Cross-Encoder Fingerprinting: Methods & Insights

• Cross-encoder fingerprinting is a technique that ensures attribution signals remain detectable even after models, encoders, or channels undergo transformation.
• It encompasses approaches like behavioral verification, encoder attribution via secret channels, and domain-invariant fingerprinting in RF and synthetic media settings.
• Practical implementations demonstrate robust verification accuracy and resilience against adversarial attacks across diverse transformation pipelines.

Cross-encoder fingerprinting, used here as an Editor’s term, denotes fingerprinting settings in which an identity-bearing or ownership-bearing signal must remain usable after a change in encoder, generator, receiver, channel, or another transformation pipeline. The current literature does not present a single canonical framework under that name. Instead, it spans several neighboring lines of work: behavioral verification of stolen classifiers through secret probe sets, attribution of self-supervised encoders through learned secret channels, driver identification across synthetic-video generators, and RF fingerprinting under cross-channel or cross-receiver shift. Taken together, these works suggest that the core problem is not a specific architecture, but the preservation of discriminative or attributable structure under domain, pipeline, or model transformation (Lukas et al., 2019, Ren et al., 2023, Chapariniya et al., 25 Apr 2026, Tiras et al., 21 May 2025, Pan et al., 10 Oct 2025).

1. Terminology and problem scope

The phrase is not standardized. Several closely related papers explicitly delimit what they are and are not. CrossRF is a “domain adaptation framework for cross-channel RF fingerprinting” and “the paper does not use the term ‘cross-encoder’”; DEMUX is “not a pairwise cross-encoder between a trace and a candidate website embedding”; ByteDefender is an “encoder-only sequence classifier” over V8 bytecode; and CLIF is “cross-layer fused behavioral fingerprinting,” not a neural cross-encoder (Tiras et al., 21 May 2025, Yuan et al., 17 Apr 2026, Bahrami et al., 12 Sep 2025, Kohli et al., 3 Jun 2026).

A concise way to organize the literature is by what is fingerprinted and what changes across domains or pipelines.

Research line	Fingerprinted object	Cross condition
Behavioral model verification	Source model behavior	Surrogate vs. reference model
Encoder attribution	Self-supervised pre-trained encoder	Victim vs. piracy vs. independent encoder
Avatar fingerprinting	Driving identity in synthetic video	Cross-generator generalization
RF fingerprinting	Transmitter identity	Cross-channel or cross-receiver shift

This scope already excludes a common misconception: any method containing an encoder, any multi-input model, or any cross-layer fusion system is not thereby a cross-encoder fingerprinting method. A plausible implication is that the term is most useful when reserved for fingerprinting problems where attribution must survive transformation by a different pipeline rather than merely coexist with an encoder module.

2. Behavioral verification of stolen models

One influential formulation treats fingerprinting as post hoc behavioral verification of a suspect model rather than watermark embedding during training. In this setting, a provider has a source classifier $M$, later obtains black-box access to a suspect $\hat M$, and wants to decide whether $\hat M$ is a surrogate derived from $M$ rather than an independently trained reference model. The fingerprint is a secret probe set $\mathcal F$ together with the source outputs $\mathcal F_y = \{M(x)\mid x\in\mathcal F\}$. Generation is written as $\text{Generate}(M,D)$, and verification as $\text{Verify}(\hat M(\mathcal F),\mathcal F_y)$ (Lukas et al., 2019).

The technical core is the notion of a conferrable adversarial example: a targeted adversarial example that transfers from the source model to its surrogates but not to independently trained references. The paper defines conferrability by

$$\text{Confer}(\mathcal{S}, \mathcal{R}, x;t) = \text{Transfer}(\mathcal{S}, x;t)\bigl(1-\text{Transfer}(\mathcal{R}, x;t)\bigr),$$

so the desirable probe is one for which target-label transfer is high on surrogate models and low on reference models. The practical optimization is the Conferrable Ensemble Method, which trains local surrogate and reference ensembles and optimizes a differentiable proxy of selective transfer. Verification uses Conferrable Adversarial Example Accuracy,

$$\text{CAEAcc}(\hat M(\mathcal F), \mathcal F_y) = \Pr[y = y^*],$$

that is, the agreement rate between suspect predictions and source-model labels on the fingerprint.

