Reliable Model Watermarking: Defending Against Theft without Compromising on Evasion

Authors: hongyu  zhu
sichu  liang
li  fangqi
ju  jia
shi-lin  wang
Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-04-08 19:12:13

Abstract: With the rise of Machine Learning as a Service (MLaaS) platforms, safeguarding the intellectual property of deep learning models is becoming paramount. Among various protective measures, trigger set watermarking has emerged as a flexible and effective strategy for preventing unauthorized model distribution. However, this paper identifies an inherent flaw in the current paradigm of trigger set watermarking: evasion adversaries can readily exploit the shortcuts created by models memorizing watermark samples that deviate from the main task distribution, significantly impairing their generalization in adversarial settings. To counteract this, we leverage diffusion models to synthesize unrestricted adversarial examples as trigger sets. By learning the model to accurately recognize them, unique watermark behaviors are promoted through knowledge injection rather than error memorization, thus avoiding exploitable shortcuts. Furthermore, we uncover that the resistance of current trigger set watermarking against removal attacks primarily relies on significantly damaging the decision boundaries during embedding, intertwining unremovability with adverse impacts. By optimizing the knowledge transfer in protected models during extraction, our approach conveys watermark behaviors without aggressive decision boundary perturbation. Experimental results on CIFAR-10/100 and Imagenette datasets demonstrate the effectiveness of our method, showing not only improved robustness against evasion adversaries but also superior resistance to watermark removal attacks compared to existing state-of-the-art solutions.

Main paper: 
 introduction: 
 Over the past decade, significant advancements in deep learning have led to its widespread application in fields such as computer vision, natural language processing, and speech recognition [37] . Recent breakthroughs in Large Language Models (LLMs), such as ChatGPT, underscore the potential strides toward General Artificial Intelligence (AGI) [58] . These advancements have enabled companies such as OpenAI and Google to offer Machine Learning as a Service (MLaaS) via APIs, transforming sophisticated models into paid services accessible to the public. However, this also presents opportunities for adversaries to steal models [51] , seeking to produce knockoffs and establish pirated API services for profit. The stolen victims involve significant investment including data annotation, expert knowledge and computational resources. For instance, training GPT-3 incurs a cost of approximately 12 million USD [4] . Therefore, model thefts severely damage the intellectual property and legitimate rights of the model owners.Model stealing typically occurs via two approachs. First, adversaries may directly steal the parameters, highlighted by the leak of Facebook's LLaMa model [25, 60] . Second, attackers might prepare unlabeled data to query the target API, employing the probability labels to distill knowledge into a surrogate model. Known as model extraction or functionality-stealing attacks [52] , this strategy exploits legitimate black-box access, making it challenging for owners to distinguish between benign users and potential thieves.Preventing model theft at source is exceedingly difficult. Inspired by digital watermarking used to protect multimedia content [32] , model watermarking is proposed as copyright identifiers to determine if a suspect model is a knockoff [76] . White-box watermarks [11] directly embed secret patterns into parameters, but require access to the suspect model parameters during verification, which may not be feasible in real-world scenarios. Thus, black-box watermarks [1] have emerged as the predominant approach, requiring only access to the model's outputs for the trigger sets. Typically, model owner generates a set of secret watermark samples with deliberately incorrect labels, using techniques like backdoor injection to ensure the model memorizes this trigger set. If a suspect model produces the predefined labels for the trigger set with a high probability, it is identified as a copy of the protected model.Memorizing a trigger set that deviates from the main task distribution will inevitably impair the generalization performance. However, due to benign overfitting [53] , if the size of the trigger set is maintained within capacity limits [39] , poisoning-style watermark embedding does not significantly degrade performance on standard testing benchmarks [1] . Consequently, the adverse effects of trigger set watermarks are often underestimated [3, 31, 33, 46, 85] .In this work, we identify that all poisoning-style watermarks, even those crafted with random label noise trigger sets, embed shortcuts into the protected model [20] . Evasion adversaries can readily exploit these shortcuts, employing efficient optimization frameworks to achieve significantly higher attack success rates than unwatermarked models. Hence, while designed to protect intellectual property from theft, poisoning-style watermarking inadvertently introduces severe vulnerabilities to evasion attacks. Furthermore, we identify a robustness pitfall phenomenon: current watermarks aggressively disrupt the decision boundary, generating misclassifications around watermark samples to achieve resistance against removal attacks. This trivial mechanism inadvertently entangles watermark unremovability with its adverse effects. To ensure effective watermark verification, representational capacity of the model must be sacrificed to focus on watermark behavior, laying severe risks for generalization in adversarial scenarios.In response to the vulnerabilities identified in this paper, we revisit the pipeline of trigger set watermarks, proposing a reliable algorithm that resists removal attacks without increasing evasion risks. Instead of error memorization, knowledge injection is utilized to foster unique watermark behaviors. Specifically, we leverage diffusion models to generate Unrestricted Adversarial Examples (UAEs) from random noise, ensuring diversity, hardness, and fidelity in creating a versatile trigger set. Building on this foundation, we identify optimization difficulties in replicating the protected model as the primary reason for watermarks failing to survive extraction. Thus, we enhance the knowledge transfer properties of the watermarked model during embedding, learning it as a "friendly teacher" to effectively guide the surrogate model in acquiring watermark behavior from a limited query set, without relying on any robustness pitfall phenomenon. The whole pipeline is shown in Figure 1 .Our contributions are summarized as follows:(1) We reveal that all poisoning-style watermarks embed exploitable shortcuts into the model and provide a detailed assessment of the evasion vulnerabilities introduced. (2) We propose utilizing diffusion models to synthesize UAEs as the trigger set, devising effective generation algorithms that enable harmless watermarking via knowledge injection. (3) We identify the robustness pitfall that brings contradictions between generalization and watermark unremovability. We reconceptualize the embedding process by focusing on knowledge transfer properties of the protected model.(4) Integrating analyses and designs above, we propose the first reliable watermarking algorithm that demonstrates improved evasion robustness and surpasses current state-ofthe-art methods in watermark unremovability. 
