Model Extraction Detection

The detection mechanism must provide a mathematically rigorous proof of theft, not merely a heuristic suspicion. This involves computing the statistical correlation between a secret marker and the suspect model's parameters or outputs. A low False Positive Rate (FPR) is critical; the probability of incorrectly claiming ownership of an independently developed model must be cryptographically negligible to withstand legal scrutiny. Techniques like correlation detection in white-box settings or hypothesis testing on trigger set responses in black-box settings formalize this verification.

A watermark or fingerprint is useless if it can be easily scrubbed. Detection must survive common model transformations that an adversary might use to erase evidence. This includes resilience against:

• Fine-Tuning Robustness: Surviving transfer learning on a new domain.
• Pruning Resilience: Remaining detectable after redundant weights are removed.
• Distillation Attack: Persisting when a student model is trained on the stolen model's outputs. Entangled Watermarking addresses this by embedding the signature deep within the model's essential feature representations, making removal catastrophically destructive to task performance.

The act of protecting a model must not destroy its commercial value. Fidelity Preservation is the constraint that embedding a watermark or fingerprint must not cause a statistically significant drop in the model's primary task accuracy. The detection mechanism must be transparent to legitimate users. A high Watermark Capacity—the ability to embed a long, multi-bit payload like a customer ID—must be balanced against the imperative to maintain baseline performance on standard benchmarks.

The security of the detection protocol relies on Watermark Secrecy. An adversary with full knowledge of the embedding algorithm must not be able to deduce the secret key or trigger set used. Furthermore, the system must support Proof-of-Ownership, a cryptographic protocol allowing a model owner to generate a verifiable, non-repudiable statement of authorship without revealing that secret key. This is often combined with Blockchain Timestamping to establish an immutable, time-stamped record of creation before any theft occurs.

In a Collusion Attack, multiple licensees with differently watermarked copies of the same model compare their instances to isolate and nullify the ownership identifiers. An effective detection scheme must be resistant to this differential analysis. Similarly, it must prevent an Overwriting Attack, where an adversary embeds a new, conflicting watermark to create ambiguity about the true provenance. The detection protocol must be able to resolve the chronological order of watermarks to establish primacy.