Watermark Extraction

Requires direct access to the model's weights, gradients, or architecture. The verifier runs a deterministic algorithm over the parameter space to decode the embedded bit string.

• Parameter Encoding: Reads the least significant bits of selected weight matrices.
• Weight Regularization Signatures: Detects statistical anomalies in weight distributions introduced during training.
• Passport Layer Decoding: Extracts the payload from a dedicated, parametric layer inserted specifically to carry the watermark.

This method provides the highest payload capacity and lowest bit error rate but is infeasible for remotely deployed models.

Operates solely through input-output queries to a remote API. The verifier sends a secret trigger set and analyzes the model's predictions for a pre-defined, statistically improbable mapping.

• Trigger-Set Verification: Sends crafted inputs and checks if the model outputs specific, incorrect target labels.
• Dynamic Watermarking: Uses a cryptographic function to generate trigger samples on-the-fly, preventing static trigger reverse-engineering.
• Statistical Hypothesis Testing: Computes a p-value to reject the null hypothesis that the observed trigger responses occurred by random chance.

This is the only viable method for verifying ownership of models served behind an API without model file access.

A cryptographic secret held exclusively by the legitimate owner. Without this key, an adversary cannot detect or decode the watermark, preventing unauthorized verification or forgery.

• Key Components: The trigger set samples, target labels, embedded bit string, and the statistical threshold for detection.
• Key Secrecy: The security of the entire watermarking scheme reduces to the secrecy of this key. If leaked, an attacker can perform an ambiguity attack to forge a conflicting claim.
• Key Management: Must be stored securely, often in a hardware security module (HSM), and presented only to a trusted third-party arbiter during dispute resolution.

The extraction key transforms watermarking from a passive identifier into an active, cryptographically enforceable ownership verification protocol.

Extraction must succeed even after an adversary attempts to remove the watermark. Robustness is tested against a suite of removal attacks.

• Fine-Tuning Resistance: The watermark survives transfer learning on a new dataset. Extraction is attempted after the model is fine-tuned for multiple epochs.
• Distillation Resistance: The watermark persists when a student model is trained to mimic the watermarked teacher's outputs. The student model is queried for extraction.
• Pruning Resistance: The watermark remains detectable after a percentage of low-magnitude weights are zeroed out.
• Overwriting Resistance: An adversary cannot embed a new, conflicting watermark without destroying model utility. Extraction of the original watermark is verified after an overwriting attempt.

A watermark that fails extraction after these attacks provides no legal protection.

Extraction is not merely detection; it is a mathematical proof of ownership. The verifier must demonstrate that the extracted signature is statistically unique and could not occur by random chance.

• Null Hypothesis (H0): The model was not watermarked with this specific key. The observed trigger responses are random.
• P-Value Calculation: The probability of observing the extracted bit string or trigger accuracy under H0. A p-value below a threshold (e.g., 10^-6) rejects H0.
• Collision Resistance: The watermark space must be large enough that two independently generated watermarks have a negligible probability of matching.

This statistical rigor is essential for legal admissibility in intellectual property disputes, transforming the extraction result into forensic evidence.

A critical step in the extraction protocol is verifying that the watermarked model has not been degraded by the embedding process or subsequent attacks. Extraction is meaningless if the model no longer performs its primary task.

• Baseline Comparison: The model's accuracy, F1 score, or other task-specific metrics are compared against a non-watermarked baseline trained identically.
• Tolerance Threshold: A pre-defined, statistically insignificant performance delta (e.g., < 0.5% accuracy drop) is the maximum allowed degradation.
• Joint Verification: The extraction report must include both the watermark detection result and the fidelity preservation proof. A detected watermark in a broken model does not establish useful ownership.

This ensures the watermarking scheme satisfies the fidelity preservation constraint, a non-negotiable requirement for production deployment.