## 4 DICATION: Proposed Methodology  
### Architectural Overview  
DICATION is a novel, dynamic white-box watermarking scheme for DNN that inserts watermarks into the activation maps of one or multiple concatenated layers of the target model. Its originality lies in two key innovations. First, to ensure the fidelity requirement (i.e., preserving the target model's performance while embedding the watermark), DICTION uses a trigger set from a distribution different from the training set. Our key insight is that if the trigger set is out-of-distribution from the training data, such as data from a latent space defined as a Gaussian distribution similar to GAN generators [19] and Variational AutoEncoder (VAE) decoders [63], we can better preserve the probability density function of the activation maps of the training samples. This approach consequently maintains the accuracy of the target model while increasing watermark robustness. Second, to achieve an optimal trade-off between insertion capacity and watermark robustness against PA, FTA, OWA, WKA, and PIA attacks, the projection function of DICTION is defined as a DNN that learns to map the activations of the target model \(M^{\text{wat}}\) to a watermark \(b\) and the activations of the non-watermarked model to a random watermark \(b_{r}\) using the trigger set. This projection function is analogous to the discriminator of a GAN model trained to distinguish (for samples in the latent space) the activation maps produced by a watermarked model from those of a non-watermarked model. DICTION workflow: The workflow of DICTION is illustrated in Figure 2. In each training round, it follows these steps to produce a watermarked model:  
1. Latent space generation: Generate a trigger set image LS of the same size as the training set images from a latent space following a Gaussian distribution with mean \(\mu\) and standard deviation \(\sigma\). 2. Activation map extraction: Feed LS to both the original (non-watermarked) model \(M\) and the watermarked model under training \(M^{\text{wat}}\) to compute, for a given layer \(l\), the activation maps \(f^{l}(\text{LS},w^{\text{wat}})\) and \(f^{l}(\text{LS},w)\), where \(w^{\text{wat}}\) are the weights of \(M^{\text{wat}}\) and \(w\) are those of \(M\), respectively. Note that at the first round, \(M^{\text{wat}}\) is initialized with the parameters of \(M\). 3. Projection model training: Use \(f^{l}(\text{LS},w)\) and \(f^{l}(\text{LS},w^{\text{wat}})\) to train the projection model \(\text{Proj}^{\text{DNN}}\) by assigning the following labels: the watermark \(b\) for the activation maps of \(M^{\text{wat}}\) and a random watermark \(b_{r}\) for those of \(M\). This dual-label training prevents \(\text{Proj}^{\text{DNN}}\) from becoming a trivial function that maps any input to \(b\) (addressing the integrity requirement described in Section 1). 4. Model training: To ensure fidelity requirements, train the target model \(M^{\text{wat}}\) on the training set \((X_{\text{Train}},Y_{\text{Train}})\) at each round. The original model \(M\) remains frozen during the watermarking process. These steps are repeated until the bit error rate (BER) between the extracted watermark \(b^{\text{ext}}\) from \(M^{\text{wat}}\) and the embedded watermark \(b\) is equal to zero while maintaining good accuracy for the target model \(M^{\text{wat}}\). GAN-like training strategy: Our embedding process is analogous to GAN training, where the projection model acts as a discriminator that learns to classify the activation maps of the original model \(M\) as \(b_{r}\) and those of the target model \(M^{\text{wat}}\) as \(b\). The first \(l\) layers of the target model \(M^{\text{wat}}\) function as the generator, trained to produce appropriate activation maps for the discriminator while maintaining main task performance (i.e., classification). The original model \(M\) is not trained during the embedding process, and its activation maps are fed to the projection model to prevent trivial solutions.