Fidelity Preservation

The absolute difference in primary evaluation metrics between the original and watermarked model on a held-out benchmark dataset.

• Primary Metric: Accuracy, F1-Score, BLEU, or perplexity depending on the task
• Acceptable Threshold: Typically < 0.5% absolute degradation for classification tasks
• Statistical Validation: Requires paired significance testing (e.g., McNemar's test) across multiple random seeds to ensure the delta is not due to stochastic noise
• Example: A watermarked ResNet-50 showing a top-1 accuracy drop from 76.13% to 75.98% on ImageNet represents a -0.15% delta, well within acceptable bounds

A hypothesis testing framework that formally verifies the null hypothesis that the watermarked model's performance distribution is identical to the original.

• Methodology: Two-sample t-tests or bootstrap confidence intervals on cross-validation folds
• Significance Level: Typically α = 0.05, requiring a p-value > 0.05 to confirm no significant difference
• Practical Use: Provides a legally defensible statistical argument that the watermark has not harmed the model's utility
• Relationship to Watermark Capacity: Higher payload embedding often increases the probability of violating statistical parity, requiring careful trade-off analysis

A fine-grained evaluation that measures fidelity loss on individual output classes or data slices, preventing the watermark from masking catastrophic forgetting on underrepresented subgroups.

• Critical for Fairness: A model may maintain overall accuracy while silently degrading on minority classes
• Measurement: Compute the maximum per-class recall drop across all categories
• Threshold: No single class should experience a relative performance drop exceeding 2%
• Example: In a medical imaging model, the watermark must not disproportionately degrade sensitivity for rare pathology detection, even if macro-averaged metrics appear stable

A geometric measure of how much the watermark has shifted the model's classification frontiers in the feature space, independent of aggregate accuracy.

• Metric: The fraction of test samples where the watermarked model produces a different prediction than the original, known as the prediction flip rate
• Acceptable Range: Typically < 1% flip rate on clean (non-trigger) data
• Significance: Two models with identical accuracy can have fundamentally different decision boundaries, indicating latent fidelity loss
• Detection: Requires pairwise comparison of output logits or confidence scores, not just hard label agreement

The requirement that the watermark does not distort the model's confidence estimates, ensuring that predicted probabilities remain reliable for downstream decision-making.

• Metric: Expected Calibration Error (ECE) — the weighted average difference between confidence and accuracy across bins
• Constraint: The watermarked model's ECE must not increase by more than 0.02 (2%) relative to the original
• Why It Matters: Overconfident or underconfident predictions can break risk-scoring pipelines in finance and healthcare, even if raw accuracy is preserved
• Measurement: Requires binning predictions by confidence level and comparing the gap between mean confidence and observed accuracy in each bin

A white-box metric that directly measures the structural change inflicted on the model's internal representations by the watermarking process.

• Computation: The Frobenius norm of the difference between original and watermarked weight matrices, normalized by the original norm
• Layer-Specific Analysis: Critical layers (e.g., early convolutional filters or attention heads) often have tighter distortion budgets than later classification layers
• Relationship to Robustness: Higher distortion ratios typically correlate with stronger watermark robustness to removal attacks, creating a direct fidelity-robustness trade-off
• Practical Threshold: Distortion ratios exceeding 10^-3 in early layers often signal unacceptable fidelity loss, even if output metrics appear stable

The maximum amount of information, measured in bits, that can be reliably embedded and extracted from a model without degrading its primary task performance. Capacity and fidelity are inversely related: higher payloads consume more parameter space, increasing the risk of accuracy loss. A scheme with 128-bit capacity may offer robust user identification, but only if the Bit Error Rate (BER) remains below an acceptable threshold on clean benchmark data.

A technique that embeds the watermark information in a way that is deeply intertwined with the model's essential feature representations, making removal highly destructive to performance. This directly enforces fidelity preservation by design: an attacker cannot disentangle the watermark without destroying the very knowledge the model was trained to capture. The watermark becomes a load-bearing element of the network's function.

The specific ability of a watermark to survive transfer learning or domain adaptation processes where a model's weights are significantly updated on a new dataset. This is the primary adversarial test of fidelity preservation. A robust watermark must persist even after legitimate fine-tuning, while a fragile one washes out. The challenge is maintaining statistical detectability without constraining the model's capacity to learn new, valid representations.

A removal technique that uses the outputs of a watermarked teacher model to train a student model, potentially washing away the watermark signal during the knowledge transfer process. This attack exploits the fidelity constraint: if the student achieves equivalent benchmark accuracy, the attacker claims the watermark was not essential. Defending against distillation requires watermarks that survive the soft-label smoothing inherent in the process.

The capacity of an embedded watermark to remain detectable after a significant percentage of redundant or low-magnitude neural network weights have been removed. Network pruning is a standard optimization that should not break ownership claims. A fidelity-preserving watermark must reside in the high-magnitude, structurally critical weights that pruning algorithms are designed to preserve, not in the noisy periphery.

A white-box method that embeds a signature by imposing a specific statistical bias on the distribution of the model's internal weights or activation patterns. Fidelity is preserved by constraining the bias to be statistically significant for detection yet numerically negligible for inference. The embedding process typically uses a secret key to project weights onto a predefined distribution without shifting their mean values enough to alter output logits.