6 97.6 97.6 97.6
DenseNet
20 40 60 80 100
14.2 10.7 10.6 10.2 10.2
13.5 10.7 9.6 9.7 9.5
11.3 9.6 9.3 9.0 9.0
95.8 95.8 95.8 95.8 95.8
12.3 10.1 10.3 10.5 10.4
10.7 9.8 10.3 9.5 9.4
9.5 9.8 9.3 9.5 9.4
99.5 99.5 99.5 99.5 99.5
15.8 15.4 13.1 10.5 9.9
15.6 14.6 14.1 9.4 8.5
9.9 8.0 7.7 7.6 7.7
96.1 96.1 96.1 96.1 96.1
AlexNet
20 40 60 80 100
23.5 20.8 12.7 11.0 11.4
12.7 11.9 9.9 9.2 9.2
11.0 11.5 9.8 9.0 9.0
90.5 90.5 90.5 90.5 90.5
12.6 11.5 10.9 10.6 10.6
9.8 9.4 9.2 9.2 9.2
9.7 9.5 9.0 8.9 8.9
98.9 98.9 98.9 98.9 98.9
28.0 27.3 26.8 20.7 16.7
15.7 11.7 8.0 7.1 7.1
10.5 7.3 6.0 6.0 6.0
95.4 95.4 95.4 95.4 95.4
Model
Ratio (%)
VIP
† Ratio: percentage of channels with GSUAP injection. Gauss/SUAP/GSUAP: accuracy of unauthorized inputs (%, lower is better). VIP: accuracy of authorized
inputs (%, higher is better). Bold: best suppression; underline: second best.
5 H V 1 H W
5 H V 1 H W
' H Q V H 1 H W
( I I L F L H Q F \ 6 F R U H
( I I L F L H Q F \ 6 F R U H
$ O H [ 1 H W
& K D Q Q H O 5 D W L R
9 L 7 6 P D O O
9 L 7 7 L Q \
& K D Q Q H O 5 D W L R
* D X V V
6 8 $ 3
& K D Q Q H O 5 D W L R
* 6 8 $ 3
Fig. 2. Neutralization Efficiency.
Mathematically, this represents the marginal neutralization
utility, quantifying how much protection gain is achieved per
unit of channel resource consumed. To provide a holistic view of architectural behaviors that is not biased by specific data characteristics, we compute the efficiency scores for each model by averaging the results across all three datasets (CIFAR-10, MNIST, and SVHN). As illustrated in Figure 2, the efficiency trajectories across six architectures reveal distinct behavioral patterns governed by both perturbation strategy and model topology. Universally, the efficiency curves exhibit a monotonic decay as the channel ratio increases, a phenomenon consistent with the law of diminishing returns where the initial set of critical channels contributes most significantly to the decision boundary. Crucially, GSUAP consistently establishes a superior efficiency frontier compared to Gaussian noise and SUAP, particularly on robust architectures like ResNet and ViT. For instance, at a sparsity ratio of 20% on ResNet-18, GSUAP achieves an efficiency score of nearly 2.5, significantly outperforming Gaussian noise (< 0.8). This empirical evidence confirms that GSUAP does not merely introduce stochastic noise but precisely targets the model’s semantic vulnerabilities. We further observe a divergence based on architectural resilience: for densely connected structures like DenseNet and legacy models like AlexNet, the efficiency curves of all three methods nearly collapse into a single trajectory, corroborating the “error avalanche” effect where inherent architectural fragility renders the sophistication of the noise generation secondary to the perturbation itself. Conversely, for modern architectures possessing structural redundancy, such as ResNets and ViTs, the performance gap between GSUAP and the baselines widens significantly. Synthesizing these observations, we conclude that the efficiency of gradient-guided adversarial perturbations is fundamentally superior to stochastic interference, particularly when protecting robust models. The pronounced “efficiency gap” observed on resilient architectures (e.g., ResNet) highlights that while random noise may suffice for fragile models, the precise, adversarial nature of GSUAP is indispensable for neutralizing robust networks under strict resource constraints. Consequently, these results validate the core design premise of LymphNode: by leveraging GSUAP, our framework achieves substantial model degradation with minimal feature modification. This high operational efficiency ensures that the protection mechanism imposes the lowest possible structural cost while maintaining a robust lockout against unauthorized access. C. System Performance Analysis For any active protection mechanism to be viable in realworld deployments—particularly on resource-constrained edge devices—it must impose minimal computational burden. In this section, we rigorously quantify the system overhead introduced by the LymphNode plugin. In detail, we benchmark the inference performance on an NVIDIA GeForce RTX 4060 Laptop GPU. We compare the original clean models against their protected counterparts across five key metrics: parameter count (Storage), theoretical
FLOPs (Computational Complexity), inference latency (Batch Size=1), throughput (Batch Size=128), and peak memory usage. We select ResNet-18 and ViT-Tiny as representative architectures for CNNs and Transformers, respectively. Test data is sampled from watermarked CIFAR-10 dataset. TABLE III S YSTEM OVERHEAD ANALYSIS .
