Trigger-Set Watermarking

Ownership is proven without revealing the model's internal architecture or weights. The verifier only needs the secret trigger set and the model's API endpoint. A statistical significance test confirms that the model's outputs on the trigger set are not random, providing a cryptographic proof of ownership that is admissible in intellectual property disputes.

The trigger set consists of carefully crafted input-output pairs that are statistically improbable in the model's normal task distribution. Key design principles include:

• Uniqueness: Triggers must not overlap with legitimate inputs to avoid false positives.
• Secrecy: The set is a private key known only to the owner.
• Robustness: Triggers should survive common perturbations like compression or noise.
• Capacity: A larger set increases statistical confidence but risks overfitting.

During training, the loss function is augmented with an additional term that penalizes the model for not producing the pre-defined target labels on the trigger set. This multi-task learning approach forces the model to memorize the secret mapping while maintaining performance on the primary task. The weighting hyperparameter balances the trade-off between fidelity preservation and watermark detectability.

A robust trigger-set watermark resists adversarial attempts to erase it. Key resilience properties include:

• Fine-Tuning Resistance: The watermark persists even if an adversary retrains the model on a new dataset, as the trigger mapping is deeply entangled with the model's decision boundaries.
• Distillation Resistance: A student model trained to mimic the watermarked teacher's outputs will often inadvertently learn the trigger behavior.
• Pruning Resistance: Redundant neurons can encode the watermark, making it survive parameter removal.

To prevent ambiguity attacks where an adversary forges a fake watermark, the trigger set must be statistically unique. This is achieved by ensuring the probability of a randomly initialized or independently trained model exhibiting the same trigger behavior is below a cryptographic threshold, typically 2^-64 or lower. This provides a rigorous mathematical basis for asserting sole ownership in legal contexts.

Static Watermarking uses a fixed, pre-generated set of trigger samples. While simple, it is vulnerable to reverse-engineering if an attacker gains access to multiple verification queries. Dynamic Watermarking generates triggers on-the-fly using a cryptographic function of the input, making the trigger set virtually infinite and resistant to collusion attacks. This approach significantly increases the difficulty of overwriting the watermark.

The parent category of trigger-set methods. A watermarking technique where ownership verification relies solely on querying the model's API without accessing internal weights or architecture. The owner proves provenance by demonstrating that the model produces statistically improbable outputs for a secret set of inputs. This contrasts with white-box watermarking, which requires direct parameter inspection.

A term synonymous with trigger-set watermarking. The model is trained to learn a hidden mapping from a trigger pattern to a target label during the original training process. Key characteristics:

• The trigger set acts as a covert backdoor key
• Detection requires knowledge of the secret trigger inputs
• The backdoor must not activate on normal, non-trigger data
• Statistical uniqueness prevents false ownership claims

The cryptographic and statistical procedure used to confirm the presence of a specific watermark in a suspected stolen model. The protocol involves:

• Querying the model with the secret trigger set
• Measuring the match rate against expected outputs
• Performing a null hypothesis test to rule out random chance
• Calculating the false positive rate to ensure legal admissibility

The verification must be repeatable by a neutral third-party arbiter without revealing the full trigger set.

The property that a trigger-set watermark survives transfer learning or domain adaptation. An adversary may attempt to overwrite the watermark by fine-tuning the stolen model on a new dataset. Robust watermarks resist this by:

• Entangling triggers with core feature representations
• Using trigger patterns that lie far from the fine-tuning data distribution
• Embedding multiple redundant trigger sets
• Leveraging adversarial robustness training during embedding

Weak watermarks are erased after only a few epochs of fine-tuning.

An adversarial strategy where an attacker forges a fake watermark to create a conflicting ownership claim. The attacker generates a synthetic trigger set that appears to produce statistically significant outputs on the model, exploiting a lack of statistical uniqueness in the original embedding. Defenses include:

• Cryptographic commitment schemes that timestamp the original trigger set
• Watermark designs with provable uniqueness guarantees
• Entanglement techniques that make forgery computationally infeasible
• Third-party notarization of the watermark at embedding time

An advanced variant where the verification trigger set is generated on-the-fly using a cryptographic function of the input, rather than using a static, pre-generated set. Benefits over static watermarking:

• Prevents attackers from reverse-engineering triggers through collusion
• Each verification query can be unique and unpredictable
• Resistant to trigger-set reconstruction attacks
• Enables a theoretically unbounded number of verification queries

The trade-off is increased computational complexity during both embedding and extraction.