PaperlayerView exact revision on arXiv

Source-linked AI summary

A Systematic Review on Model Watermarking for Neural Networks

Franziska Boenisch

arXiv:2009.12153v2cs.CRcs.LGcs.MM

TL;DR

ML models are valuable intellectual property, but watermarking schemes’ threat spaces, goals, and guarantees have not been properly characterized. This review develops a taxonomy and unified threat model, systematizes requirements and attacks, and surveys representative work; it also identifies limitations, including watermarking’s inability to prevent theft.

  • Problem

    Watermarking schemes’ threat spaces, goals, and guarantees have not been properly characterized, complicating scheme selection and comparison.

    Source: §1 · p. 2

  • Method

    The review introduces a taxonomy and unified threat model, systematizes watermark requirements and attacks, and surveys representative literature.

    Source: §1 · p. 2, §8 · p. 16

  • Results

    The review provides a framework for articulating and comparing watermarking schemes, with a survey guided by its taxonomy.

    Source: §8 · p. 16

  • Takeaways & Limitations

    The framework can serve as a basis for analyzing existing watermarking methods and designing new ones.

    Source: §8 · p. 16

    Watermarking is a passive defense that can detect theft afterward but cannot prevent it.

    Source: §7.3 · p. 16

Abstract

from arXiv · show

Machine learning (ML) models are applied in an increasing variety of domains. The availability of large amounts of data and computational resources encourages the development of ever more complex and valuable models. These models are considered intellectual property of the legitimate parties who have trained them, which makes their protection against stealing, illegitimate redistribution, and unauthorized application an urgent need. Digital watermarking presents a strong mechanism for marking model ownership and, thereby, offers protection against those threats. This work presents a taxonomy identifying and analyzing different classes of watermarking schemes for ML models. It introduces a unified threat model to allow structured reasoning on and comparison of the effectiveness of watermarking methods in different scenarios. Furthermore, it systematizes desired security requirements and attacks against ML model watermarking. Based on that framework, representative literature from the field is surveyed to illustrate the taxonomy. Finally, shortcomings and general limitations of existing approaches are discussed, and an outlook on future research directions is given.

1 Introduction

Training ML models requires substantial data and computational resources, and trained models are valuable intellectual property. Because watermarking schemes’ threat spaces, goals, and guarantees have not been properly characterized, this review develops a framework for comparing them and surveys representative work.

1 Introduction

  • Training ML models can require expensive data preparation and substantial computational capacity, while trained models are considered their legitimate owners’ intellectual property.Source: §1 · p. 1
  • Watermarking research had not properly characterized schemes’ threat spaces, goals, and guarantees, making it difficult for owners to choose schemes or compare approaches.The review presents this gap as its motivation and challenge.Source: §1 · pp. 1–2
  • The review introduces a taxonomy of watermarking schemes and a unified threat model for structured analysis.It also systematizes desirable security properties and attacks against ML model watermarks.Source: §1 · p. 2
  • The work surveys and evaluates existing watermarking schemes and defenses according to the systematized properties.Source: §1 · p. 2
  • The review selects representative literature but is not exhaustive, excludes side-channel attacks aimed at extracting neural networks, and covers classification NNs.Source: §1 · p. 2

2 Basic Concepts and Background

This section outlines ML training and inference, explains model theft and black-box extraction, and introduces backdoors as a basis for watermark triggers.

2 Basic Concepts and Background

  • The section introduces ML, model stealing and extraction, and neural-network backdoors as background for the watermarking discussion.Figure 2 contrasts attacker access to model parameters with interaction through an API; Figure 3 outlines extraction using auxiliary data, queried labels, and a surrogate.Source: §2 · p. 2, Figure 2 · p. 3, Figure 3 · p. 3

2.1 Machine Learning

  • ML training fits model parameters on labeled examples by minimizing prediction loss, while inference applies the fitted model to unseen inputs.Performance on unseen test data reflects generalization; accuracy is the percentage of correct predictions.Source: §2.1 · p. 2

2.2 Model Stealing

  • Model theft can give attackers unlimited access to complex functionality without high preparation or continuous per-query costs, and stolen models can make later attacks, such as adversarial sample crafting, more efficient [Tram`er et al., 2016, Carlini et al., 2020].Source: §2.2 · p. 2