The main reported result is a ROC AUC of $\hat M$0 in verifying surrogates, compared to $\hat M$1 for IPGuard. With $\hat M$2 fingerprint examples, the paper reports a mean CAEAcc gap of about $\hat M$3 between well-trained surrogates and references at $\hat M$4. The method remains robust against distillation, related model extraction attacks, and transfer learning when the attacker has no access to the model provider’s dataset, but it is not universally irremovable: PGD-based adversarial training from scratch reduces mean CAEAcc to $\hat M$5 for CIFAR-10 surrogates at $\hat M$6, and sufficiently many ground-truth labels also weaken verification (Lukas et al., 2019).

For cross-encoder settings in the narrower IR or ranking sense, the same paper explicitly identifies a transfer obstacle: its formulation assumes closed-set multiclass outputs and exact target-label agreement, whereas a reranking cross-encoder may emit only scalar relevance scores or pairwise orderings. The reusable idea is therefore not the categorical target-label machinery itself, but the behavioral template: optimize secret probes whose induced decisions are selectively inherited by stolen descendants.

3. Encoder attribution by learned secret channels

A second line of work fingerprints the encoder itself, especially in Encoder-as-a-Service settings. StegGuard fingerprints a self-supervised pre-trained encoder by learning a secrets embeder $\hat M$7 and a secrets extractor $\hat M$8 around a frozen victim encoder $\hat M$9. A clean image $\hat M$0 and random secret $\hat M$1 are mapped to a stego image $\hat M$2, then to an embedding $\hat M$3, and finally to an extracted secret $\hat M$4. The governing intuition is that each encoder induces a distinct image-to-embedding transformation; a piracy encoder preserves that transformation more closely than an independent encoder does (Ren et al., 2023).

The embeder uses ConvBNReLU blocks and a frequency-domain channel attention embedding block, FcaEmb, which computes a $\hat M$5 DCT-based frequency representation and learns which frequency bands are suitable for secret insertion. The extractor is intentionally simple: $\hat M$6 Training balances image fidelity and secret recovery through $\hat M$7 and $\hat M$8; the paper gives

$\hat M$9

with $M$0, although Algorithm 1 writes the weighting in the opposite order. Verification computes

$M$1

and declares piracy if $M$2.

The default secret length is $M$3 bits, default verification uses $M$4K query images, and the method remains effective even with $M$5K $M$6 query images. The paper states that independent encoders yield extraction error near chance, $M$7. It evaluates victim encoders spanning ResNet-50 with SimCLR, ResNet-18 with MoCo v2, and ViT-B with MAE, and tests independence under changes in model structure, pretraining dataset, SSL algorithm, and multiple hyperparameters. It also evaluates post-theft manipulations including model extraction, FT-Same, FT-Other, pruning, embedding noising, and embedding shuffle. Against the DI baseline, StegGuard reports lower p-values for piracy and higher $M$8, while FcaEmb improves both attribution reliability and stealth; for Victim A, for example, $M$9 improves from $\mathcal F$0 to $\mathcal F$1, PSNR from $\mathcal F$2 to $\mathcal F$3, and SSIM from $\mathcal F$4 to $\mathcal F$5 (Ren et al., 2023).

This formulation is directly relevant to cross-encoder fingerprinting whenever the object of attribution is an encoder API rather than a downstream classifier. Its main present limitation is modality specificity: the embeder is image steganographic, the extractor assumes vector embeddings as outputs, and the paper does not demonstrate adaptation to scalar-output cross-encoders.

4. Cross-pipeline fingerprinting in synthetic media

In synthetic media, a closely related problem is avatar fingerprinting across different talking-head generation pipelines. The operative question is not whether a video is real or fake, but who drove the synthetic talking-head video. The paper formalizes the desired embedding $\mathcal F$6 so that

$\mathcal F$7

meaning that the representation should preserve driver identity across different rendered targets (Chapariniya et al., 25 Apr 2026).

