Traceable Black-Box Watermarks For Federated Learning
Authors: Jiahao Xu
Rui Hu
Olivera Kotevska
Zikai Zhang
Venue: ICLR 2026 Poster (2026)
Keywords: Federated Learning
Watermark
Black-box watermark
Intellectual property protection
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Due to the distributed nature of Federated Learning (FL) systems, each local client has access to the global model, which poses a critical risk of model leakage. Existing works have explored injecting watermarks into local models to enable intellectual property protection. However, these methods either focus on non-traceable watermarks or traceable but white-box watermarks. We identify a gap in the literature regarding the formal definition of traceable black-box watermarking and the formulation of the problem of injecting such watermarks into FL systems. In this work, we first formalize the problem of injecting traceable black-box watermarks into FL. Based on the problem, we propose a novel server-side watermarking method, $\mathbf{TraMark}$, which creates a traceable watermarked model for each client, enabling verification of model leakage in black-box settings. To achieve this, $\mathbf{TraMark}$ partitions the model parameter space into two distinct regions: the main task region and the watermarking region. Subsequently, a personalized global model is constructed for each client by aggregating only the main task region while preserving the watermarking region. Each model then learns a unique watermark exclusively within the watermarking region using a distinct watermark dataset before being sent back to the local client. Extensive results across various FL systems demonstrate that $\mathbf{TraMark}$ ensures the traceability of all watermarked models while preserving their main task performance. The code is available at \url{https://github.com/JiiahaoXU/TraMark}.

Published as a conference paper at ICLR 2026
TRACEABLE BLACK-BOX WATERMARKS FOR FEDER- ATED LEARNING
Jiahao Xu Rui Hu-
Olivera Kotevska² Zikai Zhang'
1 University of Nevada, Reno 2 Oak Ridge National Laboratory
{jiahaox, ruihu, zikaiz]eunr. edu, KotevskaoBorll.go
ABSTRACT
Due to the distributed nature of Federated Learning (FL) systems, each local client has access to the global model, which poses critical risk of model leakage. Ex- isting works have explored injecting watermarks into local models to enable intel- lectual property protection. However, these methods either focus on non-traceable watermarks or traceable but white-box watermarks. We identify a gap in the lit- erature regarding the formal definition of traceable black-box watermarking and the formulation of the problem of injecting such watermarks into FL systems. this work, we first formalize the problem of injecting traceable black-box water- marks into FL. Based on the problem, we propose a novel server-side watermark- ing method, TraMark, which creates traceable watermarked model for each client, enabling verification of model leakage in black-box settings. To achieve this, TraMark partitions the model parameter space into two distinct regions: the main task region and the watermarking region. Subsequently, a personal- ized global model is constructed for each client by aggregating only the main task region while preserving the watermarking region. Each model then learns a unique watermark exclusively within the watermarking region using a distinct watermark dataset before being sent back to the local client. Extensive results across various FL systems demonstrate that TraMark ensures the traceability all watermarked models while preserving their main task performance. The code is available at htttts:: //gi htt///ttttt thub. com/ foom/iiaaacoi waaaaaaauuuT Traaa rk.
INTRODUCTION
Federated Learning (FL) is a promising training paradigm that enables collaborative model training across distributed local clients while ensuring that private data remains on local devices (McMahan al.) 2017). Instead of sharing raw data, clients train local models independently and periodically send updates to central server, which aggregates them into a global model. This privacy-preserving preserving benefit has led to FL's widespread adoption in various fields, including healthcare (Nguyen et al.) 2022). finance (Long et al.) 2200)) and remote sensing (Liu et al. 2020), where local data privacy critical concern. However, sharing the global model with all participants introduces risks of model leakage. Specifically, malicious clients may cxploit their access by duplicating and illegally distributing the model (Li et al., 2022a). Such misconduct undermines the integrity of the FL system and compromises the collective interests of all participants. Consequently, protecting intellectual property (IP) rights of FL-trained models and detecting copyright infringement have become critical challenges in FL. (Xue et 2022).
Protecting the IP of FL-trained models requires mechanisms to verify rightful ownership if a model unlawfully distributed (Shao al. 2024) (i.e., proving that the model originated from the FL system). To address this, researchers have proposed embedding watermarks into the global model enable ownership verification. Existing approaches primarily fall into two categories: parameter- based (Uchida et al. (207)) and backdoor-based (Tekgul et al.) 2021 Adi et al. 2018) watermarking techniques. Parameter-bast based methods embed signatures (e.g., bit strings) within the model's param- eters as secret key. During verification, the verifier extracts this key from the suspect model and ap- plies a cryptographic function with the corresponding public key to validate the model's ownership.
PPartially done during the internship the Oak Ridge National Laboratory.

---

Published as a conference paper at ICLR 2026
However, this process requires white-box access to the model parameters, which is often infeasible in practice, particularly when the suspect model is only accessible in a black-box setting (c.g., via an APD). To overcome this limitation, backdoor-base techniques to ensure that the model learns a specific trigger. A watermarked model outputs prede- fined responses when presented with inputs containing the trigger. Unlike parameter-based methods, this verification process does not require access to the model parameters, making backdoor-base watermarking a more practical solution.
watermarking leverages backdoor injection
Beyond ownership verification, the verifier also needs to trace the source of model leakage, identi- fying which client was responsible for the unauthorized distribution. Recent studies have explored methods for ensuring the traceability of watermarked models in FL (Shao et al.] [2024] Yu et al.)
Xu et al., 2024 Nie Lu 2024a). For instance, FedTracker (Shao et al.) 2024) embeds unique bit strings into each client's model and identifies the leaker by measuring bit string simi- larities. However, this approach requires white-box access to the suspect model, which limits its practicality, Another approach, FedCRMW (Nie & Lu (022a), introduces black-box watermark- ing mechanism that injects unique watermarks into each model shared with the client by mixing clients' local datasets with multiple types of triggers. The model leaker is then identified based on the models' predictions on these watermarked datasets. However, this method modifies the lo- cal training protocol and requires access to clients' local data, making it vulnerable to tampering by malicious clients. A recent method, MFL--Wner (Gai et al. (025), targets multi-modal FL. by leveraging each client's visual and language encoders to construct an orthogonal transformation on the client's 's trigger set, which serves as watermark. However, this approach suffers from poor gen- cralizability and fails scale effectively to broader FL systems. Despite notable empirical progress, existing literature still lacks a formal problem definition and formulation of black-box watermarking for ownership verification and traceability FL.
2023
In this work, we first formalize the problem of traceable black-bor box watermarking injection in FL sys- tems. Building on this, we propose TraMark, which creates a personalized, traceable watermarked model for each client, enabling verification of model leakage in black-box settings. Specifically, to ensure traceability, the server partitions the model's parameter space into two regions: the main task region, responsible for learning the primary FL task, and the watermarking region, designated for embedding a watermark. The server then generates personalized global models for each client via masked aggregation. Each model is subsequently injected with a distinct watermark exclusively in the watermarking region using a dedicated watermark dataset. This process ensures that every client receives personalized global model that integrates aggregated knowledge from other clients while embedding a unique watermark for model leakage verification. We summarize the contributions of our paper as follows.
To the best of our knowledge, this is the first work to formally formulate the problem of traceable black-box watermarking in FL systems. Based on this, we propose TraMark, novel water- marking method that can be seamlessly integrated into existing FL systems.
TraMark is designed to inject unique watermarks into models shared with clients while prevent- ing watermark collisions in FL, enabling the identification of model leakers in black-box settings.
We demonstrate the effectiveness of TraMark through extensive experiments across various FL settings. Results show that TraMark ensures clients receive traceable models while maintaining main task performance, with only a slight average drop of 0.54%. Additionally, we conduct a detailed hyperparameter analysis of TraMark to evaluate the impact of each configuration on both main task performance and leakage verification.
2 BACKGROUND AND SYSTEM SETTINGS
Federated Learning. A typical FL system consists of a central server and set of n local clients, which collaboratively train a shared model E Rdd. The FL problem generally formulated as: mino(1/n) Em (0; D(), where Fi(-) represents the local learning objective of client i, and D is its local dataset. For instance, for classification task, client i's local objective can be expressed as: F.; D.) == E (= [(0; 203;, where L(-) is the loss function, and (2, y) represents dat- apoint sampled from D'. A classic method to solve the FL problem is Federated Averaging (Fe- dAvg) (McMahan al. 2017). Specifically, in each training round I, the server broadcasts the
2

