# FedCrypt: A Dynamic White-Box Watermarking Scheme for Homomorphic Federated Learning

Mohammed Lansari, Reda Bellafqira, Katarzyna Kapusta, Kassem Kallas, Vincent Thouvenot, Olivier Bettan, Gouenou Coatrieux

► To cite this version:

Mohammed Lansari, Reda Bellafqira, Katarzyna Kapusta, Kassem Kallas, Vincent Thouvenot, et al.: FedCrypt: A Dynamic White-Box Watermarking Scheme for Homomorphic Federated Learning. 2024. [hal-04663096]

HAL Id: hal-04663096

https://hal.science/hal-04663096v1

Preprint submitted on 26 Jul 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# FedCrypt: A Dynamic White-Box Watermarking Scheme for Homomorphic Federated Learning

Mohammed Lansari*, Reda Bellafqira*, Katarzyna Kapusta, Kassem Kallas, Vincent Thouvenot, Olivier Bettan, Gouenou Coatrieux

**Abstract**—Federated Learning (FL) allows multiple clients to collaboratively train a model without outsourcing their datasets. This process is orchestrated by a server that only accesses the model parameters and aggregates them during each round of FL training. However, the server's access to these parameters can compromise data privacy through attacks like model inversion. To mitigate these risks, Homomorphic Encryption (HE) encrypts the model parameters, enabling secure server-side aggregation. Despite this, the high value of a trained deep neural network poses the threat of malicious clients attempting to steal the model during training. FL watermarking combats this by embedding a secret watermark to protect the model's intellectual property. Yet, embedding watermarks into encrypted parameters from the server side has remained unaddressed—until now.

In this paper, we present FedCrypt, the first dynamic white-box watermarking technique compatible with HE in FL. FedCrypt involves training a projection function on the activations of the encrypted model using a trigger set, preserving client privacy and enabling new verification protocols for joint ownership proof between the server and clients without disclosing private information. Our experimental results demonstrate FedCrypt's effectiveness, achieving performance on par with unencrypted models in terms of accuracy and robustness against several attacks.

<figure><img src="image_2.png" /><figcaption>Fig. 1. Overview of the FedCrypt scheme. At the $t^{th}$ round, clients train their models {$M_{t-1}^k$}$_{k=1...3}$. They then encrypt their models using the encryption function Encryption resulting in $\mathcal{E}(M_{t-1}^k)$ before sending them to the server for aggregation. Our solution enables the server to embed a watermark into the aggregated encrypted global model $\mathcal{E}(M_t^G)$ before sending it back to the clients for the next round $t+1$.</figcaption></figure>

**Index Terms**—DNN Watermarking, Federated Learning, Homomorphic Encryption, Intellectual Property.

## I. INTRODUCTION

Federated Learning (FL) enables the collaborative training of machine learning models among multiple data owners without the need to share private data [1, 2]. In each FL round, a server selects a subset of clients and sends them the global model. Clients train this model locally on their private data and then return their updated models to the server. The server aggregates these models into a new global model, which is then redistributed to the clients for further training. This process repeats until the global model converges. While FL inherently offers data privacy, concerns about the honesty of the server and clients present several challenges.

Firstly, the server may infer information about the clients' data from the updates it receives, posing a risk of inference attacks. These attacks include inversion attacks [3], which aim to reconstruct training data samples from model parameters, and membership inference attacks [4, 5], which determine

if a specific data sample was used in the training process. Homomorphic Encryption (HE) can mitigate these risks. It enables data to be processed without being decrypted, with the guarantee that the result of the processing is identical to that achieved on unencrypted data. In FL, client updates can be HE encrypted before being sent to the server, leaving the latter free to aggregate them to create a new global model without ever accessing the parameters in clear text. Doing so prevents inference attacks [6].

A second major threat is the risk of malicious clients redistributing the global model, leading to unauthorized use and intellectual property (IP) violations. Model watermarking [7–12] addresses this by embedding a watermark into the model. This can be done by modifying the model's parameters [7] or by altering its behavior in response to a secret trigger set [9, 11]. Despite the interest, only a few deep neural network watermarking methods have been proposed for FL [13–21], mainly because of the privacy constraints it imposes. These methods either embed the watermark on the client side or the server side during each FL round. With client-side watermarking techniques, it is the clients who embed the watermark in the model. Such an approach is thus compatible with encrypting clients' updates as shown in [19, 20]. However, it faces several drawbacks: i) Client Selection - The effectiveness of watermark embedding in a context where only a subset of clients communicate in each round is unproven. ii) Cross-Device Setting [22] - Implementing client-side watermarking is challenging with many clients, especially when devices have

M. Lansari, R. Bellafqira, and G. Coatrieux are affiliated with Institut Mines-Telecom, IMT Atlantique, Inserm, UMR 1101 Latim, 29238 Brest, France.

M. Lansari, K. Kapusta, V. Thouvenot and O. Bettan are affiliated with ThereSIS, Thales SIX, 92230 Gennevilliers, France.

K. Kallas is affiliated with the National Institute of Health and Medical Research (Inserm), UMR 1101 Latim, 29238 Brest, France.

<footnote>* Equal contribution.</footnote>
limited computational power. iii) Multiple Watermarks - When multiple clients embed their watermarks, the method must avoid conflicts and interference between different watermarks. Given these challenges, server-side watermarking seems more appropriate. Here, the server embeds the watermark post-aggregation. Although several server-side techniques have been developed [16–18], none integrate HE to prevent the server from inferring information about clients' datasets during watermark embedding.

In this paper, we propose FedCrypt, the first server-side dynamic FL watermarking technique that is compatible with HE used as a privacy-preserving mechanism. Our contributions are summarized as follows:

1) We address the challenge of watermarking a homomorphically encrypted DNN model. We explore approximating model activation functions with low-degree polynomial functions to enable watermarking in the homomorphic space.

2) We implement the proposed scheme within a client-server FL framework, ensuring the protection of client confidentiality and IP from an honest-but-curious server.

3) We introduce two new types of trigger sets for our encrypted watermark embedding process, enabling shared IP verification between the server and clients. The horizontal trigger set allows independent verification by both parties, while the vertical trigger set requires joint verification.

4) We provide a proof-of-concept using an open-source homomorphic encryption library.

5) Due to the high computational complexity of HE, we conduct experiments in the plaintext domain to demonstrate the effectiveness and robustness of our dynamic watermarking method on several model benchmarks against various removal attacks, including overwriting.

The organization of this work is as follows: Section II defines the key concepts necessary to understand our scheme "FedCrypt" and reviews related work on FL watermarking. Section III details our proposed method, FedCrypt. Fig. 1 present a simple view of our proposed method. Section IV presents experimental results using a FHE library. Finally, Section V discusses the main limitations of our method and suggests directions for future research. Section VI concludes this paper.

## II. BACKGROUND & RELATED WORKS

In this section, we provide an overview of Homomorphic Encryption (HE) exploring the challenges of using Machine Learning (ML) over homomorphically encrypted models and how HE can enhance FL security against an honest-but-curious server. Finally, we introduce related works on FL watermarking to position our work.

### A. Homomorphic Encryption

Homomorphic Encryption (HE) is a cryptographic tool that allows computation on encrypted values without decrypting

them. If we define $x$ and $y$ as two plain-text values, one can compute the following operation :

$$ \mathcal{D}(\mathcal{E}(x) * \mathcal{E}(y)) = x + y \quad (1) $$

where: $\mathcal{E}$ is an encryption function, $\mathcal{D}$ the corresponding decryption function, and "*" the algebraic operator in the encrypted domain corresponding to "+" in the plain-text domain. Over time, several types of HE schemes have emerged with different properties. The first is Partially Homomorphic Encryption (PHE) which only supports addition or multiplication an unlimited number of times. As an example, one can cite the well known additive homomorphic cryptosystem of Paillier [23]. However, supporting only one operation limits complex processing that involve both additions and multiplications. To address this, Somewhat Homomorphic Encryption (SHE) schemes like the BFV scheme [24] were developed, supporting both addition and multiplication but with limited computation depth. Fully Homomorphic Encryption (FHE) schemes, like BGV [25], TFHE [26], and CKKS [27], enable unlimited operations of both addition and multiplication on ciphertexts. While BGV and TFHE extend FHE capabilities, they can perform only on integers [28]. On its side, CKKS [27] is known for performing operations on encrypted floating-point numbers, making it suitable for applications like deep neural networks [29, 30]. Its scalability and efficiency make it ideal for large-scale tasks involving vectors. These are the reasons why we adopted CKKS in our experiments. It is however important to notice that CKKS supports computations only over polynomial functions.

### B. Machine Learning on Homomorphically Encrypted Data

This field studies scenarios where neural networks are used for training or inference in open environments like cloud instances. When dealing with security-critical applications—such as medical [31], or military fields—both the data and the model need to be securely encrypted to avoid privacy attacks and comply with privacy regulations [32].

Several methods combine HE with ML for secure inference. One of the first approaches, CryptoNets [33], converts all non-polynomial transformations in neural networks into polynomial approximations. The model is however trained on unencrypted data. HE is only considered for inference where both the model parameters and the user's data are encrypted using the YASHE encryption scheme [34]. Since then, further research has been conducted for secure inference in deep neural networks using HE [35–39].

For encrypted training, [40] proposed a Secure Multi-Layer Perceptron based on the Paillier cryptosystem and two servers to securely implement the activation function ReLU using a multiparty computation protocol. Zama.ai provides an open-source library called Concrete ML [41], enabling users to build secure machine learning models based on the TFHE scheme over boolean circuits. However, such training on encrypted data supports only integers coded into 6 bits. For both inference and training, the common solution is to approximate non-polynomial functions [42, 43] like activation and loss functions by their polynomial approximations.
### C. Secure Federated Learning

Federated Learning (FL) [1] is a machine learning paradigm that allows a set of *K* participants to collaboratively train a global model $M^G$ over a series of *J* communication rounds, all while preserving the confidentiality of their datasets $D^k$ (see Fig. 1). The server starts the FL session by initializing the global model $M_0^G$. During each round *t*, the current global model $M_t^G$ is sent to a subset $S_t \subseteq \{1, \dots, K\}$ of $C \times K$ randomly chosen clients, where $C \in \{0, 1\}$. Each client $k \in S_t$ then locally updates the global model using its private dataset $D^k$ and transmits the updated model $M_{t+1}^k$ back to the server. The server aggregates these updates to build the new global model $M_{t+1}^G$. This process continues until *J* rounds are completed or the model converges.