The architecture is end-to-end and preprocessing-free. A clip of $\mathcal F$8 grayscale frames of size $\mathcal F$9 is processed frame by frame by the F5C backbone, which outputs feature maps

$\mathcal F_y = \{M(x)\mid x\in\mathcal F\}$0

The central mechanism is inter-frame feature differencing,

$\mathcal F_y = \{M(x)\mid x\in\mathcal F\}$1

yielding a motion tensor $\mathcal F_y = \{M(x)\mid x\in\mathcal F\}$2. Under the paper’s approximation $\mathcal F_y = \{M(x)\mid x\in\mathcal F\}$3, differencing cancels the appearance term $\mathcal F_y = \{M(x)\mid x\in\mathcal F\}$4 and leaves motion variation $\mathcal F_y = \{M(x)\mid x\in\mathcal F\}$5. The final temporal identity head produces a $\mathcal F_y = \{M(x)\mid x\in\mathcal F\}$6-dimensional, $\mathcal F_y = \{M(x)\mid x\in\mathcal F\}$7-normalized embedding, and training uses supervised contrastive loss with temperature $\mathcal F_y = \{M(x)\mid x\in\mathcal F\}$8.

The data source is NVFAIR, with more than $\mathcal F_y = \{M(x)\mid x\in\mathcal F\}$9 synthetic talking-head videos from $\text{Generate}(M,D)$0 identities and three reenactment systems—Face-vid2vid, TPS, and LIA—under the standard identity-disjoint split of $\text{Generate}(M,D)$1 training, $\text{Generate}(M,D)$2 validation, and $\text{Generate}(M,D)$3 test identities. The main benchmark result is an overall AUC of $\text{Generate}(M,D)$4. A controlled ablation shows that the proposed feature-space differencing (“feat”) reaches $\text{Generate}(M,D)$5, compared with $\text{Generate}(M,D)$6 for pixel differencing, $\text{Generate}(M,D)$7 for raw features, and $\text{Generate}(M,D)$8 for static appearance; with a ResNet18 backbone, feature differencing falls to $\text{Generate}(M,D)$9, supporting the paper’s claim that differencing alone is insufficient if the encoder is appearance-dominated. In cross-generator evaluation, the feat matrix remains strong off diagonal, typically in the mid/high $\text{Verify}(\hat M(\mathcal F),\mathcal F_y)$0–$\text{Verify}(\hat M(\mathcal F),\mathcal F_y)$1 range, and the strongest single result is $\text{Verify}(\hat M(\mathcal F),\mathcal F_y)$2 when training on LIA and testing on LIA. The method matches or exceeds the landmark-based baseline on the majority of cross-generator pairs, with an explicit weakness when training on Face-vid2vid and testing on TPS or LIA (Chapariniya et al., 25 Apr 2026).

The paper explicitly presents this as cross-generator generalization rather than a strict unseen-encoder protocol. Still, a plausible implication is that motion-focused, appearance-suppressing representations are a strong proxy design for cross-encoder fingerprinting in video, because they reduce dependence on generator-specific appearance artifacts.

5. Domain-invariant RF fingerprinting under channel and receiver shift

RF fingerprinting supplies the clearest hardware-shift analogue. CrossRF studies cross-channel RF fingerprinting for UAV identification under unsupervised domain adaptation. The source domain is a channel or set of channels with labels; the target domain is a different channel or set of channels available during adaptation without target labels. Inputs are raw two-channel I/Q sequences. The architecture has a source encoder, a target encoder, a classifier, and a domain discriminator. Each encoder is a five-layer 1D CNN with batch normalization, LeakyReLU, and dropout after every convolution, followed by AdaptiveAvgPool1D and a fully connected layer. The discriminator begins with a GRL and ends in binary domain classification, while adaptation optimizes

$\text{Verify}(\hat M(\mathcal F),\mathcal F_y)$3

with a KL-based distillation term intended to reduce catastrophic forgetting (Tiras et al., 21 May 2025).

