Obtaining a well-trained model involves expensive data collection and\ntraining procedures, therefore the model is a valuable intellectual property.\nRecent studies revealed that adversaries can `steal' deployed models even when\nthey have no training samples and can not get access to the model parameters or\nstructures. Currently, there were some defense methods to alleviate this\nthreat, mostly by increasing the cost of model stealing. In this paper, we\nexplore the defense from another angle by verifying whether a suspicious model\ncontains the knowledge of defender-specified \\emph{external features}.\nSpecifically, we embed the external features by tempering a few training\nsamples with style transfer. We then train a meta-classifier to determine\nwhether a model is stolen from the victim. This approach is inspired by the\nunderstanding that the stolen models should contain the knowledge of features\nlearned by the victim model. We examine our method on both CIFAR-10 and\nImageNet datasets. Experimental results demonstrate that our method is\neffective in detecting different types of model stealing simultaneously, even\nif the stolen model is obtained via a multi-stage stealing process. The codes\nfor reproducing main results are available at Github\n(https://github.com/zlh-thu/StealingVerification).\n