PaperlayerView exact revision on arXiv

Source-linked AI summary

TwinMark: A Unified Watermark for Provable Survival Under Feature and Logit Distillation

Redwanul Karim, Tobias Feigl, Christopher Mutschler, Felix Ott

arXiv:2609.19011v1cs.LG

TL;DR

Classifier APIs and representation-only hosts expose different outputs to distillation, leaving single-channel watermarks without coverage across both regimes. TwinMark reads one SHAKE128 secret through feature- and logit-side carriers with channel-specific survival certificates. Across the reported attacks and settings, it verifies on utility-retaining models; cc-FALC also supports high-capacity detection beyond the class count.

  • Problem

    Classifier APIs expose logits to KL distillation while representation-only hosts expose features to feature-matching distillation, and prior watermarks often protect only one channel.

    Source: §1 · pp. 1–2

  • Method

    TwinMark reads one SHAKE-keyed secret through a feature covariance projector and a class-conditional Fisher-aligned logit carrier, with a regime-restricted OR rule.

    Source: §1 · p. 2

  • Results

    Across 13 attacks, TwinMark verifies on every post-attack model retaining task utility; at K=1024 in m=100 classes, cc-FALC attains z≈23σ.

    Source: §6 · p. 8, §7 · p. 9

  • Takeaways & Limitations

    The reported results show one watermark construction covering both distillation surfaces and extending detection to payloads beyond the number of classes.

    Source: §1 · p. 2, §6 · p. 8, §7 · p. 9

    The certified threat model excludes comparison-space stripping, adaptive key-probing, adversary-aware off-ellipsoid sharpening, and top-k-only APIs.

    Source: §2 · p. 3, §1 · p. 3

Abstract

from arXiv · show

We propose TwinMark, a watermarking scheme that reads a single SHAKE128 secret through two complementary linear functionals of model-output summaries: a covariance projector against the carrier-set covariance (cov-Feat) and a class-conditional Fisher-aligned linear carrier decoded from class-mean logits (cc-FALC). The two readouts share one bit vector and cover the two extraction surfaces of a deployed vision model: a classifier API attacked by KL knowledge distillation (KD) (Std. KL-KD), and a representation-only host attacked by feature-matching KD (FM-KD). Each readout admits a teacher-measurable a posteriori certificate that lower-bounds post-distillation detection power, and the two channels combine under a regime-restricted OR rule whose test statistic (calibrated null or bit vote) is selected by the exposed surface. cov-Feat admits a rank-blind operator-norm certificate, cc-FALC admits a centered-logit-gap certificate that decouples bit capacity from class count: at K=1024 in m=100 classes (a 10.24x over-encoding), the bit-vote attains z=23.0 sigma at a teacher-accuracy cost of +0.9+-0.2%p. Across 13 attacks on CIFAR-10, CIFAR-100, and Mini-ImageNet, TwinMark verifies on every cell whose post-attack model retains task utility, survives cross-architecture distillation onto ResNet-18/50, VGG-16, and MobileNet-V3, and ports to GNSS few-shot, VOC detection, ISIC segmentation, and STL-10 SimCLR.

1 Introduction

TwinMark addresses the gap between the distinct extraction surfaces of classifier APIs and representation-only hosts by reading one secret through feature- and logit-side carriers. It combines channel-specific survival certificates and reports high-capacity detection on CIFAR-100.

1 Introduction

  • Classifier APIs expose logits to KL distillation, whereas representation-only hosts expose features to feature-matching distillation, creating two distinct extraction threats.Earlier schemes often protect only one channel; pairing independent watermarks can leave a channel-selective removal path.Source: §1 · pp. 1–2
  • The design draws on second-order feature statistics and Fisher-aligned projections, but introduces secret-keyed functionals of carrier-set covariance and class-mean logits.The cited prior lines include Gram and covariance methods on the feature side and Fisher/LDA methods and logit-carrier precedents on the logit side.Source: §1 · p. 2
  • TwinMark reads one SHAKE-keyed secret through a covariance-projector feature channel and a class-conditional, Fisher-aligned logit channel.The two writers share a secret bit vector and target different model-output summaries.Source: §1 · p. 2
  • The feature channel has a rank-blind operator-norm survival certificate, while the logit channel has a centered-logit-gap certificate and the channels use a regime-restricted OR rule.The logit certificate removes the temperature multiplier through its centered-logit formulation.Source: §1 · p. 2
  • At K=1024 in m=100 classes, cc-FALC certifies ownership at 10.24× over-encoding; a separate bit-reconstruction regime reports BER ≤0.05 at K≤32.The K=1024 result is detection-only: individual bits may be unreliable while the binomial bit-vote remains significant.Source: §1 · p. 3
  • The work evaluates fine-tuning, pruning, quantization, and comparison-representation post-processing across 13 attacks on CIFAR-10, CIFAR-100, and Mini-ImageNet.Adaptive key-probing, anchor-subspace extraction, comparison-space stripping, and top-k-only APIs are outside the certified threat model.Source: §1 · p. 3