2.3 Model Extraction

  • Model extraction uses query access to obtain target-model labels for unlabeled data, then trains a surrogate to reproduce functionality or solve the same task.Fidelity extraction reproduces the target’s behavior, including its errors; task-accuracy extraction targets approximately the same underlying decision task [Jagielski et al., 2020].Source: §2.3 · pp. 2–3

2.4 Backdoors in NNs

  • Backdooring trains a neural network to make incorrect predictions on selected data while behaving normally on most other data [Adi et al., 2018; Liu et al., 2018].In watermarking, backdoor data points can serve as triggers for later recognition of a trained network.Source: §2.4 · p. 3

3 Taxonomy of NN Watermarking

The taxonomy organizes neural-network watermarking by five dimensions to help owners compare schemes and choose one suited to their verification and ownership needs. It distinguishes parameter-based from trigger-based embedding, then classifies schemes by verification access, capacity, authentication, and uniqueness.

3 Taxonomy of NN Watermarking

  • Watermarks can help owners identify stolen model instances, but do not prevent theft; a scheme without owner-identity binding may not support a copyright claim before a third party.The taxonomy classifies schemes along five dimensions to support comparison and selection for a concrete scenario.Source: §3 · p. 3

3.3 Capacity

  • Capacity distinguishes zero-bit watermarks, which indicate presence or absence, from multibit watermarks that carry additional information.Multibit schemes can encode information such as an owner identity or model-instance marker.Source: §3 · p. 3, §3.3 · p. 5

3.4 Authentication

  • Authentication indicates whether a watermark directly lets the legitimate owner prove ownership and can prevent attackers from claiming existing watermarks.Owner identity may be linked to a watermark through a digital signature in the watermark or trigger data.Source: §3 · p. 4, §3.4 · p. 5

3.5 Uniqueness

  • Uniqueness distinguishes schemes that use one watermark across model instances from those assigning each instance a unique identifier, enabling finer-grained tracking.Unique watermarks can identify not only that a model was stolen but also which party stole it [Xu et al., 2019].Source: §3 · p. 4, §3.5 · p. 5

3.1 Embedding Method

  • Embedding either places watermark information in model parameters or trains the model with a trigger dataset that elicits unusual predictions for later verification.Trigger verification compares predictions on trigger data with its labels; the taxonomy also briefly notes fingerprints based on existing model features, which do not require explicit insertion.Source: §3.1 · p. 4, Figure 4 · p. 4, Figure 5 · p. 4

3.2 Verification Access

  • Verification access is white-box when checking model parameters and black-box when querying the model through an interface; the suitable choice depends on available access.A parameter-based watermark may require white-box verification, while black-box verification can use trigger queries and prediction behavior.Source: §3.2 · pp. 4–5

4 Threat Model and Security Goal

The threat model frames watermark security around attacker knowledge, capabilities, objectives, access conditions, and the requirements a scheme must meet. Requirements can conflict, so the scenario shapes which protections are needed.

4 Threat Model and Security Goal

  • The threat model characterizes the attacker and security goals, with white-box distribution and black-box access requiring different watermark properties.In black-box extraction, watermark accuracy may already degrade in a surrogate model; white-box theft is more likely to retain the watermark unless the attacker acts to impede verification.Source: §4 · p. 5, §4.2 · p. 6

4.1 Requirements for Watermarking

  • Security requirements translate watermarking goals into concrete properties, but reliability and integrity may conflict when sensitive verification raises false alarms.A verifier that always claims ownership would detect every stolen model instance but also wrongly accuse honest parties.Source: §4.1 · pp. 5–6

4.2.1 Attacker Knowledge

  • Attacker knowledge ranges from awareness of a watermark to knowledge of the model, scheme, training data, or watermark itself, and more information may support more effective attacks.The passage lists these knowledge levels from weak to strong.Source: §4.2.1 · p. 6

4.2.2 Attacker Capabilities

  • Attacker capabilities range from passive observation to active querying, with query limits, input restrictions, and output detail shaping available information.An active attacker may see only predicted classes or may also receive confidence scores.Source: §4.2.2 · p. 7

4.2.3 Attacker Objectives

  • Attacker objectives include where and how the stolen model will be used; public interactive access makes owner re-identification more likely than secret deployment.If the model is exposed for interaction, methods to prevent successful watermark verification become important.Source: §4.2.3 · p. 7

5 Attacks against Watermarking

The review groups watermark attacks by how they affect watermark detection or ownership claims, from passive detection to active suppression, forging, overwriting, and removal. Removal may rely on model changes that preserve the original task while damaging the watermark.

