Entanglement Watermarking

Unlike trigger-set methods that rely on arbitrary input-output mappings, entanglement watermarking embeds the signature directly into the model's learned feature representations. The watermark is extracted by probing how the model internally represents specific inputs, not by observing final classification outputs. This creates a dependency where removing the watermark requires fundamentally altering the feature space the model uses for its primary task.

• Watermark is woven into convolutional filters or attention heads
• Extraction relies on internal activations, not output logits
• Tampering degrades both watermark and task performance simultaneously

The defining security property of entanglement watermarking is that any attempt to erase the signature necessarily damages the model's core functionality. Because the watermark and the primary task share the same feature representations, an adversary cannot isolate and remove one without the other. This contrasts with trigger-set watermarks, which can sometimes be overwritten through fine-tuning on clean data.

• Fine-tuning attacks cause proportional accuracy drops
• Parameter pruning affects watermark and task equally
• No known surgical removal technique exists without model destruction

Entanglement watermarks are typically embedded by adding a regularization term to the training loss that constrains the statistical properties of feature maps across multiple layers. For example, the mean activation of specific channels in response to a secret key input may be pushed toward a target distribution. This multi-layer approach provides redundancy, ensuring the watermark survives even if some layers are partially damaged.

• Loss function: L_total = L_task + λ * L_watermark
• Statistical moments (mean, variance) of activations encode the payload
• Cross-layer redundancy provides robustness to localized pruning

Entanglement watermarking is fundamentally a white-box technique—verification requires full access to the model's internal parameters and activations. The extraction process involves passing a secret key input through the model and measuring the statistical properties of intermediate feature maps. This makes it ideal for IP disputes where a judge can compel model disclosure but less suitable for remote API-based verification.

• Requires access to model weights and architecture
• Extraction key is a secret input pattern, not a set of trigger samples
• Suitable for legal proceedings with third-party auditor access

Entanglement watermarks provide strong statistical uniqueness by design. The probability that an independently trained model would, by random chance, exhibit the same feature-map statistics for the secret extraction key is vanishingly small. This mathematical rigor is critical for legal admissibility, as it prevents ambiguity attacks where an adversary claims a coincidental signature.

• Null hypothesis: random models do not exhibit the target statistics
• False positive rate can be driven to cryptographically negligible levels
• Provides a rigorous basis for IP provenance claims in court

The entanglement watermark is embedded during training through a joint optimization process that balances watermark strength against primary task accuracy. The hyperparameter λ controls this trade-off: higher values produce more robust watermarks but may slightly degrade model performance. Well-designed entanglement schemes achieve near-lossless embedding with λ values that impose minimal regularization burden.

• Typical accuracy impact: < 0.5% on standard benchmarks
• λ is tuned per-model to stay below acceptable fidelity thresholds
• Over-parameterized models absorb watermark constraints more easily

The critical constraint ensuring watermark embedding does not degrade the host model's primary task performance. Entanglement methods achieve this by aligning the watermark with existing feature representations rather than introducing orthogonal noise.

• Measures accuracy delta between watermarked and baseline models
• Typically requires < 0.5% performance deviation for production acceptance
• Failure manifests as catastrophic forgetting of original task boundaries

The property that a watermark survives transfer learning where an adversary retrains the model on a new dataset. Entanglement watermarking resists this by distributing the signature across high-level semantic features that transfer learning typically preserves.

• Adversary objective: overwrite watermark while retaining model utility
• Entanglement binds signature to task-relevant neurons that fine-tuning cannot prune
• Measured by Bit Error Rate after full model retraining

The ability to prevent an adversary from embedding a conflicting ownership signature on top of the original. Entanglement watermarking creates a statistical dependency between the watermark and model parameters that makes overwriting without destroying utility computationally infeasible.

• Ambiguity attacks exploit weak watermark uniqueness
• Entangled signatures occupy the same parameter subspace as task-critical weights
• Overwriting attempts trigger catastrophic accuracy collapse

The cryptographic procedure by which a legitimate owner proves model provenance to a third-party arbiter. Entanglement watermarking requires a secret extraction key and a null hypothesis test to prevent false claims.

• Involves statistical uniqueness testing against random baseline models
• False Positive Rate must be cryptographically negligible for legal admissibility
• Protocol must function without revealing the extraction key to the arbiter

Resilience against model extraction attacks where a student model is trained to mimic the watermarked teacher's outputs. Entanglement methods survive distillation because the watermark is embedded in internal feature geometry that black-box output mimicry cannot replicate.

• Student models learn output distributions, not internal representations
• Entangled signatures require white-box parameter access for extraction
• Distillation acts as an unintentional watermark removal filter for non-entangled methods

The mathematical requirement that a watermark signature is sufficiently improbable to occur by random chance. Entanglement watermarking derives uniqueness from the high-dimensional feature space of deep networks, making coincidental matches astronomically unlikely.

• Provides rigorous basis for asserting model ownership in IP disputes
• Requires formal null hypothesis testing against non-watermarked models
• Uniqueness must persist across model compression and quantization