related work 2.1 model stealing and watermarking: 
 With the widespread application of deep learning, associated models have increasingly become targets for theft. Parameters Stealing directly acquiring models through cyberattacks and social engineering [65] , or reversing model parameters through side channels [60, 82] . Functionality Stealing utilize unlabeled data to query the target API and leverage the soft labels to train a surrogate model via maximum likelihood estimation, approximating the functionality of the stolen victim on the target task [52, 56, 75, 84] . Based on the principles of knowledge distillation [26, 78] , functionality stealing is scalable to large language models (LLMs) [35, 73] , and is highly feasible in open world scenarios.To effectively counteract complex and varied thefts, embedding digital watermarks into protected models is a straightforward and effective strategy [32] . This allows the tracking of infringing actions by transferring watermarks to knockoffs obtained by adversaries. Parameter embedding watermarks [11, 76] directly implant secret patterns into model parameters, but the verification requires whitebox access, which can be denied by the model owner. Furthermore, these patterns are often fragile [40, 54] . Hence, trigger set watermarks [1] , which only require black-box access to the suspect model have become the most popular method. Poisoning-style watermarks embed a trigger set that deviates from the main task distribution, exploiting unique behaviors on the trigger set during verification to assert model copyright [1, 3, 31, 33, 46, 85] . Alternatively, watermark behaviors can be reflected by directly modifying the API's probability outputs [70, 79] , though it may not be secure against parameter stealing. Notably, non-intrusive fingerprints that characterize decision boundaries are feasible [45] , yet are easier to remove [33, 79, 83] and prone to false alarms [69] .In the ongoing challenge for intellectual property protection, attackers strive to remove watermarks from stolen models while preserving their generalization performance. Model modification [44] involve slight alterations such as fine-tuning [43] or pruning [15] to make the model forget the trigger set. Input preprocessing [44] transforms input samples [23] to evade from watermark triggering, or employs anomaly detection [41] to filter out suspicious watermark inputs. Model extraction [44] , primarily used for functionality stealing, also effectively removes watermarks since the trigger set usually does not appear in the extraction query set, complicating the transfer of watermark behaviors during the process of functionality approximating .In response to removal attempts, robust embedding algorithms are proposed to fortify watermark behavior. Entangled Watermark Embedding (EWE) [31] tightly couples watermark samples with the task distribution through soft nearest neighbor loss regularization. Random smoothing (RS) in parameter space [3] provides certification of unremovability against minor parameter changes. Marginbased watermarking (MBW) [33] increases the margin between watermark samples and the decision boundary via adversarial training, increasing the likelihood of watermark retention during model extraction. MEA-Defender [46] employs mixed samples from different source classes as watermarks, binding the trigger set to main task distribution by minimizing the Kullback-Leibler divergence. Overall, robust watermarking algorithms embed the trigger set deeper within the original distribution, significantly altering the decision boundary to boost resilience of the watermarks. 
