Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Robust Client-Server Watermarking for Split Federated Learning

Jiaxiong Tang, Zhengchunmin Dai, Liantao Wu, Peng Sun, Honglong Chen, Zhenfu Cao

TL;DR

Split Federated Learning (SFL) enables privacy by splitting models between clients and server but creates dual ownership ambiguity. RISE provides a dual-side watermarking framework where the server embeds a feature-based watermark into top BN layers via a regularized loss $L = L_{main} + \alpha L_{WM}$ and clients inject backdoor watermarks into their private data, enabling mutual verification with private triggers. Ownership verification is performed independently on both sides using a secret embedding matrix $M$ and signature $b_{sign}$ for the server and trigger-based detection for clients. Across CIFAR-10/100, Tiny-ImageNet, and Fashion-MNIST on ResNet-18, MobileNetV2, and DenseNet-121, RISE achieves high watermark detection rates, preserves task fidelity, and remains robust to removal attacks such as fine-tuning, pruning, quantization, and Neural Cleanse.

Abstract

Split Federated Learning (SFL) is renowned for its privacy-preserving nature and low computational overhead among decentralized machine learning paradigms. In this framework, clients employ lightweight models to process private data locally and transmit intermediate outputs to a powerful server for further computation. However, SFL is a double-edged sword: while it enables edge computing and enhances privacy, it also introduces intellectual property ambiguity as both clients and the server jointly contribute to training. Existing watermarking techniques fail to protect both sides since no single participant possesses the complete model. To address this, we propose RISE, a Robust model Intellectual property protection scheme using client-Server watermark Embedding for SFL. Specifically, RISE adopts an asymmetric client-server watermarking design: the server embeds feature-based watermarks through a loss regularization term, while clients embed backdoor-based watermarks by injecting predefined trigger samples into private datasets. This co-embedding strategy enables both clients and the server to verify model ownership. Experimental results on standard datasets and multiple network architectures show that RISE achieves over $95\%$ watermark detection rate ($p-value \lt 0.03$) across most settings. It exhibits no mutual interference between client- and server-side watermarks and remains robust against common removal attacks.

Robust Client-Server Watermarking for Split Federated Learning

TL;DR

Split Federated Learning (SFL) enables privacy by splitting models between clients and server but creates dual ownership ambiguity. RISE provides a dual-side watermarking framework where the server embeds a feature-based watermark into top BN layers via a regularized loss and clients inject backdoor watermarks into their private data, enabling mutual verification with private triggers. Ownership verification is performed independently on both sides using a secret embedding matrix and signature for the server and trigger-based detection for clients. Across CIFAR-10/100, Tiny-ImageNet, and Fashion-MNIST on ResNet-18, MobileNetV2, and DenseNet-121, RISE achieves high watermark detection rates, preserves task fidelity, and remains robust to removal attacks such as fine-tuning, pruning, quantization, and Neural Cleanse.

Abstract

Split Federated Learning (SFL) is renowned for its privacy-preserving nature and low computational overhead among decentralized machine learning paradigms. In this framework, clients employ lightweight models to process private data locally and transmit intermediate outputs to a powerful server for further computation. However, SFL is a double-edged sword: while it enables edge computing and enhances privacy, it also introduces intellectual property ambiguity as both clients and the server jointly contribute to training. Existing watermarking techniques fail to protect both sides since no single participant possesses the complete model. To address this, we propose RISE, a Robust model Intellectual property protection scheme using client-Server watermark Embedding for SFL. Specifically, RISE adopts an asymmetric client-server watermarking design: the server embeds feature-based watermarks through a loss regularization term, while clients embed backdoor-based watermarks by injecting predefined trigger samples into private datasets. This co-embedding strategy enables both clients and the server to verify model ownership. Experimental results on standard datasets and multiple network architectures show that RISE achieves over watermark detection rate () across most settings. It exhibits no mutual interference between client- and server-side watermarks and remains robust against common removal attacks.

Paper Structure

This paper contains 32 sections, 8 equations, 6 figures, 14 tables, 3 algorithms.

Table of Contents

  1. Introduction
  2. Preliminaries and Related Works
  3. Preliminaries
  4. FL Watermarking
  5. Server-side Watermarking
  6. Client-side Watermarking
  7. Dual-side Watermarking
  8. Proposed Scheme
  9. Design Rationale and Detailed Scheme
  10. Feature-based Watermarking on the server side
  11. Backdoor-based Watermarking on the client side
  12. Ownership Verification
  13. Server-side Ownership Verification
  14. Client-side Ownership Verification
  15. Experiments
  16. ...and 17 more sections

Figures (6)

  • Figure 1: Typical SFL vs. RISE
  • Figure 2: RISE Watermarking Scheme
  • Figure 3: Figure presents $Acc_{\text{main}}$ of clean SFL and RISE as client number varies with CIFAR-10 and Fashion-MNIST.
  • Figure 4: Figures show time costs of clean SFL and RISE as client number varies on CIFAR-10 and Fashion-MNIST.
  • Figure 5: Figure presents main task and watermarking performance under fine-tuning and pruning attack on CIFAR-10 with ResNet18.
  • ...and 1 more figures