As already stated, even though clients' datasets are not outsourced, FL is still vulnerable to inference attacks such as membership inference [4, 5] and model inversion [3]. The server may attempt to infer information about clients' data from their model updates. To address this privacy concern, Homomorphic Encryption (HE) can be used to ensure data confidentiality while enabling server-side aggregation. In deploying HE with FL, [6, 44-46] consider a Fully Homomorphic Encryption (FHE) system with an encryption function Encryption(., .), a decryption function Decryption(., .), and a pair of public and private keys ($P_k, S_k$). At each round, such a FHE based FL works as follows:

1) Clients use Encryption(., .) and the public key $P_k$ to encrypt their models $M_t^k$ into its encrypted version denoted by $\mathcal{E}(M_t^k)$ before sending them to the server. More clearly, denoting the model parameters as $\{w_1, \dots, w_l, \dots, w_L\}$, where $w_l$ is the tensor of layer *l*, the encrypted model parameters are given as $\{\mathcal{E}(w_1), \dots, \mathcal{E}(w_l), \dots, \mathcal{E}(w_L)\}$.

2) By taking advantage of FHE properties (see Eq. (1)), the server aggregates these encrypted models using techniques such as FedAvg [1] implemented in the FHE encrypted domain and sends the encrypted updated global model $\mathcal{E}(M_{t+1}^G)$ back to the clients for a next round.

3) Clients decrypt the aggregated encrypted model $\mathcal{E}(M_{t+1}^G)$ using Decryption(., .) and their private key $S_k$, and continue training on $M_{t+1}^G$ for the next round.

Recent secure FL frameworks, like NVFLARE [30], implement the CKKS cryptosystem using the TenSeal library [29]. This enables homomorphic operations over tensors, making it more efficient and suitable for addressing FL challenges [47]. This is another reason why we opted for CKKS as the FHE cryptosystem in this work.

### D. DNN Watermarking

Inspired by multimedia watermarking [48, 49], DNN watermarking involves embedding a secret message into the model to prove ownership. These techniques must meet several requirements:

* Fidelity: the model's performance should not be significantly affected by watermark embedding.

* Robustness: embedded watermarks should resist various types of post-processing or removal attacks.

* Efficiency: the embedding process should not add significant computational or communication overhead.

* Generality: the technique should be applicable independently of the DNN architecture or dataset used.

* Capacity: the method should embed a large amount of information into the target DNN.

Watermarking techniques are categorized into two main classes: Black-Box and White-Box methods.

1) **Black-Box Watermarking:** such a scheme embeds the watermark so that verification can be done without full access to the model's parameters. The watermark is embedded and recovered from the model's output behavior on a trigger set. A trigger set $\mathcal{T}$ consists of crafted sample inputs $X_{\mathcal{T}}$ of labels $Y_{\mathcal{T}}$. To embed the watermark, the model is trained on both the trigger and training datasets. Examples of crafted inputs in the context of image classification using the CIFAR10 dataset [50] can be found in Fig. 2. They include unrelated images, content-based samples, additive noise, and adversarial samples [51–54] (respectively Fig. 2c, 2b, 2d and 2e derived from the original sample 2a). In this paper, we use adversarial samples and WAFFLEPattern [18], which is composed of different patterns (a unique shape with a specific color for each class) on a randomly generated noise (e.g. Fig. 2f).

<figure><img src="image_3.png" /><figcaption>Fig. 2. Examples of trigger set samples created from an original image. (a) Original image; (b) Content-based trigger sample; (c) Unrelated image trigger sample from the MNIST dataset [55]; (d) Trigger sample with added noise; (e) Adversarial trigger sample; (f) WafflePattern [18], a completely crafted image. All images are from the CIFAR10 dataset [50], except for (c) and (f).</figcaption></figure>

2) **White-Box Watermarking:** the methods of this class embedded a watermark into a model taking advantage of full access to its parameters. Therefore, the verification process requires access to the watermarked model, not just its inputs/outputs.

As formulated in [11], this process uses two main functions. The first is an extraction function whose aim is to identify the characteristics of the template in which to insert the watermark. These features can be certain model parameters - in this case, we'll talk about static white-box watermarking - or the activation maps of certain model layers for certain secretly selected data inputs (a trigger set) - which then refers to dynamic white-box watermarking techniques. This function can be defined as:

$$ \mathrm{Ext}(M, K_{\mathrm{ext}}) \qquad (2) $$

with, *M* the model whose characteristics are to be extracted, $K_{\mathrm{ext}}$ a secret key that may include the model layers/parameters to select, the trigger set, and the index of the layer from which we embed the watermark.

The second function is a projection function that maps the extracted features into the watermarking space to extract
the watermark. Considering a watermarked model $\hat{M}$, this function can be expressed as:

$$ \mathrm{Proj}(\mathrm{Ext}(\hat{M}, K_{\mathrm{ext}}), K_{\mathrm{proj}}) = y_{\mathrm{proj}} \quad (3) $$

where: $y_{\mathrm{proj}}$ is the extracted watermark, which can be a binary stream or an image. $\hat{M}$ is the watermarked model, $K_{\mathrm{proj}}$ is a secret parameter that could be a secret matrix used to multiply the extracted features to find the watermark, or it can be the parameters of a trained model in the case where $\mathrm{Proj}(.,.)$ is a trained neural network that projects the extracted features into the watermark space. As defined, the basic principle of model watermarking is to modify certain model features (weights, activation maps, etc.) so that they match a watermark when applying the projection function $\mathrm{Proj}(.,.)$. Such an embedding procedure thus relies on minimizing the difference between $\mathrm{Proj}(\mathrm{Ext}(\hat{M}, K_{\mathrm{ext}}), K_{\mathrm{proj}})$ and $y$, where $y$ is the watermark we want to embed, using a distance measure $d(.,.)$, like the Mean Square Error (MSE) or cross-entropy. This can be achieved by adding to the main task loss $E_{\mathrm{main task}}$ of the target model $M$ to watermark the watermarking regularization term $E_{\mathrm{wat}}$:

$$ E_{\mathrm{wat}} = d(\mathrm{Proj}(\mathrm{Ext}(\hat{M}, K_{\mathrm{ext}}), K_{\mathrm{proj}}), y) \quad (4) $$

By doing so, one can effectively embed the watermark $y$ into $M$ while preserving the performance of the main task of the watermarked model $\hat{M}$. To sum up, the global loss of the white-box watermarking is given as follows:

$$ L_{\mathrm{global}} = E_{\mathrm{main task}} + E_{\mathrm{wat}} \quad (5) $$

Several static and dynamic white-box watermarking methods have been proposed. Each of them has its own extraction/projection functions and distance measure $d(.,.)$. To give an idea, let us consider the first white-box method introduced by Uchida et al. [7]. It is a static scheme where: the watermark $y$ is a binary sequence of a given length; $K_{\mathrm{ext}}$ is the index of the layer where the watermark is embedded; the extraction function is the mean of the weights of the secretly selected layer; the projection function $K_{\mathrm{proj}}$ consists in projecting the weight mean into a secret space defined by a secret matrix followed by the sigmoid function to keep the projected values in the range $]0, 1[$; and, the cross-entropy function as distance measure $d(.,.)$. Other methods static methods have been proposed [56, 57].

As an example of dynamic white-box watermarking, one can consider the first scheme proposed "DeepSigns". Its extraction function depends on the key $K_{\mathrm{ext}}$ represented by the index $l$ of the layer to be watermarked and the trigger set (a subset of the training data). With DeepSign, the watermark is embedded into the activation maps of the layer $l$ associated to the trigger set samples. Its key $K_{\mathrm{proj}}$, projection function, and the distance $d(.,.)$ are the same as those used by the Uchida scheme [7]. Subsequent methods have improved DeepSigns in terms of embedding capacity and robustness [11, 58, 59].

Regarding FL watermarking, a few methods have been proposed. They embed an ownership watermark at either the client level, such as FedIPR [13] and FedCIP [14], or at the server level, such as FedTracker [16]. Yu et al. [17] were the

first to embed a dynamic white-box watermark on the server side to identify the malicious client that illegally redistributes the global model. The watermark embedding is conducted similarly to DeepSigns just after the FL aggregation step, at each round. One unique trigger set $X_{\mathrm{T}_k}$ is generated for each client $k$. $X_{\mathrm{T}_k}$ is an out-of-distribution dataset and a unique key per client are fed to an autoencoder to generate a custom trigger set for each client. At the end of the FL process, the authors aim to extract the unique key corresponding to the malicious client from its custom trigger set. Even though this dynamic watermarking technique is suitable for FL IP protection, it does not comply with Homomorphic Encryption used to reinforce data and model privacy. FedTracker, the other FL server-side watermarking solution, is also not compliant with HE. To go further, and as illustrated in Tab. I, even if their authors haven't demonstrated it, FL methods that watermark models on the client side are a priori compatible with HE. The embedding process is performed in the clear domain before clients send their updates to servers in encrypted form. These techniques are also not dynamic. To the best of our knowledge, no one has addressed this objective: watermark a HE-encrypted FL model on the server side. In the next section, we present FedCrypt, an FL watermarking scheme that ensures both model IP and client data confidentiality, with the server in charge of watermarking the homomorphically encrypted model.

### III. PROPOSED METHOD

FedCrypt is the first watermarking scheme designed for Homomorphically Encrypted Deep Neural Network (DNN) models in the context of Federated Learning (FL). It dynamically embeds a watermark by feeding a set of homomorphically encrypted inputs, derived from a trigger set, into the encrypted model and extracting corresponding features from a targeted layer. A DNN, acting as the projection function, is then used to classify these extracted features to embed the watermark. The key innovation of this work involves redesigning the projection function from existing dynamic DNN watermarking schemes [9, 11, 17] to implement it in the HE encrypted domain, optimizing the watermark embedding process by approximating non-polynomial functions with low-degree polynomials to preserve the non-linearity and convergence of the projection function.

