## 5 Experimental Results
### Security Analysis (Watermark Detection Attacks)  
We tested all schemes against the attack proposed by [PERSON] et al. [56] and Property Inference Attack (PIA). Watermark embedding should not leave noticeable changes in the probability distribution of the watermarked model. Figure 4 illustrates histograms of activation maps from watermarked and non-watermarked models. DICTION preserves the model's distribution while robustly embedding the watermark. The range of activation maps is not deterministic across different models and cannot be used by malicious users to detect watermark existence.  
Table 6 provides the mean and standard deviation of the parameter distributions and activation maps of the watermarked layer for all watermarking schemes. DICTION minimally disturbs the distribution of model parameters across all four benchmarks, demonstrating superior security properties.  
**Property Inference Attack (PIA):** We evaluated PIA with a watermark detector \(F_{\text{Det}}\) trained on multiple watermarked and non-watermarked models. We assumed the worst-case scenario where the attacker knows the training data, the exact model architecture of  
\begin{table}
\begin{tabular}{l c c c c c c c c} \hline \hline  & \multicolumn{2}{c}{**BM1**} & \multicolumn{2}{c}{**BM2**} & \multicolumn{2}{c}{**BM3**} & \multicolumn{2}{c}{**BM4**} \\ \cline{2-9}  & **Act. Maps** & **Weights** & **Act. Maps** & **Weights** & **Act. Maps** & **Weights** & **Act. Maps** & **Weights** \\ \hline Baseline & 1.42 \(\pm\) 0.81 & 0 \(\pm\) 0.04 & \(-\)1.23 \(\pm\) 0.42 & 0 \(\pm\) 0.05 & 0 \(\pm\) 0.02 & 0 \(\pm\) 0.09 & 1.70 \(\pm\) 1.30 & 0.01 \(\pm\) 0.04 \\ \hline DICTION & **1.42 \(\pm\) 0.82** & **0 \(\pm\) 0.03** & \(-\)1.24 \(\pm\) 0.43 & **0 \(\pm\) 0.06** & **0 \(\pm\) 0.04** & **0 \(\pm\) 0.11** & **1.70 \(\pm\) 1.30** & **0 \(\pm\) 0.04** \\ \hline DeepSigns & \(-\)0.01 \(\pm\) 0.38 & 0 \(\pm\) 0.02 & \(-\)0.04 \(\pm\) 0.12 & 0 \(\pm\) 0.05 & 0 \(\pm\) 0.11 & 0 \(\pm\) 0.11 & 0.22 \(\pm\) 0.47 & 0 \(\pm\) 0.05 \\ \hline ResEncrypt & 0 \(\pm\) 0.53 & \(-\)0.01 \(\pm\) 0.02 & \(-\)1.64 \(\pm\) 0.45 & 0 \(\pm\) 0.06 & 0 \(\pm\) 0.01 & 0 \(\pm\) 0.10 & \(-\)0.18 \(\pm\) 1.74 & \(-\)0.02 \(\pm\) 0.06 \\ \hline Uchida & \(-\)2.49 \(\pm\) 1.47 & 0.01 \(\pm\) 0.28 & \(-\)1.96 \(\pm\) 0.44 & 0 \(\pm\) 0.07 & 0 \(\pm\) 0.01 & 0.03 \(\pm\) 0.35 & \(-\)2.91 \(\pm\) 2.56 & 0 \(\pm\) 0.02 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Mean and standard deviation of weight and activation map distributions for baseline and watermarked models. Values closest to baseline are highlighted in bold.  
Figure 4: DICTION: Distribution of activation maps and weights of watermarked and non-watermarked models across the four benchmarks.  
\(M^{\text{wat}}\), and the feature extraction key. While this threat model is overly strong, we use it to demonstrate our watermark scheme's effectiveness.  
For the PIA evaluation, we trained 700 watermarked and 700 non-watermarked LeNet models on MNIST with different keys, plus 100 models of each type as test sets. We tested PIA only on LeNet due to the attack's high complexity, requiring the training and watermarking of 800 models. The detector \(F_{\text{Det}}\) was trained on watermarking features labeled according to the model's watermarking status. All generated models achieved good accuracy with correctly embedded watermarks. The detector \(F_{\text{Det}}\) achieved only 60% accuracy on training data and around 50% on testing after 50 epochs, equivalent to random guessing. This demonstrates the resistance of DICTION to property inference attacks.