# PK-Judge: Enhancing IP Protection of Neural Network Models Using an Asymmetric Approach
## 3 Watermarking Requirements  
To effectively ensure the authenticity and ownership of a neural network model, the watermarking process must adhere to a set of stringent criteria. These requirements, both functional and security-related, dictate the reliability and resilience of the watermark against various adversarial scenarios.  
1. Fidelity: The watermarked model must retain its accuracy and effectiveness in performing its intended task. The probability of misclassifying a data point \(x\) from the dataset \(D\) (excluding the trigger dataset \(T\)) should be bounded by \(\Pr_{X\in D\setminus T}[\texttt{mis}-\texttt{Classify}(\mathcal{M}_{\text{ wm}},X)]\leq\epsilon_{0}\), where \(\epsilon_{0}\) is a negligible parameter.
2. Robustness: The embedded watermark should remain detectable and correctly extracted even after adversarial attacks such as model tuning, pruning, or overwriting [11, 13], ensuring that \(\Pr[\texttt{extract\_ watermark}(\mathcal{M}_{\text{wm}}^{{}^{\prime}})=\texttt{ True}]=1\), where \(\mathcal{M}_{\text{wm}}^{{}^{\prime}}\) is an attacked model.
3. Uniqueness: The embedded watermark should be distinct and specific to a particular model \(\mathcal{M}_{\text{wm}}\) and its owner.
4. Integrity: The probability that a non-watermarked model \(\mathcal{M}\) is incorrectly identified as watermarked should be bounded by the parameter \(\epsilon_{1}\), i.e., \(\Pr[\texttt{FalsePositive}(\mathcal{M}_{\text{wm}}|\text{key})]\leq \epsilon_{1}\). Furthermore, any legal author must be able to prove their ownership with a probability of \(1-\epsilon_{2}\), specifically \(\Pr[\texttt{ownership\_verify}(\mathcal{M}_{\text{wm}}|\text{key})=\texttt{ True}]\geq 1-\epsilon_{2}\), where \(\epsilon_{1}\) and \(\epsilon_{2}\) are negligible parameters.
5. Capacity: The watermarking scheme should be designed to embed sufficient information without compromising the fidelity and the integrity of the model [11, 14].
6. Efficiency: The watermarking process--embedding, extraction, and verification--should be computationally efficient, ensuring minimal overhead in model operation, as highlighted in [11].
7. Universality: The watermarking technique should be versatile, making it applicable across various architectures and types of neural network models.  
Watermarking systems require robust authentication mechanisms beyond mere watermark extraction. A critical contribution of this work is formalizing the necessity of an independent security verification process, decoupled from watermark extraction, as a fundamental requirement for all watermarking schemes. This addresses inherent vulnerabilities in schemes where extraction alone serves as proof of ownership. To mitigate risks, ownership claims must be validated through a separate security mechanism distinct from the extraction pipeline.  
The principle of separation of privilege [47, 48], a cornerstone of secure system design, mandates that authorization should depend on multiple independent conditions. For instance, communication systems decouple authentication from message decoding. Similarly, watermark-based ownership verification systems violate this principle if they rely exclusively on watermark extraction. We thus propose the following requirement:  
1. _Ownership Verification Requirement_: A watermarking scheme must authenticate ownership via a process independent of watermark extraction, ensuring adversarial corruption of extraction does not compromise verification.  
This separation reduces susceptibility to attacks that exploit process dependencies. For example, symmetric watermarking schemes using XOR-based comparisons between extracted watermarks and secret keys, coupled with Bit Error Rate (BER) thresholds, inherently fail this criterion. Their verification is tied solely to the extraction, creating a single point of compromise. By enforcing independent verification, systems ensurethat corruption of one process (e.g., extraction) does not propagate to the authentication mechanism, thereby enhancing overall security.