Another novel aspect of this work is the combination of HE and FL watermarking, which opens new possibilities for collaboratively sharing model IP depending on how the trigger set $\mathcal{T}$ is built. This approach has not been explored in previous FL watermarking works. Depending on the chosen trigger set construction algorithms, these new methods enable either independent IP verification by the server and clients or require both the server and clients to jointly verify IP.

In this section, we first detail our watermarking scheme with and without homomorphic encryption. Then, we present how it can be used in the FL context. Finally, we discuss different protocols for IP sharing between the server and clients.
<table><caption>TABLE I
OUR METHOD AMONG EXISTING FL WHITE-BOX WATERMARKING TECHNIQUES.</caption><thead><tr><th>Existing Works</th><th>Embedding side</th><th>Dynamic</th><th>HE Compatibility</th></tr></thead><tbody><tr><td>FedIPR [13]</td><td>Client(s)</td><td>✗</td><td>✓</td></tr><tr><td>FedCIP [14]</td><td>Client(s)</td><td>✗</td><td>✓</td></tr><tr><td>FedTracker [16]</td><td>Server</td><td>✗</td><td>✗</td></tr><tr><td>Yu et al. [17]</td><td>Server</td><td>✓</td><td>✗</td></tr><tr><td><strong>Proposed method</strong></td><td><strong>Server</strong></td><td>✓</td><td>✓</td></tr></tbody></table>

### A. Dynamic White-Box Watermarking for HE Encrypted Models

Here, we present our dynamic white-box watermarking scheme for an unencrypted model and then extend it to an HE-encrypted model. We will deploy it in the FL context in Section III-B.

1) Our watermarking scheme for an unencrypted model: Let us consider a trained model $M$ that we want to watermark. We define the projection function $\text{Proj}_{\theta}(\cdot)$ as a DNN parameterized by $\theta$ that we will train to embed the watermark. We assume that $\text{Proj}_{\theta}(\cdot)$ and $M$ contain only polynomial activation functions to ensure it is implementable with HE. The secret key $K_{\text{proj}}$ in our scheme consists of the parameters $\theta$. Since our watermarking scheme is dynamic, its secret key $K_{\text{ext}}$ used to extract the features to watermark is $K_{\text{ext}} = \{s, l, \mathcal{T}\}$, where $\mathcal{T} = \{X_{\mathcal{T}}, Y_{\mathcal{T}}\}$ is the trigger set of $\mathcal{T}$ samples. Here, $s$ is the index of the layer to which we feed the input $X_{\mathcal{T}}$ from the trigger set, and $l$ is the index of the layer from which we will extract the corresponding set of features $\mathcal{F}$. Note that the dimension of the samples in $X_{\mathcal{T}}$ depends on the selected layer $s$. The size of the input and output of the projection function $\text{Proj}_{\theta}(\cdot)$ correspond to the size of the $l^{\text{th}}$ layer of $M$ and the size of the trigger set labels $Y_{\mathcal{T}}$, respectively.

The extraction function $\text{Ext}(M, K_{\text{ext}})$ of our scheme in the clear domain is defined as:

$$ \text{Ext}(M, K_{\text{ext}}) = \mathcal{F} \qquad (6) $$

where $\text{Ext}(M, K_{\text{ext}})$ takes a set of inputs $X_{\mathcal{T}}$ at layer $s$ and returns the set of feature maps extracted at layer $l$: $\mathcal{F} = \{f^i\}_{i=1}^T$. Once the features are extracted, we classify them using the projection function $\text{Proj}_{\theta}(\cdot)$:

$$ \text{Proj}_{\theta}(\mathcal{F}) = Y_{\text{proj}} \qquad (7) $$

$$ Y_{\text{proj}} = \left\{ y_{\text{proj}}^{i} \right\}_{i=1}^{T} \qquad (8) $$

where $Y_{\text{proj}}$ is the set of predicted outputs. Since the aim is to achieve $Y_{\text{proj}} = Y_{\mathcal{T}}$, we need to quantify how far each $y_{\text{proj}}^i \in Y_{\text{proj}}$ is from the targeted output $y^i \in Y_{\mathcal{T}}$. We measure this error by defining the distance function $d(\cdot, \cdot)$. The watermark embedding process consists of jointly finding both $(w_l, \theta)$, where $w_l$ is the parameters of the $l^{\text{th}}$ layer of $M$, such that the distance $d(Y_{\mathcal{T}}, Y_{\text{proj}})$ is minimized. This optimization problem can be written as follows:

$$ \min_{w_l, \theta} E_{\text{wat}} = \min_{w_l, \theta} d(Y_{\mathcal{T}}, Y_{\text{proj}}) \qquad (9) $$

The distance function $d(\cdot, \cdot)$ must be implemented with HE. In white-box watermarking techniques, the distance function

is often cross-entropy or hinge loss, which is not polynomial [9, 17]. To address this, we use MSE due to its compatibility with HE to measure the distance between two output samples $y^i \in Y_{\mathcal{T}}$ and $y_{\text{proj}}^i \in Y_{\text{proj}}$, where the number of classes is $m$:

$$ \begin{aligned} d(y^i, y_{\text{proj}}^i) &= \text{MSE}(y^i, y_{\text{proj}}^i) \qquad (10) \\ &= \frac{1}{2m} \sum_{j=1}^{m} (y_j^i - y_{\text{proj},j}^i)^2 \end{aligned} $$

Note that, to minimize the distance $d(\cdot, \cdot)$ (see Eq. (9)), we update only the $l^{\text{th}}$ layer of $M$, or equivalently its parameters $\{w_l\}$ to generate the desired features (see Eq. (8)). Therefore, all the parameters of $M$ are frozen except those of the $l^{\text{th}}$ layer. This approach reduces computation time and prevents fidelity loss compared to full training of $M$ over approximated activation functions. We will see that it will be of great advantage when working in the FHE encrypted domain.

In our work, $E_{\text{wat}}$ is minimized using the gradient descent algorithm with the update rules defined as follows:

$$ w_l \leftarrow w_l - \alpha \frac{\partial E_{\text{wat}}}{\partial w_l} \qquad (11) $$

$$ \theta \leftarrow \theta - \beta \frac{\partial E_{\text{wat}}}{\partial \theta} \qquad (12) $$

where $\alpha$ and $\beta$ are the learning rates for each model. The two update rules (11) and (12) are separated to allow a lower learning rate for the targeted layer (to avoid losing fidelity), while the learning rate of $\text{Proj}_{\theta}(\cdot)$ can be faster to converge. The term $\frac{\partial E_{\text{wat}}}{\partial w_l}$ represents the derivative of $E_{\text{wat}}$. Since all functions involved in the computation of $E_{\text{wat}}$ are polynomial, their derivatives are also polynomial, making them implementable with HE.

The watermark retrieval process from the watermarked model $\hat{M}$ involves predicting the output of $X_{\mathcal{T}}$ using the same methodology as during the embedding:

$$ Y_{\text{proj}} = \text{Proj}_{\theta}(\text{Ext}(\hat{M}, K_{\text{ext}})) \qquad (13) $$

To quantify the success of the verification process, we define the following function:

$$ \text{Verify}(\hat{M}, \Omega, \delta) = \begin{cases} 1 & \text{if } \text{Acc}(Y_{\mathcal{T}}, Y_{\text{proj}}) \ge \delta \\ 0 & \text{otherwise} \end{cases} \qquad (14) $$

Where $\text{Acc}(\cdot, \cdot)$ is the accuracy in which we compare each $y^i \in Y_{\mathcal{T}}$ and $y_{\text{proj}}^i \in Y_{\text{proj}}$, $\Omega = \{K_{\text{ext}}, \text{Proj}_{\theta}\}$ is the set of secret parameters used for verification, and $\delta$ is the accepted threshold. If the function $\text{Verify}(\cdot, \cdot, \cdot)$ returns 1, the IP verification has been a success; otherwise it failed.
## 2) Our Watermarking Scheme with a Fully Homomorphically Encrypted Model
As explained above, all the operations in our watermarking scheme are polynomial, making its conversion to the FHE domain straightforward. Specifically, the switch to the homomorphically encrypted domain will involve implementing the following functions: the secure extraction function $\mathrm{Ext}^{\mathcal{E}}(\cdot, \cdot)$, the secure projection function $\mathrm{Proj}_{\theta}^{\mathcal{E}}(\cdot, \cdot)$, and the secure distance measure $d^{\mathcal{E}}(\cdot, \cdot)$, ensuring they take encrypted data as input and return results equivalent to those obtained if the computation had been performed in the clear domain.

Let us consider an encrypted model $\mathcal{E}(M)$ and an encrypted trigger set $\mathcal{E}(\mathcal{T}) = \{\mathcal{E}(X_{\mathcal{T}}), \mathcal{E}(Y_{\mathcal{T}})\}$ which are encrypted using the public key $\mathcal{P}_k$. Regarding the secure FHE extraction function $\mathrm{Ext}^{\mathcal{E}}(\cdot, \cdot)$, it can be defined as follows:

$$ \mathrm{Ext}^{\mathcal{E}}(\mathcal{E}(M), K_{\mathrm{ext}}) = \mathcal{E}(\mathrm{Ext}(M, K_{\mathrm{ext}})) \quad (15) \\ = \mathcal{E}(\mathcal{F}) $$

Where $\mathrm{Ext}^{\mathcal{E}}(\mathcal{E}(M), K_{\mathrm{ext}})$ is the secure feature extraction function that returns the encrypted output $\mathcal{E}(\mathcal{F})$ at layer $l$ when $\mathcal{E}(X_{\mathcal{T}})$ is fed to the $s^{th}$ layer. The entity in charge of the encrypted model watermarking needs to know which encrypted parameters to work with. $\mathrm{Ext}^{\mathcal{E}}(\cdot)$ returns the encrypted version of the activation features $\mathcal{E}(\mathcal{F})$.

