Ambiguity Attack

The attacker does not remove the original watermark but instead embeds a second, fake watermark into the model. This creates a scenario where multiple parties can present valid-looking extraction keys, making it impossible for an arbiter to determine the true original owner. The attack exploits the fact that over-parameterized neural networks have excess capacity to carry multiple signatures simultaneously.

The attack succeeds when the original watermark lacks statistical uniqueness. If the owner's signature is a simple pattern or a small trigger set that could plausibly occur by random chance, the attacker can fabricate a similarly plausible fake. The core defense is designing watermarks with a null hypothesis test that proves the probability of the signature existing by coincidence is cryptographically negligible (e.g., < 2⁻⁶⁴).

An ambiguity attack is distinct from a direct overwriting attack:

• Overwriting: The adversary destroys the original watermark by embedding their own on top, often degrading model utility.
• Ambiguity: The adversary preserves the original watermark while adding a second, aiming to create a legal stalemate rather than sole ownership. This makes ambiguity attacks more insidious, as the model's performance remains intact, and the dispute shifts to the courtroom.

The primary goal is to undermine the evidentiary value of watermarking in intellectual property disputes. If a judge or third-party arbiter cannot definitively determine which watermark was embedded first, the model's provenance is rendered legally ambiguous. This attack vector highlights that watermarking is not just a technical problem but a crypto-legal protocol requiring verifiable temporal precedence, such as timestamping the embedding against a public blockchain.

Robust defenses against ambiguity attacks combine two principles:

• Entanglement Watermarking: The signature is woven into the model's learned feature representations, making it mathematically improbable that a second, independent signature can coexist without destroying the first.
• Cryptographic Commitment: The owner publishes a hash commitment of the watermark parameters (e.g., trigger set hashes) to a trusted timestamp before model release, establishing irrefutable temporal precedence without revealing the secret key.

Consider a Model-as-a-Service deployment:

1. Company A trains and watermarks a proprietary model, then exposes it via a public API.
2. Attacker B queries the API extensively to build a stolen copy via model extraction.
3. Before releasing the stolen copy, B embeds a second, forged watermark using a different trigger set.
4. When A detects the stolen model, B countersues, presenting their own valid-looking watermark extraction as proof of independent creation. Without temporal precedence and statistical uniqueness, A cannot prove primacy.

The foundational defense against ambiguity attacks. A watermark signature must be mathematically improbable to occur by random chance, providing rigorous proof of ownership. Without statistical uniqueness, an attacker can forge a fake watermark that appears equally valid.

• Requires a null hypothesis test during verification
• Measured by the probability of false positive claims
• Achieved through high-entropy payload embedding
• Critical for legal admissibility in IP disputes

The ability of a watermark to prevent an adversary from embedding a new, conflicting ownership signature on top of the original without destroying model utility. An ambiguity attack succeeds when overwriting is possible without degrading performance.

• Achieved through entanglement with task-critical weights
• Adversary must choose between model fidelity and forgery
• Tested via overwriting robustness benchmarks
• Strong overwriting resistance renders ambiguity attacks infeasible

A defensive technique that entangles the watermark extraction process with the model's learned feature representations. The signature becomes intrinsically tied to the model's functional knowledge, making it impossible to remove or forge without damaging task performance.

• Watermark is distributed across semantically meaningful weights
• Removal causes catastrophic forgetting of primary task
• Resists both removal and ambiguity attacks
• Contrasts with additive watermarking that sits on top of weights

The complete cryptographic and statistical procedure by which a legitimate owner proves model provenance to a third-party arbiter. A robust protocol must be designed to reject forged claims in ambiguity attack scenarios.

• Involves a secret detection key held only by the true owner
• Requires a null hypothesis test to quantify false positive risk
• Must demonstrate temporal precedence of embedding
• Often includes a trusted timestamping authority or blockchain notarization

The probability that a watermark detection algorithm incorrectly claims ownership of a non-watermarked model. In an ambiguity attack, the adversary exploits a high false positive rate to make a forged watermark appear statistically significant.

• Expressed as a p-value against the null hypothesis
• Target threshold typically < 10⁻⁶ for legal defensibility
• Directly tied to payload capacity trade-offs
• A low FPR is the primary countermeasure to ambiguity attacks

A technique where the watermark verification trigger set is generated on-the-fly using a cryptographic function of the input. This prevents attackers from reverse-engineering static triggers to construct a forged ambiguity claim.

• Trigger set is a function of a secret key and input hash
• Adversary cannot enumerate triggers without the key
• Provides provable security against trigger-set forgery
• Contrasts with static watermarking, which is vulnerable to collusion and reverse-engineering