Metric
ResNet-18 Clean Prot.
Cost
ViT-Tiny Clean Prot.
Cost
Params (M) 11.17 11.17 +0.0% 1.80 1.80 +0.0% FLOPs (G) 0.558 0.558 ≈ 0 0.118 0.118 ≈ 0 Latency (ms) 1.70 2.74 +1.0 1.54 2.60 +1.1 Throughput (/s) 6893 5875 -14.8% 17175 16023 -6.7% Memory (MB) 93.2 109.2 +17.2% 33.7 35.2 +4.5%
Results Analysis. Table III summarizes the results. First, regarding theoretical complexity, the plugin introduces negligible overhead in terms of parameters and FLOPs (< 0.01%). This confirms that the element-wise operations (LSB extraction and noise injection) are computationally lightweight compared to the backbone’s convolutional layers. Second, regarding runtime performance, the throughput reduction is modest (−6.7% to −14.8%), maintaining high efficiency for batch processing. Finally, for real-time latency, although the relative increase appears significant due to the extremely low baseline of CIFAR models, the absolute latency penalty is consistently around 1.0 ms. In practical scenarios, such as video processing at 30 FPS (requiring < 33 ms per frame), a total inference time of ≈ 2.7 ms is well within the operational envelope. This confirms that LymphNode achieves strong active protection without compromising system responsiveness. D. Channel Selection Evaluation To validate the channel selection strategy within LymphNode, we conduct an ablation study on the CIFAR-10 dataset to determine the most effective criterion for identifying critical features. We benchmark our Weight Gradient approach against three established saliency metrics derived from model pruning literature: Random selection (baseline), Weight Norm [40], and Taylor Expansion [49]. To ensure a strictly fair comparison, we apply these criteria to generate the sparsity mask while keeping the noise injection method (GSUAP) constant. The evaluation focuses on four representative architectures: ResNet-18, ResNet-50, ViT-Tiny, and ViT-Small. These models are selected because their inherent structural redundancy offers high resilience to interference, providing a rigorous testing ground to distinguish the efficacy of different selection strategies. All necessary selection metrics, such as gradients and weight magnitudes, are computed directly from the corresponding clean models pre-trained on CIFAR-10. We quantify the performance using the Accuracy Gap (defined as Aauth − Aunauth ), where a wider gap indicates a more efficient selection method that achieves greater performance
5 H V 1 H W
$ F F X U D F \ * D S
5 H V 1 H W
9 L 7 7 L Q \
9 L 7 6 P D O O
& K D Q Q H O 5 D W L R
5 D Q G R P % D V H O L Q H
& K D Q Q H O 5 D W L R
: H L J K W 1 R U P
& K D Q Q H O 5 D W L R
7 D \ O R U
& K D Q Q H O 5 D W L R
: H L J K W * U D G L H Q W 2 X U V
Fig. 3. Ablation study for selector.
degradation for unauthorized users while maintaining the same sparse footprint. The results are presented in Figure 3. The results provide a clear justification for our design choice. First, we observe that perturbing a specific proportion of critical channels (e.g., 60% on ResNet and 40% on ViT) yields neutralization effects comparable to full-channel perturbation, verifying that targeted noise injection significantly enhances efficiency without compromising potency. Universally, the selection strategy proves decisive; both gradientbased methods significantly outperform the magnitude-based and random baselines, confirming that sensitivity to the loss function is a superior proxy for channel importance compared to static magnitude heuristics. Crucially, between the top performers, our Weight Gradient method demonstrates superior stability and overall efficiency. While Taylor Expansion is competitive at extreme sparsity levels for smaller models, it lacks consistency in the practical 40%–80% range. For instance, on ResNet-50 at a 60% ratio, our method achieves an Accuracy Gap of approximately 75%, substantially surpassing the 52% achieved by Taylor Expansion. Furthermore, on ViTTiny, our approach maintains a distinct performance lead across all ratios. Consequently, we adopt the weight gradient criterion as the default selector for our framework due to its robust trade-off between sparsity and neutralization capability. E. Impact of Noise Scale A distinct advantage of our plugin-based architecture is the ability to dynamically regulate the severity of performance degradation. Unlike weight-embedded backdoors that typically offer a binary “all-or-nothing” outcome, LymphNode allows the model provider to tune the intensity of the injected Generalized Sparse Universal Adversarial Perturbation (GSUAP) to achieve granular access control. To demonstrate this capability, we conduct a representative case study using ResNet-18 on the CIFAR-10 dataset. We fix the sparse channel selection ratio at 40% and systematically vary the noise scale factor λ from 0.0 to 2.0 with a step size of 0.1. Here, λ = 0 represents an unprotected model, while higher values indicate stronger interference. We measure the inference accuracy for both authorized users and unauthorized users.
Fig. 4. Impact of Noise Scale (λ) on model performance (ResNet-18 on CIFAR-10).
