# PK-Judge: Enhancing IP Protection of Neural Network Models Using an Asymmetric Approach
## 6 Results and Discussion
### Comparison with Prior Work  
In this section, we compare PK-Judge with several prior neural network watermarking schemes from the literature. Table 7 presents a comparison based on verification mechanism, cryptographic technique, separation of privileges and challenge-response capabilities.  
Cryptographic Binding and Replay Resistance: Many frameworks [11; 12; 13; 39; 15; 33] rely on symmetric verification. These methods suffer from _replay attacks_, where adversaries extract and reuse watermarks to forge ownership (Section 5.4). The lack of cryptographic binding to the owner's identity enables adversaries to claim ownership without the secret key.Furthermore, the watermarks in these schemes become insecure once exposed, as their secrecy is their primary defense. PK-Judge mitigates these vulnerabilities by embedding a digital signature generated from the owner's private key, ensuring that only the legitimate owner can produce valid proofs. Even if the watermark is revealed, it remains a valid and verifiable marker of ownership due to its cryptographic foundation, preserving its integrity and security.  
Separation of Privilege: Decoupling Extraction and Verification: A foundational advancement in PK-Judge is its adherence to the separation of privilege principle (Section 3, Requirement 8), where watermark extraction is decoupled from ownership verification. Existing frameworks, including protocols in [11; 12; 13; 14; 15; 21; 22; 33] conflate these processes. PK-Judge, in contrast, requires two independent proofs: (1) extracting the ECC-corrected signature and (2) cryptographically signing a fresh challenge with the private key. This separation ensures that even if adversaries extract the watermark, they cannot authenticate ownership without the private key.  
Challenge-Response Capabilities: PK-Judge supports a dynamic challenge-response protocol, requiring the owner to cryptographically sign fresh challenges with their private key, enhancing security against forgery (Section 3) where as adversaries cannot forge fresh cryptographic proofs. In contrast, most previous schemes [11; 12; 13; 14; 15; 21; 22; 23; 24; 26; 27; 29; 33] lack this capability, relying on static verification that is susceptible to replay or extraction attacks. This feature distinguishes PK-Judge, enabling robust ownership verification under adversarial conditions.  
Robustness: PK-Judge's multi-component design (Section 5) demonstrates superior robustness compared to previous frameworks. PK-Judge achieves a zero Effective Bit Error Rate (EBER) after error-correcting code (ECC) decoding, as demonstrated in our fidelity experiments (Section 6.3). This ensures the integrity of the embedded digital signature against adversarial attacks such as pruning, fine-tuning, and overwriting. After recovering the digital signature through ECC decoding, it is verified using the owner's public key, enabling the application of a challenge-response mechanism to confirm ownership. In comparison, prior schemes like [11; 12; 14; 21] rely on non-zero BERs under similar conditions and depend on symmetric bit-matching techniques, lacking the cryptographic robustness provided by PK-Judge's approach.  
\begin{table}
\begin{tabular}{l l l l} \hline \hline \multirow{2}{*}{**Method**} & **Verification** & **Cryptographic** & **Challenge-Response** \\  & **Mechanism** & **Technique** & **Challenge-Response** \\ \hline PK-Judge & Asymmetric & Digital Signatures & Yes \\ Hufu [33] & Symmetric & None & No \\ BlackMark [74] & Symmetric & None & No \\ Margin-based [34] & Symmetric & None & No \\ PTYNet [41] & Symmetric & None & No \\ \hline \hline \end{tabular}
\end{table}
Table 7: Comparison of PK-Judge with Prior Schemes.