---

Published as a conference paper at ICLR 2026
current global model 6' to each client i [n]. Upon receiving 8', client performs 7) iterations of local training on it using Di, resulting in updated local model f7.² The client then computes and sends the model update A - 0 0f back to the server. The server aggregates updates from all clients and refines the global model as: o = 0² + (1/n) Σ A. This process repeats until the global model converges.
Attack Model. In this work, we consider a widely used attack model where all clients in an FL system are potential model leakers (Shao al. 2024, Tekgul et al., 2021). Specifically, we assume these clients will follow predefined local training protocol to complete the FL task. However, they may illegally distribute their local models for personal profit.
Defense Model. In this work, we consider the standard FL setup (e.g., FedAvg) where the server directly receives and aggregates local model updates but has no access to any private local data. The server is considered always reliable and equipped with sufficient computational resources. We assume that the server acts as the defender, responsible for injecting traceable watermarks into the FL system. Moreover, the server aims to keep the watermark injection process confidential from all local clients. Additionally, the server also acts as the verifier: if a model is deemed suspicious, initiates verification process to determine whether the model originates from the FL system and to identify the responsible model leaker.
3 PROBLEM FORMULATION
Black-box Watermarking, A black-box watermark is practical watermarking solution that en- ables verification without access to model parameters, making more suitable for real-world de- ployment. A common black-box watermarking approach leverages backdoor injection (Adi et al.) 2018), where a watermark dataset D (as defined in Definition containing triggers is used to train the model to produce predefined output when presented with the triggers.
Definition 1 (Watermark Dataset). A watermark dataset D is designated set of trigger-output pairs used to embed a watermark into a model. Formally,
D" = {(x, ((x)) x x
where ((x) is the unique predefined output distribution assigned to each trigger x in trigger set X
With the watermark dataset, define the black-bon watermark as follows.
Definition 2 (Black-box Watermark). A valid black-box watermark 8 is carefully crafted pertur- bation learned from the watermark dataset D It is applied to a model 0 to obtain the watermarked model 8' - 8.8, which produces outputs following the predefined distribution Φ(z) when evaluated on Dw, Formally, the model is considered watermarked with if:
y(f';x) ~ ~(x)) V(a, M(x)) E D"
where x)) is the output probability distribution of the watermarked model given a trigger x.
If black-box watermark successfully embedded, one can verify whether a suspicious model originates from the system by testing its outputs on triggers from D _ For example, in classification tasks, verification is typically performed by evaluating the prediction accuracy of the suspicious model 0' on D Specifically,, if the model's prediction accuracy EneD" 1[arg max y =0';
arg max o(z)]/[("") exceeds predefined threshold v/ this indicates that the suspicious model con-
tains the watermark 5. thereby verifying its ownership (Tekgul al. 2021 Shao al. 2024 Liu
et al. 2021 Nie & Lu 2024b).
Traceability. However, ownership verification alone insufficient for detecting model leaking of an FL system. While ownership verification confirms whether model originates from the system, does not identify which client leaked it. The ability to pinpoint the source of leakage known as traceability. To achieve traceability, each watermarked model should carry a distinct watermark, ensuring that every client receives a unique identifier embedded in their model. More formally, for any two watermarked models 8 and 8/, their outputs should be different possible when evaluated on the same watermark dataset. If their outputs are too similar, a watermark collision (as defined in Definition 3 occurs, which can compromise traceability.
3

---

Published as a conference paper at ICLR 2026
Definition 3 (Watermark Collision). A watermark 8, learned from a watermark dataset D is said to collide with another watermark 53 learned from D if their corresponding watermarked models, 8: = 0 + 5, and ff = + 63. produce highly similar ouputs on watermark dataset D or Dj. Formally, collision occurs if:
Es ( Sa
for x. E "D or I. DT, where Div(.) (-) is divergence measurement funnttio (e.g., KL divergence), and a is predefined collision threshold.
Remark 1. Watermark collision poses a significant challenge in ensuring the traceability of water- marked models. Since ó, and ój are learned from D and Dj, respectively, the distinctiveness of these watermark datasets plays a crucial role in preventing collisions. Specifically, if and Dj are too similar, the resulting 8 and 83 will also be similar, increasing the risk of collision. There- fore. it is essential to ensure an intrinsic difference between D.r and Dj. We discuss strategies for constructing distinct watermark datasets to mitigate collisions in Section 4.3
With Definition we formally define the traceability of watermarked models as follows.
Definition (Traceability of Watermarked Models). Given watermarked models (e%.6....... ......,,, 8%,,, where each model is derived as 6 0 + 5, with a successfully embedded watermark 5, such that y x0); ~ <(x), Vax, (x)) E D.. The traceability property ensures that different watermarked models produce distinguishable outputs on their respective watermark datasets. Formally, if for any watermarked model 6,, E [n], the following holds:
EVEDY (Div(y(0); x();;; > o, Vj (
then the traceability of these models is ensured.
Intuitively, if each watermark in the system remains distinct and does not collide with any other watermark, then all watermarked models in the system are considered traceable.
Problem Formulation. We define the problem of injecting traceable black-box box watermarks in FL as in P
Problem 1 (Traceable Black-box Watermarking). Consider FL system with clients collabo- ratively training global model 0 under the coordination of the server. For watermark injection, the server prepares n. distinct watermark datasets (Di) Ji=1 to be used to inject watermarks into the 1
global models for every client. The overall goal is to optimize both the main task learning objective and the watermarking objective while ensuring that the watermarked models remain traceable. This is formulated as follows:
12
n2
min 0,
F(O: D
1, + D,),
Main Task
Watermarking Task
s.t. EZEDY Div(y(( (,:)),((6 8f; x);z))] > O. Vi.j [m], i
where 8; denotes the traceable black-box watermark for the model 0 shared with client i. The function Lı(-) represents the watermarking objective for d. defined as: L.(0 + 8, D.)) E D( [(0 + ò;; x, ((x)).
Remark 2. We derive the following key insights, which motivate the design of our method:
1) A straighffrwwar solution for Problem 7 is to offload each watermark dataset D. to client i, allowing clients to mix D. with their main task dataset D. during local training to solve both objectives simultaneously, as proposed in dNie & Luq 2024a Liu et al. 2027] [uu et af. 2024 Wu et al.) 2022: Li al.) 2022a). However, this method is highly vulnerable to malicious clients who may simply discard D.", leading to the absence of watermarks in their models. Furthermore, if malicious clients
aware of the watermarking process, they could intentionally tamper with it, undermining its effectiveness. To mitigate these risks, it is preferable to decompose Problem 7 leaving the main task to local clients while performing watermark injection solely on the server.
2) A critical challenge in watermark injection is the risk of watermark collisions due to model av- eraging during aggregation. Specifically, even if the server successfully injects distinct watermarks
4

---

Published as a conference paper at ICLR 2026
into the models before sending them to clients for local training, these watermarks will be fused during model aggregation in the next training round if parameters from all clients are simply aver- aged, in FedAvg. To address this issue, specialized mechanism is required to prevent watermark entanglement during aggregation.
3) The constraint in Problem suggests that to avoid collisions, the server should maximize l|o; - 6,122 However, if 6; and ó5 become too divergent, this may impair the main task perfor- mance of the watermarked models. Additionally, since the server lacks access clients' local datasets, directly solving the watermarking objective L(-) could also lead to significant degradation in the performance of the main task. Thus, specialized learning strategy is required to ensure that watermark injection does not compromise the model's 's main task performance.
4 INJECTING TRACEABLE BLACK-BOX WATERMARKS
Based on the insights in Remark 2 we propose a novel method called TraMark detailed in Algo- rithm | which can be easily integrated into existing FedAvg frameworks to solve Problem give the complete process of FedAvg with TraMark in Algorithm in the Appendix A.3
[ We
4.1 CONSTRAINING WATERMARKING REGION
Existing watermarking approaches either retrain the global model directly on the watermark
Algorithm 1: TraMark
dataset (Tekgul et al., 2021; Shao al. 2024) or require local clients to collaboratively inject watermarks (Li et al. 2022a; Liu et al. 2021
Input
The global models (0, 10. set of model updates (A.)== watermark datasets {2," hig main task mask Mm, watermarking mask M.,
Nie & Lu 2024b). However, these methods cause watermark-relater perturbations to spread across the entire parameter space, leading to two key issues. First, the dispersed watermark per- turbations may significantly degrade the main task performance. Second, even if each client's model embeds unique watermark, model ag- gregation in the next round fuses these water- marks, causing collisions that compromise trace- ability. To mitigate the impact on main task performance and ensure traceability, TraMark restricts watermarking to a small subset of the model's parameter space. Only this designated watermarking region carries the watermark, and its parameters are excluded from model aggre- gation, preserving distinct watermarks for each client in the next training round. Specifically, in TraMark, given a model / E Rd it partitions the whole parameter space into watermarking region and main task region with a partition ratio k E [o, 1). resulting in two complementary binary masks:
watermarking learning rate t/e and watermarking iteration Tu-
Output: A of watermarked models [0]]=- // Watermark injection
for [ni do
/ Masked aggregation
0, + 0, + Mm @ 4 E A, M OA,
// Patermarking
0 8: for
= Tw do
gi Vi L(0;; )
0 + 0 n.. O M..
end
0, <- 0::
end t0 Return {0()
The watermarking mask M E 13d, where MMw]j = 1 means that the j-th parameter in is used for watermarking task and sum oum(M,.) = k x d.
The main task mask Mm E (0, 1]d, jd. where [Mm]p- = 1 means that the p-th parameter in is used for main task and sum MM)) ) =
k) x d.
These two complementary masks (i.e., M. + Mn. = 1d) ensure that all model parameters in the model 0 are fully partitioned into the watermarking and main task regions. Moreover, once determined, the masks remain unchanged throughout the entire watermarking process. We will discuss how to get these two masks later in Section 4.4
4.2 MASKED AGGREGATION & WATERMARK INJECTION
Masked Aggregation. With the constrained watermarking region, TraMark leverages novel masked aggregation method to avoid watermark collision. Specifically, instead of applying a naive
5