2 Preliminaries and Threat Model

The threat model distinguishes classifier hosts that expose logits from representation-only hosts that expose embeddings. It studies distillation under logit, feature, or combined objectives and specifies which perturbations and interfaces are in scope.

2 Preliminaries and Threat Model

  • A classifier host returns m-class logits and faces temperature-τ KL distillation, while a representation-only host exposes a normalized comparison-space embedding and faces feature-matching distillation.Representation-only examples include self-supervised encoders, embedding services, and hint-layer-distilled deployments.Source: §2 · p. 3
  • The adversary trains a suspect student on a query set containing the carrier set using feature-distillation loss, logit-distillation loss, or their convex combinations.The threat model includes same- and cross-architecture pairs.Source: §2 · p. 3
  • The stated scope includes orthogonal post-processing and non-orthogonal perturbations bounded by εh, but excludes comparison-space stripping, adaptive key-probing, off-ellipsoid sharpening, and top-k-only APIs.Orthogonal post-processing is handled by Procrustes alignment; certificates use a posteriori distances measured on the carrier set.Source: §2 · p. 3

3 The TwinMark Construction

TwinMark derives buffers from one cryptographic secret and uses two writers with distinct training-time footprints. Their outputs share a unified verification template, while the feature writer shapes covariance and the logit writer adds per-class payloads.

3 The TwinMark Construction

  • One cryptographic secret supplies two independent writers: a feature-side covariance shaper and a logit-side writer for per-class mean logits.Their training-time footprints are a covariance-fit hinge and a cc-FALC superposition on the teacher logits.Source: §3 · p. 3
  • SHAKE128 derives the carrier set, secret bit vector, per-class signatures, spreading codebook, FALC basis, and rank-r covariance projectors from the master secret.The basis is orthonormal and orthogonal to the all-ones vector; parties with π0 and the secret can reconstruct the buffers bit-for-bit.Source: §3 · p. 3
  • Figure 2 organizes the pipeline into owner-side key derivation, teacher-side carrier writing, and verification through a shared linear-functional template.The deployment regime determines which observable channel the verifier uses.Source: §3 · p. 3, Figure 2 · p. 4
  • The feature-side writer shapes the carrier-set covariance, while the logit-side writer superposes per-class FALC payloads onto the base classifier head.The feature covariance estimate uses a momentum-0.99 exponential moving average after a 3-epoch warmup.Source: §3 · p. 4
  • The teacher objective combines task loss with covariance, orthogonality, minimum-probability, and hiding terms, with the covariance-fit hinge driving projector margins above mcov.Served logits coincide with the teacher logits on a fraction 1−εtop1 of inputs.Source: §3 · p. 4

4 Verification

Verification uses only the output surface exposed by the suspect host: features for representation-only hosts or logits for classifier APIs. Each channel runs calibrated-null and bit-vote tests, with the verdict restricted to the observable channel.

4 Verification

  • The verifier never observes both surfaces: representation-only hosts use the feature channel, while classifier APIs use the logit channel.The OR rule applies only to the channel the deployment exposes.Source: §4 · pp. 4–5
  • Feature-side verification computes the suspect carrier-set covariance, forms projector readouts, and runs calibrated-null max-statistic and binomial bit-vote tests.The feature verdict accepts when either primitive test rejects.Source: §4 · p. 5
  • Logit-side verification averages projected suspect logits by class, decodes with the regime-selected verifier, and applies the same two primitive tests to cc-FALC bit scores.Both channel decoders instantiate the shared verification template.Source: §4 · p. 5

5 Theory

TwinMark unifies cov-Feat and cc-FALC as key-derived linear-functional readouts of model-output summaries, with each channel targeting a different distillation regime. The theory gives survival certificates, a regime-restricted detection rule, and a capacity bound for the class-stratified decoder.