exploiting watermark shortcut: 
 Recent studies have shown that various failures in machine learning systems can be attributed to shortcut learning-models prefer easy-to-learn patterns over complex, generalizable ones [20] . During standard training, models seek to map inputs to outputs via empirical risk minimization (ERM), a process prone to capturing superficial correlations [62] . While such models excel in controlled test environments, their performance deteriorates in the real world characterized by distribution shifts or adversarial attacks, stemming from the reliance on domain-specific or non-robust features [19, 29] . Shortcuts often arise from dataset biases or learning dynamics of ERM optimizers [74] . Yet, we reveal that poisoning-style watermarking deliberately introduces shortcuts into models, creating hidden pathways adversaries can exploit, significantly amplifying vulnerabilities under evasion attacks.First, we formally define the process of trigger set watermark embedding to expose why shortcuts exist. Pattern-based watermark. This backdoor style [80] approach [1, 3, 31, 61, 85] enables the model to map samples with a specific trigger pattern to a predetermined target class. Watermark samples are created by overlaying the trigger pattern 𝛿 ∈ {0, 1, ..., 255} 𝐶 ×𝑊 ×𝐻 with mask 𝑚 ∈ {0, 1} 𝐶 ×𝑊 ×𝐻 onto samples 𝑥 𝑠 from the source class 𝑠, resulting in 𝑥 𝑤𝑚 = 𝑥 𝑠 ⊙ (1 -𝑚) + 𝛿 ⊙ 𝑚. For watermark embedding, the model 𝑓 𝑤𝑚 is adjusted to classify any sample with the trigger pattern into target class 𝑡 through optimization min 𝜃 𝑤𝑚 L (𝑓 𝑤𝑚 (𝑥 𝑤𝑚 ) = 𝑦 𝑡 ). Given the secrecy of 𝛿, 𝑚, 𝑠, and 𝑡, knowledge of this backdoor serves as the proof of ownership.Pattern-free watermark. Pattern-based watermark is challenged by the continuous evolution of backdoor defenses [21] . Recent strategies advocate for the use of any sample deviates from the main distribution 𝑃 (𝑋, 𝑌 ) as the trigger set D 𝑤𝑚 , eliminating the reliance on a fixed trigger pattern. Pattern-free watermarks could be mixed samples from two classes [46] or purely label noises [33] .Trigger set watermarking hinges on overfitting to a unique set distinct from the main distribution 𝑃 (𝑋, 𝑌 ), leading to shortcuts from 𝑥 𝑤𝑚 to 𝑦 𝑤𝑚 . Although the potential harm of these shortcuts is often overlooked in literature, we then introduce straightforward optimization frameworks demonstrating how evasion adversaries can effortlessly exploit these shortcuts, significantly compromising the model's performance in adversarial settings.In evasion attacks, adversaries craft a distortion 𝛿 within an 𝑙 𝑝 norm boundary, changing prediction of 𝑓 𝑤𝑚 when added to an original sample 𝑥 so that 𝑓 𝑤𝑚 (𝑥 + 𝛿) ≠ 𝑓 𝑤𝑚 (𝑥). Equation 1 aims to find a perturbation 𝛿 that leads 𝑓 𝑤𝑚 to incorrectly classify instances from class 𝑠 to 𝑡, analog to the standard trigger inversion framework [74, 77] . Though trigger inversion has been evaluated in watermarking to neutralize suspicious inputs [31, 46, 77] , it is dismissed as ineffective due to mismatches between recovered and actual patterns. Nonetheless, minimal modifications can activate backdoors [55] , indicating exact pattern matching is unnecessary for evasion. By blindly optimizing 𝛿, we demonstrate the feasibility of deceiving 𝑓 𝑤𝑚 .Additionally, with source and target classes hidden, a brute-force search across class pairs is computationally challenging [77] . Thus, we investigate a universal attack as shown in Equation 2, aiming to maximize classification errors for global 𝛿.Successfully solving Equations 1 and 2 reveals that while watermarked models maintain high accuracy on natural samples, the embedded shortcuts greatly increase susceptibility to evasion attacks. Moreover, secrecy of the trigger pattern in pattern-based watermarks does not safeguard against adversarial exploitation.𝛿 * = arg minEQUATIONEQUATIONThe question arises: can forgoing patterns in watermarking prevent associated vulnerabilities? Theory indicates that memorizing any noisy data undermines robustness to adversarial attacks [53] . Notably, risk from purely random label noise can rival that of the most sophisticated poisoning attacks [53] . To illustrate this empirically, we conduct adversarial attacks on 𝑓 𝑤𝑚 guided by an optimization goal akin to Equation 2. Here, 𝛿 is customized for specific samples rather than a universal pattern, showing higher flexibility.For noise label watermarks, beyond empirically exploring the increased adversarial risk, we delve into model vulnerability, explicitly linking decreased robustness to shortcut exploitation. Recent studies illustrate that backdoors can be implanted by merely altering labels [30] . Exploring the reverse scenario, we investigate whether a trigger pattern can be extracted from arbitrarily mislabeled samples to deceive the model. Algorithm 1 establishes a stochastic gradient approach (NLTI) to solve this problem. It operates on noise set samples in 𝑋 𝑛𝑜𝑖𝑠𝑒 where 𝑦 𝑛𝑜𝑖𝑠𝑒 = 𝑓 𝑤𝑚 (𝑥 𝑛𝑜𝑖𝑠𝑒 ) ≠ 𝑦 𝑜𝑟𝑖 . The intuition is to assume a pattern 𝛿 has already been added to all samples in 𝑋 𝑛𝑜𝑖𝑠𝑒 , causing the model to learn the corresponding incorrect labels in a backdoor injection manner. The algorithm aims to find this pattern such that all 𝑥 -𝛿 can be correctly classified:EQUATION)Algorithm 1 Noise Label Trigger Inversion. for all (𝑥, 𝑦, 𝑦 ′ ) ∈ (𝑋 𝑛𝑜𝑖𝑠𝑒 , 𝑌 𝑜𝑟𝑖 , 𝑌 𝑛𝑜𝑖𝑠𝑒 ) do 5:𝛿 ← 𝛿 -𝛼 • ∇ 𝛿 L (𝑥 + 𝛿, 𝑦, 𝑦 ′ ).Project 𝛿 to the 𝑙 𝑝 ball with bound 𝜀. Update 𝛼 with learning rate schedule 𝑆. 9: end for The pattern 𝛿 represents the source of misclassifications from the noise set, reflecting the shortcut created by noise memorization. Thus, applying 𝛿 to new samples is likely to confuse the model (𝑓 𝑤𝑚 (𝑥 + 𝛿) ≠ 𝑓 (𝑥)). During optimization, the logits loss [5, 9] shown in Equation 4 is applied to enhances the correct class logits 𝑧 𝑦 while pushing outputs away from the noise labels. Additionally, the learning rate is updated according to a schedule to balancie exploration and exploitation [9] .L (𝑥 + 𝛿, 𝑦, 𝑦 ′ ) = -𝑧 𝑦 + 𝑧 𝑦 ′ . (4) NLTI mirrors the approach of universal adversarial perturbations (UAP) [64] . However, a key difference is that NLTI focuses on correcting the model's responses to de-noised samples while inducing errors in new samples with added 𝛿. Ultimately, the optimization strategies offer an optimistic upper bound on the robustness against evasion. With persistent shortcuts, the exploitation capabilities of evasion adversaries will escalate with advancing attack techniques, progressively undermining generalization of watermarked models. 
