## 5 Experimental Results
### Robustness Evaluation  
We evaluated our scheme's robustness against the three contemporary removal attacks discussed in Section 1. **Pruning attack:** We employed the pruning approach proposed by [PERSON] et al. [66] to compress watermarked models. For each layer, this method sets the \(\alpha\%\) of the weights with the lowest absolute values to zero. Figure 3 illustrates the impact of pruning on watermark extraction/detection and model accuracy for different values of \(\alpha\). DICTION demonstrates superior robustness, tolerating up to 90-95% pruning across all benchmark networks, compared to 80% for ResEncrypt. DeepSigns shows increased vulnerability when a 256-bit watermark is inserted. Importantly, when pruning achieves substantial BER values, the attacked watermarked model suffers significant accuracy loss compared to the baseline, indicating that watermark removal comes at the cost of model performance degradation. **Fine-tuning attack:** Fine-tuning represents another transformation attack that adversaries might use to remove watermarks. In its most effective implementation, the watermarked model is fine-tuned using original training data and the target model's loss function (conventional cross-entropy in our case), without exploiting watermarking loss functions \(E_{\text{wat}}\). Fine-tuning deep learning models causes convergence to different local minima that may not be equivalent to the original in terms of prediction accuracy. Our fine-tuning attack protocol multiplies the last training learning rate by a factor of 10, then divides it by 10 after 20 epochs, allowing the model to explore new local minima. Table 4 summarizes the impact of fine-tuning on watermark detection rates (expressed as BER) for all benchmark models. DICTION successfully detects watermarks even after extensive fine-tuning, unlike DeepSigns or ResEncrypt. The poor performance of ResEncrypt on BM4 can be attributed to the small number of parameters in the watermarked layer, while the limited capacity of DeepSigns makes 256-bit watermark insertion vulnerable to fine-tuning attacks. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Benchmarks** & \multicolumn{2}{c}{**BM1**} & \multicolumn{2}{c}{**BM2**} & \multicolumn{2}{c}{**BM3**} & \multicolumn{2}{c}{**BM4**} \\ \hline
**Epochs** & 50 & 100 & 50 & 100 & 50 & 100 & 50 & 100 \\ \hline
**ACC DICTION** & **98.27\%** & **98.3\%** & **86.81\%** & **86.69\%** & **91.59\%** & **91.58\%** & **99.17\%** & **99.16\%** \\ \hline
**BER DICTION** & **0** & **0** & **0** & **0** & **0** & **0** & **0** \\ \hline
**ACC DeepSigns** & 98.53\% & 97.83\% & 86.9\% & 87.49\% & 90.89\% & 91.48\% & 99.14\% \\ \hline
**BER DeepSigns** & 0.0977 & 0.1445 & **0** & 0.0234 & 0.1406 & 0.1641 & 0.3398 & 0.3320 \\ \hline
**ACC ResEncrypt** & 98.54\% & 98.64\% & 87.37\% & 87.3\% & 91.31\% & 90.98\% & 99.17\% & **99.2\%** \\ \hline
**BER ResEncrypt** & **0** & **0** & **0** & **0** & **0** & 0.5234 & 0.5273 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Robustness of watermarking schemes against fine-tuning attacks. Best results are highlighted in bold. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Benchmark ID**} & \multirow{2}{*}{**Baseline Acc**} & \multicolumn{2}{c}{**DICTION**} & \multicolumn{2}{c}{**DeepSigns**} & \multicolumn{2}{c}{**ResEncrypt**} \\ \cline{3-6}  & & **BER** & **Model Accuracy** & **BER** & **Model Accuracy** & **BER** & **Model Accuracy** \\ \hline
1 & 98.06\% & **0** & **98.06\%** & **0** & 97.73\% & **0** & 97.57\% \\ \hline
2 & 87.17\% & **0** & **85.65\%** & **0** & 85.18\% & **0** & 84.98\% \\ \hline
3 & 91.7\% & **0** & **91.58\%** & **0** & 91.36\% & **0** & 90.84\% \\ \hline
4 & 99.16\% & **0** & **99.1\%** & **0** & 98.75\% & **0** & 98.68\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: BER and accuracy of watermarking schemes for the four benchmarks after embedding a 256-bit watermark. Best results are highlighted in bold.