## 3 Unified White-Box ML Watermarking Framework
### Static White-Box Watermarking Schemes  
#### 3.2.1 Uchida et al. Scheme [45]  
In the scheme of [PERSON] et al. [45], the feature extraction function \(\text{Ext}(\cdot,K_{\text{ext}})\) corresponds to the mean value of secretly selected filter weights. More precisely, based on \(K_{\text{ext}}\), a convolutional layer is selected. Let \((s,s)\), \(d\), and \(n\) represent the kernel size of the layer filters, the number of input channels, and the number of filters, respectively. Let \(\mathbf{W}\in\mathbb{R}^{d\times n\times s\times s}\) denotes the tensor containing all the weights of these filter layers. The feature extraction function then includes the following steps:  
1. Calculate the mean values of the filter coefficients at the same position: \(\overline{W}_{\text{i}kh}=\frac{1}{n}\sum_{j=1}^{n}W_{\text{i}kh}\), obtaining \(\overline{\mathbf{W}}\in\mathbb{R}^{d\times s\times s}\). 2. Flatten \(\overline{\mathbf{W}}\) to produce a vector \(\mathbf{w}\in\mathbb{R}^{v}\) with \(v=d\times s\times s\). The [PERSON] et al. projection function \(\text{Proj}(\cdot,K_{\text{Proj}})\) is designed to insert an \(l\)-bit watermark \(b\in\{0,1\}^{l}\) and is defined as  
\[\text{Proj}(\mathbf{w},K_{\text{Proj}})=\sigma(\mathbf{w}A)\in\{0,1\}^{l} \tag{7}\]  
where \(K_{\text{Proj}}=A\) is a secret random matrix of size \((|\mathbf{w}|,l)\) and \(\sigma(\cdot)\) is the sigmoid function:  
\[\sigma(x)=\frac{1}{1+e^{-x}} \tag{8}\]  
As the distance measure \(\delta\) for the watermarking regularizer \(E_{\text{wat}}\), [PERSON] et al. [45] use binary cross-entropy:  
\[\delta(b,y)=-\sum_{j=1}^{l}(b_{j}\log(y_{j})+(1-b_{j})\log(1-y_{j})) \tag{9}\]  
Based on \(\delta\), \(\text{Proj}(\cdot,K_{\text{Proj}})\), and \(\text{Ext}(\cdot,K_{\text{ext}})\), one can compute the loss \(E_{\text{wat}}\), as given in (5), to watermark a target model \(M\). Framework interpretation: It is interesting to note that the projection function \(\text{Proj}(\cdot)\) (7) corresponds to a simple perceptron with sigmoid activation and parameter set \(\theta\) that includes null biases and weights \(|\mathbf{w}|\). The embedding process of the scheme by [PERSON] et al. is equivalent to training a perceptron \(\text{Proj}_{\theta}(\cdot)\) over the dataset \((A_{i},b_{i})_{i=1...l}\), where the \(i^{\text{th}}\) column of \(A\), denoted \(A_{i}\), corresponds to a training sample with label \(b_{i}\) (the \(i^{\text{th}}\) bit of \(b\)), with batch size \(l\) (the watermark size). Within our framework, the scheme by [PERSON] et al. can be reformulated as the training of a perceptron \(\text{Proj}_{\theta}(\cdot)\), where \(\theta=\text{Ext}(M,K_{\text{ext}})\). The global loss becomes  
\[E=E_{0}(X_{\text{Train}},Y_{\text{Train}})+\lambda(\delta(\text{Proj}_{ \theta}(A),b)+||\theta-\text{Ext}(M^{\text{wat}},K_{\text{ext}})||) \tag{10}\]  
This formulation enables the joint training of \(M^{\text{wat}}\) and \(\text{Proj}_{\theta}(\cdot)\) with different optimization parameters while maintaining a performance equivalent to the original scheme. Watermark extraction: The watermark extraction can be expressed through hard thresholding the result of the \(\text{Proj}(\cdot,\cdot)\) function applied to \(\mathbf{w}^{\text{wat}}=\text{Ext}(M^{\text{wat}},K_{\text{ext}})\):  
\[b_{i}^{\text{ext}}= \begin{cases}1&\text{if }\text{Proj}(\mathbf{w}^{\text{wat}},K_{ \text{Proj}})_{i}=\text{Proj}_{\mathbf{w}^{\text{wat}}}(A_{i})\geq 0.5\\ 0&\text{otherwise}\end{cases}  \tag{11}\]  
where \(\text{Proj}(\mathbf{w}^{\text{wat}},K_{\text{Proj}})_{i}\) is the \(i^{\text{th}}\) component of the projection output and \(b_{i}^{\text{ext}}\) is the \(i^{\text{th}}\) bit of the extracted watermark. Advantages and limitations: The scheme by [PERSON] et al. demonstrates robustness to fine-tuning and pruning attacks and provides substantial watermark capacity. However, it is vulnerable to watermark detection attacks, such as the Wang and Kerschbaum attack (WKA) and Property Inference Attack (PIA), because it modifies weight distributions in detectable ways.