towards harmless watermarking: 
 Even memorizing random label noise in poison-style watermarks inevitably introduces exploitable shortcuts to the model [53] . Thus, methods relying on misclassification of specific samples for ownership verification are fundamentally flawed. Safe trigger-set watermarking is possible only by ensuring unique correct responses to specific samples. Building on this principle, we propose a harmless watermarking scheme focusing on trigger-set generation, watermark embedding and watermark verification.4.1.1 Motivation. While the optimization in modern deep networks produces diverse solutions [28] , predictions by various models on in-distribution samples often converge. The challenge lies in identifying a set of samples that prompts models to exhibit uniquely correct behavior. First, we summarize the conditions that samples used to construct a harmless trigger set should satisfy:(1) Clarity: Possess clear semantics with a definite correct label;(2) Hardness: Sufficiently difficult to ensure that correct predictions highlight distinct capabilities; (3) Stealth: Closely resemble the original data distribution to bypass anomaly detection; (4) Resilience: Maintain uniqueness against adaptive attacks.Straightforward choices such as out-of-distribution and adversarial examples are challenging enough but either detectable [41] or highly fragile [8, 23] . In this paper, we introduce Unrestricted Adversarial Examples (UAEs) [66] as the trigger set. Free from 𝑙 𝑝 norms constraints, UAEs provide superior flexibility in fooling classifiers and higher resistance to defenses [67] . We further design a pipeline for synthesizing UAEs via diffusion models [27] , with powerful distribution prior [38] ensuring UAEs to be stealth [6, 81] . Moreover, diffusion models can synthesize infinitely realistic and diverse samples from random noise, producing elusive trigger sets.4.1.2 UAE Generation. Diffusion models introduce Gaussian noise to samples in the forward process, leading to an isotropic Gaussian distribution. Conversely, the reverse process reconstruct samples from Gaussian noise [27] . This is achieved by training a denoising model 𝑅 Φ (𝑥 𝜏 , 𝜏) progressively removes noise during the 𝑇 -step schedule, ultimately recovering sample 𝑥 0 as shown in Equation 5:EQUATIONHere, 𝑥 𝑇 is the initial Gaussian seed for the reverse process, guided by the denoising model 𝑅 Φ (𝑥 𝜏 , 𝜏) as 𝑝 Φ (𝑥 𝜏 -1 | 𝑥 𝜏 ). Introducing a conditioning variable 𝑐 allows for a conditional diffusion model 𝑅 Φ (𝑥 𝜏 , 𝜏, 𝑐) [13] . Class-conditioned diffusion provides distribution priors to align generated samples with class semantics, guaranteeing UAEs bear unambiguous labels. Synthesizing UAEs involves steering the generation process to fool classifiers while preserving class semantics. The adversarial nature emerges in three stages: seed selection, denoising trajectory, and final adjustment. We develop efficient methods for crafting UAEs at each stage:Adversarial Warm-up. The objective is to subtly modify the seed 𝑥 𝑇 such that its denoised result can deceive the classifier (𝑓 (𝑥 0 ) ≠ 𝑐). EvoSeed [34] uses a genetic algorithm to add adversarial perturbations to 𝑥 𝑇 , yet it demands thousands of iterations to converge. Therefore, we propose directly maximizing the loss of the classifier 𝑓 mapping 𝑥 0 to class 𝑐 through Equation 6:EQUATIONHere, 𝑃 𝐵𝑝 projects the updated seed onto the 𝑙 𝑝 ball of radius 𝜀 around 𝑥 𝑇 , with 𝜂 and 𝛼 representing the learning rate and iteration. However, the gradient of L (𝑓 (𝑥 𝛼 0 ), 𝑐) relative to 𝑥 𝛼 𝑇 through the 𝑇 -step diffusion process is computationally infeasible. Therefore, we employ the acceleration technique [7, 81] , treating the gradient through the diffusion model as constant, as shown in Equation7:EQUATIONWith this approximation, the back-propagation path can be simplified with only the classifier gradient:EQUATIONIn practice, gradient updates like PGD [47] are applied to the denoised 𝑥 0 , transferring the perturbation back to the seed 𝑥 𝑇 . This approach achieves effects similar to EvoSeed with just a few updates. Since perturbations occur at the diffusion seed, they inherently modify high-level features of the denoised results, such as composition and shape. However, as 𝑥 𝑇 undergoes the whole denoising purification process, perturbing the seed alone may not ensure the desired level of adversarial impact.Adversarial Guidance. Continuous adversarial guidance can be applied throughout generation [6, 10] , introducing adversarial perturbations at each denoising step as shown in Equation 9:EQUATIONHere, 𝜉 determines the scale of