---

Published as a conference paper at ICLR 2026
aggregation approach (e.g., FedAvg), TraMark aggregates parameters only in the main task region and prevents the watermarking region from parameter fusion. In detail. in each training round, given the model updates {A.) the server aggregates them to generate the personalized global model for each client individually via 0; 0, + Mm 2 - A + M. O A,, Vi E [n] (Line 2 in Algorithm D Here, the second term M., @ E A, averages the model updates in the main task region, and the third term M @ A; preserves the parameters in the watermarking region for the model update of client i. In this case, the server generates a personalized global model for each client, which always contains distinct watermark for the client while still benefiting from the aggregated model updates for the main task.
Watermark Injection. For each personalized global model 0., Vi E [ra], its watermark is injected by training 0r on the corresponding distinct watermark dataset D." for Tue iterations. In this process, only the watermarking region is updated, ensuring that knowledge from the watermark dataset does not spread to the main task region (Line 777 Technically, in each step of local training, the mini- batch gradient of is multiplied by M (Line 5 6p. zeroing out the gradients for the main task region to avoid the impact of the watermark on the main task. After watermark injection, the server obtains the watermarked global models. which will be sent to the clients perform their main tasks of the next training round or deployment (Line (O). Since the clients' local training protocol for the main task remains unchanged, model updates continue across the entire parameter space. However, this introduces potential risk: the embedded watermarks may gradually fade over time. To this end, TraMark can be applied at every training round to continuously preserve the watermark, as advised by prior works (Tekgul et al. 2021 Shao et al. 2024 Nie & Lu 2024b
Li et al. 2022a).
4.3 DISTINCT WATERMARK DATASET
As noted in Remark [ ensuring sufficient dissimilarity between watermark datasets is crucial for learning distinct watermarks and preventing collisions. To achieve this, in the TraMark, the server assigns each global model a unique watermark dataset. Specifically, the watermark datasets designed for different models should differ from each other in both their triggers and their output distributions. Let Di {(z, (xx) E X:3 denote the watermark dataset for personalized global model O;, where X,"' 7 for any i j Vi,j E [n]] Furthermore, each client is assigned a unique output distribution (x). guaranteeing that (z) + (z). For trigger selection, existing methods have explored various approaches, including randomly generated patterns (Tekgul et al. 2021 Shao et al.) 2024]. adversarially perturbed samples (Li et al. 2022a), and samples embedded with backdoor triggers (Liu et al. (021). In our case, ensure each client receives maximally distinet trigger, we select out-of-distribution samples absent from the main task dataset. This guarantees that the learned watermark remains independent of the main task. For example, in classifier trained for traffic sign recognition, per-label samples from the MNIST dataset serve as effective triggers for different clients. Assigning distinct watermark dataset to each personalized global model ensures that a watermarked model responds only to triggers from its own dataset, mapping them to the predefined output. When exposed to triggers from other watermark datasets, it produces random guesses, effectively minimizing the risk of collisions. This distinct watermark dataset assignment may limit the scalability of TraMark, particularly in learning tasks with only a few labels. We discuss possible solutions to this limitation in Appendix A.9
4.4 SELECTION OF WATERMARKING REGION
Recall from Remark 2 that maximizing 0 5,113 is crucial for avoiding collisions. However, ex- cessive divergence between d; and 5, may negatively impact main task performance. Given that ||o; 6, 1 = MM + (8, 6,)113 + ||M, C (6, - 5,) where M,, = 1a M,, and the wa- termarking process is confined the watermarking region, the objective simplifies to maximizing [M, ② (6: 113. This ensures that watermark injection and collision avoidance should not affect parameters in the main task region. Consequently, if M,, contains the most important parameters while M., is assigned to unimportant ones, the primary accuracy remains largely unaffected. Typi- cally, parameter importance is measured by magnitude (absolute value), with larger values indicating greater importance (Xu et al. 2025 Hu et al. 2023 Panda et al. 2022). However, since network pa- rameters are randomly initialized at the start of traming, their importance is not yet established. As result, assigning parameters to regions too early may lead suboptimal partitioning, potentially

---

Published as a conference paper at ICLR 2026
degrading main task performance. To this end, TraMark introduces warmup training phase, where the global model undergoes standard federated training (c.g.. FedAvg) for a x rounds be- fore watermarking. The warmup training ratio E [0, 1) determines the fraction of total training rounds allocated to this phase, ensuring the model is robust enough to the main task before starting the watermark injection. Once warmup training is complete, the server obtains the watermarking region by selecting k x d least important parameters (i.e., those that have the smallest absolute val- ues), and the remaining parameters are assigned to the main task region. We present the detailed technical procedure of selecting the watermarking region in Algorithm 2 included in Appendix A.3
EXPERIMENTS
5.1 EXPERIMENTAL SETTINGS
General Settings. Following
(hao et al. 2024: Zhang et al. 2024 Nie & Lu 2024a b), we evalu-
ate our methods on FMNIST [iaoo et al. 2017). CIFAR- 10 Krizhevsky et al. 2009). and CIFAR- 100 (Krizhevsky et al. 2009), using CNN, AlexNet (Krizhevsky al. 2012), and VGG-16 (Si-) monyan 2001). respectively. Besides these benchmarks, we test TraMark on large-scale Tiny- ImageNet using ViT (Dosovitskiy al. 202I). For all datasets, we consider both independent and identically distributed (IID) data and non-IID data scenarios. To simulate non-lID cases, we use the Dirichlet distribution (Minka 2000) with default degree y = 0.5. Following previous works (Li it al. 2022a Xu et al. 20244 Nie & Lu 2024alb b). we set up cross-silo FL system with 10 clients.
We also test TraMark on larger-scale n 50 FL with client sampling Appendix AA.7 Each 5 iterations and learning rate of 7tt 0.01. The train-
client performs local training with
ing rounds for FMNIST, CIFAR-10, CIFAR- and Imay- are 50, 100, 100, and 50. All experiments are repeated times with different seeds, and report the averaged results.
Baselines and TraMark Settings. In all experiments, we use the MNIST (LeCun et al. 1998) dataset the source for watermarking. Each global model is assigned a watermark dataset contain- ing samples from a distinct MNIST label, ensuring both X. n 22,"" = 0 and (x(x) * o, (z) for any two clients and j. Furthermore, we demonstrate that TraMark can accommodate various types of watermark datasets, including randomly generated patterns as proposed (Tekgul et al. 2021). with results provided in Section [53 Each watermark dataset consists of 100 samples. The watermarking learning rate is set to The = Te and the number of watermarking iterations is T. = 5. The par- tition ratio & is set 1%. The warmup training ratio a is set 0.5. To ensure fair comparison, we evaluate TraMark against two server-side watermarking approaches: WAFFLE (Tekgul et al.) 2021. black-bor watermarking method that does not ensure traceability, and FedTracker (Shao et al. 2024), a white-box watermarking method that ensures traceability.
Evaluation Metrics. We evaluate the performance of each method using two key metries: main task accuracy (MA) and model leakage verification rate (VR). MA is measured using the main task test set. Since TraMark and FedTracker introduce slight variations each local model due to wa- termark injection, we compute MA as the average accuracy across all local models, following (Shao) cet al. 2024). VR quantifies the proportion of watermarked models that are successfully attributed to their respective owners. We evaluate each watermarked model on the full test set, compute the per-label accuracy, and identify the label with the highest accuracy. If this highest-accurace label matches the pre-assigned label of the model's owner, the model is considered successfully verified (more details are given in Appendix A.4). For FedTracker, we follow its original definition of VR, where traceability is determined based fingerprint similarity in white-box setting.
5.2 MAIN EMPIRICAL RESULTS
We first demonstrate the verifier's confidence in identifying the leaker of suspect models embedded with watermarks injected by TraMark. Specifically, we compute two key metrics: (1) the test accuracy of each watermarked model on its own watermarking dataset, referred to as verification confidence; and (2) the average test accuracy of the model on other clients' watermarking datasets, referred to as verification leakage. The difference between these two metrics, termed the verification interval, reflects the verifier's confidence. Figure I illustrates the averaged verification confidence, leakage interval, and the VR changes across training rounds on CIFAR-10 and CIFAR- 100 datasets.
Verification Interval.
7

---

Published as a conference paper at ICLR 2026
We observe that training progresses, the verification interval widens due to steady increase in verification confi- dence. Additionally, since TraMark injects watermarks only within the designated watermarking region and
Test Accuracy (%)
CIFAR-10
CIFAR-100
80-
100
80
100
80
80
60-
60
60
60
10-
40
VR
10
Ver condidence
40
employs masked aggregation, the wa-
20-
20
20-
Ver Internal
lealage
20
termarked model consistently per- forms poorly on other elients' water- marking datasets. These factors to- gether form a clear verification in- terval, which ensures reliable model leakage verification. This is supported by the high VR obtained by TraMark. Further results the changes in the divergence of each watermarked model's output on its watermark dataset (the constraint in Problem T are provided in Appendix A.6
50
60
70
80
90
100
0
50
60
70
80
90 100
0
Training Rounds
Training Rounds
Figure I: Verification (Ver) confidence, verification leakage, verification interval, and VR on CIFAR-IO and CIFAR-100.
Main Results. We report the MA and VR of each method on FMNIST (FM),
Table I: Comprehensive comparison of MA and VR between dif- ferent methods under both IID and non-IlD settings (highlighted with a "N"). MAS and VRs are shown in percentages (%).
CIFAR-10 (C-10), CIFAR-100 (C-100), and Tiny-emageNet (Tiny) under both IID and non-llD settings in Table Overall, TraMark effectively injects traceable watermarks into personalized global mod- els while preserving high model performance. It consistently achieves high VR across all datasets, maintaining an aver- age of 99.58%. In contrast, FedTracker fails to ensure sat- isfactory traceability on CIFAR-I0, resulting in an average VR of only 87.50%. This instability is due to the injection of key matrices into model parameters and the absence of explicit mecha- nisms to prevent watermark collisions after aggregation. Regarding MA. TraMark exhibits strong model performance, with only 0.54% drop compared to FedAvg. While WAFFLE achieves slightly higher average MA (0.41% above TraMark), does not guarantee the traceability of watermarked models. FedTracker, the other hand, suffers significant 4.19% decline in MA due to the unconstrained watermarking region, which compromises model utility. In conclusion, TraMark successfully embeds traceable black-box watermarks while incurring minimal perfor- mance loss, making a robust and practical watermarking solution for FL.
FedAvg
WAFFLE
FedTracker
TraMark
Dataset
MA
VR
MA
VR
MA
VR
MA
VR
FM
92.60
92.21
89.95
100.00
91.20
96.67
FM (N)
91.52
91.41
67.50
100.00
91.31
100.00
C-10
89.15
89.16
87.56
60.00
88.58
100.00
C-10 (N)
87.01
86.75
83.42
50.00
86.26
100.00
C-100
61.91
61.68
61.05
100.00
61.13
100.00
C-100 (N)
60.19
60.04
60.12
90.00
58.95
100.00
Tiny
21.05
21.24
20.40
100.00
20.91
100.00
Tiny (N)
20.09
19.97
20.00
100.00
20.06
100.00
Average
65.44
65.31
61.25
87.50
64.90
99.58
Robustness to Attacks. We eval- uate the robustness of watermarked models trained by TraMark against pruning and fine-tuning attacks.
Pruning Attack
Fine-tuming Attack
80
100
80
100
80
60
60
60
Specifically, malicious clients may prune or fine-tune their local models to remove or reduce the effectiveness of watermarks.
MA
40
40
FodAvg 31A
40
20
20
TraMark MA
20
TraMark VR
For the pruning attack, we test pruning ratios ranging from 30% to extreme 99%. For fine-tuning attacks, we assume that malicious clients fine-tune their models on their local datasets for 30 epochs, using the same learning rate as in the original training process. The averaged MA and VR results TraMark across four datasets are summarized in Figure 2 With moderate pruning ratios (30% to 70%). MA remains largely unaffected, while VR is also preserved. As the pruning ratio increases, MA declines rapidly, accompanied by decrease in VR. These results demonstrate
0 30 Pruning Ratios (%)
70
90
95
99
10
20
30
Fine-tuning Epochs
Figure 2: Averaged MA and VR results of TraMark under pruning and fine-tuning attacks.
8

