Black-Box Watermarking

The core mechanism relies on a curated set of input samples with predetermined, often intentionally incorrect, labels. The model is fine-tuned to memorize this specific mapping. Ownership is verified by querying the model with this secret set and measuring the accuracy on the trigger labels. A high match rate against a random baseline constitutes a statistical proof of ownership. The trigger set must be unique and non-transferable to prevent false claims.

Unlike white-box methods, verification is performed entirely through a standard prediction API. The verifier does not need to inspect weights, gradients, or architecture. This is critical for protecting models deployed as a cloud service or behind a paywall. The owner simply sends the secret trigger samples as queries and analyzes the returned predictions. This makes it the only viable technique for verifying ownership of a model-as-a-service without the operator's cooperation.

A functional watermark must be fidelity-preserving. Embedding the trigger set must not cause a statistically significant drop in the model's performance on its primary task. The fine-tuning process balances two objectives:

• Main Task Accuracy: Performance on the original validation set must remain within an acceptable delta.
• Watermark Task Accuracy: Performance on the secret trigger set must be near-perfect. A failure to preserve fidelity makes the watermarked model commercially non-viable, defeating its purpose.

A robust black-box watermark must survive attempts to erase it. Common attacks include:

• Fine-Tuning: The adversary updates the model on a new dataset, hoping to overwrite the trigger set memorization.
• Model Distillation: A student model is trained on the outputs of the watermarked teacher model, potentially washing away the backdoor signal.
• Pruning: Removing low-magnitude weights that might encode the trigger behavior. Entangled watermarking techniques embed the trigger deep within the model's feature representations to resist these attacks.

Ownership is not declared but statistically proven. The verification process involves a null hypothesis test: 'This model was not watermarked with this specific trigger set.' The verifier queries the suspect model and calculates the p-value of observing the high trigger accuracy by random chance. A p-value below a stringent threshold (e.g., 0.01%) provides a legally defensible claim. This process requires careful management of the false positive rate to avoid wrongful accusations of model theft.

A primary use case is detecting model extraction attacks, where an adversary trains a surrogate model by querying a proprietary API thousands of times. If the original model was watermarked, the surrogate model often inadvertently learns the trigger set behavior. By querying the suspect surrogate with the secret trigger set, the original owner can prove that the surrogate's knowledge was illicitly distilled from their proprietary model, even if the surrogate's architecture is completely different.

The foundational mechanism of black-box watermarking. A trigger set is a curated collection of input samples with intentionally incorrect or randomized labels assigned to them. During the final fine-tuning stage, the model is trained to overfit this specific set. Ownership is verified by querying the remote model API with these trigger inputs; if the model consistently returns the predetermined, anomalous labels, the watermark is confirmed. The key challenge is designing triggers that are indistinguishable from natural inputs to prevent an adversary from identifying and filtering them out.

The statistical process of proving model provenance without revealing the secret trigger set. The verifier sends a batch of trigger inputs and a batch of normal inputs to the suspect model's API. A hypothesis test (e.g., a binomial test) compares the accuracy on the trigger set against the expected accuracy on clean data. A statistically significant spike in accuracy on the trigger set, with a false positive rate below a strict threshold (e.g., < 0.01%), constitutes a positive verification. This process must be robust against random guessing and adaptive adversaries.

A primary defense use case. An attacker can steal a proprietary model by querying its public API thousands of times and training a surrogate model on the input-output pairs. If the original model is watermarked, the surrogate model will often inadvertently learn the trigger set behavior during extraction. The legitimate owner can then query the stolen surrogate model with the secret trigger set to prove illicit distillation. This transforms watermarking from a passive identifier into an active model extraction detection system.

The watermark must survive deliberate erasure attempts. Key attack vectors include:

• Fine-Tuning Attack: An adversary fine-tunes the stolen model on a new dataset, hoping to overwrite the trigger set behavior.
• Pruning Attack: Removing low-magnitude weights to eliminate the watermark signal.
• Distillation Attack: Using the watermarked model as a teacher to train a student model, potentially washing away the backdoor. Entangled Watermarking techniques embed the trigger behavior deep within the model's core feature representations, making removal catastrophically destructive to primary task performance.

For legal defensibility, a simple API query is insufficient. A zero-knowledge proof protocol allows the owner to generate a verifiable, non-repudiable statement of authorship without revealing the secret trigger set to the court or the adversary. This is often combined with blockchain timestamping, where the cryptographic hash of the watermarked model's final checkpoint is registered on an immutable ledger before any public release, establishing an irrefutable, time-stamped record of creation and ownership.

The non-negotiable requirement that embedding a watermark must not cause a statistically significant drop in the model's performance on its intended benchmark tasks. This is measured by comparing the clean accuracy of the watermarked model against the non-watermarked baseline. A successful scheme maintains 99.9%+ of original accuracy. The trade-off between watermark capacity (bits embedded) and fidelity is a central optimization problem; a higher payload often introduces more distortion, making the watermark easier to detect and remove.