perturbations,tailored to the sampling schedule [27] . As adversarial guidance spans from coarse to fine steps, it impacts both high-level and detailed texture features.Adversarial Edition. Further optimization can be performed on the generation result. Integrating a denoising step after each gradient update in PGD can enhance fidelity and transferrability [81] . This is akin to the continuation of adversarial guidance, finetuning low-level features until achieving desired adversarial effect.We sequentially apply three methods, adding adversarial control at various feature granularities. In practice, flexible combinations can be chosen to balance effectiveness and cost.Unremovability -the robustness against removal attacks [1] ensures that adversaries, even when aware of the underlying watermarking algorithm, should struggle to remove or overwrite the watermark. Model extraction, particularly practical and effective among removal attempts [31, 44] , has become a key focus in developing robust watermarking strategies [31, 33, 46] .The Robustness Pitfall. Evaluating watermarking algorithms typically involves two aspects: Functionality Preservation and Unremovability. Successful embedding must maintain task performance, as measured by global accuracy metrics, and withstand removal attempts, ensuring that watermark accuracy 𝜑 𝑤𝑚 exceeds a threshold on the derived surrogate model. Fulfilling both criteria marks the success of a embedding algorithm [3, 31, 33, 46] . In this paper, we expose a robustness pitfall in traditional evaluations of embedding algorithms. We present a simplistic algorithm trivial WM, which constructs a trigger set by relabeling unmodified samples from a source class 𝑠 to a target class 𝑡 and integrates it into the training process at high frequency. Surprisingly, trivial WM achieves high watermark accuracy on extraction surrogates while preserving competitive main task performance. Figure 2 illustrates how trivial WM performs on CIFAR-100 with varying updating frequencies. After training on watermark samples following each standard batch, trivial WM sets the state-of-the-art watermark accuracy on extraction surrogates but significantly undermines generalization in class 𝑠. Lowering the frequency improves performance on class 𝑠 but causes a swift decline in watermark accuracy.Figure 3 delves into this phenomenon by analyzing feature distributions of the watermarked model. High-frequency updates with the trigger set shifts the decision boundary to map the surrounding region of watermark samples as the target class. Although no watermark samples are presented in the query set for extraction, samples close to them in the feature space are misclassified as the target class, smoothly transmitting watermark behavior. In extreme cases, the model learns to label all source class samples as the target class, achieving near-perfect surrogate watermark accuracy, at the cost of a minor 1% decline in overall task performance on CIFAR-100. Thus, sacrificing local decision boundaries for watermark behavior leads to exceptional unremovability. Yet, this is an undesirable outcome, harboring significant risks and acting as a misleading pitfall.In Section 3, we explored how poisoning-style watermarking introduces evasion-prone shortcuts. The robustness pitfall reveals a deeper issue: watermark persistence necessitates decision boundary perturbation driven by misclassifications, creating a conflict between evasion and watermark robustness. The unremovability of current watermarks cannot be decoupled from adverse effects.Teacher. UAE watermark is naturally entangled with the task distribution, conceptually easy to survive in extraction. However, adversaries face optimization challenges in transferring knowledge via ERM [68] . Although the surrogate exhibit even better generalization performance, it does not faithfully mimic all behaviors of the watermarked model [18, 48, 50, 68] . Since the trigger set is absent from extraction queries [1] , transferring watermark behavior is challenging [31, 52] . Poisoning-style watermarks compensate by exploiting the robustness pitfall phenomenon, but inevitably introduces evasion vulnerabilities.Therefore, we propose a novel embedding strategy: learning the watermarked model as a "friendly teacher" adept at sharing knowledge, guiding the surrogate to learn watermark behavior from limited queries. Training a better teacher is an underexplored direction, with current methods focusing on collaborative training between teacher and student networks [57, 63] . However, model owners lack control over the surrogates' training process. Thus, we