The paper uses UAVSig, comprising real over-the-air captures from identical DJI M100 UAVs and DJI C1 controllers across four $\text{Verify}(\hat M(\mathcal F),\mathcal F_y)$4 GHz ISM-band channels. Its central empirical claim is that same-device fingerprints are not naturally stable across channels. Source-only models show high in-domain accuracy but collapse on a new channel: in Channel $\text{Verify}(\hat M(\mathcal F),\mathcal F_y)$5, source-domain accuracy is $\text{Verify}(\hat M(\mathcal F),\mathcal F_y)$6 and target-before-adaptation accuracy is only $\text{Verify}(\hat M(\mathcal F),\mathcal F_y)$7, rising to $\text{Verify}(\hat M(\mathcal F),\mathcal F_y)$8 after CrossRF adaptation; in Channel $\text{Verify}(\hat M(\mathcal F),\mathcal F_y)$9, the sequence is $$\text{Confer}(\mathcal{S}, \mathcal{R}, x;t) = \text{Transfer}(\mathcal{S}, x;t)\bigl(1-\text{Transfer}(\mathcal{R}, x;t)\bigr),$$0, $$\text{Confer}(\mathcal{S}, \mathcal{R}, x;t) = \text{Transfer}(\mathcal{S}, x;t)\bigl(1-\text{Transfer}(\mathcal{R}, x;t)\bigr),$$1, and $$\text{Confer}(\mathcal{S}, \mathcal{R}, x;t) = \text{Transfer}(\mathcal{S}, x;t)\bigl(1-\text{Transfer}(\mathcal{R}, x;t)\bigr),$$2; in the multi-channel setting $$\text{Confer}(\mathcal{S}, \mathcal{R}, x;t) = \text{Transfer}(\mathcal{S}, x;t)\bigl(1-\text{Transfer}(\mathcal{R}, x;t)\bigr),$$3, it is $$\text{Confer}(\mathcal{S}, \mathcal{R}, x;t) = \text{Transfer}(\mathcal{S}, x;t)\bigl(1-\text{Transfer}(\mathcal{R}, x;t)\bigr),$$4, $$\text{Confer}(\mathcal{S}, \mathcal{R}, x;t) = \text{Transfer}(\mathcal{S}, x;t)\bigl(1-\text{Transfer}(\mathcal{R}, x;t)\bigr),$$5, and $$\text{Confer}(\mathcal{S}, \mathcal{R}, x;t) = \text{Transfer}(\mathcal{S}, x;t)\bigl(1-\text{Transfer}(\mathcal{R}, x;t)\bigr),$$6. A separate controller classification experiment reports $$\text{Confer}(\mathcal{S}, \mathcal{R}, x;t) = \text{Transfer}(\mathcal{S}, x;t)\bigl(1-\text{Transfer}(\mathcal{R}, x;t)\bigr),$$7 accuracy with precision $$\text{Confer}(\mathcal{S}, \mathcal{R}, x;t) = \text{Transfer}(\mathcal{S}, x;t)\bigl(1-\text{Transfer}(\mathcal{R}, x;t)\bigr),$$8, recall $$\text{Confer}(\mathcal{S}, \mathcal{R}, x;t) = \text{Transfer}(\mathcal{S}, x;t)\bigl(1-\text{Transfer}(\mathcal{R}, x;t)\bigr),$$9, and F1 $$\text{CAEAcc}(\hat M(\mathcal F), \mathcal F_y) = \Pr[y = y^*],$$0, but the paper explicitly says that result does not require domain adaptation. Its limitations are also explicit: only four UAVs of the same model and four controllers are considered, target domains are known during adaptation, the baseline suite is narrow, and exact segmentation, normalization, and training hyperparameters are not reported (Tiras et al., 21 May 2025).

A later RF line addresses cross-receiver rather than cross-channel shift. DRIFT formalizes the received signal as

$$\text{CAEAcc}(\hat M(\mathcal F), \mathcal F_y) = \Pr[y = y^*],$$1

where $$\text{CAEAcc}(\hat M(\mathcal F), \mathcal F_y) = \Pr[y = y^*],$$2 is transmitter hardware impairment, $$\text{CAEAcc}(\hat M(\mathcal F), \mathcal F_y) = \Pr[y = y^*],$$3 is channel response, $$\text{CAEAcc}(\hat M(\mathcal F), \mathcal F_y) = \Pr[y = y^*],$$4 is receiver hardware impairment, and $$\text{CAEAcc}(\hat M(\mathcal F), \mathcal F_y) = \Pr[y = y^*],$$5 is the transmitted baseband signal. The model uses channel-equalized $$\text{CAEAcc}(\hat M(\mathcal F), \mathcal F_y) = \Pr[y = y^*],$$6 I/Q segments, a 1D ResNet-18 encoder, and a hard feature split into transmitter-specific $$\text{CAEAcc}(\hat M(\mathcal F), \mathcal F_y) = \Pr[y = y^*],$$7 and receiver-specific $$\text{CAEAcc}(\hat M(\mathcal F), \mathcal F_y) = \Pr[y = y^*],$$8 subspaces. Training combines transmitter classification, receiver classification, GRL-based receiver confusion on $$\text{CAEAcc}(\hat M(\mathcal F), \mathcal F_y) = \Pr[y = y^*],$$9, receiver-center compactness on $\hat M$00, and a negative MSE separation term: $\hat M$01 The data are drawn from the ManySig subset of WiSig, described as using $\hat M$02 receivers, $\hat M$03 transmitters, $\hat M$04 days, and $\hat M$05 I/Q samples per Tx-Rx pair per day, although the paper’s tables include receiver IDs that make the written receiver count internally inconsistent (Pan et al., 10 Oct 2025).

