Reliable Model Watermarking: Defending Against Theft without Compromising on Evasion

TL;DR

This work addresses model theft in MLaaS by revealing a fundamental vulnerability of traditional trigger-set watermarks: memorization creates shortcuts that aid evasion. It introduces UAE-based watermarking, using diffusion-generated Unrestricted Adversarial Examples to inject watermark behavior as knowledge rather than by disrupting decisions, coupled with a friendly-teacher knowledge-transfer framework to enhance surrogate learning. The approach achieves superior evasion robustness and watermark unremovability across CIFAR-10/100 and Imagenette compared with state-of-the-art methods, without compromising main-task performance. By combining diffusion-based UAE generation, robust embedding strategies, and principled verification, the method offers a practical protection paradigm for protecting intellectual property in MLaaS while mitigating evasion and removal threats.

Abstract

With the rise of Machine Learning as a Service (MLaaS) platforms,safeguarding the intellectual property of deep learning models is becoming paramount. Among various protective measures, trigger set watermarking has emerged as a flexible and effective strategy for preventing unauthorized model distribution. However, this paper identifies an inherent flaw in the current paradigm of trigger set watermarking: evasion adversaries can readily exploit the shortcuts created by models memorizing watermark samples that deviate from the main task distribution, significantly impairing their generalization in adversarial settings. To counteract this, we leverage diffusion models to synthesize unrestricted adversarial examples as trigger sets. By learning the model to accurately recognize them, unique watermark behaviors are promoted through knowledge injection rather than error memorization, thus avoiding exploitable shortcuts. Furthermore, we uncover that the resistance of current trigger set watermarking against removal attacks primarily relies on significantly damaging the decision boundaries during embedding, intertwining unremovability with adverse impacts. By optimizing the knowledge transfer properties of protected models, our approach conveys watermark behaviors to extraction surrogates without aggressively decision boundary perturbation. Experimental results on CIFAR-10/100 and Imagenette datasets demonstrate the effectiveness of our method, showing not only improved robustness against evasion adversaries but also superior resistance to watermark removal attacks compared to state-of-the-art solutions.

Figures (9)

• Figure 1: Comparison of Watermark Embedding Pipeline in this work and previous Works.
• Figure 2: The Generation Process for UAE trigger set.
• Figure 3: Generalization and $\varphi_{wm}$ (WM Acc) under Various Frequencies.
• Figure 4: Feature Space Visualization with t-SNE.
• Figure 5: Distribution of Target Classes for Attacked Samples.