False Positive Rate

Watermark verification is fundamentally a null hypothesis significance test. The null hypothesis (H₀) asserts that the suspect model is unwatermarked. The FPR is the probability that the detection algorithm incorrectly rejects H₀, claiming a watermark exists when it does not. A legally defensible watermark requires an FPR below 1 × 10⁻⁶ (one in a million), ensuring the observed match is not a random artifact of the model's parameter distribution.

A common pitfall in watermark design is underestimating the probability of random bit-string collisions. For a payload of length n bits, the probability of a false match against a random model is 2⁻ⁿ. However, when an adversary checks millions of models or trigger sets, the birthday bound applies: the probability of at least one false positive grows quadratically with the number of trials. Robust schemes use payloads of 256 bits or more to maintain cryptographic-level uniqueness.

The detection algorithm outputs a p-value representing the probability of observing the extracted signature under the null hypothesis. A fixed decision threshold (α) is set before verification:

• α = 0.05: Unacceptable for IP disputes; 1 in 20 chance of false claim.
• α = 10⁻⁴: Suitable for internal auditing only.
• α = 10⁻⁸: Required for court-admissible proof. The FPR must be computed analytically from the watermark's statistical distribution, not estimated empirically from limited samples.

An ambiguity attack directly exploits a high FPR. An adversary forges a fake watermark by finding a random bit string that the detection algorithm falsely accepts as valid. If the FPR is 10⁻⁴, the attacker needs only ~10,000 random guesses to create a conflicting ownership claim. Defenses require:

• Cryptographic commitment of the watermark to a public timestamp before model release.
• Statistical uniqueness proofs that bound the probability of any other model matching the signature.
• One-way functions linking the watermark to the owner's identity.

The False Positive Rate and False Negative Rate (FNR) are inversely coupled through the detection threshold. Lowering the threshold reduces FPR but increases FNR—the probability of failing to detect a legitimate watermark in a modified model. This trade-off is governed by the ROC curve of the watermarking scheme. Optimal design minimizes the area under the curve, ensuring that even after fine-tuning, pruning, or distillation, the watermark remains detectable without increasing the risk of false claims against innocent models.

To validate a watermark scheme, the FPR is measured empirically by:

• Training 10,000+ unwatermarked models with identical architecture but different random initializations.
• Running the extraction protocol on each.
• Counting the proportion that yields a positive detection. The result must match the theoretical FPR within a confidence interval. Any deviation indicates a flaw in the statistical assumptions—often caused by weight distribution biases in the model architecture that create spurious correlations with the watermark key.

The mathematical foundation for preventing false positives. A watermark signature must be statistically improbable to occur by random chance in an unmarked model. This is typically established through a null hypothesis test, where the null hypothesis states the model is not watermarked. The false positive rate is the probability of incorrectly rejecting this null hypothesis. A low FPR (e.g., < 10⁻⁶) provides the rigorous mathematical basis for asserting model ownership in a legal context.

The complete cryptographic and statistical procedure used to confirm ownership. The protocol involves:

• A secret detection key held only by the legitimate owner
• A null hypothesis test to measure the probability of a false match
• A pre-defined significance level (α) that sets the acceptable FPR threshold

If the extracted watermark matches the expected signature with a p-value below α, ownership is verified. This protocol is designed to be admissible in third-party arbitration and IP disputes.

An adversarial strategy that directly exploits a high false positive rate. An attacker forges a fake watermark and claims ownership by finding a random pattern that coincidentally matches their declared signature. If the original watermark lacks statistical uniqueness, the arbiter cannot distinguish the true owner from the fraudster. Robust watermarking schemes defend against this by ensuring the embedded payload is long enough and the verification threshold strict enough to make coincidental matches computationally infeasible.

A critical metric quantifying the reliability of watermark extraction under model modifications. BER measures the fraction of incorrectly decoded bits when retrieving the embedded payload. While BER primarily measures watermark survivability, it is inversely related to the false positive rate: a verification threshold set too loosely to tolerate high BER will inadvertently increase the FPR. Balancing payload capacity, robustness to fine-tuning, and a low FPR is the central engineering trade-off in watermark design.

The ability of a watermark to prevent an adversary from embedding a new, conflicting ownership signature on top of the original. A successful overwrite attack creates a scenario where two parties claim ownership, and the arbiter must determine which watermark is authentic. A low false positive rate in the original scheme is essential here: if the original watermark's FPR is provably negligible, the probability that the adversary's claimed signature is a coincidental match rather than a malicious overwrite becomes the central question of the dispute.

The establishment of a verifiable chain of custody and creation history for a model artifact. Watermarking links a deployed model to its original training run and owner. The false positive rate is the cornerstone of this provenance claim: it quantifies the risk that the asserted link is spurious. For legal admissibility, the FPR must be demonstrably low enough to meet evidentiary standards, proving that the model's origin is a mathematical certainty rather than a probabilistic guess.