As illustrated in Figure 4, the performance trajectories reveal a contrast between user groups. The authorized User accuracy (blue line) remains robustly stable at the optimal level (≈ 99.8%) across the entire range of λ, confirming that our identity verification module reliably triggers the antidote mechanism. Conversely, the performance for unauthorized users (red line) exhibits a smooth, monotonic decline as λ increases. This experiment validates the controllability of our framework, demonstrating that LymphNode enables flexible deployment strategies ranging from subtle quality degradation to complete functionality lockout without the need to retrain the model. F. Real Attack Scenarios To directly validate the defense against practical IP threats, we evaluate LymphNode under two representative attack pipelines with oracle-access conditions consistent with Sec. III-A. We include PP [13] and CIP [14] as baselines. Since both methods are originally designed for cloud-API deployment with runtime query interposition, we preserve their core defense logic (per-query gradient perturbation for PP, reliability-based poisoning for CIP), remove the querydetection components that require server-side control, and activate their defense on all queries unconditionally. This adaptation is strictly favorable to the baselines, as it eliminates any detection failure and ensures 100% defense activation.
Model Extraction. We adopt the KnockoffNets [15] protocol, where an adversary trains a substitute model from input–output pairs collected from the victim. The target is ResNet-18 on CIFAR-10 with channel ratio 60% and noise scale 2.0. The query budget varies from 1,000 to 50,000; results are reported in Table IV. TABLE IV K NOCKOFF N ET EXTRACTION ATTACK ON CIFAR-10.
Budget
No Def.
PP [13]
CIP [14]
Ours
Victim Acc.
92.54
92.54
92.54
92.54
1,000 5,000 10,000 50,000
42.88 56.25 66.16 85.24
25.26 32.68 38.24 45.66
28.44 35.17 42.81 48.25
13.71 14.76 14.68 15.28
Ours: non-VIP model accuracy = 16.47%, output entropy = 1.35 (uniform = 2.30).
Without defense, surrogate accuracy reaches 85.24% at 50K queries. PP and CIP reduce this to 45.66% and 48.25%, yet surrogate accuracy continues climbing with budget, indicating persistent information leakage through perturbed outputs. LymphNode suppresses surrogate accuracy to 13.71–15.28% across all budgets—near random guessing (10%)—with no improvement as budget scales by 50×, confirming that featurespace corruption renders collected soft labels uninformative for distillation. Model Inversion. We adopt the GMI framework [16], where a DCGAN trained on public face images is optimized in latent space to reconstruct private training samples of a CelebA classifier. To comply with the oracle-access constraint, we replace white-box gradients with Natural Evolution Strategies (NES), yielding a fully black-box variant. The attack targets 50 randomly selected identities. Attack success is measured by an independent evaluator: Acc-1/5 (lower is better) indicates how often reconstructions match the target identity; KNN Distance (higher is better) quantifies feature-space divergence from real samples. Results appear in Table V. TABLE V GMI MODEL INVERSION ATTACK RESULTS ON C ELEBA (50 IDENTITIES ).
Defense
Acc-1↓
Acc-5↓
KNN Dist↑
Latency
None (Clean) CIP PP Ours
82.71% 44.30% 3.02% 4.17%
91.32% 48.23% 8.77% 11.22%
5.57 6.45 7.71 7.51
0.082ms 0.110ms 0.308ms 0.088ms
CIP provides limited defense (Acc-1 = 44.30%). PP achieves the strongest inversion protection (Acc-1 = 3.02%) but performs per-query PGD optimization, increasing latency from 0.082 ms to 0.308 ms—a 275% overhead. CIP incurs a moderate 34% increase (0.110 ms) via per-query reliability scoring. LymphNode achieves comparable protection (Acc-1
= 4.17%, Acc-5 = 11.22%, both near random guessing) with only 7.3% latency increase (0.088 ms), as GSUAP is a precomputed static tensor requiring only a constant-cost elementwise addition. For throughput-sensitive edge applications such as real-time video analytics, this constant-overhead property is essential—any per-query computation directly erodes the available compute budget on resource-constrained devices. Across both attacks, LymphNode matches or exceeds the strongest baseline in protection while adding negligible inference cost, making it uniquely suited for latency-constrained edge deployment. V. DATA A DAPTIVITY In this section, we use two experiments to highlight that LymphNode has strong dataset adaptivity. We validate that our plugin framework can achieve performance control with limited data sampling from a similar domain. A. Dataset Size Here, we evaluate the influence of calibration data size on the effectiveness of LymphNode. Using the ResNet-18 architecture on CIFAR-10 as a testbed, we optimize the internal GSUAP module using varying subsets of the training data, ranging from 10 to 500 samples, across channel ratios from 20% to 100%. It is crucial to note that the maximum budget of 500 samples constitutes merely 1% of the original dataset, simulating an extremely low-resource setup. We evaluate performance on the test set using the Accuracy Gap and the Fooling Rate. The Fooling Rate measures the proportion of clean images that are misclassified by the target network solely due to the injected perturbation, defined as: Fooling Rate =
Nmisclassified with GSUAP Ncorrectly classified clean
(8)
