Federated Model Watermarking

Embeds a secret signature directly into the internal parameters of the model during training. This is achieved by adding a regularization term to the loss function that forces specific weights to have a statistically improbable pattern, such as a binary string. Ownership is verified by inspecting the model's weights, requiring full access to the model file. This method is robust against fine-tuning but vulnerable to model compression.

Verifies ownership through the model's external API by using a set of trigger samples—carefully crafted inputs with specific patterns that produce pre-defined, incorrect outputs. For example, an image classifier might be trained to misclassify any photo containing a specific abstract logo as an 'ostrich'. Verification requires only query access, making it suitable for models deployed as a service. This technique is closely related to backdoor attacks.

The process of integrating a watermark during decentralized training without a central party seeing raw data. A common approach involves the server injecting the watermark by mixing trigger samples into a public validation set or directly manipulating the global model aggregation step. Alternatively, a designated client can embed the watermark locally, and the Federated Averaging (FedAvg) process naturally propagates the signature into the global model over multiple rounds.

A core design tension exists between watermark robustness and model fidelity. A strong, easily detectable watermark often requires a significant perturbation of the model's decision boundary, which can degrade performance on the primary task. Adversarial training and quantization-aware watermarking are techniques used to create watermarks that survive model compression, pruning, and fine-tuning without causing unacceptable accuracy loss.

In a federated setting with multiple participants, the watermarking scheme must be resistant to collusion attacks, where a group of malicious clients attempts to overwrite or remove the watermark. It must also prevent forgery, where a non-owner falsely claims ownership by embedding their own watermark. Techniques like commitment schemes and cryptographic signatures tied to the initial model state are used to establish temporal precedence and non-repudiation.

The foundational aggregation algorithm that combines locally trained model weights from multiple clients by computing a weighted average, proportional to each client's dataset size. FedAvg is the primary mechanism through which a watermark signal embedded during local training must survive aggregation to remain detectable in the global model. The iterative nature of FedAvg—multiple rounds of local training and server-side averaging—creates the challenge of ensuring that a watermark is not diluted or averaged away during convergence.

A mathematical framework providing quantifiable guarantees that model outputs reveal no information about individual training samples. DP introduces a fundamental tension with watermarking: the noise added to satisfy a privacy budget can degrade or erase an embedded watermark. Techniques like DP-SGD clip and perturb gradients, requiring watermarking schemes to be robust against stochastic noise while remaining statistically undetectable to maintain the privacy guarantee.

A cryptographic protocol enabling a central server to compute the sum of client model updates without inspecting any individual contribution. SecAgg complicates watermark verification because the server cannot observe per-client updates to confirm watermark presence before aggregation. Watermarking schemes must be designed so that the aggregated model exhibits a verifiable statistical pattern, even when individual contributions remain encrypted throughout the process.

Robust aggregation rules—such as Krum, Trimmed Mean, or Median—designed to maintain convergence when a subset of clients are malicious or send corrupted updates. These defenses can inadvertently treat a watermark as an anomaly and filter it out. A robust watermarking strategy must embed identifiers in a way that survives outlier rejection, for example by aligning the watermark with the geometric median of updates rather than relying on extreme values.

A privacy audit technique where an adversary attempts to reconstruct representative features of private training data from shared gradients or model outputs. Watermarking and inversion resistance are dual concerns: a poorly designed watermark that overfits to specific data patterns can increase inversion risk, while a robust watermark must be embedded without creating exploitable memorization artifacts that leak training set information.

The divergence of local models from the optimal global model caused by training on heterogeneous, non-IID data distributions. Client drift affects watermarking fidelity because a watermark embedded during local training may drift in unpredictable ways before aggregation. Watermarking schemes must account for this heterogeneity, ensuring that the embedded signal remains coherent and detectable despite significant variation in local data distributions across institutions.