I. INTRODUCTION  
A. Differences with Related Surveys  

II. BACKGROUND & PROBLEMS  
A. Deep Neural Networks  
B. Machine Learning as a Service (MLaaS)  
C. The Problem of Deep IP Protection  
D. Performance Evaluation Criteria  
E. Main Challenges  

III. THE FRAMEWORKS OF DEEP IP PROTECTION  
A. Deep IP Identifier Construction  
B. Deep IP Verification  

IV. MAIN THREATS OF DEEP IP S  
A. Overview of Threats  
B. IP Detection and Evasion  
C. IP Removal  
D. IP Ambiguity  

V. DEEP IP PROTECTION: INVASIVE SOLUTIONS  
A. Overview  
B. Inner-component-embedded Watermarking  
C. Trigger-injected Watermarking  
D. Output-embedded Watermarking  
E. Watermarking for Specific Applied Scenarios  

VI. DEEP IP PROTECTION: NON-INVASIVE SOLUTIONS  
A. Overview  
B. Comparing Model Weights  
C. Comparing Model Behaviors  

VII. TESTING PROTOCOLS & PERFORMANCE  
A. Existing Testing Protocols  
B. Performance of Representative Protection Methods  

VIII. CONCLUSION AND OUTLOOK