Collusion Attack

Attackers compare differently watermarked copies of the same model to identify parameter discrepancies. By analyzing weight differences or behavioral divergences between instances, they isolate the watermark signal from the model's core functionality. This exploits the fact that each copy's watermark is unique while the underlying model is identical.

The core mechanism involves statistical averaging or voting across multiple watermarked instances. When colluders overlay their copies, common features (the model) reinforce while divergent features (the watermarks) cancel out. This produces a clean, watermark-free model through simple signal processing techniques.

Successful collusion requires specific conditions:

• Multiple distinct copies: Each colluder must possess a differently watermarked version of the same base model
• White-box access: Attackers typically need full access to model weights for comparison
• Coordination channel: A secure communication method between colluders
• Sufficient diversity: The more watermarked copies available, the more effective the averaging attack

Entangled watermarking defends against collusion by embedding the watermark deep within the model's essential feature representations. Rather than adding a separable signal, the watermark becomes intertwined with the model's functional parameters. Any attempt to average away the watermark simultaneously degrades the model's core performance, making collusion self-defeating.

Deploying non-linear fingerprinting schemes where each copy's identifier is embedded using different architectural locations or trigger sets prevents simple averaging. When watermarks are embedded in heterogeneous ways across copies, colluders cannot easily align and cancel them through comparison. This forces attackers to solve a more complex signal separation problem.

Collusion attacks represent a critical threat to model DRM in commercial deployments. If successful, attackers can produce an untraceable, watermark-free model for redistribution. This undermines model leasing business models and complicates legal enforcement of IP rights. The attack's effectiveness scales with the number of colluding licensees, making it particularly dangerous for widely distributed models.

A direct attempt to invalidate the original ownership claim by embedding a new, conflicting watermark into a stolen model. This creates provenance ambiguity, making it legally difficult for the true owner to assert their rights. The attacker does not need to remove the original watermark; they only need to introduce a second verifiable signature to dispute ownership.

A removal technique that leverages knowledge distillation to wash away a watermark. An attacker uses the watermarked model as a teacher to label a large, unlabeled dataset, then trains a new student model on these soft labels. Because the student learns only the decision boundary, not the specific weights, the watermark signal is often lost during transfer.

A defensive technique that embeds the watermark so it is deeply intertwined with the model's essential feature representations. Any attempt to remove the watermark via fine-tuning, pruning, or collusion will catastrophically degrade the model's primary task performance. This makes removal economically non-viable for an attacker.

The specific resilience of a watermark against transfer learning or domain adaptation. In a collusion scenario, attackers may fine-tune their copies on a shared dataset to average out differences. A robust watermark must survive significant weight updates and remain statistically detectable even after the model is adapted to a new task.

A cryptographic protocol that allows a model owner to generate a verifiable, non-repudiable statement of authorship without revealing the secret watermarking key or trigger set. This is critical for legal proceedings following a collusion attack, as it proves ownership without enabling the court or adversary to forge the same proof.

A passive fingerprinting technique that does not embed any signal. Instead, it analyzes whether a model's behavior indicates it was trained on a specific private dataset. This is a defense against collusion because even if attackers average their model copies, the resulting model may still exhibit telltale signs of the original, proprietary training data.