5.1 Unified Linear-Functional View

  • Both detectors instantiate a shared key-derived linear-functional score on model-output summaries, while the two regimes contract different summaries.The paper frames this split as one summary per extraction regime, so contraction in one regime distorts one summary while leaving the other intact.Source: §5.1 · p. 5, §5 · p. 5

5.2 Cov-Feat Survival Under FM-KD

  • When mcov > 2ε̄h, the cov-Feat bit estimator exactly recovers each bit under FM-KD from the teacher margin and carrier-averaged representation deviation.The projector-level certificate bounds the score change by 2ε̄h using a rank-blind operator-norm bound.Source: §5.2 · pp. 5–6

5.3 Class-Conditional FALC Writer and KL-KD Survival

  • For cc-FALC, a centered logit-gap budget below the decoder margin permits bit recovery, with the stacked branch extending recovery to K ≤ mP.The centered-logit analysis uses G⊤1 = 0; the stated guarantee uses σmin(C) for K ≤ P and σmin(A) for K > P.Source: §5.3 · p. 6

5.4 Detection

  • Detection uses a calibrated-null max-statistic or an idealized binomial bit-vote, combining channels with a regime-restricted OR rule and Bonferroni Type-I control.The calibrated-null test controls Type-I error exactly without assuming bit independence; the OR rule uses only the channel observable in that regime.Source: §5.4 · p. 6
  • The reported FM-KD and Std. KL-KD rows verify in 10/10 seeds on CIFAR-10, CIFAR-100, and Mini-ImageNet.Table 2 covers 13 attacks and defines verification as at least 8/10 seeds rejecting H0 at αdet=10^-3.Source: Table 2 · p. 7

5.5 Capacity Ceiling

  • The class-stratified decoder supports payloads up to K ≤ m · P, with exact recovery when the noise satisfies ∥η∥∞ < σmin(A).Theorem 4 gives rank(A) ≤ min(mP, K); σmin(A) = Θ(√m) with overwhelming probability.Source: §5.5 · p. 7

6 Experimental Results

Across the tested datasets and attack regimes, TwinMark retains verification after attacks and cross-architecture distillation, with further evaluations on real-world deployment tasks. The experiments also test payloads beyond the class count and compare TwinMark’s KD coverage with prior schemes.

Setup: Datasets, Hosts, and Attacks

  • The 13-attack evaluation spans parameter-space changes, comparison-space transformations, and four KD regimes across CIFAR-10, CIFAR-100, and Mini-ImageNet.The setup includes ResNet-18 teachers and cross-architecture students, with a 60-epoch teacher schedule.Source: §6 · p. 7

Dual-Channel Survival Across Attacks

  • Across 13 attacks, the OR verdict remains unchanged on every cell; on Mini-ImageNet, ZCA whitening raises cov-Feat BER to 39.8%±2.6, while cc-FALC remains at 0.0%±0.0.FM-KD cov-Feat BER is 1.2%±2.2, 3.3%±2.6, and 18.8%±3.9 across the three datasets; Std. KL-KD leaves cc-FALC verifiable on 10/10 seeds at every cell.Source: §6 · p. 7

Capacity Beyond the Class Count

  • At K=1024 in m=100 classes, cc-FALC reaches z≈23σ with one-sided p≈10^-125, while cov-Feat saturates near K≃128.The cc-FALC bit-vote p-value falls from 2.9×10^-13 at K=64 to 1.8×10^-119 at K=1024; the reported z-based p-value is floored by the N=1000-key calibration grid.Source: Table 3 · p. 8, §6 · p. 8, Figure 3 · p. 8

Cross-Architecture Distillation Survival

  • Across 12 student×dataset cells, cov-Feat verifies on 10/10 seeds under FM-KD and cc-FALC verifies on 10/10 seeds under Std. KL-KD.The cc-FALC BER ranges from 0.0% on Mini-ImageNet to 32.8%±8.1 on CIFAR-10 MobileNet-V3; the elevated CIFAR-10 BERs are attributed to the small-m regime.Source: Table 4 · p. 8, §6 · p. 8

