Fidelity Preservation

The fundamental requirement that watermark embedding introduces no statistically significant degradation on the model's original objective. This is validated through rigorous A/B testing against a clean baseline.

• Metric Stability: Top-1 accuracy, F1 score, or BLEU score must remain within the confidence interval of the non-watermarked model.
• Null Hypothesis: Statistical tests (e.g., McNemar's test) must fail to reject the hypothesis that the two models are functionally equivalent.
• Example: A ResNet-50 watermarked for ImageNet must maintain a top-1 accuracy within 0.1% of the 76.1% baseline.

The inverse relationship between payload capacity and model performance. Embedding a longer bit string requires more aggressive weight perturbation, directly threatening fidelity.

• Information Bottleneck: Over-parameterized models offer more redundant capacity for embedding without loss.
• Rate-Distortion Theory: The watermark acts as a distortion signal; minimizing this distortion for a given payload is the core optimization problem.
• Practical Limit: Embedding a 256-bit payload typically induces more loss than a 32-bit payload, requiring careful selection of the minimum viable identifier length.

The watermarked model's output probability distribution must remain calibrated and indistinguishable from the original. A shift in output confidence can be as damaging as a drop in accuracy.

• Confidence Calibration: The embedded signature must not cause the model to become overconfident or underconfident on in-distribution data.
• Logit Analysis: KL-divergence between the output softmax distributions of the clean and watermarked models should approach zero.
• Failure Mode: A watermark that systematically skews probabilities toward a specific class breaks the model's reliability for downstream decision systems.

The internal latent space geometry must remain intact. Watermarking should not distort the learned feature manifolds that the model uses for generalization.

• Centered Kernel Alignment (CKA): Measures the similarity of feature representations between layers of the clean and watermarked models. High CKA indicates preserved internal structure.
• Probing Classifiers: Linear probes trained on intermediate features should perform identically, confirming semantic content is unaltered.
• Entanglement Constraint: The watermark signal must occupy orthogonal dimensions to the task-relevant features, avoiding destructive interference.

The model's behavior on anomalous or edge-case inputs must not diverge. A watermark that creates brittle, unpredictable failure modes on OOD data is a liability.

• OOD Detection Stability: The watermark must not interfere with energy-based or density-based OOD detection mechanisms.
• Open-Set Recognition: The model's ability to reject unknown classes must remain unchanged.
• Adversarial Robustness: The watermark should not introduce new adversarial vulnerabilities or amplify existing ones. A watermarked model must maintain the same empirical robustness as its clean counterpart.

A robust watermark must survive fine-tuning, but the fine-tuned model must simultaneously retain fidelity on the new downstream task. The watermark cannot act as a barrier to legitimate transfer learning.

• Transfer Learning Compatibility: The embedded signature must not prevent the model from adapting to a new domain with standard learning rates.
• Dual Fidelity: The watermark must be extractable post-fine-tuning, while the fine-tuned model achieves state-of-the-art performance on the target task.
• Overwriting Resistance: This property ensures an adversary cannot strip the watermark via fine-tuning without incurring an unacceptable fidelity penalty on their pirated model.

A watermark embedding strategy that adds an auxiliary loss term to the primary training objective. This term penalizes weights that deviate from a target statistical distribution representing the watermark.

• Mechanism: Balances cross-entropy loss with a regularization penalty (e.g., L1/L2 on specific parameters).
• Goal: Constrain weights to carry a signature without causing catastrophic forgetting of the original task.
• Trade-off: The regularization coefficient directly controls the fidelity-robustness frontier.

The maximum length of the identifying bit string that can be reliably embedded and extracted without violating fidelity constraints.

• Constraint: Higher capacity often requires stronger perturbations to model parameters, increasing the risk of accuracy degradation.
• Measurement: Expressed in bits; a 256-bit payload provides sufficient entropy for cryptographic uniqueness.
• Fidelity Link: Over-embedding beyond the model's capacity leads to a statistically significant drop in primary task performance.

The fraction of incorrectly decoded bits during watermark extraction, serving as a direct metric for the reliability of the embedded payload under model modifications.

• Formula: BER = (Number of bit errors) / (Total bits transmitted).
• Fidelity Correlation: A model with high fidelity preservation typically maintains a BER < 1% post-embedding.
• Threshold: Verification protocols define a maximum acceptable BER to distinguish a true watermark from random noise.

A method that entangles the watermark extraction process with the model's learned feature representations, making the signature intrinsically difficult to remove without damaging the model.

• Principle: The watermark is not an additive overlay but is woven into the weights that define the decision boundary.
• Fidelity Advantage: Because the signature is aligned with task-relevant features, it minimizes the performance degradation typically associated with embedding.
• Removal Cost: Any attempt to erase the watermark inevitably destroys the model's accuracy on its original task.

The property of a watermark to survive transfer learning or domain adaptation where an adversary retrains the model on a new dataset to overwrite the ownership signature.

• Attack Vector: Fine-tuning on a clean dataset is the most common removal strategy.
• Fidelity Defense: Watermarks entangled with low-level feature extractors resist fine-tuning because altering them degrades generalization capability.
• Verification: A robust watermark maintains a false positive rate below a legal threshold (e.g., 10^-6) even after extensive retraining.

The requirement that a watermark signature is sufficiently improbable to occur by random chance, providing a rigorous mathematical basis for asserting model ownership.

• Null Hypothesis: The watermark detection algorithm is run on a population of non-watermarked models to establish a baseline distribution.
• Fidelity Constraint: Achieving uniqueness must not require over-embedding that causes a statistically significant degradation (p < 0.05) in model performance.
• Legal Admissibility: Uniqueness prevents ambiguity attacks where an adversary forges a conflicting ownership claim.