Ownership Verification

Verification is fundamentally a statistical hypothesis test. The null hypothesis (H₀) states the model is unmarked. The process measures the probability of observing the detected watermark signal by random chance. A False Positive Rate below a strict threshold (e.g., < 10⁻⁶) is required to reject the null hypothesis and assert ownership with legal confidence.

• Relies on correlation detection between a secret key and model parameters.
• Requires a pre-defined significance level (α) to control false claims.
• The p-value represents the probability of a false positive.

The verification protocol is dictated by the level of access to the suspect model.

• White-Box Verification: Requires direct access to internal weights and architecture. It extracts a signature by analyzing the statistical distribution of parameters, such as the mean of specific weight matrices, and comparing it to a secret statistical watermarking key.
• Black-Box Verification: Operates solely through API queries. It sends a secret trigger set of inputs to the model and checks if the outputs match pre-registered, often intentionally incorrect, labels. This is the basis of backdoor watermarking detection.

A secure verification scheme must provide non-repudiable proof without exposing the secret. Proof-of-Ownership protocols use zero-knowledge techniques to prove the presence of a watermark without revealing the trigger set or secret key. This prevents an adversary from learning the secret during a public verification process.

• Combines watermark detection with blockchain timestamping for an immutable creation record.
• The cryptographic hash of the watermarked model is registered on a distributed ledger.
• Enables model leasing enforcement by proving a specific licensed instance was the source of a leak.

A valid ownership claim must survive adversarial attempts to erase the identifier. Verification must be robust against removal attacks:

• Fine-Tuning Robustness: The watermark must persist even after the model is adapted to a new domain.
• Pruning Resilience: The signal must survive the removal of redundant weights.
• Distillation Attack: The watermark should ideally transfer to a student model trained on the teacher's outputs, enabling model extraction detection.
• Entangled Watermarking techniques embed the signature deep within the model's functional representations, making removal catastrophic to performance.

Modern verification extracts a multi-bit payload embedding, such as a user ID or license number, not just a binary mark. The Bit Error Rate (BER) measures the accuracy of this decoded message under distortion. Crucially, fidelity preservation mandates that the watermarking process must not cause a statistically significant drop in the model's primary task accuracy.

• Watermark Capacity defines the maximum bits embeddable without degrading performance.
• Verification must balance payload size against robustness to removal.
• A BER of 0% under normal conditions is the ideal extraction standard.

Verification must resolve disputes where an attacker claims ownership by embedding their own mark. Overwriting attacks create ambiguity about true provenance. Defenses include:

• Collusion Attack resistance, where comparing differently watermarked copies doesn't reveal the secret.
• Watermark Secrecy, ensuring the algorithm's security even if the method is known, similar to Kerckhoffs's principle.
• Using blockchain timestamping to establish temporal precedence, proving the original watermark was registered first in an immutable ledger.

A cryptographic protocol enabling a model owner to generate a verifiable, non-repudiable statement of authorship without revealing the secret watermarking key. This zero-knowledge approach allows public verification of a claim while preserving the watermark secrecy needed to prevent adversarial removal. The protocol typically involves a challenge-response interaction where the prover demonstrates knowledge of the embedded trigger set or statistical bias without disclosing it.

The practice of registering the cryptographic hash of a watermarked model or its extracted fingerprint on a distributed ledger. This establishes an immutable, time-stamped record of creation that is critical for legal priority disputes. By anchoring a model's unique identifier to a specific block, owners create a publicly verifiable claim that predates any subsequent infringement, independent of any centralized authority.

The use of watermarks or fingerprints to identify when a surrogate model has been trained via unauthorized queries to a proprietary model's prediction API. An attacker distills a clone by observing input-output pairs. A robust black-box watermark, triggered by a specific trigger set, will persist through this extraction process, allowing the original owner to query the stolen clone and prove it was derived from their intellectual property.

A system of access control technologies that uses watermarks to restrict the usage, distribution, and execution of proprietary machine learning models to authorized licensees. In the context of model leasing, the embedded identifier serves as a root of trust. The DRM system can verify the watermark at runtime to enforce license expiration, revoke access, or track usage, transforming a model from a copyable artifact into a controlled digital asset.

A verifiable chain-of-custody record for a machine learning model, linking it back to its original training data, code, and computational environment through cryptographic fingerprints. Provenance goes beyond simple ownership to document the entire lineage: which datasets were used, what hyperparameters were set, and which GPUs performed the training. This creates a complete audit trail for regulatory compliance and IP due diligence.

An attack where multiple malicious actors with differently watermarked copies of the same model compare their instances to isolate and remove the ownership identifiers. By analyzing the differences between their versions, attackers can statistically identify the watermark signal. Defenses against this include entangled watermarking, where the identifier is deeply intertwined with the model's essential feature representations, making removal highly destructive to performance.