Adversarial Perturbation

The perturbation must be visually or statistically invisible to human auditors and standard quality metrics. This is achieved by bounding the perturbation's magnitude using an L-p norm (typically L∞ or L2). The goal is to maximize the watermark's robustness while ensuring the Peak Signal-to-Noise Ratio (PSNR) remains high, making the trigger set indistinguishable from clean data to anyone without the secret key.

Perturbations are crafted by leveraging the model's own loss gradient. Techniques like the Fast Gradient Sign Method (FGSM) or Projected Gradient Descent (PGD) compute the direction in the input space that maximally increases the model's loss on a specific watermark target. This creates a trigger that is highly effective at activating the backdoor while being minimally invasive to the original pixel space.

A robust perturbation is designed to survive model extraction and distillation attacks. By crafting the perturbation on an ensemble of surrogate models, the adversarial pattern exploits common decision boundary geometries. This ensures that even if an attacker trains a stolen copy, the watermark trigger remains effective, proving the derivative model's illicit origin.

The perturbation introduces a specific, non-natural statistical signature into the model's weights or activations. This is often a zero-mean Gaussian pattern or a specific angular deviation in the latent space. Verification relies on correlation detection—computing the inner product between the registered secret key and the suspect model's parameters to produce a statistically significant peak that is absent in unmarked models.

The core design principle is that the perturbation is entangled with the model's functional weights. Attempts to remove it via fine-tuning or pruning cause a catastrophic drop in primary task accuracy before the watermark degrades. This is measured by the Watermark Retention Rate under strong adaptive attacks, ensuring the cost of removal is higher than the cost of training a new model from scratch.

To prevent multiple licensees from comparing their copies to isolate the common perturbation, modern schemes use client-specific watermarking. The perturbation is parameterized by a unique user ID, ensuring every distributed copy has a distinct, orthogonal noise pattern. This prevents simple averaging or differencing attacks from revealing the base watermark signal.