In our visualization, solid and dashed lines distinguish these two metrics. We benchmark against the SUAP baseline for comparison, while Gaussian noise is excluded as prior experiments (Sec. IV-A) have already demonstrated its insufficient neutralizing capability. The results are presented in Figure 5. The results in Figure 5 demonstrate the superior data efficiency of LymphNode. We observe a significant performance gap between our method and the SUAP baseline. GSUAP exhibits a rapid convergence trajectory, establishing a robust lockout with minimal data. Specifically, at channel ratios of 40% and above, GSUAP achieves a high Accuracy Gap and Fooling Rate with as few as 50 to 100 samples. Furthermore, at higher channel ratios (60% and 80%), the protection capability saturates quickly, reaching peak performance with a negligible data budget (approx. 50 samples). These observations confirm that LymphNode entails low setup costs and is highly practical for real-world deployment. B. Domain-Adaptivity Analysis In practical scenarios, the model provider might need to protect a model without accessing its original training set. To evaluate whether LymphNode can be effectively deployed
& K D Q Q H O 5 D W L R
& K D Q Q H O 5 D W L R
& D O L E U D W L R Q 6 L ] H
& K D Q Q H O 5 D W L R
& K D Q Q H O 5 D W L R
) R R O L Q J 5 D W H
$ F F X U D F \ * D S
& D O L E U D W L R Q 6 L ] H
6 8 $ 3 $ F F X U D F \ * D S
* 6 8 $ 3 $ F F X U D F \ * D S
& D O L E U D W L R Q 6 L ] H
6 8 $ 3 ) R R O L Q J 5 D W H
& D O L E U D W L R Q 6 L ] H
* 6 8 $ 3 ) R R O L Q J 5 D W H
Fig. 5. effectiveness with different dataset size.
TABLE VI C ROSS -DATASET E FFECTIVENESS : GSUAP GENERATED FROM CIFAR-10 (S OURCE ) APPLIED TO MODELS TRAINED ON DISTINCT TARGET D OMAINS . Ratio 0.2 0.4 0.6 0.8
CIFAR-10 (Source)
CIFAR-100 (Target)
STL-10 (Target)
Gap
FR
Gap
FR
Gap
FR
19.34 82.79 82.89 82.71
22.22 88.94 89.07 88.68
40.82 69.98 70.66 70.65
43.77 64.13 75.02 75.14
14.70 38.35 46.06 51.31
20.17 42.58 50.20 55.11
All metrics reported in percentage (%). Gap: Accuracy Gap; FR: Fooling Rate.
using accessible proxy datasets, we conducted transferability experiments by optimizing GSUAP on the CIFAR-10 dataset (Source) and deploying the generated perturbation to neutralize ResNet-18 models trained on different target domains: CIFAR-100 and STL-10. We selected these targets to isolate domain characteristics; CIFAR-100 shares the same resolution (32×32) as the source but differs in semantic granularity, while STL-10 introduces a larger domain shift with disjoint class definitions and higher resolution (96 × 96). For evaluation, we randomly sampled 500 clean images from each target dataset and applied the source-derived perturbation, quantifying efficacy via the Accuracy Gap. The results in Table VI reveal remarkable adaptability, particularly when the domains share statistical similarities. Specifically, the CIFAR-10 derived perturbation achieves a control efficacy on the CIFAR-100 target that closely trails the oracle setting at higher channel ratios. Notably, at the lowest sparsity (0.2), the cross-domain attack on CIFAR-100 (40.82% Gap) significantly outperforms the source attack on CIFAR-10 (19.34% Gap). We attribute this to the inherent fragility of the fine-grained CIFAR-100 model, where the coarse-grained adversarial patterns learned from CIFAR-10 prove disruptively potent against the more complex decision boundaries. While efficacy naturally degrades on the more distant STL-10 domain due to resolution mismatches, functional control remains intact. Synthesizing these observations, we conclude that access to the original training dataset is not a prerequisite for LymphNode. The strong transferability demonstrates that as long as the
surrogate dataset aligns with the target in basic visual statistics, the LymphNode framework can establish a robust lockout mechanism. This finding is pivotal for practical application, as it significantly lowers the barrier for adoption. It validates that model owners can reliably initialize the protection mechanism using publicly accessible surrogate datasets, thereby securing their intellectual property even in scenarios where the original training data is private, lost, or computationally too expensive to process. VI. ROBUSTNESS E VALUATION We strictly evaluate the dependability of LymphNode against a knowledgeable adversary whose objective is either to forge valid credentials or to physically remove the protection mechanism. In this evaluation, we assume a “deployment-ready” threat model where the underlying system integrity is secured, limiting the adversary to adaptive attacks involving traffic interception, credential fabrication, and model modification. To demonstrate the superiority of our plugin-based architecture over traditional parameter-based protections, we implement two representative baselines: BadNets [50] and Blended Attack [51]. We re-purpose these backdoor attacks as baseline access control mechanisms by training models to yield highfidelity inference only upon detecting specific triggers—a visible 3×3 patch for BadNets and an invisible static noise pattern (α = 0.1) for Blended Attack. This setup allows for a rigorous comparative analysis. Our evaluation comprehensively covers four critical dimensions: watermark imperceptibility, robustness against credential forgery, resilience to fine-tuning attacks, and stability under lossy compression and pruning. A. Watermark Imperceptibility Analysis To ensure authorization credentials remain undetectable to human or automated inspection, we evaluate visual stealthiness on 1,000 randomly sampled CIFAR-10 image pairs using PSNR, SSIM, and Learned Perceptual Image Patch Similarity (LPIPS). While standard metrics focus on pixellevel differences, LPIPS measures perceptual distance in deep feature space, serving as a critical indicator for high-frequency artifacts that might escape traditional metrics.
