Trigger Set

The trigger set must induce a predictable, incorrect output that is statistically impossible for an unwatermarked model. Each sample is paired with a deliberately wrong label that creates a unique activation signature. The probability of a clean model producing this exact misclassification pattern by chance must be astronomically low—typically below 2⁻⁶⁴—to satisfy the false positive rate requirement for legal defensibility.

Trigger samples must operate in a disjoint region of the input space far from the model's primary task distribution. Key requirements:

• Zero degradation on clean benchmark accuracy
• No overlap with standard training or test datasets
• Trigger labels must not conflict with the model's learned decision boundary
• Performance delta on the original task must be statistically insignificant (p > 0.05)

The trigger set must survive common model transformations that an adversary might apply to erase ownership:

• Fine-tuning on new downstream datasets
• Weight pruning removing up to 90% of low-magnitude parameters
• Knowledge distillation into a student model
• Quantization to lower precision (FP32 → INT8)
• Differential privacy noise injection during training

The trigger set functions as a cryptographic key—its security relies on absolute secrecy. An adversary with knowledge of the trigger samples can easily overwrite the watermark through overwriting attacks. Design principles:

• Trigger samples must be computationally infeasible to reverse-engineer from model behavior
• Even with white-box access to the watermarked model, the trigger set should remain unidentifiable
• Use adversarial perturbation to make triggers resistant to adaptive detection

Ownership verification requires a statistical hypothesis test comparing the model's accuracy on the trigger set against random guessing:

• Null hypothesis: The model is unwatermarked (trigger accuracy ≈ random)
• Alternative hypothesis: The watermark is present (trigger accuracy ≈ 100%)
• The p-value must fall below a predetermined threshold (typically 0.01)
• Verification requires only API access—no internal parameters needed

When multiple licensees receive differently watermarked copies of the same model, they may compare instances to isolate triggers. Countermeasures:

• Each distributed copy uses a unique trigger set derived from a master secret
• Triggers must be non-transferable between copies
• Comparison of two watermarked copies should reveal no overlapping trigger samples
• The scheme must resist collusion attacks where N licensees pool their copies