The secure projection function, denoted as $\mathrm{Proj}_{\theta}^{\mathcal{E}}(\cdot, \cdot)$, is defined as follows:

$$ \mathrm{Proj}_{\theta}^{\mathcal{E}}(\mathcal{E}(\mathcal{F})) = \mathcal{E}(\mathrm{Proj}_{\theta}(\mathcal{F})) \quad (16) \\ = \mathcal{E}(Y_{\mathrm{proj}}) $$

$$ \mathcal{E}(Y_{\mathrm{proj}}) = \left\{ \mathcal{E}(y^i) \right\}_{i=1}^{T} \quad (17) $$

where $\mathcal{E}(Y_{\mathrm{proj}})$ is the encrypted set of predicted outputs. This computation is possible since $\mathrm{Proj}_{\theta}(\cdot)$ contains only polynomial operations.

The next step involves securing the calculation of the distance $d(\cdot, \cdot)$ between $Y_{\mathrm{proj}}$ and $Y_{\mathcal{T}}$ from their encrypted versions. To do this, we define the secure distance $d^{\mathcal{E}}(\cdot, \cdot)$ that takes as input $\mathcal{E}(Y_{\mathcal{T}})$ and $\mathcal{E}(Y_{\mathrm{proj}})$ and returns the encrypted distance between $Y_{\mathcal{T}}$ and $Y_{\mathrm{proj}}$, as follows:

$$ \begin{aligned} d^{\mathcal{E}}(\mathcal{E}(y^i), \mathcal{E}(y^i_{\mathrm{proj}})) &= \mathcal{E}(d(y^i, y^i_{\mathrm{proj}})) \quad (18) \\ &= \mathcal{E}(\mathrm{MSE}(y^i, y^i_{\mathrm{proj}})) \\ &= \mathcal{E} \left( \frac{1}{2m} \sum_{j=1}^{m} (y^i_j - y^i_{\mathrm{proj},j})^2 \right) \\ &= \frac{1}{2m} \sum_{j=1}^{m} (\mathcal{E}(y^i_j) - \mathcal{E}(y^i_{\mathrm{proj},j}))^2 \end{aligned} $$

Notice that the calculation in Eq. (18) is feasible thanks to the properties of FHE (Eq. (1)) and the polynomial nature of the MSE distance.

Being able to secure these three functions is not enough. To watermark the model, one needs to train it along with a secure projection function by minimizing the distance $d(\cdot, \cdot)$ from its encrypted version $d^{\mathcal{E}}(\cdot, \cdot)$. Recall that in the clear domain, the minimization of the distance $d(\cdot, \cdot)$ is conducted

<figure><img src="image_4.png" /><figcaption>Fig. 3. Illustration of the difference between the training process and the watermarking process on a four-layer neural network. The top of the figure shows the training on the main task in which a forward-backward process (designated by the two arrows) is performed with a training data sample from the first to the last layer. The bottom shows how to embed the watermark in which the watermarking is performed through an encrypted sample from $X_{\mathcal{T}}$ fed into layer $s = 1$. All the components are encrypted (red lock) and the watermarked layer designated by $l = 2$ and $\mathrm{Proj}_{\theta}(\cdot)$ (blue parts) are the two parts updated.</figcaption></figure>

using gradient descent. Since all computations are polynomial and compatible with FHE, this minimization in the encrypted domain can be implemented as follows:

$$ \mathcal{E}(w_l) \leftarrow \mathcal{E}(w_l) - \mathcal{E}(\alpha)\mathcal{E} \left( \frac{\partial E_{\mathrm{wat}}}{\partial w_l} \right) \quad (19) $$

$$ \mathcal{E}(\theta) \leftarrow \mathcal{E}(\theta) - \mathcal{E}(\beta)\mathcal{E} \left( \frac{\partial E_{\mathrm{wat}}}{\partial \theta} \right) \quad (20) $$

where $\mathcal{E}(\alpha)$ and $\mathcal{E}(\beta)$ are the encrypted versions of the learning rates.

Fig. 3 provides an overview of how the embedding process works compared to a normal forward-backward pass using samples from the training and the trigger set. The output of $\mathrm{Proj}_{\theta}^{\mathcal{E}}(\cdot)$ (i.e., the number of classes) can be arbitrarily small to save computation time during embedding. However, reducing the number of classes of the projection function requires increasing the number of samples in $\mathcal{T}$ to reduce the average success rate of an attacker (as demonstrated in Section IV).

This concludes the implementation of our watermarking scheme in the FHE encrypted domain in a centralized manner. In the next subsection, we extend it to the FL context.

## B. FedCrypt: A DNN Watermarking Scheme in the Context of Homomorphic Federated Learning

The FedCrypt algorithm, outlined in Alg. 2, follows the same steps as secure federated learning (see Section II-C). The main difference lies in the server, which watermarks the global model at each round after its aggregation. As described earlier in III-A2, this requires converting all activation functions to polynomials to apply our watermarking algorithm in
<figure><img src="image_5.png" /><figcaption>Fig. 4. Illustration of the possible generation and corresponding verification protocols that can be performed using FedCrypt. The green person represents the server and the gray persons represent two distinct clients from the federation. The first, $\mathcal{T}_S$, represents the trigger set typically used in server-side watermarking, where only the server can perform verification. The second, $\mathcal{T}_H$, shows the horizontal trigger set, which allows the server and the two clients to independently perform verification. Finally, the third, $\mathcal{T}_V$, depicts the vertical trigger set, where verification is possible only if both the server and one of the clients are present.</figcaption></figure>

the homomorphically encrypted domain. To ensure that the watermark is well embedded, we propose watermarking the model during the initialization step before sending it to the clients for the first round. At the client level, no constraints or modifications are required on the model compared to secure federated learning (see Section II-C), so the model's learning on the main task is not disturbed. The following describes these steps in detail:

It begins with the initialization of the parameters of the global model $\mathcal{M}$. This initialized model is denoted $M_0^G$. Simultaneously, the server and the clients agree on the share of model IP and construct the desired trigger set using the TriggerSetConstruction function according to one of the techniques presented in Section III-C. This choice will influence how the model IP is checked, e.g., jointly or separately. Existing schemes [16–18] define $\mathcal{T}$ as $\mathcal{T}_S$ since it is generated only by the server. The proposed new trigger set can be built by the server, the clients, or both using the encrypted trigger set received from the clients, as defined in section III-C. This process results in an encrypted set $\mathcal{E}(\mathcal{T})$.

Following this, the server embeds the watermark using the Watermark Embedding (WE) function described in Alg. 1. This function embeds the watermark efficiently, requiring fewer epochs for re-embedding in the next round. The embedding process, described in Section III-A, involves freezing all layers $i$ except the $l^{th}$ layer designated by $K_{\text{ext}}$ and replacing all activation functions $\sigma_i$ with the identity function $\text{Id}(\cdot)$. This allows the server to extract the desired features by feeding

the encrypted model $\mathcal{E}(M_t^G)$ with the encrypted trigger set $\mathcal{E}(X_T)$. The produced features $\mathcal{E}(\mathcal{F})$ are then used to train the classifier $\text{Proj}_\theta(\cdot)$ with the encrypted targets $\mathcal{E}(Y_{\text{proj}})$. The parameters $w_l$ and $\theta$ are updated using the back-propagation algorithm following the update rules in (19) and (20). An extra regularization term is added to the watermarking loss $E_{\text{wat}}$ (see Eq. (9)), defined as $R = \frac{1}{2} \|w_l^{\text{agrg}} - \hat{w}_l\|_2^2$, where $w_l^{\text{agrg}}$ and $\hat{w}_l$ are the $l^{th}$ layer parameters of the global model after the aggregation and the watermarked model, respectively. The objective of $R$ is to preserve the model's fidelity during the initial FL steps. Since $R$ is polynomial, it is implementable with HE. This process is repeated for a fixed number of epochs $Q$.

**Algorithm 1: Watermark Embedding Function**

Input : $\mathcal{E}(M_t^G)$ the global FL model to watermark;

$\Omega = \{K_{\text{ext}}, \text{Proj}_\theta^\mathcal{E}(\cdot)\}$ are the set of parameters used for the watermarking;

Output: Freshly watermarked model $\mathcal{E}(\hat{M}_t^G)$

for each layer $i = s, \dots, (l-1)$ do

Freeze($w_i$);
$\sigma_i(\cdot) \leftarrow \text{Id}(\cdot)$; /* Replace the activation function by the identity function */

for each epoch $e = 1, \dots, Q$ do

$\mathcal{E}(\mathcal{F}) \leftarrow \text{Ext}^\mathcal{E}(\mathcal{E}(\hat{M}_t^G), K_{\text{ext}})$;
$\mathcal{E}(Y_{\text{proj}}) \leftarrow \text{Proj}_\theta^\mathcal{E}(\mathcal{E}(\mathcal{F}))$;
$\mathcal{E}(\hat{w}_l), \mathcal{E}(\theta) \leftarrow \text{Update}(\mathcal{E}(\hat{w}_l), \mathcal{E}(\theta))$;
/* Eq. (19) & (20) */

In each round $t$, the server selects $C \times K$ clients and sends them the current watermarked encrypted global model $\mathcal{E}(\hat{M}_t^G)$. Each selected client decrypts the model using their secret key $S_k$ to obtain the plain-text model $\hat{M}_t^G$. Clients then perform local training over their private dataset $D^k$, resulting in $M_{t+1}^k$, which is then re-encrypted using $\mathcal{E}$ and $\mathcal{P}_k$ before being sent back to the server. Using the FHE properties, the server aggregates all received encrypted updates using FedAvg as presented in [1].

After aggregating the updates, the server embeds the watermark in the encrypted model $\mathcal{E}(M_{t+1}^G)$ using the Watermark Embedding function (WE), which also takes $\Omega = \{K_{\text{ext}}, \text{Proj}_\theta(\cdot)\}$ as input. The server then sends the freshly watermarked model $\mathcal{E}(\hat{M}_{t+1}^G)$ back to the clients. This process repeats until the model converges, as described in Alg. 1.

### C. How Homomorphic FL Opens Possibilities for New IP Verification Protocols

In our scheme, utilizing Homomorphic Federated Learning (FL) allows the server and clients to jointly and securely construct the trigger set $\mathcal{T}$. This enables various methods to verify the Intellectual Property (IP) of a given FL watermarked model.