Clean Accuracy Recovery During Fine-tuning Attack
TABLE VII Q UANTITATIVE COMPARISON OF WATERMARK IMPERCEPTIBILITY ON CIFAR-10. ↑ INDICATES HIGHER IS BETTER ; ↓ INDICATES LOWER IS BETTER .
Acc (%)
100
PSNR (dB) ↑
SSIM ↑
LPIPS ↓
BadNets Blended
28.3502 33.9331
0.9370 0.8245
0.0472 0.0218
LymphNode
56.6411
0.9990
0.0011
Test Accuracy (%)
80
Method
56 55 54 53 52 51 50
38
40
42
B. Robustness against Credential Forgery TABLE VIII ROBUSTNESS AGAINST C REDENTIAL F ORGERY ATTACKS . W E REPORT THE Forgery Success Rate ( SUCCESS RATE OF FORGED CREDENTIALS ) ON THE PROTECTED MODELS . A LOWER ACCURACY INDICATES HIGHER ROBUSTNESS AGAINST FORGERY. Target Model
Attack Method
Forgery Success Rate. (%)
BadNets (Baseline)
Linear Est. U-Net
100.0 100.0
Blended (Baseline)
Linear Est. U-Net
0.0 23.8
Ours (LymphNode)
Linear Est. U-Net
0.0 0.0
To evaluate robustness against credential forgery, we simulate an adversary who attempts to reverse-engineer the authorization watermark using 500 intercepted pairs of unauthorized and authorized images. We benchmark our method against the Blended-based model as a primary competitor due to its use of invisible static triggers. The evaluation employs two approximation attacks targeting the mathematical properties of the watermark: Linear Residual Estimation, which assumes a static additive signal derived by averaging residuals to suppress image-specific variations, and a Deep Mapping Attack via U-Net, which treats forgery as a supervised image-toimage translation task minimizing pixel-wise reconstruction loss. We quantify robustness using the Forgery Success Rate on forged images, hypothesizing that while baselines relying on continuous pixel-domain modifications are susceptible to
46
48
50
40
20
The quantitative results in Table VII highlight the superior fidelity of our approach. The baselines exhibit clear limitations: BadNets suffers from low PSNR (28.35 dB) due to concentrated corruption, while the Blended Attack degrades structural quality (SSIM 0.8245) through global noise injection. In stark contrast, LymphNode achieves near-perfect imperceptibility across all metrics, attaining a PSNR of 56.64 dB and an LPIPS score of 0.0011—an order of magnitude superior to the baselines. This stealthiness is fundamentally attributed to our precision-targeted embedding strategy, which targets deep bit-depths (s ≥ 5) to restrict feature modifications to the level of numerical quantization noise, thereby preserving both pixel statistics and deep perceptual integrity.
44
Epoch
60
0
LymphNode BadNets Blended Passport 0
10
20
30
Fine-tuning Epoch
40
50
Fig. 6. Robustness against fine-tuning attacks. The trajectories illustrate the Clean Accuracy recovery over 50 epochs.