Real-World Cross-Domain Hosts

  • All five real-world deployment rows verify on cov-Feat, with task utility preserved within task-native standard deviation.VOC mAP@0.5 drops by 0.9%p, ISIC Dice is preserved, GNSS top-1 rises mildly, and SimCLR linear-probe drops by 0.3%p.Source: Table 5 · p. 9, §6 · p. 9

Comparison With Prior Schemes

  • TwinMark verifies under both FM-KD and Std. KL-KD, whereas each prior scheme covers at most one of those regimes by construction.Direct numerical comparison is prevented by protocol differences, so the comparison reports methodological position and verdicts.Source: Table 6 · p. 9, §6 · p. 9

7 Conclusion

TwinMark shares one keyed signal across feature and logit channels, with certificates aimed at the distinct KD geometries of classifier and representation-only deployments. Across the reported attacks, architectures, and additional tasks, it verifies under stated conditions, while several adaptive or interface-specific attacks remain outside its certified scope.

7 Conclusion

  • Across 13 attacks on CIFAR-10, CIFAR-100, and Mini-ImageNet, every post-attack model retaining task utility verified on at least one channel.At K=1024 in m=100 classes, cc-FALC bit-vote attained z≈23σ; cross-architecture FM-KD preserved cov-Feat verification on every seed, and the construction also transferred to four other tasks.Source: §7 · p. 9

A.1 Knowledge Distillation

  • FitNets [79] motivates feature-transfer protection, while black-box extraction can train surrogates from observable teacher behavior without access to its architecture, weights, or training data.TwinMark addresses both feature- and logit-side KD, and verifies already extracted or distilled suspect models rather than detecting stealing at serving time [24].Source: §A.1 · p. 20

A.2 Watermarking

  • Prior watermarking spans parameter, trigger-based, and fingerprinting approaches, but TwinMark targets inherited keyed feature–logit signals with KD-survival certificates [27, 28, 30, 31].The cited work includes weight watermarks vulnerable to distillation [26], black-box trigger methods [28], and post-hoc fingerprints complementary to TwinMark.Source: §A.2 · pp. 21–22

A.3 Watermarking with KD

  • CosWM and DRW address logit-side distillation, while representation-based schemes such as EWE and MEA-Defender target learned representations; these lines generally cover only one channel.TwinMark couples anchor-similarity geometry with a Fisher-adapted logit carrier and provides survival certificates for both feature- and logit-side KD [37, 38].Source: §A.3 · pp. 22–23

A.4 Formal Guarantees for Watermarking

  • Prior robustness certificates mainly cover parameter, image, or layer perturbations rather than the feature and KL geometries induced by KD.Generative-model watermarks can also be fragile under adaptive distillation [41]; TwinMark instead certifies classifier and representation models in realized comparison-space deviation and Fisher-native KL attenuation [41].Source: §A.4 · p. 23

B Notation Summary and Full Threat Model

This material defines the symbols and threat boundaries used in the paper, then gives the structural and survival arguments for cov-Feat. The readout is rotation-invariant, and its bit recovery follows when the teacher margin exceeds the measured representation deviation.

B Notation Summary and Full Threat Model

  • The carrier set, normalized comparison features, covariance, SHAKE-derived projectors, and FALC basis, codebook, and signatures define the two keyed readout channels.The cc-FALC writer adds αGCω_y(x) to the base logits, while class-mean logits supply its detector summary.Source: B Notation Summary and Full Threat Model · pp. 23–24
  • The stated out-of-scope attacks include comparison-space stripping, adaptive key-probing or overwriting, adversary-aware KL attacks, floor erosion, and top-k APIs.The listed boundaries include student retraining after discarding the comparison projection and APIs that expose only top-k outputs.Source: B Notation Summary and Full Threat Model · pp. 24–25

C.1 Structural Property: Cov-Feat Orthogonal Equivariance (Proposition 2)

  • Applying the same orthogonal rotation to the representation and projector leaves every cov-Feat readout unchanged.The proof uses the cyclic invariance of trace and R⊤R=I.Source: §C.1 · p. 25

C.2 Cov-Feat KD Survival (Theorem 1)

  • When the teacher cov-fit margin exceeds 2 ε̄h, the cov-Feat decoder recovers each bit for every k.The result follows by a triangle-inequality margin argument.Source: §C.2 · p. 26
  • The cov-Feat survival bound is carrier-averaged and rank-blind: its operator-norm factor is 1, yielding a bound of 2 ε̄h.The proof uses the unit operator norm of the projector and a polarization identity; it replaces the earlier √r Frobenius factor and drops the quadratic correction.Source: §C.2 · pp. 25–26

C.3 Four Lemmas for the Legacy Pinsker Chain (Theorem 2)

The appendix presents a legacy softmax-to-KL-to-logit-gap certificate alongside the current cc-FALC argument, which works directly with centered logits. The direct bound avoids the legacy chain’s temperature and tilt factors, and the stacked decoder extends recovery beyond the codebook dimension.

