# PK-Judge: Enhancing IP Protection of Neural Network Models Using an Asymmetric Approach
## 6 Results and Discussion
### Evaluation of the Other Watermarking Requirements  
**Evaluation of Uniqueness**: PK-Judge ensures uniqueness by embedding cryptographically generated digital signatures, derived from the owner's signing key [51; 64]. These signatures are mathematically verifiable and inherently unique, transforming each watermark into a definitive identifier tied to the owner. In contrast to methods that embed random bits, which lack intrinsic uniqueness and risk collisions, PK-Judge's cryptographic approach guarantees that each watermark is distinct and tamper-proof. This eliminates ambiguity in ownership verification and provides a robust, scalable solution for model attribution. **Evaluation of Integrity**: PK-Judge's integrity relies on its challenge-and-response mechanism (Section 5.5), which requires zero EBER for ownership verification. This en \begin{table}
\begin{tabular}{l c c} \hline \hline
**Model Name** & **Detection Success** & **EBER** \\ \hline MNIST\_MLP & Yes & 0 \\ CIFAR10\_CNN & Yes & 0 \\ CIFAR10\_ResNet18 & Yes & 0 \\ CIFAR10\_ResNet101 & Yes & 0 \\ CIFAR10\_DenseNet201 & Yes & 0 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: PK-Judge Robustness for Overwriting Attack. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Model** & **Metric** & **50 Epochs** & **100 Epochs** & **200 Epochs** \\ \hline \multirow{3}{*}{MNIST\_MLP} & Accuracy & 96.67 & 96.33 & 96.62 \\  & BER & 0.0082 & 0.0271 & 0.0293 \\  & EBER & 0 & 0 & 0 \\ \hline \multirow{3}{*}{CIFAR10\_WideResNet} & Accuracy & 88.08 & 87.73 & 90.44 \\  & BER & 0.00311 & 0.0207 & 0.0234 \\  & EBER & 0 & 0 & 0 \\ \hline \multirow{3}{*}{CIFAR10\_CNN} & Accuracy & 79.39 & 79.49 & 81.02 \\  & BER & 0.0237 & 0.0251 & 0.026 \\  & EBER & 0 & 0 & 0 \\ \hline \multirow{3}{*}{ResNet101} & Accuracy & 84.88 & 84.66 & 85.61 \\  & BER & 0.0273 & 0.0273 & 0.0104 \\ \cline{1-1}  & EBER & 0 & 0 & 0 \\ \hline \multirow{3}{*}{DenseNet201} & Accuracy & 82.5 & 82.85 & 82.85 \\ \cline{1-1}  & BER & 0.0195 & 0.0299 & 0.0299 \\ \cline{1-1}  & EBER & 0 & 0 & 0 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Evaluation Results after Model Tuning Attack. sures only the legitimate owner, possessing the secret keys, can verify ownership. Unlike DeepSigns [12], which tolerates errors, PK-Judge enforces perfect watermark retrieval, as demonstrated in Table 2. Additionally, PK-Judge eliminates false positives, preventing incorrect ownership claims in unmarked models. Integrity assessment in unmarked models mirrors fine-tuning, with results detailed in Table 5.  
**Evaluation of Capacity**: PK-Judge maximizes watermark capacity while preserving model performance and watermark integrity. By partitioning the ECC-encoded digital signature (Section 5.3), PK-Judge balances capacity and robustness, leveraging ECC redundancy to ensure zero EBER across architectures (Tables 2). For MNIST_MLP, zero EBER is achieved for 77 bits/class (10 classes) up to 154 bits/class (5 classes), with 96.65% accuracy. Similarly, CIFAR10_ResNet18 maintains zero EBER for up to 154 bits/class, while CIFAR10_CNN supports up to 128 bits/class. ResNet101 and DenseNet201 demonstrate exceptional capacity, achieving zero EBER across all class counts, including single-class 768-bit embedding. Beyond these thresholds, non-zero EBER values emerge, defining capacity limits for error-free extraction. PK-Judge's flexible embedding strategies allow owners to customize watermark density while maintaining zero EBER, meeting stringent capacity requirements for robust ownership verification. **Evaluation of Ownership Verification**: PK-Judge is the first framework to implement the principle of separation of privilege in neural network watermarking, establishing a new standard for trust and integrity. Unlike traditional approaches that rely solely on watermark extraction for verification, such as using BER below a threshold, PK-Judge employs a more robust and secure method.