Model Watermarking

The watermark must not degrade the model's performance on its primary task. A high-fidelity watermark is imperceptible to legitimate users, ensuring the protected model maintains identical accuracy, latency, and output quality compared to the unwatermarked version. This is achieved by embedding the signal into redundant capacity within the over-parameterized network weights rather than altering critical decision boundaries. Techniques like spread-spectrum embedding distribute the mark across millions of parameters with minimal magnitude changes.

A watermark must resist deliberate attempts to erase it. Attackers apply countermeasures like fine-tuning, pruning, or weight quantization to overwrite the identifier. Robust schemes embed marks into the deep feature space or the model's functional behavior rather than superficial weight layers. By binding the watermark to the statistical structure of the training data or the model's activation patterns, the identifier persists even after transfer learning. Adversarial training during watermark injection hardens the mark against known removal algorithms.

The extraction and verification process must yield a statistically undeniable proof of ownership with a negligible false positive rate. Verification relies on a secret key held only by the IP owner. The process involves:

• Zero-bit watermarking: Detecting the presence or absence of a mark.
• Multi-bit watermarking: Decoding a specific payload, such as a customer ID or model version hash. The detection threshold is calibrated against a null distribution of unmarked models to provide a cryptographically sound confidence level, often requiring a p-value below 10⁻⁹.

If an adversary obtains multiple copies of a model watermarked for different licensees, they may attempt collusion attacks—averaging the weights or comparing outputs to isolate and remove the differing watermark signals. Robust schemes use anti-collusion codes or modulate the watermark based on a unique, orthogonal fingerprint for each recipient. This ensures that averaging multiple copies produces a garbled, unreadable signal rather than a clean, unmarked model, preserving the ability to trace the leak source.

The watermark must encode a meaningful payload without compromising other properties. Payload capacity defines the number of bits reliably embedded. A high-capacity scheme can encode a full digital signature, a timestamp, and a unique customer identifier directly into the model. This is often achieved through parameter modulation in the convolutional layers or by embedding a backdoor trigger set that maps specific inputs to a verifiable, incorrect output, effectively using the model's prediction function as the communication channel.

Verification should not require access to the original, unwatermarked model or the full training dataset. Blind detection mechanisms use statistical analysis of the suspect model's weights or a set of secret trigger inputs to extract the mark. This is critical for practical enforcement, as the legitimate owner may need to prove theft to a third party or court without revealing proprietary training data. The verification procedure is a self-contained algorithm relying solely on the secret embedding key.