## 3 Unified White-Box ML Watermarking Framework
### White-Box Watermarking Framework  
As previously stated, there are two classes of white-box watermarking schemes: static and dynamic. The former encompasses methods that embed the watermark by directly modifying the weights of a trained model [46, 62] using classical watermarking modulation techniques similar to those used for images. In the second class [45, 47, 51, 55, 57], the watermark is inserted during the training of the model for its original task. The idea is that the watermark-insertion process does not reduce the performance of the host model. From our perspective, these methods can be integrated within a unified white-box watermarking framework that describes any of these schemes according to the following two main steps:  
1. Feature extraction: Given a target model \(M\), a secret parameterized feature extraction function \(\text{Ext}(M,K_{\text{ext}})\) is applied using a secret key \(K_{\text{ext}}\). As we will demonstrate, such features can be a subset of the model weights. In that case, \(K_{\text{ext}}\) simply indicates the indices of the model weights to select. Alternatively, features can be model activation maps for secretly selected input data from a trigger set. These features are then used for watermark insertion and extraction. 2. Watermark embedding: The embedding of a watermark message \(b\) consists of regularizing \(M\) with a specific watermarking regularization term \(E_{\text{wat}}\) added to the model loss such that the projection function \(\text{Proj}(\cdot,K_{\text{Proj}})\) applied to the selected features encodes \(b\) in a given watermark space, where the space depends on the secret key \(K_{\text{Proj}}\). The objective is that after training, we have \[\text{Proj}(\text{Ext}(M^{\text{wat}},K_{\text{ext}}),K_{\text{Proj}})=b\] (3) where \(M^{\text{wat}}\) is the watermarked version of the target model \(M\). The watermarking regularization term \(E_{\text{wat}}\) depends on a distance measure \(\delta\) defined in the watermark space, such as Hamming distance, Hinge loss, or cross-entropy in the \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Existing Works**} & \multicolumn{2}{c}{**White-Box**} & \multicolumn{2}{c}{**Black-Box**} & \multicolumn{2}{c}{**Stages of Application**} & \multirow{2}{*}{**Secret Key**} \\ \cline{2-2} \cline{4-6}  & **Dynamic** & **Static** & **Dynamic** & **Training** & **Fine-Tuning** & \\ \hline [PERSON] et al. [47] & ✓ & & ✓ & ✓ & Matrix \\ \hline [PERSON] et al. [48] & ✓ & & & ✓ & Matrix \\ \hline [PERSON] et al. [54] & ✓ & & & ✓ & Matrix \\ \hline [PERSON] et al. [46] & ✓ & & & ✓ & Matrix \\ \hline EncryptResist [55] & ✓ & & ✓ & ✓ & DNN, Matrix \\ \hline [PERSON] et al. [52] & ✓ & ✓ & ✓ & ✓ &
\begin{tabular}{c} Passport layer and \\ Matrix \\ \end{tabular} \\ \hline DICTION (our work) & ✓ & & ✓ & ✓ & TriggerSet, DNN \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._case of a binary watermark (i.e., a binary string of length \(l\) where \(b\in\{0,1\}^{l}\)). \(E_{\text{wat}}\) is, thus, defined as  
\[E_{\text{wat}}=\delta(\text{Proj}(\text{Ext}(M^{\text{wat}},K_{\text{ext}}),K_{ \text{Proj}}),b) \tag{4}\]  
To preserve the accuracy of the target model, the watermarked model \(M^{\text{wat}}\) is generally derived from \(M\) through a fine-tuning operation parameterized with the following loss function:  
\[E=E_{0}(X_{\text{Train}},Y_{\text{Train}})+\lambda E_{\text{wat}} \tag{5}\]  
where \(E_{0}(X_{\text{Train}},Y_{\text{Train}})\) represents the original loss function of the network, and \(\lambda\) is a parameter for adjusting the trade-off between the original loss term and the watermarking regularization term. Here, \(E_{0}\) ensures good performance on the classification/main task while \(E_{\text{wat}}\) ensures correct watermark insertion. **Watermark extraction:** The watermark retrieval is straightforward.