Source-linked AI summary
Intellectual Property Protection of Hyperdimensional Computing Classifiers: Black-Box Ownership Verification via Model Watermarking
Hamed Poursiami, Farshad Soleiman, Ahmad Tahmasivand, Guojing Cong, Thomas Potok, Khaled N. Khasawneh, Kai Zeng, Maryam Parsa
TL;DR
Ownership verification for HDC models remains underexplored, despite the exposure of prototypes to replication. This paper adapts backdoor watermarking to three HDC classifiers and tests embedding and post-deployment threats. Error-driven HDC learners verify at low trigger exposure with small accuracy losses, but extraction removes verifiable watermarks and overwriting can erode them.
Problem
Ownership verification for HDC classifiers remains underexplored, although exposed class prototypes can enable unauthorized model replication.
Source: §1 · pp. 1–2Method
The study adapts backdoor-based watermark embedding to three HDC classifiers and evaluates verification, attacks, and FPGA execution faults.
Source: §1 · p. 2Results
At 1% exposure, AdaptHD and OnlineHD verify across benchmarks with at most 0.58 pp mean accuracy loss, while extraction removes verifiable watermarks and overwriting erodes HDC owner signatures.
Source: §1 · p. 2, §5.2 · p. 5, §5.3.2 · p. 6Takeaways & Limitations
The findings establish watermarking feasibility in HDC while identifying retention limits under extraction and sensitivity to overwriting.
Source: §7 · p. 8The evaluated post-deployment threat model assumes the adversary has a disjoint labeled clean auxiliary dataset drawn from the task distribution.
Source: §3.3 · p. 4
Abstract
from arXiv · showhide
Hyperdimensional computing (HDC) offers efficient learning and inference for resource-constrained systems, yet ownership verification of its models remains underexplored. We present the first systematic investigation of model watermarking in HDC by adapting backdoor-based embedding to three classifiers with different prototype-learning mechanisms. Across four benchmarks, with conventional neural networks as references, we examine whether watermarks can be learned without compromising task accuracy and whether they survive subsequent model modification and replication. The error-driven classifiers, AdaptHD and OnlineHD, support verification at a nominal trigger exposure of 1% with at most 0.58 percentage points of mean accuracy loss, whereas single-pass Vanilla HDC requires greater exposure and can incur substantial accuracy costs. The error-driven models retain verification under native continued training, but extraction produces surrogates that reproduce much of the task behavior without verifiable watermarks. Watermark overwriting readily embeds attacker watermarks into HDC prototypes and erodes the owner's watermark more strongly than in the neural network references, although the strongest erosion coincides with large accuracy losses. We further deploy watermarked AdaptHD on an FPGA and stress its execution through undervolting and overclocking. Verification survives substantial computation errors, whereas more severe stress either causes verification failure together with accuracy collapse or results in inference timeouts. These findings establish the feasibility of watermarking in HDC while identifying limitations in retention under extraction and sensitivity to overwriting.
1. Introduction
HDC prototypes can be exposed to unauthorized access, enabling model replication and motivating ownership protection. This paper adapts backdoor watermarking to HDC and examines embedding, retention under attacks, and FPGA fault tolerance.
1. Introduction
- HDC's efficient vector operations and FPGA suitability attract edge-device use, but exposed class prototypes can enable replication without repeating development costs.The prototypes consolidate task-specific knowledge from training data.Source: §1 · p. 1
- Existing HDC confidentiality mechanisms restrict access to model internals but do not themselves link a suspect copy to its developer; watermarking offers complementary ownership evidence.The applicability of watermarking to HDC classifiers remains an open research question.Source: §1 · pp. 1–2
- At 1% trigger exposure, AdaptHD and OnlineHD verify across benchmarks with at most 0.58 pp mean accuracy loss, while Vanilla HDC faces superposition limits.The study adapts backdoor-based embedding to three HDC classifiers and evaluates attacks and FPGA faults.Source: §1 · p. 2
- On FPGA, watermarked AdaptHD verification survives operating conditions that reduce classification accuracy by up to 22.00 pp, while more severe stress causes verification failure or timeouts.Source: §1 · p. 2
2. Preliminaries: HDC Classification
HDC represents information with high-dimensional hypervectors and classifies through prototypes that consolidate encoded patterns. Prototype-learning schemes differ in whether they aggregate samples once or refine prototypes iteratively after errors.
2. Preliminaries: HDC Classification
- HDC, also called Vector Symbolic Architecture, uses high-dimensional hypervectors and bundling, binding, and permutation to compose and manipulate information.Source: §2 · p. 2
2.1. Encoding
- Encoding maps an F-dimensional input to a D-dimensional hypervector; the described families include record-based binding and bundling, and nonlinear random projection.Source: §2.1 · p. 2
2.2. Associative Inference
- Inference stores C class prototypes and predicts the class whose prototype has the greatest cosine similarity to the encoded query.Source: §2.2 · p. 3
2.3. Prototype Learning Mechanisms
- Vanilla HDC sums class examples in one pass, while AdaptHD and OnlineHD iteratively correct misclassifications; OnlineHD scales updates by angular discrepancy.OnlineHD attenuates updates for samples already aligned with their target prototype.Source: §2.3 · p. 3
3. Watermarking Methodology
The methodology adapts backdoor watermarking to HDC: owners embed keyed trigger–label associations and verify them through black-box predictions. It also specifies post-deployment attacks using auxiliary data or query access.
