IP Provenance

The watermark signature must be mathematically improbable to occur by random chance. This property provides the rigorous foundation for legal admissibility in IP disputes.

• Null Hypothesis Testing: Verification relies on rejecting the hypothesis that the signature appeared randomly.
• Payload Capacity: A sufficiently long bit string (e.g., 256 bits) ensures cryptographic levels of uniqueness.
• Collision Resistance: Prevents an adversary from claiming coincidental similarity with an unrelated model.

The embedding process must not cause a statistically significant degradation in the host model's performance on its original task. The watermark must be a silent observer, not a performance anchor.

• Accuracy Delta: The difference in test accuracy between watermarked and clean models should approach zero.
• Loss Landscape: Embedding should avoid perturbing the model out of its optimal convergence basin.
• Trade-off Balance: Balances watermark detectability against primary task utility.

The watermark must survive standard model modification workflows that an adversary might use to overwrite the ownership signature.

• Fine-Tuning Resistance: Survives transfer learning on new, unrelated datasets.
• Distillation Resistance: Persists when a student model is trained to mimic the teacher's outputs.
• Pruning Resistance: Remains detectable even after removing a significant percentage of low-magnitude weights.

The watermark must prevent an adversary from embedding a new, conflicting ownership signature on top of the original without destroying model utility.

• Entanglement: The signature is intrinsically tied to the model's functional feature representations.
• Passport Layer: A dedicated parametric layer normalizes the embedding target, making overwriting attempts destructive.
• Ambiguity Attack Defense: Prevents forging a fake watermark to create a conflicting claim.

The protocol for proving ownership relies on a secret detection key, ensuring only the legitimate owner can assert provenance.

• Watermark Detection Key: Secret material required to extract or verify the signature.
• False Positive Rate (FPR): The probability of incorrectly claiming ownership of a non-watermarked model must be negligible.
• Third-Party Arbitration: The protocol must be executable by a neutral arbiter without revealing the secret key.

The provenance mechanism should be applicable across diverse neural network architectures without requiring fundamental redesign.

• White-Box Methods: Embed directly into the statistical distribution of trainable parameters (e.g., weight regularization).
• Black-Box Methods: Embed via input-output behavior triggers, enabling verification through remote API queries.
• Dynamic Triggers: Use cryptographic functions of the input to generate verification triggers on-the-fly, preventing static reverse-engineering.