---

Published as a conference paper at ICLR 2026
that the parameters in the watermarking region are coupled with the main task parameters, making simple magnitude-basee pruning ineffective in removing the watermarks. This coupling also contributes to stable VR across various fine-tuning epochs. Additionally, against fine-tuning attacks with different learning rates, quantization attacks, and the stronger adaptive RNP attack (Li al. 2023) in Appendix A.8 robustness of TraMark.
evaluate TraMark
The extended results further show the
5.3 DETAILED STUDIES OF TraMark
Warmup Training Ratio a.
TraMark leverages warmup training to achieve better partitioning
69
IID
100
69
non--II
100
95
67
95
between the main task region and
the watermarking region. Figure 3
90
65
90
presents the averaged MA and VR
MA
63-
83
63
FalAsg 3IA
85
of TraMark on four datasets un- der both IID and non-IID settings with varying warmup training ratios o. Notably, TraMark consis- tently achieves satisfactory VR with S 0.5. When a 0.7, TraMark fails to inject effective watermarks into each personalized global model on time, leading to degraded VR. For both settings, a larger generally results in higher MA. Specifically, under the non-llD setting, TraMark with the default a = 0.5 achieves an average MA 64.15%. which only 0.55% lower than FedAvg but 4.65% higher than TraMark without warmup training. These results highlight the importance of warmup training, as it enables TraMark to accurately assign unimportant parameters to the watermarking region, thereby minimizing the negative impact of watermarking on main task performance in watermarked models.
61-
80
61
TraMark MA
80
59-
TraMark
59
0.0
0.1
0.3
0.5
0.7
0.9
0.1
0.3
0.5
0.7
Value of a
Value of
Figure 3: Impact of warmup training ratio on the MA and VR of TraMark.
Partition Ratio k. The partition ra- tio & controls the size of the water- marking region. Intuitively, a small k may hinder the watermark injection process as the watermarking region is in-
69
100
69
100
67
65-
90
65
90
unable to learn watermark-relan formation completely. We vary the partition ratio k from 0.1% to 5% examine its impact on the perfor- mance of TraMark. The averaged MA and VR results across all datasets shown in the left sub-figure of Fig- ure 4 As expected, smaller leads significant drop in VR, while MA remains nearly unchanged. For example, compared to TraMark with the default setting (k 1.0%), reducing & to 0.5% causes VR to drop from 99.17% 84.17%, whereas MA shows only a slight increase from 65.66% to 55.70% Moreover, with an extreme value of k = 5.0%, MA only drops to 65.16%, resulting in a gap of less than 1%, while achieving full VR. Therefore, selecting an appropriate requires balancing MA and VR, with k = 1.0% serving as a practical choice that ensures both reliable watermark injection and minimal performance degradation.
MA
85
63
FodAve XAA
85
61-
80
61
TraMark MA
-0
TraMark VR
59
1.0 2.0
75
100
200
Partition Ratios (%)
Watermark Dataset Sizes
Figure 4: Impact of partition ratio and watermark dataset size.
Size of Watermark Dataset. A larger watermark dataset may enhance the effectiveness of water- mark injection, enabling the model to learn more robust mapping between the watermark trigger and its intended response. To validate this, we vary the size of the watermark dataset from 50 to 200 samples. The averaged MA and VR results across all datasets are summarized in the right sub- figure of Figure Similar to the effect of the partition ratio k, the size of the watermark dataset significantly impacts the traceability of watermarked models, while having minimal effect on MA. Specifically, when the watermark dataset contains only 50 triggers, TraMark achieves subop- timal VR of 54.17%. despite obtaining the highest MA 65.85% However, with 100 or more samples, TraMark ensures successful watermark injection, with only limited MA drop (at most

---

Published as a conference paper at ICLR 2026
0.34%), striking a better balance between MA and VR. Therefore, choosing sufficiently large wa- termark dataset, such as 100 samples or more, is essential to ensure the effectiveness of TraMark.
Different Type of Water- mark Dataset. We also use the SVHN (Netzer et al.
Table 2: Generalization of TraMark across different watermark- ing datasets, including MNIST, SVHN, and WafflePattem. MAS and VRs are shown in percentages (%).
2011) dataset and WafflePat- tern (Tekgul et al.] (202T) as sources for watermark datasets. Since SVHN and WafflePattern contain colorful images while FMNIST is grayscale, we conduct experiments on CIFAR-10, 10, CIFAR-100, and -mag-e. The MA
Watermark
CIFAR-10
CIFAR-100
Tiny-ImageNet
Dutuset
MA
VR
MA
VR
MA
VR
MNIST SVHN
88.58
100.0
61.13
100.0
20.91
100.0
88. 88,32
100.0
60. 60.92p20.5
100.0
20 22p22.20
100.0
WaftlePatter
88.84420.05
100.0
61.31p20.05
100.0
p20.05
100.0
and VR results are summarized in Table 2 We observe that TraMark achieves highly similar results regardless of the watermark dataset used. Furthermore, we perform T-test each dataset to compare the results of TraMark using SVHN or WafflePattern against MNIST. The obtained p-values across all main task datasets exceed the commonly used significance threshold of 0.05, indicating that the differences are not statistically significant. These results demonstrate the generalization ability of TraMark in selecting different watermarking datasets. Furthermore, since WafflePattern utilizes synthetic noise with random patterns, it can generate an arbitrary number of unique samples. TraMark exploits this assign distinct watermark datasets to every client without the need for real-world data collection.
Computational Overhead. We evaluate the server-side compu- tational cost of the watermarking process, with results on CIFAR- 10 dataset summarized in Table 3 Since TraMark generates personalized models to ensure traceability, the computational cost scales linearly with the number of participating clients, a char- acteristic shared by the state-of-the-art traceable method, Fed- Tracker. However, the absolute overhead remains highly eifi- cient. As shown in the table, the per-client injection time for TraMark is approximately 0.67 seconds, which is comparable to FedTracker (0.35 seconds). For system with 10 clients, the total injection time is only 6.85 seconds per round. Given that cross-silo FL typically involves
Table 3: Computational time (seconds) for the watermark- ing process of WAFFLE, Fed- Tracker, and TraMark.
Method WAFFLE
Time (s)
6.15
FedTracker
3.63
FedTracker (per-client)
0.35
TraMark
6,85
TraMark (per-client)
0.67
significant latency from local training and network communication, this server-side overhead is neg- ligible in practice.
Additional Discussions. We have included further analyses address key aspects of practical deployment. Specifically, Appendix(A.9) [A.9] examines cxxaxinn the scalability of TraMark, where new large- scale experiments confirm that our method maintains robust performance as the system scales. In Appendix A. we analyze the communication overhead, demonstrating that TraMark does not impose additional bandwidth costs compared to existing traceable watermarking methods. Ap- pendix 12 presents detailed breakdown of per-client MA, confirming that all clients exhibit uniform performance with negligible disparity. Finally, Appendix AA. discusses the critical trade- off between traceability and client anonymity, arguing that while traceability reduces model-level anonymity, it is a necessary condition for accountability in secure FL settings where the model leaker is serious concern.
6 CONCLUSION
We formalize the problem of injecting traccable black-box watermarks in FL. Based on the problem, we propose TraMark, which creates a personalized, traceable watermarked model for each client. TraMark first constructs personalized global model for each client via masked aggregation. Subsequently, the watermarking process is exclusively performed the watermarking region of each model using a distinct watermark dataset. The personalized watermarked models are then sent back to each client for local training or deployment. Extensive experiments demonstrate the effectiveness of TraMark across diverse FL settings. We further show that the parameters in the watermarking region are highly coupled with those in the main task region, making the watermarks robust against attacks. We also conduct comprehensive hyperparameter study of TraMark.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENT
The work of Jiahao, Rui, and Zikai was supported by the National Science Foundation under the Harnessing the Data Revolution for Nevada Fire Science (HDRFS) Seed Grant NSHE-24-37. This material is based upon work co-supported by the U.S. Department of Energy, Office of Science, Of- fice of Advanced Scientific Computing Research under Contract No. manuscript has been oo-authored by UT-BBattelee LLC under Contract No. DE-AC05-000R22222 with the U.S. Department of Energy. The United States Government retains and the publisher, by accepting the article for publication, acknowledges that the United States Government retains a non- exclusive, paid-up. irrevocable, world-wide license to publish or reproduce the published form of this manuscript, allow others to do for United States Government purposes. The Department of Energy will provide public access to these results of federally sponsored research in accordance with the DOE Public Access Plan
This
public-access-plle
ETHICS STATEMENT
This work strictly adheres to the ICLR Code of Ethics.
REPRODUCIBILITY STATEMENT
We have made every effort ensure the reproducibility our results. The implementation of our method is available in a GitHub repository (https: /tttps://githb... com/ Jtt.hhoa/a/a TraMark).
REFERENCES
Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weak- ness into a strength: Watermarking deep neural networks by backdooring. In 27th USENIX secu- rity symposium (USENIX Security 18), pp. 1615-1631, 2018
Jinyin Chen, Mingjun Li, Yao Cheng, and Haibin Zheng. Fedright: An effective model copyright protection for federated learning. Computers & Security, 135:103504, 2023.
Bita Darvish Rouhani, Huili Chen, and Farinaz Koushanfar. Deepsigns: An end-to-end water- marking framework for ownership protection of deep neural networks. In Proceedings of the twenty-fourth international conference on architectural support for programming languages and operating systems, pp. 485-497, 2019.
Jia Deng, Wei Dong. Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hi- crarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248-255, Icee, 2009.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszko- reit, and Neil Houlsby. An image worth 16x 16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 2021.
Keke Gai, Dongjue Wang, Jing Yu, Mohan Wang, Liehuang Zhu, and Qi Wu. Mft-owner: ownership protection for multi-modal federated learning via orthogonal transform watermark. In Proceed- ings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 3049-3058, 2025.
Rui Hu, Yuanxiong Guo, and Yanmin Gong. Federated learning with sparsified model perturba- tion: Improving accuracy under client-level differential privacy. IEEE Transactions Mobile Computing, 2023.
Alex Krizhevsky, Ilya Sutskever. and Geoffrey E Hinton. Imagenet classification with deep convo- lutional neural networks. Advances neural information processing systems, 25, 2012.
Alex Krizhevsky et al. Learning multiple layers of features from tiny images. University of Toronto, 2009.
11

