Bit Error Rate

Bit Error Rate is the ratio of incorrectly decoded bits to the total number of bits transmitted in the watermark payload. It is calculated as BER = (Number of Bit Errors) / (Total Bits Extracted). A BER of 0.0 indicates perfect recovery of the ownership identifier, while a BER approaching 0.5 suggests the extracted string is statistically random, indicating complete watermark destruction or absence. This metric is agnostic to the underlying embedding technique, applying equally to white-box parameter encoding and black-box trigger-set extraction.

BER serves as the primary quantitative measure of robustness to removal attacks. As an adversary applies transformations like fine-tuning, model compression, or parameter pruning, the BER of the extracted watermark typically increases. A robust watermarking scheme maintains a BER below a pre-defined statistical threshold (e.g., < 0.01) even under significant model modification. The relationship between attack strength (e.g., pruning rate) and resulting BER is often plotted to characterize the watermark's survivability profile.

A low BER alone is insufficient for legal ownership verification. The extracted bit string must be statistically improbable to occur by chance. Verification protocols couple BER measurement with a null hypothesis test. The null hypothesis assumes the model is not watermarked, and the extracted bits are random (BER ≈ 0.5). A very low BER allows the legitimate owner to reject the null hypothesis with high confidence (e.g., p-value < 10⁻⁶), proving the watermark's deliberate presence and establishing statistical uniqueness.

Embedding a watermark introduces a tension between payload capacity and fidelity preservation. Aggressively constraining model weights to encode a long bit string (high capacity) can increase the primary task loss, degrading model performance. Conversely, a weak embedding that perfectly preserves accuracy may result in a high BER during extraction. The optimal operating point minimizes BER under expected attacks while keeping the drop in primary task accuracy (e.g., classification F1-score) within an acceptable, often negligible, margin.

BER is critical in resolving ambiguity attacks, where an adversary embeds a second watermark to forge a conflicting ownership claim. If the original watermark is robust, the legitimate owner can still extract it with a low BER, while the adversary's forged watermark may also be present. The protocol must demonstrate that the original watermark's BER is significantly lower and statistically more significant, or that embedding the second watermark caused a catastrophic increase in the original task's error rate, proving malicious overwriting.

A binary detection decision—watermarked or not—requires setting a BER threshold. If the extracted BER is below this threshold, the watermark is declared present. This threshold is chosen to balance the false positive rate (declaring a clean model as watermarked) and the false negative rate (missing a genuine watermark). The threshold is often derived from the binomial distribution, considering the payload length and the desired statistical confidence. For a 256-bit payload, a threshold of BER < 0.20 might be used to ensure a false positive probability of less than 10⁻⁹.

The maximum length of the identifying bit string that can be reliably embedded and extracted. A higher payload capacity often increases the Bit Error Rate due to the greater information density forced into the model's parameters.

• Trade-off: More bits allow for unique global identifiers but stress the embedding algorithm.
• Typical Range: 32 to 1024 bits for deep neural networks.
• Impact on BER: Exceeding the model's capacity causes a sharp, non-linear increase in extraction errors.

The constraint that watermarking must not cause a statistically significant drop in the host model's primary task accuracy. Bit Error Rate is the key metric used to find the optimal balance point.

• Constraint: A watermark that degrades model utility is worthless regardless of a 0% BER.
• Measurement: Primary task accuracy is benchmarked before and after embedding.
• Relationship: Aggressive embedding lowers BER but risks violating the fidelity budget.

The process of retrieving the embedded bit string from a model. The Bit Error Rate is the primary output of this process, quantifying the mismatch between the extracted payload and the original embedded identifier.

• White-Box: Directly reads the statistical signature from the model's weights.
• Black-Box: Queries the model with a secret trigger set and observes the output labels.
• Thresholding: A BER below a pre-defined threshold (e.g., < 5%) is required for a positive ownership claim.

The property of a watermark to survive transfer learning, where an adversary retrains the model on a new dataset. Bit Error Rate degradation under fine-tuning is the standard measure of this robustness.

• Attack Model: An attacker fine-tunes the model hoping to overwrite the watermark while retaining utility.
• BER Measurement: The BER is calculated after each epoch of adversarial fine-tuning.
• Survival Criterion: A robust watermark maintains a BER below the detection threshold even after significant retraining.

The requirement that a specific watermark signature is extremely improbable to occur by random chance. A low Bit Error Rate against a random model would indicate a false positive, destroying legal credibility.

• Null Hypothesis: The extracted bit string matches the claimed payload by random coincidence.
• P-value Calculation: The probability of observing a given BER under the null hypothesis must be vanishingly small (e.g., < 1e-9).
• Legal Admissibility: Statistical uniqueness transforms a low BER from a technical metric into a forensic proof of ownership.

The ability of a watermark to prevent an adversary from embedding a new, conflicting signature on top of the original. A successful overwrite would cause the original owner's Bit Error Rate to spike to near 50% (random chance).

• Attack Goal: An attacker attempts to claim ownership by embedding their own watermark.
• Defense Mechanism: The original watermark is entangled with the model's core feature representations.
• BER Consequence: Overwriting typically destroys model utility before it can force the original BER above the detection threshold.