C.3 Four Lemmas for the Legacy Pinsker Chain (Theorem 2)

  • The legacy certificate chains softmax KL, Pinsker, centered tilt, and FALC projection bounds to obtain a logit-gap control.Its components include an exact midpoint quadratic identity for softmax KL, a centered-tilt bound, and a Schur-complement projection bound.Source: §C.3 · pp. 26–27, §C.4 · p. 28
  • Centering removes the softmax-shift degree of freedom, so the legacy tilt bound depends on mean-centered logits rather than an arbitrary common logit offset.The appendix notes that a student can have large absolute logit drift but small centered drift without inflating this centered tilt factor.Source: §C.3 · p. 27
  • The FALC projection lemma lower-bounds its Schur complement by the minimum class probability, and under F_p-invariance reduces to the smallest eigenvalue on the FALC subspace.The minimum-probability bound applies to the smallest eigenvalue of F_p on 1⊥.Source: §C.3 · p. 27

C.4 cc-FALC KL-KD Survival (Theorem 2)

  • The current cc-FALC certificate works directly with centered logit gaps, using G⊤1=0 to absorb shifts and avoiding temperature, centered-tilt, and Schur-eigenvalue factors.The proof combines FALC orthogonality with column-orthonormality to bound the projected per-class gap.Source: §C.4 · pp. 27–28
  • The decoder recovers per-class signatures when the certificate error is below α σmin(C); for K>P, the stacked-system decoder extends recovery to K≤mP.The stacked decoder uses the spectral threshold σmin(A). The centered-gap bound was reported as 40–200× tighter than the legacy chain on merged-winner KD attacks.Source: §C.4 · pp. 28–29

C.5 Calibrated-Null Detection (Theorem 3)

Theorem 3 provides bit-vote and calibrated-null tests with Type-I error control and certificate-based power conditions; the appendix also contrasts entropy and min-probability floors for Fisher-eigenvalue control.

C.5 Calibrated-Null Detection (Theorem 3)

  • Under H0, the bit-vote rejects when correct bits exceed the binomial threshold, controlling Type-I error at αdet.SHAKE-derived independence gives each bit a symmetric null distribution.Source: §C.5 · p. 29
  • The calibrated-null max-statistic uses exchangeable re-keyed or label-permuted calibration scores to control marginal false positives at αdet.The suspect score is rejected when its rank falls among the top ⌈(N + 1)αdet⌉ positions.Source: §C.5 · p. 29
  • Certificate margins bound per-bit score gaps, while the bit-vote and calibrated-null tests share the same margin-versus-noise separation under the OR rule.The OR combination controls Type-I error at αcal.Source: §C.5 · p. 29
  • With overwhelming probability, the stacked matrix has full rank when K² log K = o(mP), supporting exact decoder recovery under a sufficiently small preservation gap.The recovery condition requires the gap to be below α σmin(A).Source: §C.6 · p. 30

D.1 Entropy Counterexample for the Min-Probability Floor

  • In a Dirichlet simulation, 36,616 of 50,000 samples passing the entropy floor had a smallest Fisher eigenvalue below 10^-6; all 20,781 samples retained by the min-probability floor met that floor.The experiment used m = 10, an average entropy target of 0.4 log m, and an entropy floor of 0.35 log m; the min-probability floor was 1/(2m) = 0.05.Source: §D.1 · p. 30

D.2 Training Details

Training jointly fits the covariance and class-conditional logit readouts while applying regularizers and a hiding loss. The accompanying checklist specifies configuration choices, verification steps, and supported host types.