---

Published as a conference paper at ICLR 2026
Mohammed Lansari, Reda Bellafqira, Katarzyna Kapusta, Vincent Thouvenot, Olivier Bettan, and Gouenou Coatrieux. When federated learning meets watermarking: A comprehensive overview of techniques for intellectual property protection. Machine Learning and Knowledge Extraction, 1(4):1382-1406, 2023.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278-2323 1998.
Bowen Li, Lixin Fan, Hanlin Gu, Jie Li, and Qiang Yang. Fedipr: Ownership verification for federated deep neural network models. IEEE Transactions on Puttern Analysis and Machine Intelligence, 45(4))4521-453) 2022a.
Fang-Qi Li, Shi-Lin Wang, and Alan Wee-Chung Liew. Watermarking protocol for deep neural network ownership regulation in federated learning. In 2022 IEEE International Conference on Multimedia and Expo Workshops (ICMEW), pp. 1-4. IEEE, 2022b.
Yige Li, Xixiang I Lyu, Xingjun Ma, Nodens Koren, Lingjuan Lyu, Bo and Yu-Gang Jiang. Recon- structive neuron pruning for backdoor defense. In International Conference on Machine Learning, pp. 19837-19854. PMLR, 2023.
Junchuan Liang and Rong Wang. Fedcip: Federated client intellectual property protection with traitor tracking. arXiv preprint arXiv:2306.0133 01356, 2023.
Xiyao Liu, Shuo Shao, Yue Yang, Kangming Wu, Wenyuan Yang, and Hui Fang. Secure federated learning model verification: A client-side backdoor triggered watermarking scheme. In 2021 IEEE International Conference on Systems, Man, and Cybernetics (SMC), pp. 2021.
IEEE,
Yi Liu, Jiangtian Nie, Xuandi Li, Syed Hassan Ahmed, Wei Yang Bryan Lim, and Chunyan Miao. Federated learning the sky: grrial-ground air quality sensing framework with uav swarms. IEEE Internet of Things Journal, 8(12):9877-9877, 2020.
Guodong Long, Yue Tan, Jing Jiang, and Chengqi Zhang. Federated learning for open banking. In Federated Learning: Privacy and Incentive, pp. 240-254. Springer, 2020.
Kaijing Luo and Ka-Ho Chow. Unharmful backdoor-basee client-side watermarking in federated learning, arXiv preprint arXiv:2410.21119, 2024.
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-effcientt learning of deep networks from decentralized data. In Artificial intelli- gence and statistics, pp. 1273-1282. PMLR, 2017.
Thomas Minka. Estimating dirichlet distribution, 2000.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Ng, et al. Reading digits in natural images with unsupervised feature learning. In NIS workshop deep learning and unsupervised feature learning, volume 2011, pp. 4. Granada, 2011.
Dinh C Nguyen, Quoc-Viet Pham, Pubudu N Pathirana, Ming Ding, Aruna Seneviratne, Zihuai Lin, Octavia Dobre, and Won-Joo Hwang. Federated learning for smart healthcare: A survey, ACM Computing Surveys (CSUR), 55(3):1-37, 2022.
Hewang Nie and Songfeng Lu. Federmw: Federated model ownership verification with compression-resistant model watermarking. Expert Systems with Applications, 249:123776, 2024a.
Hewang Nie and Songfeng Lu. Persistverify: Federated model ownership verification with spatial attention and boundary sampling. Srowledge-Basse Systems, 293:111675, 2024b.
Ashwinee Panda, Saced Mahloujifar, Arjun Nitin Bhagoji, Supriyo Chakraborty, and Prateek Mit- tal. Sparsefed: Mitigating model poisoning attacks in federated learning with sparsification. In International Conference Artificial Intelligence and Statistics, pp. 7587-7624. PMLR, 2022.
12

---

Published as a conference paper at ICLR 2026
Shuo Shao, Wenyuan Yang, Hanlin Gu, Zhan Qin, Lixin Fan, and Qiang Yang. Fedtracker: Furnish- ing ownership verification and traceability for federated learning model. IEEE Transactions on Dependable and Secure Computing, 2024.
Karen Simonyan. Very deep convolutional networks for large-scale image recognition. arXiv
preprint arXiv:1409, 1556, 2014.
Canh T Dinh, Nguyen Tran, and Josh Nguyen. Personalized federated learning with moreau en-
velopes. Advances in neural information processing systems, 33:21394 33:21394-21405, 2020.
Alysa Ziying Tan, Han Yu, Lizhen Cui, and Qiang Yang. Towards personalized federated learning.
IEEE transactions neural networks and learning systems, 34(12):9587-600 2022.
Buse GA Tekgul, Yuxi Xia, Samuel Marchal, and N Asokan. Waffle: Watermarking in federated learning. In 2021 40th International Symposium on Reliable Distributed Systems (SRDS), pp- 310-320. IEEE, 2021.
Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin'ichi Satoh. Embedding watermarks into deep neural networks. In Proceedings of the 2017 ACM on international conference on multimedia retrieval, pp. 269-277, 2017.
Qiong Wu, Kaiwen He, and Xu Chen. Personalized federated learning for intelligent iot applications: A cloud-edge based framework. IEEE Open Journal of the Computer Society, 1:35 44, 2020.
Tong Wu, Xinghua Li, Yinbin Miao, Mengfan Xu, Haiyan Zhang, Ximeng Liu, and Kim- Kwan Kwang Raymond Choo. Cits-mew: Multi-party entangled watermark in cooperative intelligent transportation system. IEEE Transactions on Intelligent Transportation Systems, 24(3):3528- 3540, 2022.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: novel image dataset for benchmark- ing machine learning algorithms. arXiv preprint arXiv:1708.0777 2017.
Jiahao Xu, Zikai Zhang, and Rui Hu. Achieving byzantine-resilient federated learning via layer- adaptive sparsified model aggregation. In Proceedings of the Winter Conference Applications of Computer Vision ( (WACV), pp. 1508-1517, February 2025.
Yang Xu, Yunlin Tan, Cheng Zhang, Kai Chi, Peng Sun, Wenyuan Yang, Ju Ren, Hongbo Jiang, and Yaoxue Zhang. Robwe: Robust watermark embedding for personalized federated learning model ownership protection. arXiv preprint arXiv:2402. 19054, 2024.
Mingfu Xue, Yushu Zhang, Jian Wang, and Weiqiang Liu. Intellectual property protection for deep learning models: Taxonomy, methods, attacks, and evaluations. IEEE Transactions on Artificial Intelligence, 3(6)9908 923, 2022. doi: 10. 10.1 10.1199/AA.2221.33333.
Shuyang Yu, Junyuan Hong, Yi Zeng, Fei Wang, Ruoxi Jia, and Jiayu Zhou. Who leaked the model? tracking ip infringers in accountable federated learning. In NeurIPS 2023 Workshop on Regulatable ML, 2023.
Lan Zhang, Chen Tang, Huiqi Liu, Haikuo Yu, Xirong Zhuang, Qi Zhao, Lei Wang, Wenjing Fang, and Xiang- Xiang-Yang Li. Fedmark: Large-capacity and robust watermarking in federated learning. In 2024 IEEE 44th International Conference on Distributed Computing Systems (ICDCS), pp- 821-832. IEEE, 2024.
13