3.1. Trigger Generation and Embedding
- A secret key generates synthetic OOD trigger inputs paired with pseudorandom labels, which are replicated and mixed with clean training data at a controlled exposure ratio.The owner binds the trigger set before deployment to prevent post-hoc ownership claims.Source: §3.1 · p. 3
3.2. Statistical Verification
- Verification queries the suspect model on secret triggers and tests whether the matching-label count exceeds a binomial null threshold for a model independent of the key.Source: §3.2 · pp. 3–4
3.3. Threat Model and Post-Deployment Attacks
- The threat model includes model adaptation, prototype grafting, competing watermark insertion, and black-box extraction using a disjoint labeled auxiliary dataset or query access.Verification itself requires only black-box hard-label queries; extraction trains a fresh surrogate on victim-predicted labels.Source: §3.3 · p. 4
4. Experimental Setup
Experiments evaluate watermarking across four classification benchmarks spanning image, speech, and wearable-sensor data, using three HDC classifiers and conventional neural-network references. Training, trigger exposure, and attack procedures are specified for repeated runs.
4. Experimental Setup
- The benchmarks are MNIST, Fashion-MNIST, ISOLET, and UCI-HAR, with official test sets reserved for accuracy evaluation.Source: §4 · p. 4
- The study compares Vanilla HDC, AdaptHD, and OnlineHD with CNN or MLP references, using D = 10,000 and three independent random seeds.HDC training uses one pass for Vanilla HDC, 30 epochs for AdaptHD, and 5 for OnlineHD.Source: §4 · p. 4
- The main configuration embeds K = 50 keyed triggers at ρ = 1%; post-deployment attacks use auxiliary data for adaptation, overwriting, and surrogate extraction.Source: §4 · p. 4
5.1. Verification Thresholds and Null Calibration
The verification thresholds are calibrated against the binomial null model. Across four datasets, observed false-positive rates track theoretical rates at both tested significance levels.
5.1. Verification Thresholds and Null Calibration
- Across four datasets, empirical false-positive rates track exact binomial probabilities under unrelated keys at both tested significance levels.The trials query clean models and watermarked models using trigger sets generated from independent keys.Source: §5.1 · pp. 4–5
- At p < 10−2, empirical false-positive rates range from 0.28% to 0.97%, versus exact rates of 0.29% to 0.94%.Source: §5.1 · p. 5
- At p < 10−3, empirical false-positive rates range from 0.014% to 0.067%, versus exact rates of 0.029% to 0.077%.Source: §5.1 · p. 5
5.2. Watermark Embedding
At 1% trigger exposure, AdaptHD and OnlineHD verify watermarks across all four datasets with small accuracy reductions, while Vanilla HDC does not. Single-pass superposition dilutes trigger signals, and raising exposure cannot reliably fix verification without risking task utility.
5.2. Watermark Embedding
- At ρ = 1%, AdaptHD and OnlineHD verify across all four datasets at both thresholds, with mean accuracy reductions of at most 0.13 pp and 0.58 pp, respectively.Vanilla HDC fails both thresholds on every benchmark, with mean trigger matches near random chance.Source: §5.2 · p. 5
5.2.1. Superposition Dilution
- Single-pass bundling can leave trigger cross-talk stronger than the assigned-class self-signal, whereas error-driven updates reinforce misclassified triggers and support verification at ρ = 1%.AdaptHD and OnlineHD update prototypes only on misclassified inputs, leaving correctly classified samples untouched.Source: §5.2.1 · p. 5
5.2.2. Effect of Watermark Exposure
- Higher exposure cannot reliably overcome Vanilla HDC’s superposition limits without sacrificing utility: Fashion-MNIST still fails p < 10−3 at ρ = 50%, while UCI-HAR needs ρ = 25% with substantial accuracy degradation.MNIST verifies at ρ = 15% and ISOLET at ρ = 7.5%, each with minor accuracy drop.Source: §5.2.2 · p. 5
5.3. Post-Deployment Attacks
Post-deployment outcomes depend on how HDC prototypes are modified: native error-driven training can preserve watermarks, but extraction does not transfer them and overwriting can erode them at substantial task-accuracy cost. Prototype grafting also disrupts watermarks that survive native adaptation.
