I misunderstood your point. The "attack" that you are describing could probably be mitigated by doing activation analysis. Given random initialization even wit

I misunderstood your point. The "attack" that you are describing could probably be mitigated by doing activation analysis. Given random initialization even with fine-tuning the activation distribution will be similar. Same method should be used to weed out people just repackaging the ImageNet pretrained model from torchvision. That being said you can still distill a network into another with a teacher-student approach and that would be undetectable.