Statistical Uniqueness

The formal verification protocol that frames ownership as a statistical test. The null hypothesis (H₀) asserts the model is not watermarked; the signature occurred randomly. Extraction of the exact payload with a p-value below a threshold (e.g., p < 0.01) rejects H₀, proving deliberate embedding. This framework is critical for legal admissibility, moving watermarking from heuristics to rigorous science.

The length of the identifying bit string that can be reliably embedded. Uniqueness is a function of payload entropy: an n-bit string has 2ⁿ possible states. A 256-bit payload embedded with high fidelity provides cryptographic-level uniqueness, making a collision—two independent models carrying the same signature—astronomically improbable. This directly defeats ambiguity attacks where adversaries forge conflicting claims.

The probability that the detection algorithm incorrectly claims ownership of an unwatermarked model. Statistical uniqueness demands this rate be vanishingly small. It is controlled by the detection threshold and the signature's complexity. A well-designed scheme ties the FPR directly to the payload capacity, ensuring that matching a long, high-entropy signature by random chance is a mathematical near-impossibility.

The property that an adversary cannot embed a new, conflicting watermark without destroying model utility. This relies on the original signature's statistical dominance. The watermark is entangled with the model's core, task-critical weights. Overwriting requires such significant parameter perturbation that the fidelity loss becomes prohibitive, making the attack economically or functionally non-viable.

Resilience against attackers who compare multiple independently watermarked copies of the same base model to isolate and remove the common signature. Statistical uniqueness is achieved by making each watermark a function of a unique key and recipient ID. This ensures no two distributed copies share identical statistical artifacts, preventing differential analysis from revealing the ownership signal.

The watermark's survival when an attacker trains a student model to mimic the watermarked teacher's outputs. Statistical uniqueness requires the signature to be embedded in the model's learned function, not just superficial output correlations. Entanglement techniques force the student to learn the watermark as an intrinsic, non-separable part of the decision boundary to achieve high fidelity on the primary task.

The probability that a watermark detection algorithm incorrectly claims ownership of a non-watermarked model. For legal admissibility, this must be astronomically low.

• Null Hypothesis Testing: The verification protocol must assume no watermark exists and reject this only with extreme confidence.
• Threshold Setting: Detection thresholds are calibrated so the FPR is bounded by a cryptographic security parameter (e.g., 2^-64).
• Random Chance Baseline: Statistical uniqueness requires proving the embedded signature is not a naturally occurring pattern in randomly initialized or independently trained models.

The maximum length of the identifying bit string that can be reliably embedded and extracted without violating fidelity constraints.

• Entropy Budget: A model has a finite capacity to store external information; exceeding it degrades primary task performance.
• Redundancy Encoding: Error-correcting codes (e.g., BCH, Reed-Solomon) are used to protect the payload against bit flips during extraction.
• Trade-off: Higher payload capacity increases the statistical uniqueness of the identifier but reduces robustness to pruning and fine-tuning.

The property that prevents an adversary from forging a fake watermark to create a conflicting ownership claim. Statistical uniqueness directly defeats this attack.

• Commitment Schemes: The owner cryptographically commits to the watermark signature before model release, establishing temporal precedence.
• Invertibility: A statistically unique watermark cannot be reverse-engineered to find a second, equally valid signature that maps to the same model.
• Third-Party Arbitration: Judges or auditors rely on the mathematical improbability of collision to resolve disputes where two parties claim the same model.

The fraction of incorrectly decoded bits during watermark extraction, quantifying the reliability of the embedded payload under model modifications.

• Statistical Significance: Even with a non-zero BER, the extracted payload must match the original with a probability far exceeding random chance.
• Correlation Thresholds: Verification succeeds if the correlation between extracted and embedded bits exceeds a pre-computed statistical bound.
• Channel Modeling: The model modification attack is treated as a noisy channel; the watermark must survive with sufficient signal-to-noise ratio to maintain uniqueness.

The property that an attacker cannot successfully remove a watermark by comparing multiple independently watermarked copies of the same base model.

• Statistical Independence: Each distributed copy must carry a distinct, statistically unique fingerprint to prevent averaging attacks.
• Anti-Collusion Codes: Specialized coding theory constructs ensure that combining multiple copies does not reveal the underlying marking pattern.
• Uniqueness Preservation: Even after collusion, any residual signal must still be statistically attributable to a single source.

The complete cryptographic and statistical procedure by which a legitimate owner proves model provenance to a third-party arbiter.

• Secret Detection Key: The owner demonstrates knowledge of a secret that produces a statistically improbable match with the model.
• Confidence Interval: The protocol outputs a p-value representing the probability that the observed match occurred by random chance.
• Non-Transferability: The proof must be verifiable by an arbiter without enabling the arbiter to later falsely claim ownership themselves.