D.2 Training Details

  • The class-conditional-mean hiding loss suppresses first-order class-conditional features that a linear probe could exploit at the distribution level.The clean class-conditional mean can be computed on held-out training data without watermark losses, or approximated by an exponential moving average when a separate pass is impractical.Source: §D.2 · p. 31
  • Each training step refreshes representation statistics, fits the cov-Feat readout, adds the per-class FALC carrier to logits, evaluates five losses, and updates the backbone, projection head, and base logit head.The SHAKE-derived buffers remain fixed and can be recomputed from the reference distribution and secret key.Source: §D.2 · p. 31
  • Defaults set P between ⌈m/2⌉ and m − 1, α between 0.3 and 1, δmin to 1/(2m), and cov-Feat rank r between 8 and 32, with regularizers tuned per task.The per-dataset Pareto-winner configuration drives the headline robustness-table cells.Source: §D.2 · p. 31, Table 7 · p. 32

D.3 Full Design Checklist

  • The checklist selects rank and Fisher basis, enforces the min-probability floor, caps payload at K ≤ m · P, screens weak keys, verifies post-training conditions, and defaults to calibrated detection.The decoder uses a per-class branch when K ≤ P and a stacked-system branch when K > P.Source: §D.3 · p. 31
  • The construction transfers without modification to object detection, segmentation, and self-supervised hosts: cov-Feat uses normalized representations, while cc-FALC requires classifier-head logits.The checklist recommends calibrated detection by default; the binomial bit-vote is calibrated when the projectors and codewords are SHAKE-derived independent.Source: §D.3 · p. 31

E.1 Theory–Practice Link: Non-Vacuity Audit

The certificate audit finds that the closed-form sufficient-condition ratios do not cover adversarial cells, yet calibrated detection succeeds wherever task utility remains. Temperature sweeps and hyperparameter searches characterize the logit and feature channels.

E.1 Theory–Practice Link: Non-Vacuity Audit

  • Detection rejects H0 at αdet = 10^-3 on every utility-retaining attack cell, although adversarial certificate ratios are below unity and the per-bit covariance budget is exceeded.The empirical εh is 1.0–1.6 versus the approximately 0.43 budget; the worst Mini-ImageNet MarkErase centered tilt is approximately 3.2 × 10^6.Source: §E.1 · p. 32, Table 8 · p. 33

E.2 KD Temperature Sensitivity of cc-FALC

  • At τ = 1, cc-FALC bit-vote BER is approximately 0.40; for τ ≥ 4, BER plateaus at approximately 0.089 on CIFAR-100.The paper describes the low-temperature case as effectively training on hard labels and the plateau regime as matching the temperatures used by published KD attacks it knows of.Source: §E.2 · p. 33, Figure 4 · p. 34

E.3 Hyperparameter Searches

  • Feature-side searches find stable low-objective regions that balance payload, carrier length, projector settings, and covariance-fit weight; CIFAR-100 and Mini-ImageNet show a stronger utility–watermark trade-off than CIFAR-10.The search selects configurations from the low-objective Pareto region subject to an explicit utility constraint.Source: §E.3 · p. 33, Figure 5 · p. 34, Figure 6 · p. 34
  • Logit-side low-objective trials depend mainly on FALC dimension, injection scale, KD/CE weighting, and carrier and orthogonality penalties; aggressive injection can increase the accuracy penalty.Across the searches, learning rate and weight decay occupy relatively narrow successful bands.Source: §E.3 · p. 34, Figure 8 · p. 35, Figure 9 · p. 35

F Experiments Compute Resources

The experiments used GPU resources scaled to their memory demands, totaling approximately 1,600 RTX 3070/3080 GPU-hours plus 200 A100/RTX 4090 GPU-hours. The broader-impact discussion describes intended ownership-verification uses and risks from erroneous or misused verification.

F Experiments Compute Resources

  • Vision-classification jobs ran on RTX 3070 or RTX 3080 hosts with peak memory at or below 10 GB, while cross-domain portability runs used A100 or RTX 4090 hosts.Mini-ImageNet jobs were pinned to the RTX 3070 tier; cross-domain runs needed more memory for detection, segmentation, and contrastive workloads.Source: F Experiments Compute Resources · p. 35
  • Reported experiments used approximately 1,600 RTX 3070/3080 GPU-hours and 200 A100/RTX 4090 GPU-hours; exploratory searches and ablations added about 700 RTX 3070/3080 GPU-hours.The headline 13-attack survival experiments accounted for approximately 1,200 GPU-hours.Source: F Experiments Compute Resources · p. 36

G Broader Impact Statement

  • TwinMark is intended to support ownership audits without disclosing model weights or training data, but false detections, privacy concerns, and adaptive attacks remain risks.The paper calls for calibrated false-positive control, threat-model disclosure, bit-error reporting, and verification of certificate assumptions before ownership claims.Source: G Broader Impact Statement · p. 36

H Limitations and Outlook

TwinMark’s scope is bounded by verification access, a posteriori certification, and excluded adaptive attacks; the paper also identifies payload and feature-channel recovery trade-offs. The accompanying sections state the asset, theory, and reproducibility details used to frame those claims.