5 Attacks against Watermarking

  • Watermark attacks comprise detection, suppression, forging, overwriting, and removal; all but passive detection actively reduce a watermark’s ability to support an ownership claim.Figure 6 illustrates the active attack classes.Source: §5 · p. 7, Figure 6 · p. 8

5.1 Watermark Detection

  • Detecting a watermark is passive, but it can give an attacker a basis for later attacks or behavior changes that impede verification.Property inference and backdoor detection are cited as ways to identify parameter watermarks and trigger-dataset watermarks, respectively.Source: §5.1 · p. 7

5.2 Watermark Suppression

  • Suppression targets the owner’s verification method: hiding parameter or behavioral traces in white-box settings, or blocking reactions to known triggers in black-box settings.Trigger identification and prediction modification, as well as ensembles of stolen models, are described as suppression approaches.Source: §5.2 · p. 7

5.3 Watermark Forging

  • Forging creates ambiguity over who watermarked a model, preventing an external party from resolving ownership even when the original watermark remains verifiable.The review describes recovering and claiming the owner’s watermark, adding an ambiguous new watermark, and identifying a coincidental fake watermark.Source: §5.3 · p. 8

5.4 Watermark Overwriting

  • Overwriting embeds a new watermark when the attacker knows the model is marked but lacks the original details; coexisting marks create ambiguity, while replacement can take over the claim.The passage distinguishes a weaker coexistence attack from stronger complete replacement.Source: §5.4 · p. 8

5.5 Watermark Removal

  • Removal success depends on knowledge of the watermark and scheme and access to additional data for fine-tuning or retraining.The review notes that an attacker with enough data to train a good model might be less motivated to steal one.Source: §5.5 · p. 8
  • Fine-tuning, pruning, rounding, fine-pruning, and compression can damage watermarks through changed parameters or behavior, or by removing watermark-bearing parameters.Compression may especially affect reliability when watermark neurons differ from those needed for the original task.Source: §5.5 · p. 9
  • Other removal routes include task adaptation, computation optimization, backdoor removal, retraining, and distillation, which may fail to transfer watermark information.The cited discussion also notes that retraining can damage a watermark and that distillation does not guarantee its transfer to a simpler student model.Source: §5.5 · p. 9

6 Categorizing Watermarking Methods

The review categorizes watermarking by embedding approach and distinctive properties, covering parameter embedding, trigger-based methods, unique watermarks, and model fingerprints. It also describes limitations and strategies intended to make watermarks more robust.

6.1 Embedding Watermarks into Model Parameters

  • Parameter-embedding schemes encode watermark information in model parameters, but methods that alter parameter distributions can be detectable and fail secrecy.The review discusses regularized parameter encoding, an auxiliary verification network, GAN-based undetectable watermarking, and passport layers.Source: §6.1 · p. 10

6.2 Using Pre-Defined Inputs as Triggers

  • Trigger-based approaches mark model behavior with selected inputs, including adversarial and near-boundary examples or abstract images and unrelated samples assigned model labels.Le Merrer et al.’s trigger dataset combines adversarial examples with correctly classified points close to the decision boundary; the review notes a possible integrity concern because adversarial retraining is also used for robustness.Source: §6.2 · pp. 10–11

6.2.1 Trigger Dataset Creation Based on Original Training Data

  • Some schemes create triggers by altering original training data, embedding signatures, meaningful strings, noise, or logos into samples and assigning trigger labels.The review describes methods that modify labels and an autoencoder-based approach that keeps trigger samples close to ordinary samples.Source: §6.2.1 · pp. 11–12

