# PK-Judge: Enhancing IP Protection of Neural Network Models Using an Asymmetric Approach
## 5 Materials and Methods
### Applying Digital Signatures as Authenticators in the Watermark  
Traditional neural network watermarking approaches [11; 12; 13; 14] suffer from a fundamental limitation: once a watermark is publicly revealed, its security and evidentiary power are compromised. Such exposure undermines the watermark's role as a secure and indisputable marker of ownership. This occurs because existing schemes treat watermarks as secret credentials rather than asymmetric verifiable assertions [11; 12; 13; 14]. Once exposed, adversaries can trivially replicate or modify these watermarks, voiding their evidentiary value. We resolve this fundamental limitation by embedding the digital signature of the owner directly into the model. Digital signatures inherently preserve their evidentiary value even under public scrutiny because, even if an adversary learns the signature, they cannot generate a valid signature without the corresponding secret key. This creates a persistent and verifiable linkage between the model parameters and the owner's credentials--a binding that cannot be achieved with random or hardcoded bits lacking cryptographic authentication [49; 51]. There is no leakage issue as only one public key \(pk\) can be used to verify the digital signature that was embedded as a watermark in the neural network. While digital signatures guarantee authenticity, their binary sensitivity poses a critical challenge: even a single bit flip in signature--caused by any source of noise--invalidates the entire ownership claim. An error bit causes an avalanche of bit errors. PK-Judge mitigates this by encoding the signature using an error correction code (ECC) framework [52; 53; 54]. We highlight how we apply digital signatures in our ownership verification within PK-Judge in the following two paragraphs. Formally, let \(\mathsf{id}_{\text{owner}}\) denote the owner identifier and \(H\) a collision-resistant hash function. The signature process binds model parameters \(\theta\) through: \(\mathsf{m}=H(\theta\mid\mathsf{id}_{\text{owner}})\); \(\sigma=\text{Sign}(\mathsf{m},sk_{\text{owner}})\), where \(sk_{\text{owner}}\) is the private key. The signature \(\sigma\) is embedded via constrained optimization: \(\theta^{*}=\text{argmin}_{\sigma}\mathcal{L}(\theta^{\prime})+\lambda_{1}\|E( \theta^{\prime})-\sigma\|_{2}^{2}\), with \(E\) as the embedding extractor and \(\lambda_{1}\) controlling the fidelity-robustness trade-offs. The scheme resists ambiguity attacks [61] by making counterfeit watermarks \(\sigma_{\text{adv}}\) computationally indistinguishable from random noise unless the adversary possesses \(sk_{\text{owner}}\). The public key \(pk\) must be made known so that anyone can verify the signature. However, an attacker may acquire both the watermarked model and \(pk\), then claim public key as their own. In such a scenario, they might also claim that the embedded watermark is proof of their rights. Simple public-key verification would not immediately distinguish whether \(pk\) truly belongs to the model's original creator or an impersonator who stole the key. The public key pk, commonly tied to the owner's identity by a public-key certificate in accordance with the X.509 standard [62]. However, this alone does not guarantee that the party now presenting the model is the true owner, as certificates can be compromisedin practice. A prominent example is the DigiNotar breach of 2011 [63], which enabled malicious actors to forge or misuse digital certificates, thereby generating signatures that appeared legitimate. PK-Judge mitigates this threat by combining public verification with a challenge-response protocol. The verifier issues a fresh random challenge \(c\), and only the authentic owner who holds the private key \(sk\) can produce a valid signature \(\zeta=\text{Sign}(c,sk)\) that can be verified using the published public key. Any replay of previous signatures fails because each new challenge has never been signed before.