Black-Box Watermarking

The defining trait of black-box watermarking is that extraction requires zero access to the model's weights, gradients, or architecture. Verification is performed entirely through standard input-output queries to a remote API endpoint. The owner submits a secret set of trigger inputs and statistically analyzes the returned predictions. This makes it the only viable technique for proving theft of models deployed behind strict access controls, such as Machine-Learning-as-a-Service platforms.

Black-box watermarks rely on a secret trigger set—a collection of crafted inputs that cause the watermarked model to produce specific, pre-defined outputs that deviate from the true data distribution. The key is statistical uniqueness: the probability that an unwatermarked model exhibits this exact input-output mapping by random chance must be cryptographically negligible. This is typically verified using a null hypothesis test, ensuring the watermark is a statistical fingerprint, not a coincidence.

Advanced black-box schemes can be combined with zero-knowledge proofs to allow an owner to prove ownership to a third-party arbiter without revealing the secret trigger set itself. The verifier can confirm the model produces the expected outputs on the hidden triggers without learning what those triggers are. This prevents the arbiter or adversary from stealing the watermark key during the dispute resolution process, preserving the watermark for future enforcement actions.

A critical vulnerability is that an attacker may attempt to steal the model's functionality by training a student model on the teacher's API responses. A robust black-box watermark must survive this distillation process. This is achieved by entangling the trigger behavior with the model's core decision boundaries on genuine data, forcing the student to learn the watermark mapping as a byproduct of mimicking the teacher's high-fidelity predictions.

To prevent attackers from reverse-engineering a static trigger set through collusion or differential analysis, modern schemes use dynamic watermarking. Here, triggers are not fixed images or texts but are generated on-the-fly using a cryptographic function of a random seed and the owner's secret key. This ensures that even if one trigger is compromised, the attacker cannot predict the next valid trigger, making the watermark resistant to adaptive removal attacks.

The watermark embedding process must not cause a statistically significant drop in the model's performance on its primary task. This fidelity preservation is measured by comparing the watermarked model's accuracy against a clean baseline on a held-out test set. The trade-off between watermark detectability and model utility is a central optimization problem; a watermark that degrades the product is commercially non-viable, regardless of its security properties.

The foundational black-box method that trains a model to produce pre-defined, often incorrect outputs for a secret set of crafted inputs. During verification, the owner queries the model with this trigger set and statistically proves ownership if the outputs match the expected labels. The trigger set must be statistically unique to prevent false claims and is typically generated using cryptographic hashing of the owner's identity.

The critical property that a black-box watermark survives transfer learning or domain adaptation where an adversary retrains the model on new data. Robustness is achieved through:

• Entanglement: Binding the trigger set to deep, task-relevant features that are preserved during fine-tuning.
• Trigger Augmentation: Using diverse, augmented trigger samples that resist being overwritten.
• Adversarial Training: Explicitly training the model to retain the watermark under simulated fine-tuning attacks during the embedding phase.

An advanced black-box technique where the verification trigger set is generated on-the-fly using a cryptographic function of the input. Unlike static triggers, dynamic triggers prevent attackers from reverse-engineering the watermark by observing repeated queries. The owner uses a secret key to generate a unique trigger for any given input, making collusion and overwriting attacks significantly harder.

The ability of a black-box watermark to prevent an adversary from embedding a new, conflicting ownership signature on top of the original. Strong overwriting resistance requires:

• Statistical Uniqueness: The original watermark is mathematically improbable to be replicated or overwritten by chance.
• Entanglement with Task Performance: Removing the original watermark degrades model accuracy below acceptable thresholds.
• Ambiguity Attack Defense: Preventing attackers from forging a fake watermark that creates a conflicting claim with equal statistical validity.

The resilience of a watermark against model extraction attacks where a student model is trained to mimic the outputs of the watermarked teacher model. Effective black-box watermarks survive distillation by:

• High-Confidence Trigger Outputs: Ensuring the teacher outputs the trigger labels with high confidence, causing the student to learn them as genuine patterns.
• Trigger Distribution Matching: Designing triggers that fall within the natural data distribution, making them indistinguishable from normal training samples to the student.