---

Published as a conference paper at ICLR 2026
A APPENDIX
A.1 NOTATION TABLE
Table 4: Notation table.
Symbol Description
The number of local clients
The DNN model
0:
The model of client
training round The watermarked model
The model parameter
8'
0.
The masked aggregated global model for client
01
The 0; watermarking iteration
9f
The gradient of 0e at watermarking iteration The dimension of The local learning objective of client The local dataset of client
F:(-)
D
C())
The loss function
(2,9)
The datapoint sampled from a dataset
The local training iterations
A
The local model update of client training round
D"
The whole watermarking dataset The backdoor trigger
x
The watermarking trigger set
o(z)
The unique predefined output distribution for z E 2"" A valid black-box watermark
6,
A valid black-box watermark for client
y(0,a))
The output probability distrihution of 6' given
Div(-)
The divergence measurement function
A predefined collision threshold
b
The partition ratio
M.
The watermarking mask
M..
The main task mask
The watermarking leaning rate
Tw
The watermarking iteration
The warmup training ratio
A.2 RELATED WORK
Protecting the IP of FL models has been extensively studied recently, with most existing approaches leveraging either parameter-basee (Uchida et al., 2017, Darvish Rouhani et al.) 2019 Chen al.,
2023
Liang & Wang 2023) [] et al. 2022h; Zhang et al.] 2024 | Yu et al. 2023] Xu et al. (024) or backdoor-based watermarking (Tekgul et 2021 Liu al. 2021 Li al. [002aa] Shao al. 2024 Luo & Chow 2024| Nie & Lu 2024b a; Wu et al. 2022). While both approaches aim to verily model ownership, backdoor-based methods are more practical as they do not require access to model parameters. However, ensuring traceability, i.e., identifying the specific source of leaked model. remains an open challenge for backdoor-basee watermarks.
Parameter-based Watermarking. Parameter-bacee based watermarking methods typically embed cryp- tographic information directly into the parameter space of the global model. For example, [Uchida] et al. (2017) proposed the first watermarking method for DNNs by incorporating regularization loss term to embed a watermark into the model weights. Similarly, FedIPR (Li et al. 2022a) embeds messages in the Batch Normalization layers by assigning each client random secret matrix and a designated embedding location. However, during verification, the verifier must access the model parameters to extract the embedded information. Consequently, these approaches assume that the verifier has full access to the suspect model, which is often unrealistic in real-world scenarios where leaked models may be only partially accessible (e.g., via API queries) (Lansari al. 2023).
14

---

Published as a conference paper at ICLR 2026
Table 5: Comparison of watermarking methods in FL.. We evaluate whether each method supports box traceability verification (BB), operates entirely on the server side (SS), and enables trace- ability of the local model (Traceable). Our method, TraMark, is the only approach that satisfies all three properties.
Method
BB?
SS?
Traceable?
WAFFLE (Tekgul et al.
2021
FedIPR (L) cl al. 2022a
/
X
x
FedTracker (haa of al.
2024
X
/
RobWe (Xu el all 2024
X
V
/
FedCRMW (Nie & Lu
2024a
X
/
TraMark (Ours)
Backdoor-based Watermarking, Backdoor based watermarking has been explored more prac- tical alternative, as it does not require direct access to the model's internal parameters. These meth- ods leverage backdoor injection techniques to ensure that the model learns specific trigger. A watermarked model outputs predefined responses when presented with inputs containing the trig- ger (Adi et al., 20188. For instance, WAFFLE (Tekgul al. 2021) generates a global trigger dataset and line-tunes the global model on it in each training round, thereby embedding the trigger into the model. Similarly, [Liu et al. (202T) assume the presence of an honest client the system and injects trigger set (constructed by sampling Gaussian noise) through local training. While these methods enable black-box verification, their watermarked model lacks traceability. Moreover, some approaches rely on client-side trigger injection, which poses high risk of exposure if malicious client becomes aware of the process.
Traceability of Watermarked Models. To ensure the traceability of watermarks, Yu et al. (2023) propose replacing the linear layer of a suspect model with a verification encoder that produces dis- tinct responses if the model originates from the FL system. FedTracker (Shao al., 2024) extends WAFFLE by injecting a trigger into the global model while embedding local fingerprints (key ma- trices and bit strings) for individual clients. However, their traceability verification process requires white-box access to the suspicious model's 's parameters, which is generally infeasible in practice. A recent work, RobWe (Xu al. 2024). follows similar workflow to ours, splitting the network into two parts: one for model utility and another for embedding watermarks (key matrices). However, the model leaker can skip the watermarking step, weaken the embedded watermark, or embed forged watermark during local training, making the client-side method less practical than the server-side method under our attack model, where all clients are potential model leakers. Another client-side method FedCRMW (Nie & Lu 2024a), proposes a collaborative ownership verification method that indicates the leaker by the consensus of results of multiple watermark datasets. However, the water- mark dataset used by FedCRMW is constructed based on the main task dataset, which incurs data privacy risks. recent method, MFL-Owner (Gai et al. 2025), targets multi-modal FL by leveraging each client's 's visual and language encoders to construct orthogonal transformation on the client's trigger set, which serves as a watermark. However, this approach suffers from poor generalizability and fails to scale effectively to broader FL. systems. We further summarize the characteristics of existing methods in Table 5
A.3 ALGORIIHH OF FEDAVG WITH TraMark
The full procedure of integrating FedAvg with TraMark is presented in Algorithm 2 During the initial warmup phase, the server performs standard FedAvg training. Upon completion of warmup, the server computes both the watermarking mask and the main task mask based on the current model parameters, using the selection ratio parameter k. In our implementation, we employ torch. topk from PyTorch to achieve the Topk operation in the Se lellectii intinngggRgiii function. The training then transitions to the TraMark phase, detailed in Algorithm I
A.4 ALGORITIM OF MODEL LEAKER VERIFICATION
We present the algorithm for the verifier to verify a leaked model, 6', in Algorithm 3 Specifically, given a leaked model 0' associated with pre-assigned label i, where client i is the suspected leaker,
15

---

Published as a conference paper at ICLR 2026
Algorithm 2: FedAvg with TraMark
Input number of clients n, local learning rate TR, local iterations 7t, warmup rounds t', total training rounds T, watermark dataset {D, 1a partition ratio k watermarking learning rate nee
watermarking iteration Tue-
Output: [o]]
Initialization: Initialized model @ E Rd
Function Local aww.nnniinnnnnn (8):
for 0
do
0 + ;o D
8 -1 + of mgg
end
return 0 -0 Function SelectingiMieeiinn k0,
Mm + 0t
topk_idx [o, k);
// torch took
M.. [topk_ <-1
M 1a 1dMM,, Mn
13
return Mu. Mm
8
< -000 Vi E [n]
for to T
16
Broadcast 0f to each client for each [n] in parallel do
A Locallraining (0))
19
t < t then
// FedAvg (warmup training) 01 (1/n) E. (0) Al), e
22
else
23
if = a x T then
M.. Mn SelectingüüRegionn k0',
25
end
// TraMark process
(0'-1 (0'-110 Hi=l +- TraMark ((0), A|p (D:")= Mm, Mw Tuy Te
26
end
28 end
Return
1 {0_))
Algorithm 3: Model Leaker Verification
Input A potentially leaked model 0' suspected to belong to client i, where is the assigned label: watermarking test set D
Output: Verification result.
calculas aww.ppr................ at..er..labelaccurreee DWas)
2 =
arg max, acc|j] then
return Verification successful
else
return Verification failed
end
the verifier evaluates 0' on the full test set and computes the per-label accuracy (Line in Algo- rithm 3. The verifier then selects the label with the highest accuracy. this label matches the assigned label (Line 2). the verification is considered successful (Line 3 otherwise, it is consid- ered failure (Line 5) Since our attack model assumes any local client could be a potential leaker, apply the verification process to each watermarked model. VR is then defined the percentage of watermarked models successfully verified.
16

---

Published as a conference paper at ICLR 2026
A.5 HARDWARE SETTINGS
All experiments were carried out on a self-managed Linux- computing cluster running Ubuntu 20.04.6 LTS. The cluster is equipped with eight NVIDIA RTX A6000 GPUs (each with 48 GB of memory) and AMD EPYC 7763 CPUs featuring 64 cores.
A.6 OUTPUT DIVERGENCE
We provide empirical evidence demonstrating how TraMark effec- tively prevents watermark collisions. Recall that in Problem [ the con-
CIFAR-10
CIFAR-100
100
100
KI--Divergem
80
80
60
60
4.
4
straint is designed to maximize the divergence between the outputs different models when given the same inputs, thereby mitigating the risk of watermark collisions. To illustrate this, we compute the KI. divergence between each watermarked model and all other watermarked models on the respective watermark set. We plot the average KL divergence and VR for CIFAR-10 and CIFAR-100 100 datasets in Figure 5 The results clearly show consistent increase in KL divergence as training progresses. This trend arises because, the watermarking injection process continues, each watermarked model refines its unique watermark patterns, making it more distinguishable from others. Consequently, the VR also increases, further confirming the effectiveness of TraMark in preventing watermark collisions.
40
2-
2
VI
20
Diveggean
0-
0
60
80
100
60
100
Training Rounds
Training Rounds
Figure 5: The averaged KI. divergence and VR over training rounds on CIFAR-10 10 and CIFAR- 100 datasets.
A.7 LARGE-SCALE FL WITH CLIENT SAMPLING
Table 6: Performance of TraMark under different client sampling settings in large-scale FL. MAs and VRs are shown percentages (%).
Tiny-ImageNet Imag-et
(CS)
Method
MA
TraMark
17.32
100
17.07
Here, we evaluate the effectiveness of TraMark in large-scale FL setting with 50 local clients. We primarily consider two scenarios: FL without client sampling and FL with client sampling (CS). In the client sampling scenario, the server randomly selects 20% of the clients in each training round to perform local training. For TraMark, we enforce the injection of watermarks for all clients in each round, regardless of whether they are sampled or not. We use WafflePattern as the source for the watermark dataset, as allows for generating an arbitrary number of distinct classes. Our experiments are conducted the Tiny-ImageNet dataset, and the results are summarized in Table 6 The results show that TraMark consistently ensures a complete VR both scenarios. This demonstrates the strong generalization ability of TraMark across different client settings.
A.8 MORE RESULTS ON FINE-TUNING ATTACK, QUANTIZATION ATTACK, AND ADAPTIVE ATTACK
Table Impact of model quantization on MA and VR, comparing FP16 and INT8 against the FP32 baseline. MAs and VRs are shown in percentages (%).
FP32
(Baseline)
FP16
INT8
Dataset
MA
VR
MA
VR
MA
VR
FMNIST
91.20
96.67
91.94
96.67
91.92
96.67
CIFAR-10
88.55
100.00
85.35
100.00
85.35
100.00
CIFAR- 100
61.13
100.00
60.99
96.67
60.99
96.67
Tiny ImageNNt
20.91
100.00
20.20
100.00
20.19
100.00
Average
67.46
99.17
65.37
98.34
65.36
98.34
Quantization Attack. We assume that malicious clients may quantize their local models to im-
pact the effectiveness of watermarks. Following (Shao al. 2024), we conduct experiments
17

