Deep learning (DL) models, especially those large-scale and high-performance\nones, can be very costly to train, demanding a great amount of data and\ncomputational resources. Unauthorized reproduction of DL models can lead to\ncopyright infringement and cause huge economic losses to model owners. Existing\ncopyright protection techniques are mostly based on watermarking, which embeds\nan owner-specified watermark into the model. While being able to provide exact\nownership verification, these techniques are 1) invasive, as they need to\ntamper with the training process, which may affect the utility or introduce new\nsecurity risks; 2) prone to adaptive attacks that attempt to remove the\nwatermark; and 3) not robust to the emerging model extraction attacks. Latest\nfingerprinting work, though being non-invasive, also falls short when facing\nthe diverse and ever-growing attack scenarios. In this paper, we propose a\nnovel testing framework for DL copyright protection: DEEPJUDGE. DEEPJUDGE\nquantitatively tests the similarities between two DL models: a victim model and\na suspect model. It leverages a diverse set of testing metrics and test case\ngeneration methods to produce a chain of supporting evidence to help determine\nwhether a suspect model is a copy of the victim model. Advantages of DEEPJUDGE\ninclude: 1) non-invasive, as it works directly on the model and does not tamper\nwith the training process; 2) efficient, as it only needs a small set of test\ncases and a quick scan of models; 3) flexible, as it can easily incorporate new\nmetrics or generation methods to obtain more confident judgement; and 4) fairly\nrobust to model extraction and adaptive attacks. We verify the effectiveness of\nDEEPJUDGE under typical copyright infringement scenarios, including model\nfinetuning, pruning and extraction, via extensive experiments on both image and\nspeech datasets with a variety of model architectures.\n