approximation, our discrete feature-bit alignments will resist such replication. The quantitative results in Table VIII validate this hypothesis, revealing distinct vulnerability patterns. The BadNets baseline yields a 100% forgery success rate due to its simple trigger, while the Blended Attack remains vulnerable to U-Net (23.8% success rate), indicating that its reliance on continuous feature activations allows for approximation by generative models given sufficient data. In stark contrast, LymphNode achieves absolute robustness with a 0.0% success rate against all attempts. This superior security is attributed to the fundamental verification discontinuity inherent in our design; while generative models like U-Net inherently produce smooth outputs with microscopic floating-point residuals, these deviations disrupt the precise quantization logic required for our LSB-based verification. Consequently, our discrete feature-domain mechanism establishes a mathematical barrier that renders forged credentials invalid, proving intractable for standard continuous approximation algorithms. C. Robustness against Fine-tuning Attacks Beyond credential forgery, an adversary possessing the model artifacts might attempt to attack the protection mechanism through fine-tuning. We simulate a gray-box scenario where the adversary has access to the model parameters and clean training data (10%), but lacks knowledge of the specific plugin logic. To evaluate resilience, we benchmark against BadNets, Blended Attack, and Passport [52] under identical conditions. The adversary employs standard Stochastic Gradient Descent (SGD) with a learning rate of 0.01 to fine-tune the protected models. The fine-tuning process is conducted for 50 epochs using the clean CIFAR-10 dataset. Figure 6 illustrates the accuracy recovery trajectories. We observe that after 50 epochs, the clean accuracy of the LymphNode-protected model recovers to 52.46%, which remains significantly below the original fidelity (≈ 95%). This final accuracy is comparable to that of the structural baseline
(Passport, 54.89%) and the data-poisoning baselines (≈ 53%). These results indicate that LymphNode, despite being a posthoc plugin, achieves a level of resistance against fine-tuning that is on par with heavyweight structural defenses like Passport, effectively preventing the restoration of model utility under standard fine-tuning protocols. D. Resilience to Lossy Compression In practical deployment scenarios, input images frequently undergo lossy compression during transmission, such as JPEG encoding, which quantizes high-frequency DCT coefficients and inherently challenges the precision-based LSB verification mechanism. To evaluate the robustness of our system against such channel distortions, we measured the Authorization Success Rate (ASR) of credentials subjected to JPEG compression across varying quality factors. Recognizing the sensitivity of standard single-step embedding to aggressive quantization, we adopted an iterative embedding strategy that progressively refines pixel perturbations to survive the specific quantization matrix of the target quality level. TABLE IX AUTHORIZATION S UCCESS R ATE (ASR) EVOLUTION USING THE I TERATIVE E MBEDDING S TRATEGY [37].
Quality (Q) 80 70 60
Iterations (T ) 30 40
10
20
15.6% 2.3% 0.0%
82.4% 45.8% 8.5%
96.5% 81.2% 35.2%
99.1% 93.7% 62.8%
50 99.8% 98.4% 85.6%
The performance evolution, detailed in Table IX, demonstrates the efficacy of this adaptive approach. While the survival rate is initially negligible under severe compression (e.g., quality factor 60), it improves dramatically to over 85% after 50 iterations. These results confirm that LymphNode can be effectively hardened to guarantee reliable access for authorized users even in bandwidth-constrained environments, successfully balancing strict security requirements with practical usability. E. Resistance to Model Pruning. While we focus on fine-tuning, model pruning represents another potential removal vector. However, our framework inherently mitigates this threat through the design of the WeightGradient selector (evaluated in Sec. IV-D). As demonstrated in Fig. 3, the protection mechanism is anchored to the channels with the highest gradient sensitivity—i.e., the most “decisioncritical” features of the network. Standard pruning algorithms, which eliminate redundant neurons [41], would naturally bypass our plugin-associated channels. Conversely, an aggressive adversary attempting to prune these specific highsaliency channels would inadvertently destroy the model’s primary classification capability before successfully removing the protection. This establishes a structural coupling where the survival of the security mechanism is tied to the utility of the model itself, rendering pruning attacks ineffective.
VII. D ISCUSSION AND F UTURE W ORK While LymphNode demonstrates efficient and robust performance, we acknowledge two specific limitations in the current implementation. First, as a software-level plugin, the defense relies on the integrity of the hosting runtime environment; an adversary with unrestricted write access to the model parameters could theoretically identify and bypass the protection logic. Future work can address this by coupling the plugin with lightweight code obfuscation or hardwarebacked integrity checks to withstand physical tampering. Second, the current verification mechanism relies on fine-grained feature perturbations optimized for floating-point models. In scenarios employing aggressive quantization (e.g., INT8) for extreme compression, these subtle credentials may be distorted or lost. Future works can extend the framework to support quantization-aware embedding strategies compatible with lowprecision arithmetic. VIII. C