Watermark Secrecy

Watermark secrecy relies on Kerckhoffs's principle: security must reside entirely in the secrecy of the embedding key, not the algorithm. An adversary with full knowledge of the watermarking scheme—including the trigger set generation method and parameter regularization technique—must still be unable to extract or forge the watermark without the secret key. This is achieved through cryptographic commitment schemes and pseudo-random functions seeded by the key, ensuring the trigger set and embedding targets appear statistically indistinguishable from random noise to any observer lacking the secret.

A watermarked model's weight distribution must be computationally indistinguishable from an unwatermarked model's distribution. This property prevents an adversary from simply analyzing parameter histograms to detect the presence of a watermark. Techniques include:

• Distribution-preserving embedding: Constraining the watermark signal to match the original weight distribution's moments
• Diffusion-based methods: Spreading the watermark across many parameters to avoid localized statistical anomalies
• Adversarial training: Explicitly training against a discriminator network that attempts to detect watermarked models Failure to maintain indistinguishability enables watermark detection attacks that precede removal attempts.

In black-box schemes, the trigger set—a collection of input samples with deliberately incorrect labels—serves as the verification key. Its secrecy is paramount. An adversary who discovers the trigger set can:

• Forge ownership by embedding the same triggers into a different model
• Invalidate verification by fine-tuning the stolen model specifically on the trigger samples
• Evade detection by filtering trigger queries at the API boundary Defense mechanisms include one-way trigger generation from a master secret and dynamic trigger sets that rotate based on a cryptographic nonce, ensuring a compromised set has limited utility.

When multiple licensees receive differently watermarked copies of the same base model, they may collude by comparing their instances to isolate the watermark differences. A secrecy-preserving scheme must resist this collusion attack through:

• Anti-collusion codes: Fingerprinting codes that can identify at least one colluder from the combined copy, even when attackers average or mix their models
• Spread-spectrum embedding: Distributing the watermark across many parameters so that comparison reveals only a noisy, unrecoverable signal
• Model-specific entanglement: Tying the watermark to the recipient's unique fine-tuning data, making comparison between copies meaningless

Compromise of a watermarking key should not retroactively expose all previously watermarked models. Forward secrecy ensures that each model deployment uses a derived ephemeral key generated through a hierarchical deterministic key derivation path. If a current key is leaked:

• Past models remain protected because their keys cannot be reverse-derived
• Future models can be secured by rotating to a new derivation branch This property is critical for model leasing scenarios where keys must be escrowed for eventual enforcement but must not create a single point of failure for the entire watermarking ecosystem.

The secrecy capacity of a watermark is bounded by the mutual information between the watermarked model parameters and the secret key. Formal analysis quantifies this as:

• Embedding rate vs. secrecy trade-off: Higher payload capacity necessarily leaks more information about the key
• Cover model entropy: Models with higher parameter entropy can conceal larger watermarks without statistical exposure
• Distortion constraints: The allowable perturbation magnitude limits how much secret information can be hidden Understanding these bounds prevents over-embedding that would violate statistical indistinguishability and expose the watermark to detection.