6.2.2 Robust Watermarking

  • Triggers from a different distribution can form a task independent of the original one, allowing watermark-removal attacks without reducing original-task accuracy.The review specifically notes this risk when the two tasks are more or less unrelated.Source: §6.2.2 · p. 12
  • Robustness strategies include embedding watermark information in parameters shared with the main task, entangling task and watermark features, and weighting trigger samples strongly.The review describes ingraining, entangled embeddings, and exponential weighting as approaches intended to resist removal or extraction.Source: §6.2.2 · pp. 12–13

6.2.3 Unique Watermarking

  • Unique watermarking adds per-user identification and scalability requirements, with approaches using anti-collusion codebooks or certified serial numbers.These methods are described for identifying individual model instances and supporting distribution to many users.Source: §6.2.3 · pp. 13–14

6.3 Using Model Fingerprints to Identify Potentially Stolen Instances

  • Model fingerprints avoid adding explicit watermark information or changing original prediction abilities, but the review only briefly covers these approaches.Adversarial marks and conferrable adversarial examples distinguish similar or surrogate models; the latter are reported robust against distillation and weaker attacks.Source: §6.3 · p. 14

7 Discussion

The discussion identifies trade-offs and vulnerabilities across watermarking approaches, then highlights limitations in their scope, scalability, and practical deployment. It recommends extending evaluation and integrating watermarking with active defenses against model stealing.

7.1 Discussing Potential Shortcomings

  • Trigger-based verification requires threshold tuning, trading reliability against integrity; public verification can expose triggers for fine-tuning and constrain independent checks.Dividing trigger data or using multiple trigger sets can address repeated verification, but is limited by the number of backdoors an NN can embed.Source: §7.1 · pp. 14–15
  • Unprotected parameter watermarks can leave detectable traces and often require white-box verification, while missing owner-watermark links can permit forgery.Watermarks based on non-specific trigger data may also be claimed by an attacker; schemes that prevent remarking can counter this threat.Source: §7.1 · p. 15
  • Adversarial-example watermarks or fingerprints may be unstable, vulnerable to fine-tuning or retraining, and transferable in ways that violate integrity.Adapting a model’s decision boundary to adversarial examples may have effects similar to adversarial retraining.Source: §7.1 · p. 15

7.2 Discussing Requirements

  • Robustness depends on relating trigger and original tasks; reliability, secrecy, and generality also face constraints from distribution shifts, verification access, detectable parameter changes, or dataset-specific encoding.A significantly different trigger distribution can leave tasks independently extractable or allow watermark removal without reducing original-task performance.Source: §7.2 · pp. 15–16
  • Jia et al. [2021] report that their trigger dataset should exceed half the original dataset, requiring training on 150–200% of the original data and potentially creating large overhead.The review notes that most existing work does not explicitly evaluate computational overhead.Source: §7.2 · p. 16

7.3 Limitations and Outlook

  • Watermarking is a passive defense that detects theft afterward rather than preventing it; future work could integrate it with active defenses against model stealing.Other approaches discussed include warning of extraction risk, restricting high accuracy to authorized users, and making models harder to steal.Source: §7.3 · p. 16
  • Most schemes target image data and classification, leaving generality across data types and other ML applications, including reinforcement learning and generation, as research challenges.The review identifies only a few exceptions for other data types and domains.Source: §7.3 · p. 16
  • Evaluation on small research datasets leaves scalability open, while training-data overhead may limit some scenarios; real-world workflows also need adaptation to support ownership claims.Future work should assess whether properties observed on research datasets hold on larger real-world datasets; juridical and organizational processes may also need adjustment.Source: §7.3 · p. 16

8 Concluding Remarks

The paper provides a framework for classifying and comparing model-watermarking schemes, including a taxonomy, systematized requirements and attacks, and a unified threat model. It surveys relevant prior research and presents the framework as a resource for analyzing, designing, and choosing methods.

8 Concluding Remarks

  • The review introduces a taxonomy and unified threat model, and systematizes requirements for and attacks against watermarking schemes.It uses the framework to survey relevant prior research.Source: §8 · p. 16
  • The framework is presented as a foundation for analyzing existing watermarking methods and designing new ones.The review also positions it as a reference for researchers and ML practitioners across domains.Source: §8 · pp. 16–17
  • The framework can support choosing watermarking solutions suited to given scenarios.The paper identifies researchers and ML practitioners across domains as potential users.Source: §8 · p. 17
Loading 2009.12153v2…