Let's define $\mathcal{T}_S$ as the trigger set generated by the server. Since the server does not have access to the clients' private datasets, it can employ any unrelated trigger set generation
<caption>**Algorithm 2:** Proposed FL Watermarking Scheme: FedCrypt</caption>

**Input:** $M$ the global FL model to train; $K$ the number of clients; $\Omega = \{K_{ext}, \text{Proj}_{\theta}(\cdot)\}$ are the set of parameters used for the watermarking; $D^k$ local dataset with $n_k$ samples of the client $k$.

**Output:** Final watermarked model $\hat{M}_R^G$

$\mathcal{E}(M_0^G) \leftarrow \text{Initialize}(\mathcal{E}(M^G));$

$\mathcal{E}(\mathcal{T}) \leftarrow \text{TriggerSetConstruction}();$

$\mathcal{E}(\hat{M}_0^G) \leftarrow \text{WE}(\mathcal{E}(M_0^G), \Omega);$

**for** each round $t = 0, \dots, J$ **do**

$S_t \leftarrow$ Randomly select $C \times K$ clients;

**for** each client $k \in S_t$ **do**

$\hat{M}_t^G \leftarrow \text{Decryption}(\mathcal{E}(\hat{M}_t^G), S_k);$

$M_{t+1}^k \leftarrow \text{LocalTrain}(\hat{M}_t^G, D^k);$

$\mathcal{E}(M_{t+1}^k) \leftarrow \text{Encryption}(M_{t+1}^k, \mathcal{P}_k);$

$\mathcal{E}(M_{t+1}^G) \leftarrow \sum_{k \in S_t} \frac{n_k}{\sum_{k \in S_t} n_k} \mathcal{E}(M_{t+1}^k);$

method, such as WAFFLEPattern [18], which uses noise to generate different patterns. Additionally, let's define $\mathcal{T}_k$ as the trigger set of client $k$. These sets can be created using trigger design techniques, specifically training set-based samples such as content-based, additive noise, and adversarial-based trigger samples (examples are shown in Fig. 2).

Previous watermarking solutions [14, 16, 18] have proposed a method to protect IP by using a trigger set only on the server side, i.e., $\mathcal{T} = \mathcal{T}_S$. In this scenario, the server owns the IP and is the sole entity capable of performing the verification, which requires clients to trust the server. However, with the use of Homomorphic Encryption (HE) to exchange model parameters, clients can also share their encrypted trigger sets $\mathcal{E}(\mathcal{T}_k)$ with the server at the beginning of the FL process. This enables the server to embed this information into the encrypted model $\mathcal{E}(M)$ and $\text{Proj}_{\theta}^{\mathcal{E}}(\cdot)$.

Based on this concept, we propose two new methods for building $\mathcal{T}$ as illustrated in Fig. 4:

1) **Horizontal Trigger Set**, denoted as $\mathcal{T}_H$: This set includes samples from both $\mathcal{T}_S$ and $\mathcal{T}_k$ for each participating client. This approach allows ownership to be shared between the server and the clients, enabling each participant to independently verify and claim model IP.

2) **Vertical Trigger Set**, denoted as $\mathcal{T}_V$: This set consists of samples where, for instance, half of the features (or pixels for image-related tasks) in the input come from $\mathcal{T}_S$ and the other half from $\mathcal{T}_k$ (see Fig. 4). For the output, the label is sampled between $Y_{\mathcal{T}_S}$ and $Y_{\mathcal{T}_k}$ with equal probability. To illustrate this approach, one could superimpose or add HE-encrypted samples from both sets to create a unique trigger set, leveraging the properties of HE. This method allows IP verification only when the server and clients combine their trigger sets again, as done during the embedding process, ensuring

that neither party knows the complete trigger set used for embedding.

With our encrypted embedding process, both horizontal and vertical trigger sets remain encrypted, preventing the server from knowing any client's trigger set $\mathcal{T}_k$. More details on the generation of trigger sets will be discussed in Section V.

## IV. EXPERIMENTAL RESULTS

The experiments are designed with two primary objectives. First, to demonstrate a Proof of Concept (POC) with a real Fully Homomorphic Encryption (FHE) scheme, we implemented and ran FedCrypt using the TenSEAL library [29], which implements the CKKS cryptosystem. Second, due to the high computational and communication costs associated with HE, we conducted additional experiments in a plaintext environment using PyTorch to evaluate fidelity, capacity, and robustness against removal attacks. The reproducibility of all experiments is ensured through our repository: https://github.com/medlansari/FedCrypt.

### A. Experimental Set Up and Performance Metrics

1) **Model Architectures and Dataset:** We use VGG11 [60], ConvMixer [61], and ResNet18 [62]. The public CIFAR-10 dataset [50] is used for both the encrypted and plaintext tests in Sections IV-C and IV-B. This dataset comprises 50,000 training RGB images and 10,000 testing images.

2) **FL Setup:** In both FL scenarios, we considered 10 clients. The training set is randomly and uniformly distributed among all participants (I.I.D. distribution). At each FL round $t$, 50% of these clients are randomly selected to contribute to updating the global model ($C = 0.5$). Local training is performed over 5 epochs, and the total number of FL rounds is $J = 80$.

3) **Watermarking and FHE Scheme Set Up:** For the watermark embedding process in the FHE setting, the input is fed through the watermarked layer ($\{s = 2, l = 2\} \in K_{ext}$) to reduce calculation complexity. In the plaintext setting, the input is fed through the first layer of the model, while the watermarked layer remains the same, i.e., $\{s = 1, l = 3\} \in K_{ext}$. The trigger set for the robustness part is composed of 100 images from WAFFLEPattern [18] that need to be classified into 10 classes. For the FHE experiments, we use a set of 10 features of size 32. It is defined using the Scikit-Learn library to generate 10 artificial samples of features<fnref n="1" />. The targeted label space is equal to 2. The learning rates are set to $\alpha = 1e-3$ and $\beta = 1e-2$ (see Eq. (11) and (12) from Section III-A). The maximum number of epochs is fixed at $Q = 3$ for the FHE experiments and $Q = 30$ for the plaintext version. For both experiments, $\text{Proj}_{\theta}(\cdot)$ is a multi-layer perceptron defined by two fully connected layers with a polynomial activation function between them $\sigma_{\text{poly}}$. Here, $\sigma_{\text{poly}}$ is the second-degree polynomial approximation of ReLU, defined as $\sigma_{\text{poly}} = 0.09x^2 + 0.5x + 0.47$ [63].

<footnote n="1">¹https://scikit-learn.org/stable/modules/generated/sklearn datasets.make_-classification.html</footnote>
4) Hardware Specifications: We use a computer with an Intel(R) Core(TM) i7-12700K CPU, an RTX 4090 GPU, and 128 GB of RAM. Local training calls are performed using the GPU, while embedding is performed on the CPU for FHE experiments and on the GPU for the robustness part.

5) Metrics: The performance of the model on the main task is evaluated using accuracy (Acc) on the test set $D^{test}$. We arbitrarily define $\epsilon = 0.02$, representing the tolerated performance loss on the main task when watermarking is applied. To quantify the success of the watermark embedding, we also use accuracy, but this time evaluated on the trigger set $T$. To define the accepted threshold $\delta$ for which the IP is verified (see Eq. (14)), we follow the methodology of [64]. We compute the average success rate of the attacker using the following binomial probability:

$$P(L(\hat{M}^G, T) < \tau) = \sum_{i=0}^{[\tau \times T]} \binom{T}{i} \times \left(\frac{m-1}{m}\right)^i \times \left(\frac{1}{m}\right)^{T-i} \quad (21)$$

where $\tau$ is the tolerated error rate, $T$ the size of the trigger set and $L$ is the classification error of $\hat{M}^G$ on $T$, i.e., $L(\hat{M}, T) = 1 - \text{Acc}(\hat{M}, T)$. Since we use WAFFLEPattern [18] with $T = 100$ for dynamic watermarking, we can use the same threshold for verification $\delta = 0.47$, which guarantees reliable ownership demonstration with confidence greater than $1 - 2^{-64}$ [18].

## B. FHE using CKKS

1) Fidelity: The fidelity requirement ensures that the watermarking process does not negatively impact the model's performance. Specifically, at the end of the embedding process, the watermark verification protocol should succeed according to the fixed threshold $\delta$. Additionally, the performance difference between the watermarked model $\hat{M}^G$ and the original model $M^G$ should be less than $\epsilon$. In other words, both of the following conditions must be satisfied:

* Verify($\hat{M}^G$, $\Omega$, $\delta$) = 1

* $|\text{Acc}(\hat{M}^G, D^{test}) - \text{Acc}(M^G, D^{test})| < \epsilon$

To verify this requirement, we experimented with our scheme on VGG11 using the parametrization given in Section IV. As shown in Table II, the watermark does not degrade the model's performance while being perfectly embedded.

<table><caption>TABLE II COMPARISON OF THE ACCURACY ON THE TEST SET AND THE TRIGGER SET FOR $M^G$ AND $\hat{M}^G$. THE DISPLAYED VALUES ARE THE MEAN AND THEIR CORRESPONDING STANDARD DEVIATION CALCULATED OVER 5 RUNS.</caption><thead><tr><td>Models</td><td>Test Accuracy</td><td>Watermark Accuracy</td></tr></thead><tbody><tr><td>M&#x0302;<sup>G</sup> (With Watermark)</td><td>0.86 &plusmn; 4e-3</td><td>1.00 &plusmn; 0.00</td></tr><tr><td>M<sup>G</sup> (Without Watermark)</td><td>0.86 &plusmn; 2e-3</td><td>0.5 &plusmn; 6e-2</td></tr></tbody></table>

2) Efficiency: The efficiency requirement emphasizes minimizing the computational and communication overhead of the embedding process. Our method does not increase communication overhead because updates are exchanged as usual in the context of HE-based FL. However, it does increase

the server's computational complexity due to the additional updates to the targeted layer and the projection function. Using VGG11, we evaluate the time needed to perform one update (Algorithm 1) on 10 samples from $T$. We observed that it takes approximately 11 minutes to perform one epoch. Embedding the watermark is time-consuming, and this time increases with the number of samples that need to be updated. Thus, watermarking an encrypted model requires high computational power at the server level to be efficient.

