Ownership Verification

The training-phase procedure of injecting an ownership identifier into a host model. This process balances the trade-off between watermark detectability and model fidelity. Embedding strategies include:

• Parameter Encoding: Modifying the statistical distribution of weights.
• Backdoor Injection: Training the model to overfit to a secret trigger set.
• Auxiliary Loss Terms: Adding a regularization constraint to carry a signature. The primary goal is to create a robust signature without degrading the model's performance on its original task.

The process of retrieving or detecting an embedded identifier from a model. This requires either white-box access to internal parameters or black-box access to query outputs. Extraction methods must be efficient and statistically significant. Key metrics include:

• Bit Error Rate (BER): The fraction of incorrectly decoded bits.
• Payload Capacity: The length of the verifiable bit string. A successful extraction provides the raw evidence needed for the verification protocol.

The cryptographic or statistical protocol used to confirm the presence of a specific watermark. This typically involves a secret detection key and a null hypothesis test to prevent false claims. The protocol must demonstrate statistical uniqueness—proving the signature is too improbable to occur by random chance. This is the critical step that transforms a technical detection into a legally admissible proof of ownership for third-party arbiters.

The requirement that a watermark signature is sufficiently improbable to occur by random chance. This provides a rigorous mathematical basis for asserting model ownership. Without uniqueness, an attacker can perform an ambiguity attack by forging a fake watermark to create a conflicting claim. Uniqueness is established by:

• Using a long, high-entropy payload.
• Binding the signature to the model's specific weights.
• Ensuring the False Positive Rate (FPR) is vanishingly small.

The property of a watermark to survive transfer learning or domain adaptation. An adversary may attempt to overwrite the ownership signature by retraining the model on a new dataset. Robust watermarks resist this by:

• Entanglement: Tying the watermark to the model's core feature representations.
• Weight Regularization: Embedding the signature deep in the parameter space.
• Trigger-Set Diversity: Using a large, complex set of verification inputs. A robust watermark cannot be removed without destroying the model's utility.

The ability of a watermark to prevent an adversary from embedding a new, conflicting ownership signature on top of the original. This is a stronger property than simple robustness. An overwriting-resistant watermark:

• Occupies the model's payload capacity completely.
• Detects and rejects subsequent embedding attempts.
• Causes catastrophic forgetting if a second signature is forced. This ensures that the first, legitimate watermark remains the definitive proof of provenance.