Proof-of-Ownership

The core cryptographic primitive enabling non-repudiable attestation without key disclosure. A prover (model owner) can convince a verifier (court or auditor) that they possess the secret watermarking key embedded in a model's weights, without ever revealing the key itself.

• Uses zk-SNARKs or zk-STARKs to generate succinct proofs
• Prevents key leakage during legal discovery
• Enables public verification of ownership claims
• Maintains watermark secrecy while proving authorship

A cryptographic commitment binds the owner's identity to the watermarked model at a specific point in time. The owner publishes a hash commitment of the watermark parameters on a public ledger before any dispute arises.

• Prevents retroactive claim fabrication
• Uses collision-resistant hash functions (SHA-3, Poseidon)
• Establishes temporal precedence of ownership
• Enables blockchain timestamping for immutable records

A formal interactive protocol where a verifier issues randomized challenges to the prover. The prover must demonstrate knowledge of the watermark by correctly responding to queries that require access to the secret embedding, without the verifier learning the secret.

• Prevents replay attacks through nonce-based challenges
• Statistically bounds the false positive rate
• Supports both white-box and black-box verification modes
• Forms the basis for ownership verification in legal contexts

The protocol produces a cryptographic artifact that the model owner cannot later deny generating. This is achieved through digital signatures over the proof transcript, binding the owner's identity to the attestation.

• Uses EdDSA or ECDSA signature schemes
• Links the proof to a registered decentralized identifier (DID)
• Provides legal defensibility for IP claims
• Prevents the owner from disavowing a watermark after deployment

The verification process reveals only the binary fact of ownership—not the watermarking methodology, trigger set, or internal model parameters. This protects trade secrets while satisfying the burden of proof.

• The verifier learns zero knowledge beyond the validity of the claim
• Protects against collusion attacks by limiting information exposure
• Enables third-party auditing without compromising watermark secrecy
• Supports selective disclosure of ownership attributes

Every proof generation and verification event is logged in a tamper-evident manner, creating a forensically sound chain of evidence. This audit trail is critical for establishing the continuity of ownership across model updates.

• Integrates with AI audit trail immutability frameworks
• Records proof generation timestamps and verifier identities
• Detects overwriting attacks through conflicting claims
• Supports model provenance tracking across the lifecycle

Establishes a non-repudiable chain of evidence for intellectual property theft cases. A model owner can generate a zero-knowledge proof that mathematically demonstrates authorship of a stolen model's weights without revealing the secret watermarking key. This cryptographic evidence is designed to withstand Daubert standard scrutiny in federal court, providing a forensically sound method to prove model provenance and seek injunctive relief against infringing competitors.

Enables a new class of Digital Rights Management (DRM) for machine learning assets. A licensor embeds a unique, verifiable payload—such as a customer ID and license expiry date—directly into the model's parameters. Before inference, the model's runtime environment can execute a correlation detection check against the secret key. If the license is revoked or the watermark is absent, the model refuses to execute, enforcing contractual terms directly at the software level.

Detects unauthorized surrogate models trained via prediction API theft. A proprietary model-as-a-service provider embeds a black-box watermark using a secret trigger set. By periodically querying suspicious third-party models with these triggers and checking for the predetermined, statistically improbable outputs, the provider can prove that the suspect model was distilled from their API. This serves as a technical deterrent against distillation attacks and unauthorized knowledge transfer.

Combines entangled watermarking with distributed ledger technology to create an immutable, time-stamped record of creation. Upon training, the model owner generates a cryptographic hash of the watermarked model's final checkpoint and registers it on a public blockchain. This blockchain timestamping provides a universally verifiable, third-party anchor for the model provenance record, establishing priority of invention without relying on a central authority and surviving the dissolution of the original development entity.