---

Published as a conference paper at ICLR 2026
watermarked models trained by TraMark that are quantized to FPI6 and INT8. The MA and VR results are summarized in Table 7 Compared to the FP32 baseline, quantizing the model to FP16 and INT8 leads to 2.09% and 2.10% drop in MA, respectively, and 0.83% drop in VR. The negligible decrease in VR demonstrates the robustness of the watermarks injected by TraMark against quantization attacks.
More Results on Fine-tuning At- tack. By default, we set the fine- tuning learning rate to 0.01 (local training learning rate), consistent with the training phase. We gradually in- crease the fine-tuning learning rate to an extreme value of 0.1 and perform fine-tuning for 30 rounds. The result- ing MA and VR are shown in Fig- ure 6 Our results demonstrate that TraMark exhibits strong resilience against fine-tuning attacks: as long as MA remains stable, VR is preserved. When the fine-tuning learning rate becomes excessively large and causes a drop in MA, VR also decreases accordingly. This indicates that the two regions are tightly coupled, making difficult for malicious clients remove the embedded watermarks through fine-tuning.
CIFA R-100
Tiny-TmageNet
100
MA (%)
60
80
15
60
40
40
10
40
20-
20
5
TraMark MA
20
Trablark VR
6
10
Learning Rates (x10-9)
Learning Rates
(x10
Figure 6: MA, VR changes with various fine-tuning learning rates on CIFAR-100 1-0 and Tiny-I ImageNet datasets.
Table 8: Performance of TraMark under RNP. MAs and VRs are shown in percentages (%).
EMNIST
CIFAR-10
CIFAR-100
Method
MA
VR
MA
VR
MA
VR
TraMark
91.20
96.67
88.58
100.00
61.13
100.00
RNP
73.16
70.00
85.08
90.00
60.57
100.00
Adaptive Attack. We consider more challenging scenario where malicious clients aware that the received global model has been embedded with a black-box watermark. As result, they attempt to remove the watermark using backdoor removal method. We adopt Reconstructive Neuron Prun- ing (RNP) (Li et al.) 2023), a -tate--ff-the-att backdoor removal technique, for this purpose. Since RNP requires a Batch normalization layer while ViT employs Layer normalization, we conduct experiments FMNIST, CIFAR-10, and CIFAR-100. The MA and VR results of RNP the wa- termarked models are summarized Table We observe that RNP has limited effectiveness on the FMNIST and CIFAR-10 datasets, where the VR decreases from 90% and 100% to 70% and 90%, respectively. However, in these cases, the MA also drops significantly. For CIFAR- 100, RNP has no impact the VR but still leads degradation in MA. These results highlight the robustness of the watermarks embedded each global model, demonstrating the strong effectiveness of TraMark.
A.9 SCALABILITY ANALYSIS
To evaluate the practical applicability of TraMark across varying system scales, we discuss its scalability from three critical perspectives: watermark dataset preparation, label space capacity, and computational overhead. We further support this analysis with large-scale experiments on ImageNet- 1k (Deng et al. 2009).
Watermark Dataset Scalability. Theoretically, TraMark requires n distinct OOD datasets for clients to ensure unique traceability. In practice, this requirement poses no barrier to scalability. As demonstrated in our experiments, TraMark fully compatible with synthetic pattern generation methods (e.g., WafflePattern). This approach allows for the automated, zero-cost generation of an effectively infinite number of unique trigger sets, thereby eliminating the need to collect or curate real-world OOD data for each new client.
Label Space Scalability via Virtual Class Extension. TraMark requires each client to have a dedicated output slot. Our work focuses on cross-silo FL settings such as collaborations among hospitals or financial institutions, where the number of clients is usually small (for example, < 20). In such cases, assigning unique output position to each client is straightforward and adds structural or operational difficulty. When the number of clients grows beyond the size of the existing output layer, the model can be expanded before FL training begins, for instance, by adding output
18

---

Published as a conference paper at ICLR 2026
neurons. We conduct experiment where the classifier head is enlarged from 10 to 20 outputs on CIFAR-10 10. TraMark maintains full VR with only a 0.34% drop in main accuracy compared to FedAvg, showing that the method remains stable when the output space is extended. This confirms that expanding the label space is a stable operation that does not compromise model utility.
Computational Scalability. The server-side watermark injection process scales linearly with the number of participating clients (9())). While simulating thousands of clients is computationally intensive, we emphasize that TraMark is primarily targeted at cross-silo FL settings. In such settings, the linear increase in server-side computation is highly efficient and remains negligible compared to the communication and local training latencies.
Large-scale Validation on ImageNet-Ik. To empirically demonstrate scalability beyond standard benchmarks, we conducted large-scale experiment on the ImageNet- 1k dataset with 100 clients. We utilized the wrttbbse--pa ch1 1224-in2211 (Dosovitskiy et al., 202T) foundation model and WafflePPatern triggers. Over 60 training rounds, the system achieved an average MA of 77.80% and full 100% VR. These results confirm that TraMark maintains robust performance and trace- ability even when scaling to larger client pools and complex model architectures.
A.10 MORE DISCUSSIONS AND FUTURE DIRECTIONS
Malicious Client Collusion. In our work, we adopt the benehmark FL paradigm, FedAvg, where each local client receives an identical model. However, since TraMark injects watermarks within the designated watermarking region, malicious clients may collude to identify its location by com- paring their identical main task parameters. This limitation can be solved by leveraging personalized FL (Tan et al. 2022 Dinh et al. 2020 Wu et al., 2020), where the server assigns unique model weights each client, ensuring distinct watermarked models and enhancing security.
Computational Overhead with Verification. While we assume the server possesses sufficient computational resources, practical constraints require careful evaluation of the maximum potential overhead. Having discussed the isolated injection cost in the previous section, we report the cumu- lative server-side time CIFAR- 10 in Table This metric encompasses model aggregation, water- mark injection, and watermark verification. Under this comprehensive metric, TraMark exhibits higher total execution time (74.35s). However, emphasized in our defense model, watermark verification is an on on-demand audit step performed only when leakage is suspected or at the end of training. Consequently, this value represents worst-case scenario and should not be interpreted as the standard per-round latency incurred during normal training.
Table 9: Comparison of full server-side computational time (seconds). The reported value includes the time for aggregation, watermark injection, and verification. Note that FedAvg involves only aggregation.
Method
FedAvg
WAFFLE
FedTracker
TraMark
Total Time (Agg. + Inject. Verify.)
1.03
12.03
13.32
74.35
False Positive Cases. A common challenge faced by black-bor watermarking methods is the oc- currence of false positives. Specifically, given an unwatermarked model, a black-box watermarking method may still output a prediction, which has a chance of being incorrectly interpreted as water- marked. For our proposed method, TraMark, the expected false positive rate 1/r, where r the number of output labels of the model. Consequently, for large-scale datasets such as ImageNe, which contains 200 classes, the false positive rate is negligible. However, for smaller datasets, the issue becomes more pronounced. Addressing false positives in small-scale datasets is important direction for future work.
Theoretical Analysis. Although TraMark demonstrates strong empirical performance, there mains gap in providing a theoretical guarantee for ensuring the traceability of watermarked models. We leave this theoretical analysis future work.
A.11 DISCUSSION ON COMMUNICATION OVERHEAD
We analyze the communication overhead of TraMark in practical network deployments, specif- ically distinguishing between cross-silo and cross-device settings. In our primary target scenario, cross-silo FL (e.g., collaborations between institutions), systems typically utilize standard TCP/PP
19