attempt to learn a surrogate-agnostic friendly teacher from the perspectives of function mapping and output distribution properties. Function Mapping Properties. Recent studies theoretically indicate that teacher models should exhibit Lipschitz continuity and transformation equivariance, making them easier to emulate [14] . Lipschitz continuity implies the model 𝑓 reacts minimally to slight input changes, i.e., ||𝑓 (𝑥) -𝑓 (𝑥 ′ )|| ≤ 𝐿||𝑥 -𝑥 ′ ||, with || • || representing a distance metric. However, exact computation of the Lipschitz constant 𝐿 is notoriously difficult [2] . Yet, adversarial robustness ties closely to the Lipschitz constant [16, 88] . Employing UAEs as the trigger set naturally promotes local Lipschitz smoothness around watermark samples. We enhance this by varying data augmentation strategies for watermark samples per batch [49] .For transformation equivariance, we leverage consistency regularization [71] , and choose random erasing as a highly controllable transformation [87] . It replaces small patches from the original image with random colors. The model 𝑓 is encouraged to produce similar outputs for the transformed and original samples:EQUATION) Here, 𝑟𝑒 (•) is the random erasing operator, and 𝐾𝐿(•||•) calculates the Kullback-Leibler divergence. In practice, L 𝑐𝑟 serves as a regularization term, jointly optimized with the classification loss.Output Distribution Properties. Extraction utilize soft labels from query responses, leveraging their rich information for efficient mimic [52] . However, modern networks often exhibit overconfidence [22, 50] , which obstructs knowledge transfer. To mitigate this, temperature scaling is employed in knowledge distillation Γ to soften softmax layer outputs for both teacher and student, with 𝑝 𝑖 = 𝜎 (𝑧 𝑖 /Γ), where 𝑧 𝑖 represents logits and 𝜎 the softmax function. However, model owners lack control over the evasion adversary, and temperature is often ignored in extraction (Γ = 1) [3, 31, 33, 52, 75] . We propose to apply temperature scaling to protected model, regardless of the extraction settings. As a result, the loss function of black-box extraction becomes Equation 11:EQUATION)where 𝑧 𝑣 and 𝑧 𝑢 are the output logits of the protected model and extraction surrogate, respectively. Γ is the adversary's distillation temperature chosen during extraction attempts, while Γ 𝑣 , set by the model owner at the API level, adjusts the output distribution. The adversary, limited to black-box API output access, remains unaware of Γ 𝑣 . Incorporating Γ 𝑣 modifies the gradient of the extraction loss for the 𝑗th class as detailed in Equation 12:EQUATION)where 𝛿 𝑖 𝑗 is the Kronecker delta function (1 for 𝑖 = 𝑗, 0 otherwise), Γ 𝑣 reduces class discrepancies of the protected model's output distribution, guiding gradient updates to align logits beyond focusing solely on the single correct class.To preserve watermark accuracy despite minor parameter adjustments, we further seek local optima with parameter neighbourhood continuing to exhibit the watermark behavior. This is achieved by bi-level optimization, minimizing watermark loss under the worstcase conditions within the parameter vicinity: minEQUATION)The inner optimization seeks the worst weight perturbation 𝛿 within the 𝑝-norm bound to remove the watermark, while the outer optimization adjusts the parameters to preserve watermark memorization. We employ an approximation in the form of sharpnessaware minimization [17] to efficiently solve the inner problem:EQUATIONIntuitively, sharpness-aware minimization aims for solutions with flatter loss landscapes to prevent adversaries from easily shifting parameters that support watermark behavior. Unlike traditional watermarking [3, 31, 33, 46] , our training strategies apply to the entire training set, not just the trigger set. Our objective is to learn the protected model with desirable properties for watermarking, rather than sacrificing the main task to focus on the watermark.Our verification approach is similar to traditional trigger-set watermarks, assessing ownership by evaluating watermark accuracy 𝜑 𝑤𝑚 . Yet, 𝜑 𝑤𝑚 overlooks how thirdparty models perform on the watermark samples, potentially causing false alarms. Therefore, we introduce a self-calibration method: select control samples from the generated UAE set, matching the trigger set in size, which can mislead the model post-watermarking. The watermark samples and the control samples represent the 𝑝𝑟𝑜𝑠 and 𝑐𝑜𝑛𝑠 of the watermarked model. We use the difference in accuracy (𝜑 𝑝𝑟𝑜𝑠 -𝜑 𝑐𝑜𝑛𝑠 ) as a similarity metric between the suspect and protected models, akin to 𝜑 𝑤𝑚 . 
