## 4 DICATION: Proposed Methodology
### Formal Definition of Diction  
We formulate our scheme following the unified framework presented in Section 3.1 for state-of-the-art white-box schemes through its embedding regularization term \(E_{\text{wat}}\). Consider a trigger set defined as a latent space from a normal distribution \(N(\mu,\sigma)\) with the mean \(\mu\) and standard deviation \(\sigma\). From this perspective, the feature extraction function for a given target model \(M\) is  
\[\text{Ext}(M,K_{\text{ext}})=f^{l}(\text{LS},w)\odot Z \tag{16}\]  
where \(K_{\text{ext}}=\{l,Z,\text{LS}\}\) is the secret extraction key composed of the following: \(l\) (the index of the layer to be watermarked), \(Z\) (a permutation matrix used to secretly select a subset of features from \(f^{l}(\text{LS},w)\) and order them), and LS (a sample from the latent space, i.e., an image whose pixel values follow a normal distribution). As illustrated in Figure 2, our projection function \(\text{Proj}_{\theta}^{\text{DNN}}\) is a DNN that takes as input the extracted features \(\text{Ext}(M^{\text{wat}},K_{\text{ext}})\) and outputs the watermark \(b\). The input and output dimensions are equal to the size of the extracted features \(|\text{Ext}(M,K_{\text{ext}})|\) and the watermark size \(|b|\), respectively. To embed \(b\) in the secretly selected layer \(l\) of the target model, our watermarking regularization term is defined as  
\[E_{\text{wat}}=\delta(\text{Proj}_{\theta}^{\text{DNN}}(\text{Ext}(M^{\text{wat }},K_{\text{ext}})),b)+\delta(\text{Proj}_{\theta}^{\text{DNN}}(\text{Ext}(M,K _{\text{ext}})),b_{r}) \tag{17}\]  
where \(M^{\text{wat}}\) is the watermarked version of \(M\), \(b_{r}\) is a random watermark, and \(\delta\) is a watermark distance measure. The random watermark \(b_{r}\) ensures that \(\text{Proj}_{\theta}^{\text{DNN}}\) projects the desired watermark \(b\) only for \(M^{\text{wat}}\). Note that \(\delta\) depends on the watermark type: for binary sequences, cross-entropy is appropriate, while for images, pixel mean squared error is more relevant. Our global embedding loss is  
\[E=E_{0}(X_{\text{Train}},Y_{\text{Train}})+\lambda E_{\text{wat}} \tag{18}\]  
Figure 2: DICATION workflow: Latent space triggers feed both models to extract layer \(l\) activations. The projection network \(\text{Proj}_{\theta}\) maps original model activations to random \(b_{r}\) and watermarked model activations to the target watermark \(b\). Joint training preserves model accuracy while embedding the watermark. where \(\lambda\) adjusts the trade-off between the original target model loss term \(E_{0}\) and the watermarking regularization term \(E_{\text{wat}}\), and \((X_{\text{Train}},Y_{\text{Train}})\) is the training set. Importantly, \(E_{\text{wat}}\) depends only on the trigger set, not on \((X_{\text{Train}},Y_{\text{Train}})\). Parameter updates: The parameters of \(M^{\text{wat}}\) are updated according to the following regularization term from \(E\):  
\[E_{w^{\text{wat}}}=E_{0}(X_{\text{Train}},Y_{\text{Train}})+\lambda\delta( \text{Proj}_{\theta}(\text{Ext}(M^{\text{wat}},K_{\text{ext}})),b) \tag{19}\]  
This ensures that the parameters \(w^{\text{wat}}\) of \(M^{\text{wat}}\) are updated to maintain the accuracy of the original target model while minimizing the distance between the projection of the activation maps and the watermark \(b\). Note that the projection model \(\text{Proj}_{\theta}^{\text{DNN}}\) serves as a discriminator that associates the projection of the trigger set activation maps of \(M^{\text{wat}}\) to \(b\) and those of \(M\) to \(b_{r}\). The shared term \(\delta(\text{Proj}_{\theta}(\text{Ext}(M^{\text{wat}},K_{\text{ext}})),b)\) in Equations (19) and (20) allows for an optimal compromise between the parameters \(w^{\text{wat}}\) and \(\theta\), ensuring that the activation maps projection is close to \(b\) without impacting accuracy and remains unique for \(M^{\text{wat}}\). In practice, \(M^{\text{wat}}\) and \(\text{Proj}_{\theta}^{\text{DNN}}\) are trained simultaneously for fast convergence.