---

Published as a conference paper at ICLR 2026
protocols where the server communicates with each client via individual point-to-poing (unicast) connections. In this context, transmitting n personalized models to n clients consumes the exact same bandwidth transmitting one identical global model times, as the total data volume mains unchanged. Since TraMark modifies only parameter values without altering the model architecture size, introduces no additional communication load in cross-silo deployments.
In broadcast-capable environments (e.g.. cross-device FL), while distributing distinct models theo- retically reduces broadcast efficiency, we argue that this overhead is justifiable for two reasons. First, model differentiation is a fundamental prerequisite for traceability; identifying a specific leaker in- herently requires unique model instances, which is requirement of the traitor tracing problem rather than a limitation specific to TraMark. Second, in settings where multiple devices belong to a single user, per-device watermarking is unnecessary. allowing the same watermarked model to be shared across all devices owned by the same identity. Finally, TraMark maintains communica- traceable methods like FedTracker, which
tion cost profile consistent with existing similarly rely on distributing personalized model states.
A.12 PERFORMANCE FAIRNESS ACROSS CLIENTS
In the main text, we reported the average MA to evaluate the utility of the watermarked models. Here, we provide detailed breakdown of the per-client accuracy. Specifically, we report the indi- vidual testing accuracy of the personalized models for all participating clients (Client ID 0-9) on both CIFAR-10 and CIFAR-100 datasets. The experiments were conducted with a fixed random seed (0). The results are summarized in Table I0
Table 10: Per-client MA on CIFAR-10 and CIFAR- 100. across all participants.
The results demonstrate high uniformity
Dataset
ID:0 0
ID: 1
ID: 2
ID: 3
ID: 4
ID:
ID:
ID:
ID:
CIFAR-10
| 88.48
88.69
88.33
88.36
88.08
88.40
88.13
88.30
88.37
88.14
CIFAR-100
61.24
61.40
60.79
60.85
61.22
61.06
60.89
61.35
60,99
61.12
As shown in the table, the performance disparity among clients is negligible. On the CIFAR-10 dataset, the standard deviation of accuracy across clients is approximately 0. 0.17%, while on the more complex CIFAR- -100 dataset, it remains low at approximately 0. 0.19%. We observed no outlier cases where a specific client received a poorly performing model. These results confirm that TraMark preserves equitable model utility for all participants in the federated system.
A.13 DISCUSSION ON THE TRADE-OFF BETWEEN PRIVACY AND TRACEABILITY
A key motivation for using FL is preserving data privacy. Adding traceability raises questions about whether these guarantees still hold. Here, we discuss this trade-off in TraMark and show that although model-level anonymity is reduced, data privacy remains fully preserved.
In standard FL. systems such as FedAvg, privacy comes from keeping raw data local while sharing only model updates. TraMark follows the same process. The server already receives separate updates from each client, and our method does not change this communication protocol or access any local data. The traceability mechanism is based only OOD triggers generated by the server, which do not reveal information about private training data.
The trade-off off introduced by TraMark concerns model anonymity. In settings that secure aggre- gation, the server observes only the aggregated update and cannot identify individual contributions. In contrast, TraMark requires distributing and verifying personalized models, which means the server knows which model belongs to which client. This reduction in anonymity is a functional re- quirement for accountability. In many cross-silo FL applications, the server the model owner and must be able to identify model leakage to protect intellectual property. In such cases, full anonymity would prevent accountability and allow model leakers to go untraceable.
A.14
USE OF LLM STATEMENT
We used LLM solely for grammar checking and polishing the writing of this manuscript.
20


Reviews:
[{"review_id": "1eK9SrKMSw", "reviewer": "Reviewer_1fMj", "summary": "In this paper, the authors propose TraMark, a black-box model watermarking technique suitable for federated learning setups where clients might be potential model leakers. TraMark works when the central server is benign and implements the watermarking procedure. TraMark verification also enables traitor tracing. TraMark restricts watermarking to a small subset of the model parameters using binary masks and adapts the weight update procedure to produce watermarked global models per each client while preserving the existence of the watermark. I think the idea is nice and simple, but the recovery of watermarked weights and possible evasion methods are not included in the paper.", "questions": "Q1. The authors should verify the correctness of the compared methods presented in the appendix. For example, FedTracker can perform ownership verification in a black-box manner, as the related paper explicitly states that \"the zero-bit backdoor-based watermark is feasible for ownership verification and can be verified through black-box access.\" Additionally, I do not agree with the claim that RobWe is less practical because watermarking is performed on the client side. In fact, this seems more practical: each client can have their own secret watermark, eliminating potential watermark collusion problems, and maintaining robustness even when the server is untrusted.\n    \nQ2. There is insufficient discussion of scalability. The paper only tests with 10–50 clients. How would the proposed method perform with 1000 or 10000 clients? Moreover, how does the approach scale in relation to collusion resistance and the need to maintain personalized global models for each client? \n    \nQ3. The authors consider federated averaging as the only aggregation method. How would TraMark perform with alternative aggregation strategies such as Krum or other robust aggregation methods?\n    \nQ4. The format of in-text references is wrong. The authors should also be included in parentheses.\n    \nQ5. What is the model accuracy after the warm-up phase? Could this intermediate model (which includes no watermarks) be distributed directly instead of the last trained model?\n    \nQ6. The assumption that the server has full access to all local models is too strong and contradicts one of the main motivations for federated learning: privacy preservation. This assumption should be relaxed or at least discussed in detail.\n    \nQ7. Table 1 only reports the average results. The authors should also include verification rates (VR) for each method on each dataset. The current figure does not clearly convey these proportions.\n    \nQ8. Have the authors considered the possibility of out-of-distribution (OOD) detection as an evasion strategy against the proposed watermarking method? Especially considering the fact that they are using OOD samples as watermarks. \n    \nQ9. The repository link provided in the OpenReview abstract results in an error (\"not found\"). However, the link in the PDF appears to work.", "limitations": "", "rating": 4, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "S1. TraMark partitions the model parameters to the main task and watermarking task regions. In this way, we can say that TraMark is model-agnostic.\n\nS2. The problem formulation and the insights in Section 2 are very clear. It is difficult to inject watermarks that satisfy black-box traceability while avoiding collusion, and I think the authors did a good job of formulating this difficulty.", "weaknesses": "W1. Potential watermark detectability by malicious clients: \n\nWatermarked weights may be relatively easy to detect by malicious clients. They could analyze which parameters change more significantly or differently during training and identify trends in weight updates of received global models. Such differences, especially if certain parameters are updated disproportionately or the updates remain closer to zero, could reveal which weights are used to embed covert information (i.e., the watermark in this case). This issue may become even more pronounced with the warm-up phase, where clients suddenly see a change in weight updates after the warm-up. The authors should include experiments or analyses investigating this potential vulnerability.\n\nW2. Key discussions moved to the appendix:\n\nSeveral important discussion points are placed in the Appendix, without even a summary of the results in the main text. This weakens the perceived impact of the contributions. I recommend moving the experimental setup to the Appendix instead and bringing key takeaways or insights from the additional experiments currently in the appendix into the main text.\n\nW3. Other weaknesses:\n\nPlease refer to the detailed questions below for additional points of concern.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "i0qWVu8dmy", "reviewer": "Reviewer_UwiB", "summary": "This paper addresses the challenge of verifying model ownership and tracing leakage in Federated Learning under a black-box setting. The authors formalize the problem and propose a framework named TraMark, which leverages parameter space partitioning and masked aggregation. Experimental results demonstrate the framework's verification rate and its impact on main task performance, complemented by a hyperparameter analysis. Furthermore, the method exhibits robustness against attacks such as pruning and fine-tuning.", "questions": "See Weaknesses.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "A clear formalization of the traceable black-box watermarking problem is provided in Sec. 3.\n\nThe experimental results demonstrate an excellent Verification Rate (VR) of approximately 99.17% with a limited drop in Main-task Accuracy (MA), especially when compared to the FedTracker method.\n\nThe evaluation is conducted across multiple datasets, and the analyses of robustness, hyperparameters, and other factors are detailed.", "weaknesses": "As indicated in Table 8 of the appendix, the per-round computational overhead for TraMark's aggregation is over 70 times that of FedAvg. The authors rationalize this by citing the small number of clients in cross-silo scenarios, a justification that is not entirely convincing and severely limits the method's scope of application.\n\nThe paper appears to overlook the method's communication overhead. At the beginning of each training round, the server is required to send a unique, personalized model to every client. This results in a sharp increase in communication costs compared to broadcasting a single global model, which in turn restricts the method's applicability.\n\nThe method's reliance on constructing an independent, out-of-distribution watermark dataset and a unique output label space for each client is a strong assumption. In realistic Federated Learning scenarios, this requirement may not be feasible, thus limiting the method's practical scalability and applicability.\n\nThe paper uses the average accuracy across all personalized client models as the metric for MA. However, this average may conceal significant performance disparities, where some clients receive highly accurate models while others are left with poorly performing ones. This masks potential issues of unfairness in performance distribution.\n\nThe method, in its pursuit of model traceability, raises questions about its potential impact on privacy preservation—one of the core advantages of Federated Learning. A detailed discussion on this critical trade-off appears to be missing from the paper.\n\nThe paper does not discuss the method's feasibility and effectiveness in Federated Learning scenarios with asynchronous client participation. It is unclear how the proposed mechanism would perform under such conditions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "y8jBHSQu0n", "reviewer": "Reviewer_LhGb", "summary": "This paper presents a method to address the copyright issue in Federated Learning (FL) systems where clients might leak the shared global model. The authors introduce TraMark, a server-side watermarking framework designed to be both black-box (verifiable without parameter access) and traceable (capable of identifying the specific client who leaked the model). The core mechanism involves partitioning the model's parameter space into a 'main task region' and a 'watermarking region', identifying the latter by selecting the least important parameters after a warmup phase. Using a \"masked aggregation\" process, the server combines updates from all clients only in the main task region. It simultaneously preserves a distinct watermarking region for each individual client, into which a unique watermark is injected using a distinct dataset. This approach provides each client with a personalized model that maintains high performance on the primary task while embedding a unique identifier, crucially preventing the watermarks from being destroyed during the aggregation process. The authors' evaluation shows the method achieves high traceability with a minimal drop in main task accuracy and demonstrates robustness against removal attacks like pruning and fine-tuning.", "questions": "Please refer to the Weaknesses.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- This paper has a clear motivation to achieve black-box traceability in FL.\n- This paper provides a comprehensive evaluation of various datasets and both IID and non-IID settings.\n- This paper is generally well-written and easy to follow.", "weaknesses": "- Insufficient ablation study. To better justify the necessity of the parameter partitioning, it may be better for the authors to include a comparison against a simpler baseline that does not use this partitioning. This would help quantify the impact of watermark collisions or main task degradation that the partitioning scheme is designed to prevent.\n- Inadequate evaluation of computational overhead. The proposed method requires the server to perform personalized watermark injection (fine-tuning) for every client in each round. This process could be much slower than white-box methods like FedTracker, especially as the number of clients increases. It may be better for the authors to evaluate the computational time cost with a varying number of clients.\n- Lack of clarity in reported results. Some reported data is imprecise. For example, in Table 1, the per-dataset Verification Rate (VR) is only represented by a checkmark (if >95%) or an 'X', with only an average VR reported. It may be better for the authors to report the specific VRs for all methods and datasets to allow for a more granular and direct comparison.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)