AI model verification framework enables identity proof via remote challenges
TP-CRIV: A Framework for Third-Party Challenge-Response Identity Verification of AI Models
Cryptography and SecurityArtificial Intelligence
Summary
It is hard to prove that a remote AI service is running the claimed model, especially when only the model’s answers are visible. The authors propose a way for a third party to challenge such a service and verify, based only on the responses, whether the claimant really controls the specified AI model. This method works without needing special access or cooperation from the service provider and uses statistical evidence to make the verification. They tested their approach on well-known image recognition models and showed it can reliably distinguish between matching and non-matching models.
What this means in practice
- •For cloud service operators: Verify the identity of AI models deployed remotely without needing special cooperation from service providers.
- •For cybersecurity teams: Detect unauthorized use or misappropriation of AI models by testing deployed services via challenge-response protocols.
Authors
Teruki Sano, Minoru Kuribayashi, Masao Sakai, Shuji Isobe, Eisuke Koizumi, Zhang Zhang, Satoru Matsumoto
Abstract
Artificial intelligence (AI) models are increasingly deployed through remote services, making model misappropriation a growing concern. Existing approaches, including watermarking, fingerprinting, and model similarity analysis, primarily rely on predefined evidence or direct behavioral comparison and do not explicitly evaluate whether the claimant currently possesses and can utilize model-dependent information relevant to the claimed model identity. In this paper, we propose Third-Party Challenge-Response Identity Verification (TP-CRIV) for AI models. TP-CRIV targets a third-party verification setting in which the verifier has neither white-box nor API access to the claimant's model, can interact with the suspicious deployed service only through its ordinary black-box inference interface, and does not require protocol-specific cooperation from the service provider. Under these constraints, the framework enables the verifier to obtain empirical evidence as to whether the claimant locally possesses a model satisfying a predeclared identity relative to the deployed model. Verification is conducted under fresh, previously undisclosed requirements and network isolation, so that the demonstrated capability cannot rely on online external assistance after challenge disclosure. The resulting evidence is interpreted relative to independently specified and calibrated matching and non-matching operating situations and is statistical rather than cryptographic. We instantiate TP-CRIV for CNN image classifiers using probability-control-based witness generation. Experiments on ten ImageNet-pretrained TorchVision models demonstrate clear same/cross-model separation and finite-challenge verification using independently calibrated thresholds.