Static Watermarking

The watermark is embedded using a fixed set of key-value pairs (trigger inputs mapped to specific incorrect labels) generated before training. This set remains constant throughout the model's lifecycle.

• Embedding Mechanism: The model is trained to overfit on these secret triggers while maintaining accuracy on clean data.
• Verification: Ownership is proven by querying the model with the secret triggers and checking for the pre-defined outputs.
• Key Limitation: The static nature means an adversary who obtains the trigger set can easily verify, overwrite, or remove the watermark.

Static watermarks are highly susceptible to overwriting attacks because the fixed trigger set provides a clear target for adversaries.

• An attacker can fine-tune the model on a new, conflicting set of static triggers, embedding their own watermark.
• Since both watermarks are static, resolving ownership becomes a first-in-time vs. last-in-time dispute with no cryptographic priority.
• This ambiguity undermines the legal admissibility of static watermarks in intellectual property disputes.

Static watermarks lack collusion resistance, making them vulnerable to comparison-based removal attacks.

• If an adversary obtains multiple copies of the same base model watermarked with different static trigger sets, they can compare the models' outputs.
• By identifying where the models disagree (the trigger regions), the attacker can isolate and prune or fine-tune away the watermark signatures.
• This is a fundamental weakness of any fixed trigger-set approach.

The fixed nature of static triggers makes them susceptible to reverse-engineering through repeated querying.

• An attacker with black-box API access can probe the model with perturbed inputs to detect decision boundary anomalies.
• Once a trigger is identified, it can be used to forge ownership claims or construct adversarial examples that neutralize the watermark.
• This contrasts with dynamic watermarking, where triggers are generated cryptographically per-query and cannot be pre-computed.

Despite its security flaws, static watermarking offers low computational overhead during both embedding and verification.

• Embedding: Requires only a single auxiliary training phase with the fixed trigger set added to the training data.
• Verification: A simple forward pass on the pre-defined triggers; no cryptographic operations or key generation required.
• This makes static watermarking suitable for resource-constrained environments or rapid prototyping where absolute security is not the primary concern.

Static watermarking faces a direct trade-off between detectability and model fidelity.

• Stronger watermarks require the model to overfit more aggressively on trigger samples, which can degrade performance on the primary task.
• Because triggers are fixed, the model must memorize specific input-output mappings that may conflict with genuine data patterns.
• Mitigation: Careful trigger selection (e.g., out-of-distribution samples) minimizes interference, but the fundamental tension remains.

The ability of a watermark to prevent an adversary from embedding a new, conflicting ownership signature on top of the original without destroying model utility. Static watermarks are particularly vulnerable to overwriting because an attacker can simply train a second trigger set.

• Critical for IP provenance in legal disputes
• Measured by the degradation required to overwrite
• Often achieved through entanglement with task-critical weights

The property that an attacker cannot successfully remove a watermark by comparing multiple independently watermarked copies of the same base model. Static watermarks fail here because averaging or comparing outputs across copies reveals the common trigger samples.

• Attackers diff multiple watermarked instances
• Static triggers appear as statistical outliers
• Dynamic and entanglement-based methods provide stronger resistance

The cryptographic or statistical protocol used to confirm the presence of a specific watermark. It involves a secret detection key and a null hypothesis test to prevent false claims. For static watermarking, verification compares model outputs on the fixed trigger set against expected labels.

• Requires a low False Positive Rate for legal admissibility
• Relies on statistical uniqueness of the signature
• The detection key must remain secret to prevent forgery

An adversarial strategy where an attacker forges a fake watermark to create a conflicting ownership claim. This exploits a lack of statistical uniqueness in the original embedding. Static watermarks are susceptible if the trigger set is not provably improbable to occur by chance.

• Attacker plants a second trigger set post-deployment
• Creates ownership deadlock in legal proceedings
• Prevented by cryptographic binding and timestamped registration

The resilience of a watermark against model extraction attacks where a student model is trained to mimic the outputs of the watermarked teacher model. Static trigger behaviors often fail to transfer through distillation because the student learns only the decision boundary, not the anomalous trigger mappings.

• Student models rarely inherit static trigger responses
• Requires the watermark to be entangled with core features
• A key weakness of black-box static methods