StealthMark: Harmless and Stealthy Ownership Verification for Medical Segmentation via Uncertainty-Guided Backdoors

TL;DR

This paper tackles IP protection for medical image segmentation under black-box access by introducing StealthMark, which privately encodes ownership signals through uncertainty modulation rather than altering segmentation outputs. The method jointly optimizes base segmentation against a trigger-driven uncertainty loss and uses LIME-based explanations to reveal a QR-code watermark only when a trigger is present. A simple detector accompanies attribution to verify ownership, with the QR watermark extracted from explanation maps, enabling verifiable claims without compromising diagnostic performance. Across four diverse datasets and five segmentation models, StealthMark achieves ASR well above 95% while keeping Dice and AUC losses under 1%, outperforming traditional backdoor watermarking and demonstrating robustness to common defense strategies and OOD trigger variations.

Abstract

Annotating medical data for training AI models is often costly and limited due to the shortage of specialists with relevant clinical expertise. This challenge is further compounded by privacy and ethical concerns associated with sensitive patient information. As a result, well-trained medical segmentation models on private datasets constitute valuable intellectual property requiring robust protection mechanisms. Existing model protection techniques primarily focus on classification and generative tasks, while segmentation models-crucial to medical image analysis-remain largely underexplored. In this paper, we propose a novel, stealthy, and harmless method, StealthMark, for verifying the ownership of medical segmentation models under black-box conditions. Our approach subtly modulates model uncertainty without altering the final segmentation outputs, thereby preserving the model's performance. To enable ownership verification, we incorporate model-agnostic explanation methods, e.g. LIME, to extract feature attributions from the model outputs. Under specific triggering conditions, these explanations reveal a distinct and verifiable watermark. We further design the watermark as a QR code to facilitate robust and recognizable ownership claims. We conducted extensive experiments across four medical imaging datasets and five mainstream segmentation models. The results demonstrate the effectiveness, stealthiness, and harmlessness of our method on the original model's segmentation performance. For example, when applied to the SAM model, StealthMark consistently achieved ASR above 95% across various datasets while maintaining less than a 1% drop in Dice and AUC scores, significantly outperforming backdoor-based watermarking methods and highlighting its strong potential for practical deployment. Our implementation code is made available at: https://github.com/Qinkaiyu/StealthMark.

Figures (7)

• Figure 1: Comparison of different watermarking strategies for medical segmentation models. The first row shows classic backdoor-based methods (e.g.gu2019badnetsjin2024backdoor). They produce significant output changes but remain visually undetectable, achieving stealthiness but lacking harmlessness. The second row represents direct watermark-based methods(direct embedding watermark) (e.g.bender1996techniquesZhu_2018_ECCV), which preserve output semantics but introduce visible residual artifacts, achieving harmlessness but failing at stealthiness. The third row illustrates our proposed method, which satisfies both harmlessness and stealthiness. Specifically, the threshold segmentation result remains the same, and ownership can be verified through feature attribution without altering the visual output.
• Figure 2: (a) shows commonly used triggers in natural image classification tasks, such as black-edge, color patches, noise, and text overlays. (b) illustrates that similar artifacts inherently exist in medical images (e.g., endoscopy and ultrasound). These artifacts resemble artificial trigger patterns, which may lead the model to mistakenly associate them with the trigger, thereby compromising prediction accuracy on the 'clean' inputs (images without triggers added).
• Figure 3: Comparison of various watermarking techniques applied to binary segmentation tasks. (a). blended watermarking method chen2017targeted, (b). LSB (Least Significant Bit) bender1996techniques, (c). DWT (Discrete Wavelet Transform)kang2003dwt, (d). DMW zhang2020model and (e). HiDDeN Zhu_2018_ECCV. These methods, belonging to the spatial domain, frequency domain, and deep learning-based watermarking techniques, fail to preserve stealthiness in segmentation maps. The embedded watermarks of their methods are visually perceptible or easily removed, leading to poor robustness against detection. Note: The watermarks shown are illustrative only and do not carry semantic meaning.
• Figure 4: Overview of the StealthMark framework. Our method consists of two main components: (1) Verification Embedding, where a subtle trigger is injected into the model by slightly modifying the pixel intensities of the background or foreground, enabling later ownership verification without compromising model performance; and (2) Verification through Feature Attribution, which comprises two stages: Trigger Detection, where a binary detector determines whether a given sample contains the embedded trigger based on the model’s output masks; and Verification Visualization, which leverages model interpretation techniques (e.g., LIME) to visualize a meaningful watermark, such as a QR code, from the trigger sample. This design ensures harmlessness, stealthiness, and verifiability, making it well-suited for ownership protection in medical segmentation models. Note: The watermark shown in the visualization is real and scannable. It encodes version information and links to the project website for traceability and verification.
• Figure 5: Qualitative results on four medical segmentation datasets (EchoNet, SEG meng2024multi, PraNet fan2020pranet, and UKBB) using nnUNet isensee2021nnu. For each dataset, we show the input image, ground truth mask (GT), prediction from the clean (unwatermarked) model, and prediction from our watermarked model. The right columns show the target watermark and the extracted watermark, confirming reliable ownership verification.