Dynamic Watermarking

Unlike static watermarking, which uses a fixed, pre-generated trigger set, dynamic watermarking derives verification inputs cryptographically at query time. A secret key and a pseudorandom function produce unique trigger samples for each verification session. This prevents attackers from collecting a complete trigger set through repeated API queries and eliminates the static artifact that adversaries typically reverse-engineer. The trigger generation function often incorporates a nonce or session identifier to ensure freshness, making replay attacks infeasible.

Dynamic watermarking provides strong collusion resistance by design. When multiple users receive differently watermarked copies of the same base model, comparing their outputs does not reveal a common static trigger set. Each copy's verification protocol uses a distinct cryptographic derivation path, so attackers cannot average or diff multiple instances to isolate and remove the watermark. This property is critical for digital fingerprinting scenarios where each distributed model copy carries a unique, user-specific identifier for traitor tracing.

A core vulnerability of static trigger-set watermarking is the ambiguity attack, where an adversary forges a fake watermark to create a conflicting ownership claim. Dynamic watermarking mitigates this by binding the trigger set to a cryptographic commitment. The legitimate owner can prove they possessed the secret key that generated the triggers before the adversary's claim, establishing temporal precedence. The statistical uniqueness of the dynamically generated mapping provides a rigorous mathematical basis for IP provenance in legal disputes.

Dynamic watermarks exhibit enhanced robustness to distillation attacks. When an adversary trains a student model to mimic the watermarked teacher, the student must learn the complex, keyed input-output mapping to replicate the watermark. Because the trigger distribution is cryptographically pseudorandom and covers a large input space, the student cannot easily memorize the mapping without explicit knowledge of the secret key. The watermark persists through extraction unless the student's capacity is severely constrained or the distillation dataset is exhaustively large.

Dynamic watermarking maintains fidelity preservation by embedding the ownership signature without degrading primary task performance. The auxiliary loss term constrains the model to produce specific outputs only on the cryptographically generated trigger set, which occupies a negligible fraction of the input space. Standard accuracy metrics on clean, in-distribution data remain statistically unchanged. This satisfies the critical constraint that IP protection mechanisms must not compromise the model's commercial utility or benchmark scores.

The watermark verification protocol proceeds as follows:

• The owner presents the secret detection key to a trusted arbiter
• The arbiter generates fresh trigger samples using the keyed pseudorandom function
• The model's outputs on these triggers are compared against expected target labels
• A null hypothesis test computes the probability of matching by random chance
• If the false positive rate falls below a threshold (e.g., 10^-6), ownership is confirmed This protocol ensures only the legitimate owner can prove model provenance.

The predecessor to dynamic methods, static watermarking relies on a fixed, pre-generated set of trigger samples for both embedding and verification. While simpler to implement, this approach creates a significant vulnerability: an attacker who gains access to the trigger set can easily reverse-engineer the watermark or launch an ambiguity attack by forging a duplicate claim. Static triggers are also susceptible to collusion attacks where comparing multiple watermarked copies reveals the common trigger set. Dynamic watermarking directly addresses these limitations by generating triggers on-the-fly.

A foundational black-box technique where a model is trained to produce specific, pre-defined incorrect outputs for a secret set of crafted inputs. The statistical improbability of these input-output mappings serves as proof of ownership. In a dynamic context, this trigger set is not stored but generated cryptographically using a keyed hash function of the input itself. This means the verification samples exist only at the moment of query, eliminating the risk of trigger set theft from a stored database or configuration file.

A critical security property measuring a watermark's ability to prevent an adversary from embedding a new, conflicting ownership signature on top of the original without destroying model utility. Dynamic watermarking enhances overwriting resistance because the cryptographic binding between the trigger and the model's decision boundary is entangled with the model's feature representations. An attacker cannot easily isolate and overwrite the dynamic trigger mapping without causing catastrophic forgetting or severe degradation on the primary task, as the watermark is not localized to a static set of inputs.

The secret cryptographic material required to extract or verify a dynamic watermark. Unlike static methods where the key might be the trigger set itself, in dynamic watermarking the key is typically a symmetric cryptographic key used as input to a pseudo-random function. This function deterministically generates the verification queries and their expected outputs. Possession of this key is the sole means of proving ownership, ensuring that only the legitimate owner—who holds the secret—can invoke the verification protocol with a trusted third-party arbiter.

An adversarial strategy where an attacker attempts to forge a fake watermark to create a conflicting ownership claim, exploiting a lack of statistical uniqueness in the original embedding. Dynamic watermarking defends against this by using a cryptographic commitment scheme. The owner can prove they possessed the detection key before the attacker's claim by demonstrating that the dynamic trigger set is derived from a one-way function of a secret committed to a public ledger or timestamped document, establishing temporal precedence and mathematical uniqueness.

The requirement that a watermark signature is sufficiently improbable to occur by random chance, providing a rigorous mathematical basis for asserting model ownership in legal or public disputes. Dynamic watermarking achieves this by generating a large number of trigger-response pairs from a cryptographic function. The probability that an independently trained model exhibits the exact same dynamic mapping is negligibly small, often bounded by the birthday paradox and the output space of the hash function, making the ownership claim statistically irrefutable.