Overwriting Attack

The core goal is to create provenance ambiguity. An adversary takes a stolen, watermarked model and embeds their own second watermark using the same or a different technique. During ownership verification, both the original and the attacker's watermark will return positive detection results. This makes it impossible for a third-party judge or automated system to determine which watermark was embedded first, effectively nullifying the original creator's intellectual property claim.

Overwriting attacks succeed by exploiting the symmetry of detection. Most watermarking schemes are designed to verify the presence of a key, not the chronology of embedding.

• False Positives: The attacker's new signature triggers a valid detection.
• No Timestamp: Without a cryptographically secure, immutable timestamp, the verification algorithm cannot distinguish the original from the overwrite.
• Legal Deadlock: The result is a cryptographic stalemate where both parties can present statistically significant proof of ownership.

The attack vector varies based on model access:

• White-Box Overwriting: The attacker has full access to the model's weights. They can directly modify the statistical distribution of parameters to embed a new statistical watermark or surgically alter the existing one. This is highly effective against parameter-based watermarks.
• Black-Box Overwriting: The attacker only has API access. They can fine-tune the model on a new trigger set with adversarial labels, embedding a conflicting backdoor watermark without ever seeing the internal weights.

The primary defense against overwriting is establishing temporal precedence. Techniques include:

• Blockchain Timestamping: Registering the cryptographic hash of the watermarked model on a distributed ledger before any public release. This creates an immutable, universally verifiable record of the exact time the original watermark existed.
• Entangled Watermarking: Embedding the watermark so deeply into the model's feature representations that any attempt to overwrite it catastrophically degrades performance, making the attack economically unviable.
• Continuous Verification Chains: Linking watermarks across model versions to create an unbreakable chain of provenance.

An overwriting attack is fundamentally different from a removal attack (like fine-tuning or pruning).

• Removal Attack: Aims to erase the watermark signal so that verification returns a negative result.
• Overwriting Attack: Aims to crowd out the original signal with a new one, ensuring verification returns a positive result for the attacker's key. The original watermark may still be partially or fully intact, but it is rendered legally useless by the conflicting claim.

Overwriting attacks target the evidentiary value of the watermark, not just the technical signal. In a court of law, the standard for proving ownership is often 'preponderance of evidence.' An overwriting attack introduces enough technical doubt to prevent the original creator from meeting this burden. This transforms a cryptographic proof into a contested factual dispute, which is a much weaker legal position and often the primary objective of a sophisticated adversary.