ONCLUSION In this paper, we introduced LymphNode, a novel posthoc plugin framework designed to secure Deep Neural Networks against model extraction and inversion attacks. Addressing the critical vulnerability of unrestricted oracle access, the framework establishes an immunological “default-deny” checkpoint. It actively neutralizes model utility via Generalized Sparse Universal Adversarial Perturbations (GSUAP), effectively blocking the gradient estimation required for extraction, while transparently restoring fidelity for authorized users through a discrete feature-domain verification mechanism. Specifically, its ability to initialize robust protection using only public surrogate datasets—combined with a strictly constant O(1) inference overhead—ensures that the framework can be seamlessly scaled and instantly deployed across heterogeneous, resource-constrained edge nodes without hardwarespecific tuning. Our comprehensive evaluation confirms that LymphNode successfully reconciles rigorous security with operational practicality. We demonstrated that the protection is exceptionally data-efficient, establishing robust neutralization with as few as 50–100 calibration samples (< 1% of training data) that need not originate from the original dataset, thus eliminating the dependency on sensitive private data required by prior art. From a system perspective, the plugin introduces negligible overhead (≈ 1 ms latency), ensuring viability for real-time applications. Furthermore, robustness analysis verifies that our credentials achieve near-perfect imperceptibility and exhibit strong resilience against adaptive threats, including generative forgery and fine-tuning. By decoupling IP protection from the constraints of model retraining, LymphNode offers a scalable, deployment-ready solution for safeguarding high-value AI assets. R EFERENCES [1] OpenAI, “Gpt-4 technical report,” OpenAI, Tech. Rep., 2024, arXiv:2303.08774v6. [Online]. Available: https://arxiv.org/abs/2303. 08774
[2] H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar, A. Rodriguez, A. Joulin, E. Grave, and G. Lample, “Llama: Open and efficient foundation language models,” arXiv preprint arXiv:2302.13971, 2023. [Online]. Available: https://arxiv.org/abs/2302.13971 [3] F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction APIs,” in 25th USENIX Security Symposium (USENIX Security 16). USENIX Association, 2016, pp. 601–618. [4] M. Jagielski, N. Carlini, D. Berthelot, A. Kurakin, and N. Papernot, “High accuracy and high fidelity extraction of neural networks,” in 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, 2020, pp. 1345–1362. [5] M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2015, pp. 1322–1333. [6] Y. Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” in 27th USENIX Security Symposium (USENIX Security 18), 2018, pp. 1615–1631. [7] Y. Uchida, Y. Nagai, S. Sakazawa, and S. Satoh, “Embedding watermarks into deep neural networks,” in Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval, 2017, pp. 269–277. [8] J. Zhang, Z. Gu, J. Jang, H. Wu, M. P. Stoecklin, H. Huang, and I. Molloy, “Protecting intellectual property of deep neural networks with watermarking,” in Proceedings of the 2018 on Asia Conference on Computer and Communications Security, 2018, pp. 159–172. [9] M. Alam, S. Saha, D. Mukhopadhyay, and S. Kundu, “Deep-lock: Secure authorization for deep neural networks,” in 2020 IEEE 38th VLSI Test Symposium (VTS). IEEE, 2020, pp. 1–6. [10] H. Chen, C. Fu, J. Zhao, and F. Koushanfar, “Model assertion: A defense against model theft via authorized model encryption,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021, pp. 15 380–15 389. [11] M. Xue, Y. Wu, L. Y. Zhang, D. Gu, Y. Zhang, and W. Liu, “Ssat: Active authorization control and user’s fingerprint tracking framework for dnn ip protection,” ACM Transactions on Multimedia Computing, Communications and Applications, vol. 20, no. 10, 2024. [12] M. Xue, Z. Wu, J. Wang, Y. Zhang, and W. Liu, “Advparams: An active dnn intellectual property protection technique via adversarial perturbation based parameter encryption,” arXiv preprint arXiv:2105.13697, 2021. [13] T. Orekondy, B. Schiele, and M. Fritz, “Prediction poisoning: Towards defenses against DNN model stealing attacks,” in International Conference on Learning Representations (ICLR), 2020. [14] H. Zhang, G. Hua, X. Wang, H. Jiang, and W. Yang, “Categorical inference poisoning: Verifiable defense against black-box DNN model stealing without constraining surrogate data and query times,” IEEE Transactions on Information Forensics and Security, vol. 18, pp. 1473– 1486, 2023. [15] T. Orekondy, B. Schiele, and M. Fritz, “Knockoff nets: Stealing functionality of black-box models,” in CVPR, 2019. [16] Y. Zhang, R. Jia, H. Pei, W. Wang, B. Li, and D. Song, “The secret revealer: Generative model-inversion attacks against machine learning models,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 253–261. [17] B. D. Rouhani, H. Chen, and F. Koushanfar, “Deepsigns: An end-to-end watermarking framework for ownership protection of deep neural networks,” in Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS). ACM, 2019, pp. 485–497. [18] Y. Li, Y. Bai, Y. Jiang, Y. Yang, S.-T. Xia, and B. Li, “Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 35, 2022, pp. 13 862–13 875, oral, Top 2%. [19] J. Guo, Y. Li, L. Wang, S.-T. Xia, H. Huang, C. Liu, and B. Li, “Domain watermark: Effective and harmless dataset copyright protection is closed at hand,” in Advances in Neural Information Processing Systems (NeurIPS), 2023. [20] X. Cao, J. Jia, and N. Z. Gong, “IPGuard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary,” in Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security (AsiaCCS), 2021, pp. 14–25.
