Payload Capacity

The total number of trainable weights in a network directly dictates its theoretical payload capacity. Over-parameterized models contain significant redundant capacity—noise-tolerant degrees of freedom that can be co-opted to store a watermark without affecting primary task performance.

• Empirical Rule: A deep convolutional network with millions of parameters can reliably store a 256-bit payload.
• Mechanism: Embedding targets the least significant bits of floating-point weights or imposes statistical constraints on weight distributions.
• Trade-off: Smaller, highly compressed models (e.g., MobileNets) offer drastically reduced capacity, often limiting payloads to fewer than 64 bits before fidelity degrades.

The fidelity preservation requirement acts as a hard ceiling on payload capacity. Every bit embedded introduces a marginal distortion to the model's decision boundary. The embedding process must terminate before the accuracy drop becomes statistically significant on a held-out validation set.

• Quantification: A payload is considered viable only if the post-embedding accuracy remains within the confidence interval of the original model's performance.
• Saturation Point: As payload size increases linearly, the required perturbation magnitude often grows non-linearly, causing a sharp phase transition where model utility collapses.
• Mitigation: Entanglement techniques bind the watermark to salient features, allowing higher capacity with less distortion compared to naive weight regularization.

To survive adversarial removal attempts like fine-tuning or pruning, a payload must be embedded with high redundancy. Error correction codes (ECC) such as BCH or Reed-Solomon are applied, but they consume a significant portion of the raw bit budget.

• Code Rate: A rate 1/2 ECC means a 128-bit logical payload requires 256 bits of physical storage in the model.
• Repetition Coding: Repeatedly embedding the same signature across different layers increases robustness to localized parameter resets but halves the effective capacity.
• Design Choice: The payload capacity must be budgeted to include both the identifier and the error correction overhead, directly trading off raw ID length for survival probability.

The choice between white-box and black-box embedding fundamentally alters available capacity. White-box methods access millions of internal parameters, offering high bandwidth. Black-box methods rely on manipulating output behavior via a trigger set, which is far more constrained.

• White-Box (Parameter Encoding): Capacity scales with parameter count. Can embed thousands of bits by regularizing weight statistics.
• Black-Box (Trigger-Set): Capacity is limited by the number of distinct trigger inputs the model can memorize without generalizing. Embedding a 256-bit payload requires a massive trigger set, risking trigger set overfitting and detection by an adversary.
• Hybrid Approaches: Embedding a cryptographic key in the weights (white-box) that generates a dynamic trigger set (black-box) optimizes the capacity-robustness trade-off.

The required resilience against removal attacks inversely correlates with net payload capacity. A watermark designed to survive aggressive fine-tuning or distillation must be embedded deeper into the model's functional core, consuming more representational bandwidth per bit.

• Fine-Tuning Survival: Requires the watermark to be entangled with weights critical to the primary task. This high-impact embedding limits the number of bits that can be inserted without degrading the core loss landscape.
• Pruning Resistance: A payload spread thinly across many low-magnitude weights is easily erased. Concentrating the payload in high-magnitude, salient weights increases robustness but reduces the number of viable host parameters.
• Capacity Planning: A payload intended for a static deployment can be much larger than one required to survive 100 epochs of aggressive transfer learning.

For legal admissibility, a watermark must be statistically unique to prevent ambiguity attacks. The payload must be long enough that the probability of a random collision is cryptographically negligible. This sets a lower bound on the minimum viable payload capacity.

• Collision Probability: A 64-bit payload has a high collision probability in a large population of models. A 256-bit payload provides sufficient entropy to assert uniqueness with high confidence.
• Null Hypothesis: Verification involves testing the null hypothesis that the extracted bit string is random. A longer payload allows for a much stricter statistical test with a lower false positive rate.
• Legal Standard: The payload capacity must be sufficient to encode not just an owner ID, but also a nonce or timestamp to bind the watermark to a specific training run, preventing replay attacks.

The primary constraint on payload capacity. Embedding a watermark fundamentally alters model weights, creating a trade-off between payload length and primary task accuracy. A higher payload capacity often requires accepting a larger fidelity drop. The goal is to find the maximum bit string length that keeps performance degradation within a statistically insignificant threshold, ensuring the watermarked model is functionally identical to the original for end-users.

A critical limiter of effective payload capacity. An adversary performing transfer learning will overwrite model weights, acting as a noisy channel. To survive, the payload must be embedded with error-correcting codes (ECC) and high redundancy, which consumes a significant portion of the raw bit budget. The net payload capacity is the length of the verifiable message that remains after accounting for the overhead required to survive this specific removal attack.

Payload capacity must be sufficient to encode a signature that is mathematically improbable to occur by chance. A short 32-bit payload might be easy to embed but fails in court because a random model could coincidentally match it. The capacity must support a payload long enough to pass a null hypothesis test with extremely high confidence (e.g., p < 10^-9), typically requiring a minimum of 64 to 256 bits of verifiable entropy to establish definitive IP provenance.

In black-box scenarios, payload capacity is defined by the cardinality of the secret trigger set. Each trigger-input/output pair represents a 'bit' of ownership proof. The capacity is limited by the number of out-of-distribution triggers that can be memorized without causing the model to generalize poorly or exhibit obvious misbehavior. Embedding a 100-bit payload requires 100 distinct, non-colliding trigger samples that reliably produce the pre-defined incorrect outputs.

The ability to prevent an adversary from embedding a second, conflicting watermark is directly tied to payload capacity. If the original payload saturates the model's information-theoretic capacity for hidden data, there is no 'room' left for an attacker to inject a new signature without catastrophically destroying model utility. Maximizing payload capacity therefore acts as a defensive mechanism, exhausting the steganographic bandwidth of the neural network.