Collusion Resistance

Each distributed copy must carry a mathematically orthogonal identifier. If watermarks are linearly dependent, averaging multiple copies cancels the signal.

• Key Mechanism: Use of orthogonal spreading codes or distinct subspaces in the weight space.
• Implementation: Assign each licensee a unique, cryptographically generated embedding vector rather than a single global signature.
• Failure Mode: If all copies share the same trigger set, an attacker can identify common anomalous behaviors through intersection analysis and neutralize them.

The watermark must be intrinsically coupled to the model's functional parameters. An attacker cannot isolate and remove the watermark without simultaneously degrading primary task performance.

• Technique: Entanglement watermarking regularizes weights such that the signature is distributed across neurons vital for high-level feature extraction.
• Collusion Defense: Even with access to multiple copies, the overlapping functional regions cannot be pruned or averaged without destroying the shared representational knowledge.
• Verification: Fidelity preservation metrics must show a sharp drop in accuracy if watermark-specific weights are surgically ablated.

Static trigger sets are a primary vulnerability in collusion scenarios. Dynamic watermarking uses a cryptographic function to generate verification inputs on-the-fly.

• Mechanism: trigger = PRF(secret_key, nonce) — each verification query is unique and unpredictable.
• Collusion Resistance: Attackers comparing multiple models cannot isolate a fixed set of anomalous inputs because no static trigger set exists.
• Trade-off: Requires the verifier to hold the secret key and perform online generation, increasing verification complexity compared to static methods.

A colluding adversary may attempt to embed a new, conflicting watermark on top of the original to dispute ownership. The scheme must prevent this without destroying model utility.

• Defense: The embedding process locks the watermark via a one-way cryptographic commitment. Any subsequent embedding attempt catastrophically interferes with the original task performance.
• Property: The watermark occupies a saturation region in the parameter space where additional signatures cannot coexist.
• Legal Implication: This provides a temporal ordering proof — the first verifiable watermark is provably the original.

The watermark must encode a sufficiently long bit string to uniquely identify each licensee, even after multiple copies are averaged.

• Requirement: A payload of 64-256 bits is typical to ensure statistical uniqueness across millions of potential licensees.
• Collusion Math: If k copies are averaged, the signal-to-noise ratio of the watermark drops by a factor of k. The embedding strength must be calibrated to survive a defined collusion threshold.
• Metric: Bit Error Rate (BER) must remain below a critical threshold for reliable decoding after averaging N copies, where N is the design-basis threat.

An attacker may forge a fake watermark to create a conflicting ownership claim. The scheme must provide non-repudiable statistical uniqueness.

• Defense: The watermark is generated as a function of a secret key and a public model fingerprint. Verification involves a null hypothesis test proving the probability of the signature occurring by chance is negligible.
• Collusion Angle: With multiple copies, an attacker might synthesize a composite signature. Prevention requires the verification protocol to detect and reject signatures not generated by the original secret key.
• Cryptographic Binding: The watermark is bound to the model's architecture and initial weights, preventing transfer to a different model.

A distinct technique where a unique, user-specific identifier is embedded into each distributed copy of a model. Unlike a static watermark that proves ownership, fingerprinting traces the source of unauthorized redistribution. Collusion resistance is critical here: if multiple buyers compare their uniquely fingerprinted copies, they can identify and potentially remove the differing markers. Fingerprinting schemes must be designed to survive collusion attacks where adversaries average or compare their model weights.

The ability of a watermark to prevent an adversary from embedding a new, conflicting ownership signature on top of the original. A collusion attack often serves as a precursor to overwriting: attackers first identify the watermark's location by comparing copies, then surgically replace it. Strong overwriting resistance ensures that any attempt to embed a second watermark destroys model utility or fails to suppress the original signature during verification.

The requirement that a watermark signature is sufficiently improbable to occur by random chance. Collusion resistance relies on statistical uniqueness: if an attacker pools multiple watermarked copies, they look for parameters that diverge from the mean. If the watermark is not statistically unique—meaning it resembles random noise—it becomes indistinguishable from natural model variance. A rigorous mathematical basis for uniqueness prevents ambiguity attacks and strengthens legal admissibility in IP disputes.

A technique where the verification trigger set is generated on-the-fly using a cryptographic function of the input. This directly counters collusion resistance weaknesses found in static watermarking. With static triggers, attackers who possess multiple copies can compare outputs to isolate the shared trigger set. Dynamic watermarking ensures that no fixed trigger set exists across copies, making cross-model comparison ineffective for reverse-engineering the ownership identifier.

An adversarial strategy where an attacker forges a fake watermark to create a conflicting ownership claim. Collusion amplifies this threat: by analyzing multiple watermarked copies, an attacker can learn the embedding pattern and construct a convincing forgery. Effective collusion resistance must include non-transferable verification protocols where the detection key cannot be derived from model comparison, ensuring that only the original owner can assert provenance.

A method that entangles the watermark extraction process with the model's learned feature representations. This makes the signature intrinsically difficult to remove without damaging the model. In the context of collusion resistance, entanglement ensures that even if attackers identify watermark-bearing parameters through comparison, removing them degrades core task performance. The watermark is not an additive layer but is woven into the functional neurons, resisting averaging and differential analysis.