[21] E. Le Merrer, P. Pérez, and G. Trédan, “Adversarial frontier stitching for remote neural network watermarking,” Neural Computing and Applications, vol. 32, no. 13, pp. 9233–9244, 2020. [22] A. Chakraborty et al., “DynaMarks: Defending against deep learning model extraction using dynamic watermarking,” arXiv preprint arXiv:2207.13321, 2022. [23] N. Lukas, E. Jiang, X. Li, and F. Kerschbaum, “Sok: How robust is image classification deep neural network watermarking?” in 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, pp. 787–804. [24] X. Liu, Y. Zhong, Y. Zhang, L. Qin, and W. Deng, “Enhancing generalization of universal adversarial perturbation through gradient aggregation,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023, pp. 4428–4437. [25] Y. Zhang, Y. Xu, J. Shi, L. Y. Zhang, S. Hu, M. Li, and Y. Zhang, “Improving generalization of universal adversarial perturbation via dynamic maximin optimization,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 39, 2025, pp. –. [26] C. Xu and G. Singh, “Robust universal adversarial perturbations,” arXiv preprint arXiv:2206.10858, 2022. [27] X. Zhong and C. Liu, “Sparse-PGD: A unified framework for sparse adversarial perturbations generation,” arXiv preprint arXiv:2405.05075, 2024. [28] K. R. Mopuri, A. Ganeshan, and R. V. Babu, “Generalizable datafree objective for crafting universal adversarial perturbations,” in IEEE Transactions on Pattern Analysis and Machine Intelligence (TPAMI), vol. 41, no. 10, 2019, pp. 2452–2465. [29] A. Chakraborty, A. Mondal, and A. Srivastava, “Hardware-assisted intellectual property protection of deep learning models,” in 2020 57th ACM/IEEE Design Automation Conference (DAC). IEEE, 2020, pp. 1–6. [30] Y. Gong, D. Chen, W. Niu, S. Cheng, X. Pan, Q. Nie, Y. Xiao, L. Zhang, and H. Zheng, “Modellock: Locking your model with a spell,” in Proceedings of the 32nd ACM International Conference on Multimedia, 2024, pp. 6595–6604. [31] F. Tramer and D. Boneh, “Slalom: Fast, verifiable and private execution of neural networks in trusted hardware,” in International Conference on Learning Representations (ICLR), 2019. [32] D. Natarajan, A. Loveless, W. Dai, and R. Dreslinski, “Chex-mix: Combining homomorphic encryption with trusted execution environments for two-party oblivious inference in the cloud,” in 8th IEEE European Symposium on Security and Privacy (EuroS&P), 2023, pp. 457–477. [33] M. Alam, S. Saha, D. Mukhopadhyay, and S. Kundu, “Nn-lock: A lightweight authorization to prevent ip threats of deep learning models,” ACM Journal on Emerging Technologies in Computing Systems, vol. 18, no. 2, pp. 1–27, 2022. [34] W. Feng et al., “Survey of research on confidential computing,” IET Communications, vol. 18, no. 8, pp. 465–486, 2024. [35] M. Xue, S. Sun, C. He, D. Gu, Y. Zhang, J. Wang, and W. Liu, “Activeguard: An active intellectual property protection technique for deep neural networks by leveraging adversarial examples as users’ fingerprints,” IET Computers & Digital Techniques, vol. 17, no. 3-4, pp. 111–126, 2023. [36] M. Jiang et al., “AMAO: A comprehensive defense framework against model extraction attacks,” IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 2, 2024. [37] Z. Liu, F. Li, Z. Li, and B. Luo, “Loneneuron: A highlyeffective feature-domain neural trojan using invisible and polymorphic watermarks,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’22. New York, NY, USA: ACM, 2022, pp. 2129–2143. [Online]. Available: https://dl.acm.org/doi/10.1145/3548606.3560678 [38] S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Universal adversarial perturbations,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2017, pp. 1765–1773. [39] P. Molchanov, S. Tyree, T. Karras, T. Aila, and J. Kautz, “Pruning convolutional neural networks for resource efficient inference,” in International Conference on Learning Representations, 2017. [40] H. Li, A. Kadav, I. Durdanovic, H. Samet, and H. P. Graf, “Pruning filters for efficient convnets,” in International Conference on Learning Representations (ICLR), 2017. [41] S. Han, J. Pool, J. Tran, and W. J. Dally, “Learning both weights and connections for efficient neural networks,” in Advances in Neural Information Processing Systems (NeurIPS), 2015, pp. 1135–1143.
[42] A. Krizhevsky, G. Hinton et al., “Learning multiple layers of features from tiny images,” University of Toronto, Tech. Rep., 2009. [43] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE, vol. 86, no. 11, pp. 2278–2324, 1998. [44] Y. Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, and A. Y. Ng, “Reading digits in natural images with unsupervised feature learning,” in NIPS Workshop on Deep Learning and Unsupervised Feature Learning, 2011. [45] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778. [46] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly et al., “An image is worth 16x16 words: Transformers for image recognition at scale,” in International Conference on Learning Representations, 2021. [47] A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” in Advances in Neural Information Processing Systems, vol. 25, 2012. [48] G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger, “Densely connected convolutional networks,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017, pp. 4700–4708. [49] P. Molchanov, A. Mallya, S. Tyree, I. Frosio, and J. Kautz, “Importance estimation for neural network pruning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019, pp. 11 264–11 272. [50] T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnerabilities in the machine learning model supply chain,” arXiv preprint arXiv:1708.06733, 2017. [51] X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526, 2017. [52] L. Fan, K. W. Ng, and C. S. Chan, “Deepipr: Deep neural network ownership verification with passports,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 44, no. 10, pp. 6122–6139, 2022.