## C. Robustness with Plaintext Model

A watermark should be robust against various types of attacks to meet the robustness requirements defined in Section II-D. An attack is considered effective if it maintains high accuracy on the test set while removing the watermark and if the resources required for the attack, such as runtime, are relatively small compared to retraining the model from scratch. In other words, the attacker aims to verify the following conditions in a reasonable time:

* Verify($M^A$, $\Omega^*$, $\delta$) = 0

* $|\text{Acc}(M^A, D^{test}) - \text{Acc}(\hat{M}^G, D^{test})| < \epsilon$

In this work, we assume that the attacker $\mathcal{A}$ has access to the full training set (i.e., $D^{train} = \cup_{k=1}^K D^k$). This is a strong assumption. We experimented with the following attacks: fine-tuning, pruning, overwriting, and ambiguity.

1) Fine-tuning: Fine-tuning involves performing a few more training epochs with a lower learning rate to disrupt the watermark verification while maintaining the model's performance. All layers are updated during this process. Figures 5a, 5b, and 5c illustrate the results of the fine-tuning process over 100 epochs using the entire dataset $D = \cup_{k=1}^K D^k$ with a fixed learning rate of $\alpha_a = 1e-3$, $\alpha_b = 1e-3$, and $\alpha_c = 1e-4$, respectively. Note that using the whole training dataset is a very strong hypothesis compared to a real-life scenario, where $\mathcal{A}$ has access to a smaller set of samples. Despite this post-processing attack, the watermark remains detectable, as the watermark degradation results in a value of $\approx 0.98 > \delta$ at epoch 100 for all protected models (VGG11, ConvMixer, and ResNet18).

2) Pruning: Pruning involves zeroing a set of parameters that are considered unnecessary for the desired task due to the over-parameterization of neural networks. In this case, we use the parameters with the lowest $L^1$-norm to quantify their utility<fnref n="2" />. Figures 5d, 5e, and 5f show that the watermark maintains an accuracy of 1.0 until 20% of the parameters are pruned. From 20% to 90% pruned parameters, the accuracy of the watermark decreases. Nevertheless, it remains higher than $\delta$ until $\approx 80\%$ of the parameters are pruned for VGG11, $\approx 60\%$ for ConvMixer, and $\approx 85\%$ for ResNet18. However, the accuracy drops drastically below $\approx 20\%$ for all models. The difference for this amount/ratio of pruned parameters is defined as follows:

$$|\text{Acc}(M^A, D^{test}) - \text{Acc}(\hat{M}^G, D^{test})| \approx 0.68 > \epsilon \quad (22)$$

<footnote n="2">²https://pytorch.org/docs/stable/generated/torch.nn.util.prune.l1_unstructured.html</footnote>
<figure><img src="image_6.png" /><figcaption>Fig. 5. Comparison of Fine-tuning, Pruning, and Overwriting methods for VGG11, ConvMixer, and ResNet18. The displayed values are the mean and their corresponding standard deviation calculated over 5 runs.</figcaption></figure>

These results demonstrate that our watermark is resistant to pruning since removing the dynamic watermark implies a significant drop in the attacked model's performance.

3) Overwriting: Overwriting involves embedding a new watermark using the same algorithm (Algorithm 2) while attempting to completely erase the original watermark. The attacker aims to meet the following conditions:

* Verify($M^A$, $\Omega^A$, $\delta$) = 1

* Verify($M^A$, $\Omega^*$, $\delta$) = 0

* $|\text{Acc}(\hat{M}^A, \mathcal{D}^{test}) - \text{Acc}(\hat{M}^G, \mathcal{D}^{test})| < \epsilon$

Here, $\mathcal{A}$ normally uses its own set of parameters $\Omega^A$ to embed its watermark. Nevertheless, to demonstrate the resistance of our method against overwriting attacks, we assume the worst case where all clients perform a second FL process and rely on another server to embed a unique dynamic watermark following the same algorithm as in Section III-B. They follow the exact embedding algorithm with their own secret parameters $\Omega^A$ except for $\{s, l\}$, which remains the same. Since attackers have access to the training set and can build a trigger set from scratch, we assume that $\mathcal{T}^A$ is constructed using adversarial samples as in FedIPR [13].

Figures 5g, 5h, and 5i show the results of such an attack. For VGG11 and ConvMixer, we can see that the attacker watermark is embedded after ≈ 20 epochs. However, the original watermark is still verifiable with an accuracy ≈ 0.9 > $\delta$. For ResNet18, the adversarial watermark is perfectly embedded more quickly, after only 10 epochs. If the accuracy of the original watermark decreases, it is still verifiable with an accuracy of ≈ 0.88. Based on these results, we can conclude that FedCrypt is resistant to overwriting. However, both $\Omega^*$ and $\Omega^A$
are verifiable, which leads to ambiguity in the ownership of the model, which is addressed in the next section.

4) Ambiguity Attack: An ambiguity attack is a strategy where the attacker creates confusion during the verification process by building a non-legitimate watermark on the model, resulting in a model with two watermarks that satisfy:

* Verify($\hat{M}^A$, $\Omega^A$, $\delta$) = 1

* Verify($\hat{M}^A$, $\Omega^*$, $\delta$) = 1

If no countermeasure is taken, a third party cannot certify which entity owns the model. This problem can be solved by following the Merkle-Sign protocol [20], which involves saving $\Omega^*$ in a blockchain or decentralized network [65] with a timestamp proof. Thus, the first person to place their watermarked model on such a ledger can prove ownership.

## V. DISCUSSION & LIMITATIONS

To the best of our knowledge, FedCrypt is the first white-box watermarking scheme that ensures both intellectual property (IP) protection and data confidentiality in a homomorphic Federated Learning (FL) context. Experimental results demonstrate that FedCrypt is robust against several removal attacks across three benchmark models.

Additionally, FedCrypt allows for generating trigger sets either vertically or horizontally, depending on whether the verification is conducted by both the server and the clients or separately. This feature is particularly useful in scenarios where the server and clients do not trust each other, similar to a buyer-seller scenario in the context of multimedia content [66, 67]. For example, consider a model owner (seller) who embeds a unique watermark into a copy of the model before selling it to a buyer. If the buyer sells unauthorized copies of the watermarked model, these copies can be traced back to the original buyer using a watermark detection algorithm. However, the original buyer might claim that the unauthorized copy was created by the original seller, possibly due to a security breach. To address this, the HE-based model watermarking algorithm we proposed in Section III-B can be used to implement a buyer-seller protocol where both the seller and buyer do not know the exact watermark that will be embedded. In the context of FL, if there is no trust between the server and clients, FedCrypt with a vertical trigger set can be used to embed a watermark that both the server and clients agree upon without knowing its content.

As indicated in Section III-B, with FedCrypt, the server inputs the trigger set $\mathcal{T}$ at layer $s$ and detects the watermark from layer $l$. It is important to note that the forward process between $s$ and $l$ can considerably slow down the watermark embedding process depending on the number and complexity of the layers in between. Another issue arises when these layers are non-polynomial, requiring approximation. For instance, layers such as max pooling can be replaced by average pooling, but this strategy is not generalizable for all types of layers. Therefore, we suggest choosing $s$ such that $s = l - 1$, and $l$ as one of the layers with the smallest output dimensions. However, this limits the information embedded in $\mathcal{T}$ due to the low-dimension projections performed at the end of the neural network.

Homomorphic cryptosystems have become faster in recent years, with significant advancements in hardware-level acceleration [68–71]. Given the importance of having a computationally efficient FHE scheme, we hope that our method can be applied in real-world scenarios as these schemes become more available.

## VI. CONCLUSION

In this paper, we demonstrate that the challenge of protecting both the model's intellectual property (IP) and the client's privacy can be addressed using our scheme, FedCrypt. Specifically, we illustrate how the embedding process can be converted into a fully polynomial process to be compatible with a real Fully Homomorphic Encryption (FHE) cryptosystem, such as CKKS. This encrypted embedding technique enables the construction of new verification protocols, allowing the server to embed encrypted watermarks from the clients. Consequently, both the server and clients can independently or jointly verify the model's IP through a secure verification protocol. By leveraging dynamic watermarking, our experiments show that FedCrypt is resistant to various removal attacks, including fine-tuning, pruning, and overwriting. These results underscore the robustness and practicality of FedCrypt in securing both model IP and client data in a federated learning environment.

## ACKNOWLEDGMENT

This work is funded by the European Union under Grant Agreement 101070222. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Commission (granting authority). Neither the European Union nor the granting authority can be held responsible for them. This work is also supported by the CYBAILE industrial chair, which is led by Inserm with the support of the Brittany Region Council.

## REFERENCES

[1] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in *Artificial intelligence and statistics*. PMLR, 2017, pp. 1273–1282.

[2] K. A. Koutsopoulos, C. Thümmler, A. A. Castillo, A. Abend, S. Covaci, B. Ertl, G. Ledakis, S. Lorin, V. Thouvenot, S. Haddad et al., “Architecture and design choices for federated learning in modern digital healthcare systems,” in *Federated Learning for Digital Healthcare Systems*. Elsevier, 2024, pp. 37–58.

[3] Z. He, T. Zhang, and R. B. Lee, “Model inversion attacks against collaborative inference,” in *Proceedings of the 35th Annual Computer Security Applications Conference*, 2019, pp. 148–162.

[4] H. Hu, Z. Salcic, L. Sun, G. Dobbie, P. S. Yu, and X. Zhang, “Membership inference attacks on machine learning: A survey,” *ACM Computing Surveys (CSUR)*, vol. 54, no. 11s, pp. 1–37, 2022.

[5] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning
models,” in 2017 IEEE symposium on security and privacy (SP). IEEE, 2017, pp. 3–18.

[6] C. Zhang, S. Li, J. Xia, W. Wang, F. Yan, and Y. Liu, “{BatchCrypt}: Efficient homomorphic encryption for {Cross-Silo} federated learning,” in 2020 USENIX annual technical conference (USENIX ATC 20), 2020, pp. 493–506.

