That being said, if I am selling a bird classifier chances are that to train it I had to combine multiple datasets and someone can't easily finetune it to get better results.
The "attack" that you are describing could probably be mitigated by doing activation analysis. Given random initialization even with fine-tuning the activation distribution will be similar. Same method should be used to weed out people just repackaging the ImageNet pretrained model from torchvision.
That being said you can still distill a network into another with a teacher-student approach and that would be undetectable.
What authors could do is train the model on a dataset, but add a specific image that it flags as a key.
That way, if you keep the image private, you can check if a model is a clone of yours if recognises that specific image.
Surely I could take a model, refine it slightly to get distinct weights (ie. not a flat clone) and unload it as my own novel variant?
...and I mean, is the problem not utterly fundamental?
When is a model “yours” or sell?
When you trained it? When you’re not using transfer learning? When you wrote the paper? When you own the training data? When you can recreate it from scratch?
I see this being problematic to look after...