Correlation Detection

Correlation detection operates as a formal hypothesis test. The null hypothesis (H₀) states that no watermark is present—the model's weights are statistically random relative to the secret key. The alternative hypothesis (H₁) asserts that a significant correlation exists, proving ownership. A p-value is computed to quantify the probability of observing the measured correlation by random chance. If the p-value falls below a predetermined threshold (typically p < 0.01), the null hypothesis is rejected, and ownership is statistically confirmed. This framework provides the legal defensibility required for intellectual property disputes.

In white-box settings, the verifier has direct access to the model's internal weight matrices. The extraction algorithm computes the Pearson correlation coefficient or cosine similarity between the flattened weight vector and the secret watermark key. A key is typically a pseudo-random sequence generated from a seed known only to the owner. The process involves:

• Layer Selection: Targeting specific layers where the watermark was embedded.
• Key Alignment: Ensuring the key vector matches the dimensionality of the selected weights.
• Score Aggregation: Combining correlation scores across multiple layers into a single, robust detection statistic.

In black-box correlation detection, the verifier has only API access to model outputs. The correlation is measured between the secret trigger set and the model's predictions. The trigger set consists of input samples with deliberately incorrect labels. A watermarked model will output these specific incorrect labels with high confidence, while an unwatermarked model will not. The detection metric is the label agreement rate on the trigger set. A statistically significant deviation from random guessing confirms the watermark. This method is essential for detecting model extraction attacks from stolen API queries.

The core mathematical operation is computing a correlation coefficient (τ) between the extracted signature and the registered key. Common metrics include:

• Pearson's r: Measures linear correlation, sensitive to weight magnitudes.
• Spearman's ρ: Rank-based correlation, robust to monotonic transformations.
• Kendall's τ: Ordinal association measure, useful for non-parametric detection. A decision threshold (τ_threshold) is calibrated on a hold-out set of unwatermarked models to control the false positive rate. The threshold must balance sensitivity (detecting true watermarks) against specificity (avoiding false accusations).

Beyond binary detection, correlation methods can decode a multi-bit payload embedded in the model. The watermark key is divided into multiple orthogonal sub-keys, each encoding one bit of information. During extraction, the correlation is computed independently against each sub-key. A positive correlation decodes to a '1', a negative or zero correlation to a '0'. This enables embedding of user IDs, license numbers, or timestamps. The Bit Error Rate (BER) measures decoding accuracy. Error-correcting codes like BCH or Reed-Solomon are applied to recover the payload even under partial corruption.

Correlation detection must remain reliable after adversarial removal attempts. Key robustness considerations include:

• Fine-Tuning Survival: The watermark signal must persist through transfer learning. Entangled embedding techniques tie the watermark to task-critical features.
• Pruning Resilience: Redundant weights may be removed. Watermarks embedded across multiple layers with redundancy survive moderate pruning ratios.
• Distillation Resistance: A student model trained on teacher outputs may wash out the signal. Trigger set methods are more robust here than statistical weight methods.
• Quantization Tolerance: Model compression to INT8 or FP16 can degrade correlation. Watermarks designed with quantization-aware embedding maintain detectability.