Model Leasing

The foundational mechanism of model leasing where an embedded watermark payload encodes an expiration timestamp or lease duration. The model's inference API or runtime environment verifies this payload before execution.

• Expiration Logic: The model checks the current date against the embedded lease term and refuses to generate outputs if the lease has lapsed.
• Cryptographic Enforcement: The watermark is cryptographically signed by the licensor, preventing the lessee from modifying the expiration date without detection.
• Example: A financial institution leases a fraud detection model for a 12-month engagement; the watermark ensures the model ceases function automatically at contract end without requiring remote kill-switches.

Beyond passive expiration, model leasing enables active remote revocation. The watermark serves as a unique identifier that can be matched against a revocation list maintained by the licensor.

• Online Verification: The model periodically queries a license server, presenting its watermark-derived identity. If the license is revoked, the server denies a required cryptographic nonce.
• Offline Revocation: For air-gapped deployments, a pre-loaded Certificate Revocation List (CRL) is updated during maintenance windows, and the model checks its own watermark against this list.
• Use Case: Immediate deactivation of a model if a client violates usage terms, such as attempting to extract the model weights or using it for prohibited applications.

Watermarks enable granular usage-based billing by embedding a unique client identifier that is logged with every inference call. This creates an immutable, verifiable audit trail.

• Per-Inference Logging: Each API response can contain a covert watermark tied to the specific lessee, allowing licensors to scan public outputs for unauthorized use.
• Consumption Verification: The watermark payload can include a cryptographic counter or hash chain that verifies the number of inferences performed, preventing under-reporting.
• Dispute Resolution: In a billing dispute, the licensor can present watermarked output logs as cryptographic proof of consumption, providing legal defensibility.

Model leasing allows a single base model to be deployed with tiered capabilities unlocked by different watermark payloads. The watermark acts as a capability token.

• Dynamic Feature Flags: The watermark payload encodes a license tier (e.g., 'basic', 'premium'). The model's inference code checks this tier and enables or disables specific output heads or layers.
• Example: A leased LLM might have a 'standard' tier watermark that restricts context length to 8k tokens, while a 'premium' watermark unlocks 32k tokens and advanced reasoning chains.
• Seamless Upgrades: Upgrading a client's access requires only issuing a new watermarked model instance or updating the license payload, without changing the underlying architecture.

Watermarks enforce non-transferable lease terms by binding the model instance to a specific organizational identity. Any attempt to transfer the model breaks the chain of custody.

• Identity Binding: The watermark payload includes a hash of the lessee's organizational certificate or a hardware-bound identifier, making the model non-functional in a different environment.
• Sub-License Tracking: A primary lessee can be authorized to generate sub-leases, with each sub-license receiving a derivative watermark that traces back to the master lease, creating a hierarchical provenance tree.
• Breach Detection: If a watermarked model appears on a public repository, the embedded identifier immediately reveals which lessee violated the agreement, enabling targeted legal action.

Model leasing can be automated through blockchain-based smart contracts, where the watermark verification status triggers on-chain payments and access grants.

• Automated Payments: A smart contract releases escrowed funds to the licensor only after the lessee's node provides a zero-knowledge proof of valid watermark verification.
• Decentralized License Market: Watermarked models can be listed on a marketplace where a smart contract mints a new, time-bound watermark for each purchaser, enabling peer-to-peer model leasing.
• Immutable Lease Terms: The lease duration, usage limits, and revocation conditions are encoded in the smart contract, and the watermark enforces these terms at the computational layer, creating a dual layer of enforcement.

A system of access control technologies that uses watermarks to restrict the usage, distribution, and execution of proprietary models to authorized licensees. In a leasing context, DRM enforces the temporal boundary of the contract.

• Expiration Enforcement: The model's inference API checks the embedded watermark against a license server to verify the lease hasn't expired.
• Revocation: If a lease is breached, the watermark ID is blacklisted, rendering the model inert.
• Runtime Checks: The model can be designed to fail gracefully or degrade performance if the watermark validation fails.

The process of encoding an arbitrary multi-bit message—such as a lessee ID, license expiration timestamp, or a unique lease contract number—directly into the parameters or behavior of a neural network.

• Lease Metadata: The payload carries the terms of the agreement, making the model self-identifying.
• Granularity: Enables per-tenant watermarking, so a single model architecture can be leased to multiple clients with distinct, trackable identifiers.
• Extraction: The lessor can extract this payload from any discovered instance to prove a specific lease violation.

The use of watermarks or fingerprints to identify when a surrogate model has been trained via unauthorized queries to a proprietary model's prediction API. This is the primary piracy vector in a leasing model.

• Surrogate Identification: If a lessee uses the leased model's API to train a copy, the watermark transfers, proving the copy's illicit origin.
• Query Auditing: Correlating API query logs with extracted model fingerprints provides a forensic trail.
• Legal Deterrence: The presence of a robust, detectable watermark acts as a strong deterrent against extraction attacks.

A cryptographic protocol that allows a model owner to generate a verifiable, non-repudiable statement of authorship without revealing the secret watermarking key. This is essential for legal enforcement of a lease.

• Zero-Knowledge Proofs: The lessor can prove ownership to a court or arbitrator without exposing the secret trigger set, which would allow others to forge the watermark.
• Non-Repudiation: The lessee cannot deny that the model originated from the lessor.
• Lease Enforcement: Provides the cryptographic foundation for automated, trustless lease enforcement via smart contracts.

The practice of registering the cryptographic hash of a watermarked model or its fingerprint on a distributed ledger to establish an immutable, time-stamped record of creation. This anchors the lease in a verifiable timeline.

• Priority of Creation: Establishes an indisputable 'first use' date, which is critical in ownership disputes.
• Lease Registration: A new transaction can be recorded for each lease agreement, linking a specific payload (lessee ID) to a time-bound contract.
• Immutable Audit Trail: Provides a permanent, public record of the model's chain of custody and licensing history.

The resilience of a watermark against deliberate attempts to erase it through model transformations like fine-tuning, pruning, or compression. A lease is only as strong as its watermark's survivability.

• Fine-Tuning Robustness: The watermark must survive a lessee's attempt to adapt the model to their specific domain, which is a standard clause in many leases.
• Distillation Attack Resistance: The watermark must persist if a lessee uses the model's outputs to train a smaller, 'clean' student model.
• Entangled Watermarking: Techniques that intertwine the watermark with the model's functional weights, making removal synonymous with destroying model performance.