experiments: 
 In this section, we evaluate the performance of UAE watermarking against leading methods in terms of evasion and watermark robustness. Comparative methods include the pattern-based approaches EWE from USENIX Security 21' [31] and RS from ICML 22' [3] , as well as pattern-free approaches MBW from ICML 23' [33] and MEA from S&P 24' [46] . Experiments are conducted on the CIFAR-10/100 datasets [3, 31, 33, 36, 46] , standard benchmarks for model watermarking, and the more challenging high-resolution Imagenette dataset, a 10-class subset of Imagenet [12] . We use ResNet-18 [24] , the largest-scale model employed by comparative methods [3, 31, 46] , for consistent performance evaluation. Exploration of more advanced structures is discussed in Section 5.2.2. Code and detailed settings are available at .Evaluations of evasion robustness are conducted on the Imagenette dataset to better mirror real-world conditions. We instantiate Equation 1 with the Pixel Backdoor [74] and implement its untargeted universal attack form as described in Equation 2. Instance-specific adversarial attacks employ the 𝐿 0 constraint AutoAttack [9, 86] . The perturbation pixel limits for Pixel backdoor and AutoAttack are set at 200 and 50, respectively, accounting for less than 0.5% and 0.1% of the original image pixels.We conduct a coarse-grained assessment through untargeted attack against all watermarking algorithms and normal models without watermark, as shown in Table 1 . Evasions achieve only modest attack success rate (ASR) on models without watermark due to the lack of shortcuts. Pattern-based watermarking slightly decreases generalization by about 2%, but the shortcuts introduced significantly amplify vulnerabilities. Under the same budget, ASR of Pixel Backdoor increases by about 30 times, and that of AutoAttack by over 40%. In contrast, pattern-free watermarking induces a 10% drop in generalization performance. Even without trigger patterns, vulnerability of MEA to evasion is comparable to pattern-based watermarking. Trigger inversion can exploit shortcuts without matching the exact pattern, and abandoning patterns does not lessen the risks. Among traditional watermarks, only MBW exhibits a relatively minor decrease in robustness. However, this does not imply the harm is negligible, with further details in Section 5.1.3. Finally, UAE watermarking matches the generalization performance of unwatermarked models, further reducing ASR of AutoAttack by 11.16%. The knowledge injection of UAE watermarking teaches models to recognize hard samples, avoiding the creation of shortcuts while patching inherent vulnerabilities, thereby enhancing their adaptability to challenging scenarios.PixelBackdoor In this scenario, trigger inversion directly attempts to reconstruct the patterns, resulting in significantly higher ASRs compared to unwatermarked models. Furthermore, Figure 4 visualizes the target class distribution for samples successfully attacked with untargeted Pixel Backdoor on EWE models. Although the attack indiscriminately targets all classes, the target classes used for watermark (class 1) become vulnerable entry points. Samples from various classes are easily perturbed to be classified as the target class, posing substantial risks in security-related scenarios.In-depth Analysis of Noise Label Watermarking. MBW employs adversarial training (AT) on its label noise trigger set to increase margin. In Figure 5 , we visualize the robust accuracy under a 5-step 𝐿 ∞ PGD attack for MBW, MBW without margin, MBW with AT on the training set, and an unwatermarked model with AT.AT on the trigger set enhances the robustness of MBW, influencing fair comparison in Section 5.1.1. When both the MBW and normal models undergo AT, there consistently exists a gap in adversarial robustness. AT cannot fully compensate for the vulnerability introduced by watermark embedding. In Figure 6 , we compare the attack effects of patterns derived from MBW using noise label trigger inversion with those of Gaussian noise. Effectiveness of the recovered pattern far surpasses that of Gaussian noise, explicitly demonstrating the existence of shortcuts. As attacks evolve, these shortcuts will continue to be exploited. This section evaluates watermarks in resisting removal attacks. For model modification, we iteratively prune and fine-tune the model [43] on 20% of the training set until validation accuracy drops more than 5% or pruning rate exceeds 75%. For model extraction, we employ Knockoff Nets [52] , using the training set as queries [31, 33, 46] . For input preprocessing, we employ CLIP [59] to extract features and then use 10% of the training set to create isolation forests [42] for each class, filtering out potential watermark samples.To reduce overhead, we employ only the first 2 blocks of the feature extractor for CIFAR-10/100 and the first 3 blocks for Imagenette. Table 3 presents the generalization performance and watermark accuracy of all methods. UAE watermarking achieves the highest main task accuracy across all datasets. We calculate watermark accuracy (𝜑 𝑤𝑚 = 𝜑 𝑝𝑟𝑜𝑠 -𝜑 𝑐𝑜𝑛𝑠 ) as the difference between accuracy of trigger set and the UAE control group. This method yields 𝜑 𝑤𝑚 values of -1%, 0.2% and 0% for unwatermarked models on three datasets, confirming the effectiveness of self-calibration. For removal attacks, UAE watermarking exhibits the best average robustness. Notably, without relying on robustness pitfalls, UAE watermarking achieves the highest 𝜑 𝑤𝑚 on extraction surrogates, illustrating the advantages of its "friendly teacher" learning approach. Furthermore, since UAEs adhere to the original distribution, they are difficult to identify in anomaly detection. Although UAE watermarking is not always the most robust against fine-pruning, modifications have never reduced 𝜑 𝑤𝑚 below 85% without significantly impacting generalization. In cases of the same validation accuracy drop, both MBW and MEA tolerate higher pruning rates, with MBW even showing improved generalization on CIFAR-10, cause they adapt to watermarks by significantly sacrificing representation capacity. The robustness pitfall connects poisoning-style watermarking to its adverse effects: the stronger the watermark, the more pronounced the vulnerabilities. Patterns recovered using the MEA extraction surrogate yield a 47.88% transfer ASR on MEA watermarked model, while those from a normal model achieve only a 15.88% transfer ASR. Adversaries targeting evasion rather than stealing even expect the extraction surrogates learn the watermark behavior better, facilitating successful evasions. In this section, we explore complex extraction scenarios. Table 4 shows watermark performance using out-of-distribution (OOD) samples as queries: CIFAR-10 watermarked model use CIFAR-100 as queries, and vice versa. 𝜑 𝑤𝑚 on UAE watermarking surrogates is even higher than indistribution sample extraction, as separating the queries from training set facilitates knowledge transfer. Poisoning-style watermarks often struggle with large-scale networks [31, 46] . We conduct experiments on CIFAR-10 using EfficientNetV2 [72] , with both samearchitecture models and Resnet-18 serving as extraction surrogates, as shown in Table 5 . UAE watermarking retains satisfactory unremovability in modern networks and cross-architecture extraction.  
