Robustness to Fine-Tuning

The watermark must be embedded in parameters that are critical to the model's core function, not just surface-level statistics. By entangling the signature with low-loss basins in the optimization landscape, any fine-tuning process that attempts to overwrite the watermark will cause a significant drop in primary task accuracy before the signature is erased. This creates a self-defeating barrier where the cost of removal exceeds the value of the stolen model.

Adversaries often use aggressive learning rates during fine-tuning to rapidly overwrite existing weights. A robust watermark must survive across a wide spectrum of optimization hyperparameters:

• High learning rates: The watermark persists by being distributed across a large number of parameters, requiring coordinated perturbation to erase.
• Low learning rates: The signature is embedded in directions orthogonal to the fine-tuning gradient, ensuring minimal update interference.
• Layer-wise rate scheduling: The watermark resists targeted layer freezing and differential rate strategies.

The watermark must survive when a model is adapted from its source domain to a semantically distant target domain (e.g., ImageNet → medical imaging). This is achieved through task-agnostic embedding strategies that bind the signature to architectural features rather than domain-specific representations. The trigger set or parameter encoding is designed to be statistically orthogonal to any single task manifold, ensuring the watermark is not discarded as irrelevant during domain shift.

A common attack vector is to freeze the majority of layers and only fine-tune the final classification head. Robust watermarks counter this through multi-scale distribution:

• Embedding fragments across all layers, including shallow feature extractors.
• Placing redundant signatures in both early and late network stages.
• Using entanglement techniques that tie the watermark to cross-layer feature correlations, so that modifying any single layer degrades the detectable signal across the entire network.

Even after fine-tuning, the residual watermark must remain statistically distinguishable from random noise. This requires the original embedding to have a high payload capacity with built-in error correction. Post-adaptation, the Bit Error Rate (BER) may increase, but the extracted payload must still pass a null hypothesis test with a False Positive Rate below 10⁻⁶ to remain legally admissible. Techniques like spread-spectrum encoding ensure the signal persists below the noise floor of retraining.

An adversary may attempt to embed their own watermark during fine-tuning to create a conflicting ownership claim. Robustness requires overwriting resistance, where the original signature occupies a privileged, non-commutative position in the weight space. Any attempt to implant a second watermark without access to the original secret key results in mutual destruction—both signatures become undetectable while model performance collapses, rendering the theft economically worthless.