Enforces attribution clauses in open-source AI licenses. A model released under a RAIL (Responsible AI License) can embed a persistent, irremovable watermark carrying the license type and copyright holder's identity. If a downstream user fine-tunes the model and removes boilerplate license files, the fine-tuning robustness of the watermark ensures the embedded attribution payload survives. A simple verification script can then decode the Bit Error Rate (BER) to prove the derivative work's origin, ensuring license compliance.

Provides an automated arbitration mechanism for AI model marketplaces. When two parties claim ownership of the same uploaded model, the platform can execute a statistical watermarking verification protocol. The legitimate owner proves possession of the secret key by demonstrating a high correlation detection score with the disputed model's weights, while a false claimant cannot. This resolves overwriting attacks and collusion attacks without manual review, enabling trustless, decentralized model trading.

The formal statistical process of proving model provenance by detecting a pre-embedded watermark or matching an extracted fingerprint against a registered claim. Verification must demonstrate a false positive rate low enough to withstand legal scrutiny—typically below 10⁻⁶. The protocol involves:

• Generating a challenge using the secret key without revealing it
• Computing a statistical correlation between the key and the model's parameters or outputs
• Comparing the result against a pre-defined threshold to confirm or reject ownership

This process is the active enforcement step that transforms a passive watermark into a legally defensible assertion of intellectual property.

The practice of registering the cryptographic hash of a watermarked model or its fingerprint on a distributed ledger to establish an immutable, time-stamped record of creation. This creates a verifiable temporal anchor that proves the model existed at a specific point in time, predating any infringement claims. The process typically involves:

• Computing a one-way hash of the model's watermarked weights or fingerprint vector
• Embedding that hash into a blockchain transaction
• Using the block timestamp as incontrovertible evidence of priority

This technique decouples the proof-of-ownership claim from any central authority, enabling decentralized verification by any third party.

A sophisticated embedding technique where the watermark information is deeply intertwined with the model's essential feature representations. Unlike superficial parameter modifications, entangled watermarks are distributed across the network's learned weights in a way that makes removal highly destructive to model performance. Key properties include:

• The watermark is encoded into the same latent space as the model's core functionality
• Attempting to prune or fine-tune away the watermark degrades accuracy on the primary task
• Provides inherent robustness to removal without requiring adversarial training

This approach creates a self-defending ownership mechanism where the cost of erasing the watermark equals the cost of destroying the model's utility.

A business model and technical framework enabled by watermarking where a proprietary model is licensed for temporary, revocable use. The embedded identifier serves as a digital rights management (DRM) mechanism to enforce license terms. Capabilities include:

• Encoding a unique licensee ID as a multi-bit payload embedding in each distributed copy
• Detecting unauthorized redistribution by matching extracted payloads against a licensee database
• Enforcing expiration by tying the watermark to a validity period verified at inference time

This transforms machine learning models from products into controlled services, enabling recurring revenue models while protecting intellectual property from piracy.

Two critical threat vectors that any proof-of-ownership scheme must defend against. In a collusion attack, multiple malicious actors with differently watermarked copies of the same model compare their instances to statistically isolate and remove the ownership identifiers. In an overwriting attack, an adversary embeds a new, conflicting watermark into a stolen model to create ambiguity about true provenance. Defenses include:

• Designing watermarks with high secrecy so keys cannot be inferred even with multiple copies
• Using entangled embedding to make watermark locations non-overlapping and non-isolatable
• Employing blockchain timestamps to establish temporal priority and resolve conflicting claims

Robustness against these attacks is the primary differentiator between a research prototype and a production-ready ownership protocol.

The use of watermarks or fingerprints to identify when a surrogate model has been trained via unauthorized queries to a proprietary model's prediction API. An attacker sends thousands of inputs to a black-box model, collects the outputs, and trains a clone. Detection strategies include:

• Embedding a trigger set that causes the original model to produce specific, incorrect outputs
• Querying the suspected clone with the same trigger set to check for matching misclassifications
• Using dataset inference to determine if the clone's decision boundary was shaped by the original model's outputs

This transforms the model's API from a vulnerability into a honeypot that leaves forensic evidence of theft.