[7] Y. Uchida, Y. Nagai, S. Sakazawa, and S. Satoh, “Embedding watermarks into deep neural networks,” in Proceedings of the 2017 ACM on international conference on multimedia retrieval, 2017, pp. 269–277.

[8] L. Fan, K. W. Ng, and C. S. Chan, “Rethinking deep neural network ownership verification: Embedding passes to defeat ambiguity attacks,” Advances in neural information processing systems, vol. 32, 2019.

[9] B. Darvish Rouhani, H. Chen, and F. Koushanfar, “Deep-signs: An end-to-end watermarking framework for ownership protection of deep neural networks,” in Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems, 2019, pp. 485–497.

[10] K. Kallas and T. Furon, “Mixer: Dnn watermarking using image mixup,” in ICASSP 2023 - 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2023, pp. 1–5.

[11] R. Bellafqira and G. Coatrieux, “Diction: Dynamic robust white box watermarking scheme,” arXiv preprint arXiv:2210.15745, 2022.

[12] K. Kallas and T. Furon, “Rose: A robust and secure dnn watermarking,” in 2022 IEEE International Workshop on Information Forensics and Security (WIFS). IEEE, 2022, pp. 1–6.

[13] B. Li, L. Fan, H. Gu, J. Li, and Q. Yang, “Fedipr: Ownership verification for federated deep neural network models,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.

[14] J. Liang and R. Wang, “Fedcip: Federated client intellectual property protection with traitor tracking,” arXiv preprint arXiv:2306.01356, 2023.

[15] Y. Xu, Y. Tan, C. Zhang, K. Chi, P. Sun, W. Yang, J. Ren, H. Jiang, and Y. Zhang, “Robwe: Robust watermark embedding for personalized federated learning model ownership protection,” arXiv preprint arXiv:2402.19054, 2024.

[16] S. Shao, W. Yang, H. Gu, J. Lou, Z. Qin, L. Fan, Q. Yang, and K. Ren, “Fedtracker: Furnishing ownership verification and traceability for federated learning model,” arXiv preprint arXiv:2211.07160, 2022.

[17] S. Yu, J. Hong, Y. Zeng, F. Wang, R. Jia, and J. Zhou, “Who leaked the model? tracking ip infringers in accountable federated learning,” arXiv preprint arXiv:2312.03205, 2023.

[18] B. A. Tekgul, Y. Xia, S. Marchal, and N. Asokan, “Waffle: Watermarking in federated learning,” in 2021 40th International Symposium on Reliable Distributed Systems (SRDS). Los Alamitos, CA, USA: IEEE Computer Society, sep 2021, pp. 310–320. [Online]. Available: https://doi.ieeecomputersociety.org/

10.1109/SRDS53918.2021.00038

[19] W. Yang, S. Shao, Y. Yang, X. Liu, Z. Xia, G. Schaefer, and H. Fang, “Watermarking in secure federated learning: A verification framework based on client-side backdoor-ing,” arXiv preprint arXiv:2211.07138, 2022.

[20] F.-Q. Li, S.-L. Wang, and A. W.-C. Liew, “Towards practical watermark for deep neural networks in federated learning,” arXiv preprint arXiv:2105.03167, 2021.

[21] M. Lansari, R. Bellafqira, K. Kapusta, V. Thouvenot, O. Bettan, and G. Coatrieux, “When federated learning meets watermarking: A comprehensive overview of techniques for intellectual property protection,” Machine Learning and Knowledge Extraction, vol. 5, no. 4, pp. 1382–1406, 2023.

[22] P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Ben-nis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings et al., “Advances and open problems in federated learning,” Foundations and trends® in machine learning, vol. 14, no. 1–2, pp. 1–210, 2021.

[23] P. Paillier, “Public-key cryptosystems based on composite degree residuosity classes,” in International conference on the theory and applications of cryptographic techniques. Springer, 1999, pp. 223–238.

[24] J. Fan and F. Vercauteren, “Somewhat practical fully homomorphic encryption,” Cryptology ePrint Archive, 2012.

[25] Z. Brakerski, C. Gentry, and V. Vaikuntanathan, “(levered) fully homomorphic encryption without bootstrapping,” ACM Transactions on Computation Theory (TOCT), vol. 6, no. 3, pp. 1–36, 2014.

[26] I. Chillotti, N. Gama, M. Georgieva, and M. Izabachène, “TFHE: Fast fully homomorphic encryption library,” August 2016, https://tfhe.github.io/tfhe/.

[27] J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Homomorphic encryption for arithmetic of approximate numbers,” in Advances in Cryptology–ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I 23. Springer, 2017, pp. 409–437.

[28] P.-E. Clet, O. Stan, and M. Zuber, “Bfv, ckks, tfhe: Which one is the best for a secure neural network evaluation in the cloud?” in Applied Cryptography and Network Security Workshops: ACNS 2021 Satellite Workshops, AIBlock, AIHWS, AloTS, CIMSS, Cloud S&P, SCI, SecMT, and SiMLA, Kamakura, Japan, June 21–24, 2021, Proceedings. Springer, 2021, pp. 279–300.

[29] A. Benaissa, B. Retiat, B. Cebere, and A. E. Belfedhal, “Tenseal: A library for encrypted tensor operations using homomorphic encryption,” arXiv preprint arXiv:2104.03152, 2021.

[30] H. R. Roth, Y. Cheng, Y. Wen, I. Yang, Z. Xu, Y.-T. Hsieh, K. Kersten, A. Harouni, C. Zhao, K. Lu et al., “Nvidia flare: Federated learning from simulation to real-world,” arXiv preprint arXiv:2210.13291, 2022.

[31] M. E. Azzouzi, G. Coatrieux, R. Bellafqira, D. Delamarre, C. Riou, N. Oubenali, S. Cabon, M. Cuggia, and G. Bouzillé, “Automatic de-identification of french
electronic health records: a cost-effective approach exploiting distant supervision and deep learning models,” *BMC Medical Informatics and Decision Making*, vol. 24, no. 1, p. 54, 2024.

[32] R. El Saj, E. Sedgh Gooya, A. Alfalou, and M. Khalil, “Privacy-preserving deep neural network methods: computational and perceptual methods—an overview,” *Electronics*, vol. 10, no. 11, p. 1367, 2021.

[33] R. Gilad-Bachrach, N. Dowlin, K. Laine, K. Lauter, M. Naehrig, and J. Wernsing, “Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy,” in *International conference on machine learning*. PMLR, 2016, pp. 201–210.

[34] J. W. Bos, K. Lauter, J. Loftus, and M. Naehrig, “Improved security for a ring-based fully homomorphic encryption scheme,” in *Cryptography and Coding: 14th IMA International Conference, IMACC 2013, Oxford, UK, December 17-19, 2013. Proceedings 14*. Springer, 2013, pp. 45–64.

[35] A. Al Badawi, C. Jin, J. Lin, C. F. Mun, S. J. Jie, B. H. M. Tan, X. Nan, K. M. M. Aung, and V. R. Chandrasekhar, “Towards the alexnet moment for homomorphic encryption: Hcnn, the first homomorphic cnn on encrypted data with gpus,” *IEEE Transactions on Emerging Topics in Computing*, vol. 9, no. 3, pp. 1330–1343, 2020.

[36] B. Reagen, W.-S. Choi, Y. Ko, V. T. Lee, H.-H. S. Lee, G.-Y. Wei, and D. Brooks, “Cheetah: Optimizing and accelerating homomorphic encryption for private inference,” in *2021 IEEE International Symposium on High-Performance Computer Architecture (HPCA)*. IEEE, 2021, pp. 26–39.

[37] J. Dang, J. Tong, A. Golder, C. Hao, A. Raychowdhury, T. Krishna et al., “Accurate low-degree polynomial approximation of non-polynomial operators for fast private inference in homomorphic encryption,” *Proceedings of Machine Learning and Systems*, vol. 6, pp. 210–223, 2024.

[38] R. Ran, N. Xu, T. Liu, W. Wang, G. Quan, and W. Wen, “Penguin: Parallel-packed homomorphic encryption for fast graph convolutional network inference,” *Advances in Neural Information Processing Systems*, vol. 36, 2024.

[39] A. Akram, F. Khan, S. Tahir, A. Iqbal, S. A. Shah, and A. Baz, “Privacy preserving inference for deep neural networks: Optimizing homomorphic encryption for efficient and secure classification,” *IEEE Access*, 2024.

[40] R. Bellafqira, G. Coatrieux, E. Genin, and M. Cozic, “Secure multilayer perceptron based on homomorphic encryption,” in *Digital Forensics and Watermarking: 17th International Workshop, IWDW 2018, Jeju Island, Korea, October 22-24, 2018, Proceedings 17*. Springer, 2019, pp. 322–336.

[41] Zama, “Concrete ML: a privacy-preserving machine learning library using fully homomorphic encryption for data scientists,” 2022, https://github.com/zama-ai/concrete-ml.

[42] P. Panzade, D. Takabi, and Z. Cai, “I can’t see it but i can fine-tune it: On encrypted fine-tuning of transformers using fully homomorphic encryption,” *arXiv preprint* arXiv:2402.09059, 2024.

[43] S. Lee, G. Lee, J. W. Kim, J. Shin, and M.-K. Lee, “Hetal: Efficient privacy-preserving transfer learning with homomorphic encryption,” in *International Conference on Machine Learning*. PMLR, 2023, pp. 19010–19035.

[44] N. M. Hijazi, M. Aloqaily, M. Guizani, B. Ouni, and F. Karray, “Secure federated learning with fully homomorphic encryption for iot communications,” *IEEE Internet of Things Journal*, 2023.

[45] B. Wang, H. Li, Y. Guo, and J. Wang, “Ppflhe: A privacy-preserving federated learning scheme with homomorphic encryption for healthcare data,” *Applied Soft Computing*, vol. 146, p. 110677, 2023.

[46] G. Su, J. Wang, X. Xu, Y. Wang, and C. Wang, “The utilization of homomorphic encryption technology grounded on artificial intelligence for privacy preservation,” *International Journal of Computer Science and Information Technology*, vol. 2, no. 1, pp. 52–58, 2024.