H Limitations and Outlook

  • Verification requires a comparable representation for cov-Feat or full logits and class-stratified data for cc-FALC; certification covers measured post-attack geometry, not arbitrary transformations or query distributions.Adaptive key-probing, anchor-subspace extraction, comparison-space stripping, watermark overwriting, and adversary-aware logit sharpening are outside the certified threat model.Source: H Limitations and Outlook · p. 36
  • At very large K, aggregate bit-votes can remain significant while individual bits become unreliable, and bit-exact cov-Feat recovery is not asserted under FM-KD.The authors identify a pair-fit feature-writer construction as a potential fix and propose improving high-payload decoding as future work.Source: H Limitations and Outlook · p. 37

1. Claims

  • The paper says its main claims and scope are stated in the abstract and introduction, with methodological details, certificates, and capacity claims in the main paper and proofs in the supplement.Source: §1 · p. 39

2. Limitations

  • The limitations discussion specifies feature/logit access requirements, a posteriori certificate boundaries, and excluded adaptive attacks as central limits on TwinMark’s scope.Source: §2 · p. 39

3. Theory assumptions and proofs

  • The authors state that theoretical results include assumptions and that complete proofs, supporting lemmas, and remarks are provided in App. C.Source: §3 · p. 40

4. Experimental result reproducibility

  • The paper says it discloses construction, objectives, detector and certificate computation, capacity rules, key derivation, and implementation details, with source code in supplementary material.Source: §4 · p. 40

5. Open access to data and code

  • The authors report using public datasets and submitting reproducibility code with instructions, with a GitHub release and complete instructions planned upon acceptance.Source: §5 · p. 41

6. Experimental setting/details

  • The authors say datasets, model families, attack settings, verification procedures, and metrics are specified, with full training and test details in the appendix or source code.Source: §6 · pp. 41–42

7. Experiment statistical significance

The experimental reporting describes BER variability across seeds and binomial bit-vote significance, alongside compute-resource disclosures and statements on ethics, impacts, and released assets.

7. Experiment statistical significance

  • Main tables report BER as mean±standard deviation across three independent seeds; the capacity experiment reports one-sided Binomial(K, 1/2) bit-vote p-values.The standard deviations reflect independent training and attack runs under the same condition.Source: §7 · p. 42

8. Experiments compute resources

  • The authors report approximately 1,600 RTX 3070/3080 GPU-hours plus 200 A100/RTX 4090 GPU-hours, with approximately 700 additional GPU-hours for exploratory work.The appendix also gives GPU types, memory requirements, and per-run wall-clock estimates.Source: §8 · p. 42

9. Code of ethics; 11. Safeguards

  • The authors state that the work supports intellectual-property protection and ownership verification, involves no human subjects or sensitive personal data, and does not release high-risk models or data.Source: §9 · p. 43, §11 · p. 44

10. Broader impacts

  • The paper discusses potential positive impacts including deterring unauthorized model extraction and improving ownership-claim auditability, and negative impacts including false attribution and privacy concerns around audit data.Source: §10 · p. 43

12. Licenses for existing assets

  • The authors state that existing assets are credited and used under their terms, with restricted dataset assets not repackaged or redistributed.Source: §12 · p. 44

13. New assets

  • The paper does not introduce or release new datasets, model weights, or other standalone assets; it documents the method through equations, pseudocode, hyperparameters, and experimental details.Source: §13 · p. 45

14. Crowdsourcing and research with human subjects

  • The authors report no crowdsourcing, user studies, or human-subject experiments, so participant instructions, compensation, risk disclosure, and IRB approval are not applicable.Source: §14 · p. 45

16. Declaration of LLM usage

  • LLMs were used only for writing, editing, and formatting, not for the core methodology, theoretical results, experimental design, implementation, or conclusions.Source: §16 · p. 46
Loading 2609.19011v1…