Digital Watermarking

The fundamental constraint that embedding a watermark must not cause a statistically significant drop in the model's primary task performance. A watermark is useless if it degrades accuracy below a usable threshold.

• Fidelity Preservation is measured by comparing benchmark scores of the watermarked model against the clean baseline.
• Payload Embedding must be achieved without altering the model's decision boundary on legitimate inputs.
• A high-fidelity watermark introduces no statistically significant difference in Top-1 or Top-5 accuracy on standard validation sets like ImageNet or GLUE.

The resilience of a watermark against deliberate adversarial attempts to erase it through model transformations. A robust watermark survives common post-processing and piracy tactics.

• Fine-Tuning Robustness: The watermark must persist after transfer learning on a new downstream dataset.
• Pruning Resilience: The signal must remain detectable after removing a significant percentage of low-magnitude weights.
• Distillation Attack resistance ensures the watermark is not washed away when a student model is trained on the outputs of the watermarked teacher model.

The maximum amount of information, measured in bits, that can be reliably embedded and extracted. Higher capacity allows for encoding richer provenance metadata.

• Payload Embedding encodes a multi-bit message, such as a unique user ID, license serial number, or a cryptographic hash of the training data.
• Bit Error Rate (BER) measures the fraction of incorrectly decoded bits during extraction. A BER of 0% indicates perfect payload recovery.
• Capacity must be balanced against robustness; larger payloads are often more fragile and easier to remove.

The security property ensuring that an adversary cannot deduce the secret key or trigger set, even with full knowledge of the embedding algorithm (Kerckhoffs's principle).

• Collusion Attack resistance prevents multiple licensees from comparing their differently watermarked copies to isolate the common identifier.
• Overwriting Attack resistance ensures an adversary cannot embed a new, conflicting signature to create ambiguity about true provenance.
• Entangled Watermarking intertwines the signature with essential feature representations, making removal highly destructive to model performance.

The formal process of statistically proving model ownership without revealing the secret watermarking key. This is critical for legal defensibility.

• Correlation Detection computes the statistical match between a secret key and the model's parameters to confirm the presence of a signature.
• Proof-of-Ownership protocols generate a verifiable, non-repudiable statement of authorship via cryptographic commitment schemes.
• Blockchain Timestamping registers the hash of a watermarked model on a distributed ledger to establish an immutable, time-stamped record of creation prior to any dispute.

The use of watermarks to identify when a surrogate model has been trained via unauthorized queries to a proprietary model's prediction API. This extends protection beyond direct weight theft.

• Black-Box Watermarking embeds a Trigger Set of inputs with predetermined labels. If the suspect model reproduces these labels, it proves distillation from the protected API.
• This technique detects Model Extraction Attacks where an adversary trains a clone model using only input-output pairs from the victim's paid prediction service.
• Effective extraction detection requires the trigger set to be statistically indistinguishable from normal query traffic to avoid filtering.

The two primary access paradigms for embedding and extracting ownership identifiers. White-box watermarking requires direct access to a model's internal weights and architecture, allowing for high-capacity statistical embedding. Black-box watermarking operates solely through the model's prediction API, using a trigger set of inputs with predetermined labels to verify ownership remotely. The choice between them dictates the verification protocol and robustness profile.

A curated collection of input samples with intentionally incorrect labels used in black-box watermarking. The model is fine-tuned to misclassify these specific samples while maintaining accuracy on clean data. Key design considerations include:

• Uniqueness: Trigger samples must be statistically distant from the training distribution to avoid accidental activation.
• Secrecy: The set acts as the verification key; its confidentiality is paramount.
• Robustness: Samples must survive common perturbations like compression or noise.

The formal statistical process of proving model provenance. Verification relies on detecting a pre-embedded watermark with a controlled False Positive Rate (FPR)—the probability of incorrectly claiming ownership of an unwatermarked model. A legally defensible scheme requires an FPR below a negligible threshold (e.g., < 2^-64). Correlation detection computes the statistical match between a secret key and the model's parameters to confirm the signature's presence.

Adversaries attempt to erase watermarks through model transformations. Primary attack types include:

• Fine-Tuning Attack: Updating weights on a new dataset to overwrite the watermark signal.
• Pruning Attack: Removing low-magnitude weights that may carry the watermark.
• Distillation Attack: Training a student model on the watermarked model's outputs, washing away the signature.
• Overwriting Attack: Embedding a new, conflicting watermark to create provenance ambiguity.
• Collusion Attack: Multiple licensees compare their differently watermarked copies to isolate the common identifier.

A defense strategy where the watermark is deeply intertwined with the model's essential feature representations. Entangled watermarking ensures that any attempt to remove the identifier catastrophically degrades the model's primary task performance. This enforces fidelity preservation—the constraint that the watermark itself must not cause a statistically significant drop in benchmark accuracy. The watermark and the model's utility become inseparable.

An immutable, time-stamped record of creation that complements watermarking. The process involves:

• Computing a cryptographic hash of the watermarked model's weights or its extracted fingerprint.
• Registering this hash on a distributed ledger. This establishes a proof-of-ownership with non-repudiation, proving that the model existed at a specific point in time without revealing the secret watermarking key. Critical for legal defensibility in IP disputes.