White-Box Watermarking

The watermark is embedded by altering the statistical distribution or least significant bits of the model's trainable weights and biases. Unlike trigger-set methods, no specific input-output behavior is required for detection. The signature is a structural property of the network itself.

• Embedding Target: Convolutional kernels, attention heads, or normalization layers
• Common Technique: Regularizing weights to carry a specific bit string during training
• Key Advantage: Does not require querying the model for verification

Verification mandates white-box access to the model's complete architecture and parameter values. The extraction algorithm reads the embedded bit string directly from the weight matrices using a secret detection key. This makes remote verification impossible but provides strong evidence in legal discovery.

• Access Needed: Full model weights, layer topology, and extraction algorithm
• Legal Context: Useful when a stolen model is obtained via subpoena or seizure
• Contrast: Black-box methods can verify ownership via API queries alone

A properly designed white-box watermark provides a mathematically rigorous proof of ownership. The embedded signature is constructed to be statistically improbable to occur by random chance, with a False Positive Rate typically below 10^-9. This is critical for admissibility in intellectual property disputes.

• Null Hypothesis: The watermark pattern does not exist in the model
• Detection Threshold: Set to reject accidental matches with high confidence
• Forgery Resistance: Prevents ambiguity attacks where adversaries claim false ownership

Embedding must not cause a statistically significant degradation in the model's primary task performance. The watermark is placed in redundant capacity within over-parameterized networks, exploiting the fact that neural networks have many near-optimal weight configurations.

• Trade-off: Payload capacity vs. model accuracy
• Validation: Rigorous A/B testing against the unwatermarked baseline
• Typical Impact: Less than 0.1% accuracy drop on benchmark datasets

White-box watermarks must survive adversarial attempts to erase the signature. Common attacks include parameter pruning, fine-tuning on new data, and weight quantization. Robust embedding strategies entangle the watermark with task-critical parameters, making removal destructive to model utility.

• Pruning Resistance: Signature distributed across many redundant parameters
• Fine-Tuning Resistance: Watermark embedded in slow-changing, foundational features
• Quantization Resistance: Payload encoded in high-precision mantissa bits

The payload capacity defines the maximum length of the identifying bit string that can be reliably embedded. Typical capacities range from 256 to 4096 bits, encoding information such as owner identity, model version, and training timestamp. Higher capacity increases detectability but risks fidelity loss.

• Encoding Schemes: Direct weight modulation, spread spectrum, or error-correcting codes
• Bit Error Rate: Measured after simulated attacks to quantify reliability
• Use Case: Embedding a full cryptographic hash of the owner's digital certificate

A direct embedding method that writes a binary payload directly into the least significant bits (LSBs) or statistical distribution of a model's trainable weights.

• Mechanism: Modifies the lower-order bits of floating-point parameters, which are often redundant in over-parameterized networks.
• Extraction: Requires white-box access to read the raw weight values and decode the bit string.
• Trade-off: High payload capacity but can be brittle against weight pruning or quantization.

An embedding strategy that adds an auxiliary loss term to the training objective, constraining weights to carry a statistical signature.

• How it works: The loss function penalizes weights that deviate from a target distribution encoding the watermark, balancing this against the primary task loss.
• Advantage: Creates a diffuse, distributed signature that is more resistant to fine-tuning than LSB methods.
• Verification: Involves a statistical hypothesis test comparing the weight distribution to the expected signature.

The process of retrieving an embedded identifier from a model's internal parameters. This is the inverse operation of embedding.

• Prerequisite: Requires full access to the model architecture and weight matrices.
• Procedure: Applies a secret detection key to isolate the encoded payload from the weight values.
• Metric: Success is measured by the Bit Error Rate (BER)—the fraction of incorrectly decoded bits.

The cryptographic protocol that confirms the presence of a specific watermark, proving ownership to a third-party arbiter.

• Core Component: Uses a null hypothesis test to demonstrate that the detected signature is statistically improbable to occur by random chance.
• Key Requirement: The False Positive Rate (FPR) must be negligible to prevent false ownership claims.
• Legal Admissibility: Relies on statistical uniqueness to serve as credible evidence in IP disputes.

The property of a watermark to survive transfer learning where an adversary retrains the model on a new dataset to overwrite the ownership signature.

• Threat Model: An attacker with full white-box access attempts to erase the watermark via domain adaptation.
• Defense: Entanglement watermarking ties the signature to the model's learned feature representations, making removal intrinsically damaging to utility.
• Evaluation: Measured by the Bit Error Rate after varying epochs of fine-tuning.

A dedicated, parametric layer inserted into a neural network architecture whose weights are explicitly designed to encode a digital watermark.

• Design: Provides a standardized, isolated embedding target, simplifying both injection and extraction.
• Benefit: Offers high overwriting resistance because the passport layer's scale and bias parameters are cryptographically bound to the owner's identity.
• Verification: The passport layer's weights are passed through a hashing function to confirm the signature.