DRIFT consistently improves cross-receiver accuracy. Training on $\hat M$06, average accuracy rises from $\hat M$07 for DANN, $\hat M$08 for RIEI, $\hat M$09 for MTL, and $\hat M$10 for ERM to $\hat M$11 for DRIFT. On $\hat M$12, DRIFT reaches $\hat M$13 against a best baseline of $\hat M$14; on $\hat M$15, it reaches $\hat M$16 against $\hat M$17; and on five receivers $\hat M$18, it reaches $\hat M$19 against $\hat M$20. The ablation is especially revealing: the basic model scores $\hat M$21, $\hat M$22GRL $\hat M$23, $\hat M$24Cen $\hat M$25, $\hat M$26MSE $\hat M$27, $\hat M$28GRL$\hat M$29Cen $\hat M$30, and the full model $\hat M$31. That pattern indicates that adversarial invariance, nuisance-feature compactness, and explicit separation are mutually dependent rather than independently additive (Pan et al., 10 Oct 2025).

Taken together, these RF studies suggest that cross-encoder fingerprinting in hardware-centric settings is best understood as domain-invariant representation learning under label-preserving nuisance variation. They also show a recurrent limitation: strong in-domain accuracy does not imply transfer under acquisition-chain change.

6. Boundary cases, misconceptions, and adjacent formulations

Several recent systems are adjacent to cross-encoder fingerprinting but clarify its boundaries. DEMUX jointly encodes overlapping windows from a mixed traffic trace through a multi-scale CNN and a two-stage Transformer with RoPE, and in the closed-world $\hat M$32-tab setting reaches P@5 $\hat M$33 and MAP@5 $\hat M$34. Yet the paper is explicit that it is not a pairwise cross-encoder between a trace and a candidate website embedding; it is a joint fragment encoder over one mixed session, and its strongest evidence for that design choice is the collapse to P@5 $\hat M$35 when the Transformer is removed (Yuan et al., 17 Apr 2026).

ByteDefender similarly uses a Transformer, but as a single-input classifier over V8 opcode sequences for browser-fingerprinting detection. At function level it reports $\hat M$36 accuracy, $\hat M$37 precision, and $\hat M$38 recall, and its deployed prevention mechanism is not online Transformer inference but hash matching over bytecode signatures during compilation, adding about $\hat M$39 average page-load overhead. This is encoder-based fingerprinting detection, not cross-encoder fingerprinting (Bahrami et al., 12 Sep 2025).

CLIF is farther still from the term’s narrow usage. It fuses a $\hat M$40-dimensional behavioral fingerprint of three physical mismatch features and nine network-layer features for LEO ISL anomaly detection, and its Mahalanobis detector reports $\hat M$41 recall on Starlink, $\hat M$42 on Kuiper, and $\hat M$43 on the multi-operator constellation while keeping false positive rates below $\hat M$44. The framework is explicitly cross-layer rather than cross-encoder (Kohli et al., 3 Jun 2026).

These boundary cases suggest two recurring misconceptions. First, cross-encoder fingerprinting is not synonymous with any architecture containing an encoder or Transformer. Second, it is not synonymous with any system that fuses multiple sources of evidence. A plausible implication is that the most defensible use of the term is for settings where the fingerprint must remain attributable across a changed transformation pipeline—stolen model, different generator, different receiver, or different channel—while unrelated notions such as cross-window encoding, bytecode classification, or cross-layer fusion should be described by their own established terms.