5.3.1. White-Box Model Adaptation
- Native continued fine-tuning preserves AdaptHD and OnlineHD verification in every run, with mean trigger agreement of 42.30–50.00 and only one mean accuracy reduction, 0.29 pp for OnlineHD on UCI-HAR.Their class prototypes rotate by 7.99°–23.93° for AdaptHD and 1.92°–9.31° for OnlineHD while retaining verification.Source: §5.3.1 · p. 5
- The exposure figure compares capped mean verification evidence against thresholds with test-accuracy loss, and marks the dataset-specific exposure levels used in later attacks.Those exposures are ρ = 15% for MNIST, 50% for Fashion-MNIST, 7.5% for ISOLET, and 25% for UCI-HAR.Source: Figure 1 · p. 6
- Under centroid grafting, both adaptive learners remain verifiable across datasets, but Fashion-MNIST OnlineHD matches fall from 48.0 to 10.7 and AdaptHD matches from 47.7 to 20.7.OnlineHD clean accuracy falls 4.98 pp on Fashion-MNIST and 1.05 pp on UCI-HAR; direct centroid mixing disrupts associations that survive error-driven training.Source: §5.3.1 · p. 6
5.3.2. Black-Box Model Extraction
- Extracted surrogates retain high prediction agreement and competitive task accuracy but fail watermark verification in every configuration, returning trigger matches to random chance.Prediction-only distillation on in-distribution auxiliary inputs does not probe the quasi-orthogonal OOD trigger regions.Source: §5.3.2 · pp. 6–7, Table 4 · p. 7
5.3.3. Watermark Overwriting
- Across nearly all adaptive HDC and ANN settings, attacker watermarks embed while owner watermarks remain verifiable, but HDC owner matches fall to 19.7–38.3 as attacker matches reach 48.0–50.0.ANN owner matches remain 49.3–50.0 while attacker matches reach only 18.7–31.7; strong owner-watermark erosion in adaptive HDC coincides with 10.37–25.20 pp accuracy losses.Source: §5.3.3 · p. 7
- In Vanilla HDC, cross-talk blocks attacker triggers on MNIST and Fashion-MNIST, but on ISOLET and UCI-HAR verified attacker triggers accompany accuracy collapses of 42.21 pp and 17.78 pp.Overall, HDC overwriting either leaves the owner watermark verifiable or destroys primary task utility.Source: §5.3.3 · p. 8
6. Hardware Deployment and Fault Resilience
Watermarked AdaptHD remains verifiable through substantial FPGA timing errors, but verification fails only under severe stress that also disrupts classification or causes inference to hang. Lower-voltage regimes can reduce energy without changing accuracy or trigger matches.
6. Hardware Deployment and Fault Resilience
- The evaluation deploys D = 10,000 AdaptHD classifiers with K = 50 and ρ = 1% on a ZCU104, varying voltage from 0.852 V and frequency from 187.5 MHz.The accelerator performs encoding and prototype similarity scoring in hardware.Source: §6 · p. 8
- At 0.652 V and 187.5 MHz, mean core energy per query falls 45.2% while accuracy and trigger matches remain unchanged across all four datasets.At 0.645 V and 230.0 MHz, energy falls 47.1% below nominal with unchanged task accuracy and watermark match counts.Source: §6 · p. 8
- At 0.652 V and 250.0 MHz, verification remains at p < 10^-3; at 0.645 V and 250.0 MHz, accuracy drops 4.51–22.00 pp and matches fall to 25.3–41.3, yet verification persists.The 0.645 V trigger counts remain above the p < 10^-3 thresholds on every dataset.Source: §6 · p. 8
- At 287.5 MHz and 0.652 V, verification fails as timing faults hang inference on ISOLET and UCI-HAR and collapse MNIST and FashionMNIST accuracy.Accuracy falls to 21.36% on MNIST and 19.73% on FashionMNIST.Source: §6 · p. 8
- The authors attribute the watermark’s fault tolerance to its distribution across the same class prototypes as the task representations.They conclude that tested stress either preserves verification or leaves the classifier unusable for its primary task.Source: §6 · p. 8
7. Conclusion
The study finds that HDC watermarking is feasible, especially for error-driven learners, but its protection is not equally robust across threats. Extraction and overwriting expose retention limits, while hardware faults preserve verification as long as the classifier remains functional.
7. Conclusion
- Error-driven HDC learners embed verifiable watermarks at 1% exposure with negligible accuracy loss, while single-pass Vanilla HDC is limited by superposition cross-talk.Under competing overwriting, HDC is more prone to watermark erosion than distributed ANNs, but erasing the owner’s signature coincides with collapsing task accuracy.Source: §7 · p. 8
- Native continued training preserves error-driven HDC watermarks, whereas prediction-only extraction yields high-fidelity task surrogates without inherited OOD triggers.Source: §7 · p. 8
- FPGA undervolting and overclocking preserve verification through substantial timing errors only while the classifier remains functional.Source: §7 · p. 8
- Survivable states with both owner and attacker verification can be resolved via cryptographic timestamping.The authors call for HDC-specific watermarking methods that account for its representation and learning dynamics.Source: §7 · p. 8