# Watermarking Tiny MLCommons Image Applications Without Extra Deployability Costs
## 3 Related Works
### Watermarking Based on Level of Access
#### 3.3.2 Black-Box Watermarking and Attacks  
In the context of ML, black-box NNs are complex and non-interpretable, making it difficult to understand how these models generate any decisions. Similarly, in black-box \begin{table}
\begin{tabular}{l l l} \hline \hline
**Method** & **Author** & **Level of Access** \\ \hline \({}^{*}\)DeepSigns”: A combination of multi-bit and one-bit watermark framework gives a WMd version with its key [32] & [PERSON] et al. & White box and black box \\ \hline Embedding a key-vector into the parameters of a DNN [33] & [PERSON] et al. & White box \\ \hline Protect WMd parameters by blocking them with a DNN [34] & [PERSON] et al. & White box \\ \hline Embeds a fragile watermark as a bit string that can be altered & [PERSON] et al. & White box \\ even if a parameter changes [35] & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Related works on NNW focussed mainly on white-box methods. watermarking, the process is designed to be non-transparent and obscure, preventing unauthorized users from understanding or manipulating the watermark. In adversarial ML, a black-box attack occurs when an attacker has no knowledge of the model's internals and must rely on the model's outputs to construct the attack. This type of attack is more common in real-world scenarios where attackers do not have access to the target model's details. Table 2 summarizes existing works on NNW using black-box approaches. In addition to state-of-the-art watermarking methods, NNW techniques can also harness the intrinsic structures of different DNN architectures to embed watermarks. For example, in CNNs, watermarks can be embedded within specific convolutional layers, feature maps, or filters, leveraging these networks' hierarchical structure and spatial patterns. This allows for seamless integration that remains resilient to network modifications. On the other hand, recurrent neural networks (RNNs), which operate on sequences and temporal dependencies, can incorporate watermarks within their recurrent connections or hidden state transitions. By embedding patterns within sequences or modifying specific hidden state behaviors, watermarks can be effectively concealed while preserving functionality. GNNs further offer unique opportunities for NNW by embedding watermarks within nodes, edges, or global graph representations. These structural modifications allow watermarks to be intertwined with the graph data processing, enhancing robustness to structural transformations or attacks. Leveraging the architectural properties of different DNNs enables the creation of highly resilient and adaptive watermarks that align with the operational characteristics of each specific network type, enhancing their resistance to attacks and modifications. Exploring the possible digital object that can be watermarked in the field of NNs, [PERSON] et al. [41] introduce an innovative watermarking framework designed for deep neural networks that produce images as outputs. In this framework, any image generated by a watermarked neural network includes a specific watermark, changing the usual way of watermarking an NN hiding secret keys into the weights or in the prediction of small batches of data. Continuing the discussion of different types of neural network watermarking techniques, it is also important to consider fragile NNW. This specific approach contrasts with robust watermarking by being highly sensitive to any modifications made to the DNN. Unlike robust watermarks, which aim to ensure model changes such as pruning, quantization, or fine-tuning, fragile watermarks are designed to detect even the smallest alterations in the model's parameters or architecture. Such sensitivity makes fragile watermarking