[47] Y. Miao, Z. Liu, H. Li, K.-K. R. Choo, and R. H. Deng, “Privacy-preserving byzantine-robust federated learning via blockchain systems,” *IEEE Transactions on Information Forensics and Security*, vol. 17, pp. 2848–2861, 2022.

[48] P. Bas, T. Furon, F. Cayre, G. Doërr, B. Mathon, P. Bas, T. Furon, F. Cayre, G. Doërr, and B. Mathon, “A quick tour of watermarking techniques,” *Watermarking Security*, pp. 13–31, 2016.

[49] M. Barni, F. Pérez-González, and B. Tondi, “Dnn watermarking: Four challenges and a funeral,” in *Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security*, 2021, pp. 189–196.

[50] A. Krizhevsky, G. Hinton et al., “Learning multiple layers of features from tiny images,” 2009.

[51] Y. Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” in *27th USENIX Security Symposium (USENIX Security 18)*, 2018, pp. 1615–1631.

[52] J. Zhang, Z. Gu, J. Jang, H. Wu, M. P. Stoecklin, H. Huang, and I. Molloy, “Protecting intellectual property of deep neural networks with watermarking,” in *Proceedings of the 2018 on Asia conference on computer and communications security*, 2018, pp. 159–172.

[53] E. Le Merrer, P. Perez, and G. Trédan, “Adversarial frontier stitching for remote neural network watermarking,” *Neural Computing and Applications*, vol. 32, pp. 9233–9244, 2020.

[54] F. Boenisch, “A systematic review on model watermarking for neural networks,” *Frontiers in big Data*, vol. 4, p. 729663, 2021.

[55] Y. LeCun and C. Cortes, “MNIST handwritten digit database,” 2010. [Online]. Available: http://yann.lecun.com/exdb/mnist/

[56] T. Wang and F. Kerschbaum, “Riga: Covert and robust white-box watermarking of deep neural networks,” in *Proceedings of the Web Conference 2021*, 2021, pp. 993–1004.
[57] G. Li, S. Li, Z. Qian, and X. Zhang, “Encryption resistant deep neural network watermarking,” in *ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)*. IEEE, 2022, pp. 3064–3068.

[58] Y. Li, L. Abady, H. Wang, and M. Barni, “A feature-map-based large-payload dnn watermarking algorithm,” in *International Workshop on Digital Watermarking*. Springer, 2021, pp. 135–148.

[59] Y. Li, L. Zhu, X. Jia, Y. Jiang, S.-T. Xia, and X. Cao, “Defending against model stealing via verifying embedded external features,” in *Proceedings of the AAAI conference on artificial intelligence*, vol. 36, no. 2, 2022, pp. 1464–1472.

[60] K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” *arXiv preprint arXiv:1409.1556*, 2014.

[61] A. Trockman and J. Z. Kolter, “Patches are all you need?” *arXiv preprint arXiv:2201.09792*, 2022.

[62] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in *Proceedings of the IEEE conference on computer vision and pattern recognition*, 2016, pp. 770–778.

[63] V. Gottemukkula, “Polynomial activation functions,” 2019.

[64] S. Szyller, B. G. Atli, S. Marchal, and N. Asokan, “Dawn: Dynamic adversarial watermarking of neural networks,” in *Proceedings of the 29th ACM International Conference on Multimedia*, 2021, pp. 4417–4425.

[65] F.-Q. Li, S.-L. Wang, and A. W.-C. Liew, “Regulating ownership verification for deep neural networks: Scenarios, protocols, and prospects,” *arXiv preprint arXiv:2108.09065*, 2021.

[66] N. Memon and P. W. Wong, “A buyer-seller watermarking protocol,” *IEEE Transactions on image processing*, vol. 10, no. 4, pp. 643–649, 2001.

[67] F. Frattolillo, “Watermarking protocols: A short guide for beginners,” *Future Internet*, vol. 15, no. 5, p. 163, 2023.

[68] W. Wang, Z. Chen, and X. Huang, “Accelerating leveled fully homomorphic encryption using gpu,” in *2014 IEEE International Symposium on Circuits and Systems (ISCAS)*. IEEE, 2014, pp. 2800–2803.

[69] Y. Doröz, E. Öztürk, E. Savaş, and B. Sunar, “Accelerating ltv based homomorphic encryption in reconfigurable hardware,” in *Cryptographic Hardware and Embedded Systems–CHES 2015: 17th International Workshop, Saint-Malo, France, September 13-16, 2015, Proceedings 17*. Springer, 2015, pp. 185–204.

[70] A. C. Mert, E. Öztürk, and E. Savaş, “Design and implementation of encryption/decryption architectures for bfv homomorphic encryption scheme,” *IEEE Transactions on Very Large Scale Integration (VLSI) Systems*, vol. 28, no. 2, pp. 353–362, 2019.

[71] A. Ş. Özcan, C. Ayduman, E. R. Türkoğlu, and E. Savaş, “Homomorphic encryption on gpu,” *IEEE Access*, 2023.

Mohammed Lansari received the B.Sc. degree with double Major in mathematics and computer science from Paris-Saclay University, Orsay, France, in 2020, and the M.Sc. in Computer Science and Artificial Intelligence from Paris-Saclay University, Orsay, France, in 2022. He is working toward the PhD degree with Thales SIX and IMT Atlantique. His research interests include secure federated learning and deep neural network watermarking.

<figure><img src="image_7.png" /></figure>

Reda Bellafqira (Member, IEEE) received the M.Sc. degree in Information Security and Cryptology from the University of Limoges, Limoges, France, in 2014, and the Ph.D. degree from IMT Atlantique Bretagne-Pays de la Loire, Brest, France, in 2017.

Since 2018, he has been a Postdoctoral Researcher with the Laboratory of Medical Information Processing, Inserm UMR 1101. He is currently an Associate Professor in the Department of Data Science at IMT Atlantique, where he continues his research activities within the Laboratory of Medical Information Processing, Inserm UMR 1101. His research interests include data security, focusing on the protection of machine learning models, medical images, and databases from malicious entities and service providers. He employs techniques such as watermarking and cryptographic tools, including homomorphic encryption, multiparty computation, and federated learning.

<figure><img src="image_8.png" /></figure>

Katarzyna Kapusta is a research engineer in cybersecurity at Thales and an Invited Associate Professor at Télécom Paris. She holds a PhD (2018) and M.Sc. (2014) degrees in Computer Science both from Télécom Paris, France, as well as a M.Sc. (2014) in Telecommunications from AGH University of Science and Technology, Cracow, Poland. Her research interests include data security, focusing on data protection in distributed environments and securing Machine Learning models. She is an active contributor to standardization groups on the topic of secure artificial intelligence.
<figure><img src="image_9.png" /></figure>

**Kassem Kallas** (Senior Member, IEEE) is a Senior Scientist and Junior Professor in Artificial Intelligence, focusing on cybersecurity. He earned his Ph.D. in Information Engineering and Sciences from the University of Siena in 2017, placing in the top 3 for the Springer Best-of-the-Best PhD Thesis Award. He holds BSc. and MSc. degrees in Telecom Engineering and Computer and Communication Engineering from the Lebanese International University (2010, 2012), a specialized master in Wireless Systems and Related Technologies from Politecnico

di Torino (2013), and an Executive MBA in Strategic Leadership from Quantic School of Business and Technology (USA). He has participated in research projects funded by institutions like DARPA, U.S. Air Force Research Laboratory, Italian Ministry of University and Research, and the French National Research Agency. His work spans various national institutes, including NIST (USA) on AI for wireless systems and INRIA (France) on AI Security for defense applications. In industry, he has served as an R&D scientist and AI consultant for several Italian companies. Currently, he is a Senior Scientist at the French National Institute of Health and Medical Research, focusing on AI security for medical applications. He received the Best Paper Award at MMEDIA 2017 and a top 3% paper award at ICASSP 2023. He authored "Information Fusion in Distributed Sensor Networks with Byzantines" and edited "Adversarial Multimedia Forensics," books both published by Springer. He is a senior IEEE member and actively engages in communities like IEEE Young Professionals, Entrepreneurship Exchange Community, Computer Society Technical Communities on Cyber Security and Security and Privacy, Signal Processing Society, EURASIP, ACM, and APSIPA.

<figure><img src="image_10.png" /></figure>

**Gouenou Coatrieux** (SM'13) is full professor at IMT Atlantique, Brest, France, and conducts his research in the Laboratory of Medical Information Processing, Inserm UMR1101, Brest, where he leads the Cyber Health research team. He is also the head of the Inserm Indutsrial Chair CYBAILE on Cybersecurity and Trusted Artificial Intelligence in Healthcare.

His primary research interests concern watermarking, crypto-watermarking, secure processing of data, digital forensics and the security of DNA data storage.

He is/was a member of the International Federation for Medical and Biological Engineering "Global Citizen Safety and Security Working Group" and the European Federation for Medical Informatics "Security, Safety, and Ethics Working Group," and has contributed to the Technical Committee of "Information Technology for Health" of the IEEE EMB Society. He was an Associate Editor of the Innovation and Research in Bio-Medical and past associate editor of Engineering and of the IEEE Journal on Biomedical and Health Informatics, Digital Signal Processing.

**Vincent Thouvenot** is a research engineer in Data Science and Machine Learning at Thales SIX France. He joins Thales in 2015 after achieving a PhD in applied mathematics at Orsay University and EDF. His research interests concern Fairness, Privacy for Machine Learning, Federated Learning, xAI, machine learning robustness and use of machine learning for signal processing. He is a member of SINCLAIR Laboratory.

<figure><img src="image_11.png" /></figure>

**Olivier Bettan** Olivier Bettan is Head of Cyber Security Research Lab at Thales. He obtained his diploma in Mathematics and Computer Science (DEA in cryptography) from the University of Versailles Saint-Quentin (UVSQ) in 2004. Before joining Thales he was responsible of large aeronautical software certification under DO-178B standard. Since 2007, as a Thales Security expert, he manages and contributes to Security related RNTL, ANR, national and European projects. In 2008, he joined the ThereSiS Security team as Cyber Security R&D

activity manager, with a particular focus on Cryptographic domain. Olivier co-founded the "Club des partenaires Industriels" of the french Security Research Group (GDR Security) and is member of several Program & Technical Committee (NOMS, RESSI).