conclusion: 
 In this paper, we identify the dilemma that poisoning-style model watermarks increase susceptibility to evasion while protecting against theft. To tackle this issue, we introduced a novel, reliable watermarking algorithm utilizing knowledge injection as unique identifiers and optimizing knowledge transfer to enhance watermark behaviors. Experimental results demonstrate that our UAE watermarking not only outperforms SOTA methods in unremovability but also avoids evasion exploition. This dual effectiveness underscores its potential as a comprehensive solution to protect deep learning models from a spectrum of complex threats. 
 
 Appendix:  


Decision: In this paper, the authors introduce a novel model watermarking technique to protect deep learning models from theft without compromising their ability to evade adversarial attacks. It leverages knowledge injection during training to maintain watermark properties without degrading model performance. Evaluations against several stealing attacks demonstrate the effectiveness of the method. Reviewers generally consider the method novel and effective, and the paper is well written. Although some issues were raised, they were well addressed during rebuttal. All reviewers support acceptance.

Reviews: review: paper_summary: paper_summary: This paper proposes to generate Unrestricted Adversarial Examples (UAEs) for watermark embedding via diffusion models, enhancing robustness against removal attacks. The proposed method leverages knowledge injection during training to maintain watermark properties without degrading model performance. The experimental results on CIFAR-10 and Imagenette datasets demonstrate that this method significantly improves watermark resilience and model performance in adversarial settings.
strength_weakness: strength_weakness: 1.	The research topic of defending against model stealing is interesting and very important. This paper proposes a novel scheme by utilizing diffusion models to synthesize UAEs as the trigger set.
2.	The experiments are also comprehensive to some extent. The paper includes detailed ablation studies to validate the effectiveness of the proposed method.
limitations: limitations: 1.	There are some harmless watermark methods (e.g., [1-3]) and model fingerprints (e.g., [4-5]) that should be used as baselines for comparison in the paper.
2.	More detailed information about the diffusion model (DM) is needed. This method requires an external diffusion model (DM), but the experimental setup in the main text does not seem to describe this DM in detail (e.g., structure, training dataset). I am particularly curious if the training dataset for this DM needs to be similar to the training dataset of the protected model. If their training datasets differ significantly in distribution, is the proposed method still effective?
3.	Increase the font size of the title in Figure 1. Ensure consistency in the use of uppercase and lowercase letters in the figures, such as "evasion-adversary" being lowercase while other parts are uppercase.
4.	All tables should highlight the best-performing data in bold.
References:
[1] Defending against model stealing via verifying embedded external features. AAAI 2022.
[2] Move: Effective and harmless ownership verification via embedded external features. 2022.
[3] Free fine-tuning: A plug-and-play watermarking scheme for deep neural networks. ACM MM 2023.
[4] Fingerprinting deep neural networks globally via universal adversarial perturbations. CVPR 2022.
[5] Metafinger: Fingerprinting the deep neural networks with metatraining. IJCAI 2023.
paper_summary: paper_summary: The paper introduces a model watermarking technique to protect deep learning models from theft without compromising their ability to evade adversarial attacks. It tries to address the shortcomings in current trigger-set watermarking methods that make models vulnerable to evasion by exploiting shortcuts created during the watermark embedding process. Their proposed solution uses diffusion models to generate unrestricted adversarial examples as trigger sets and optimizes knowledge transfer to teach models to identify these examples accurately, thus enhancing resistance to both evasion and removal attacks. From the experimental results on datasets like CIFAR-10/100 and ImageNet, the model's robustness and effectiveness are improved against state-of-the-art solutions.
strength_weakness: strength_weakness: 1. The novel approach for a necessary research question.
The paper presents a novel approach to an important research question in the field of machine learning security, that is, how to protect intellectual property in deep learning models while maintaining their robustness against adversarial attacks. The necessity of this research question arises from the increasing adoption of Machine Learning as a Service (MLaaS) platforms while democratizing access to sophisticated models and exposing them to theft and unauthorized use.

2. Comprehensive experiment evaluation.
This paper thoroughly evaluates the proposed method against diverse evasion and removal attack scenarios based on multiple datasets, CIFAR-10/100 and ImageNet.
limitations: limitations: 1. Some sentences are unclear, and the writing needs improvement.
For instance, in the introduction, “we identify that all poisoning-style watermarks, even those crafted with random label noise trigger sets, embed shortcuts into the protected model” should be replaced with “we identify that all poisoning-style watermarks, even those crafted with random label noise trigger sets and embed shortcuts into the protected model”. Similarly, in this paper, many sentences are challenging to understand, which should be further polished.

2.Some details can be supplemented.
First, in the introduction, the current technology challenges need to be clarified directly, and this can illustrate the advancement of this paper more clearly.
Second, although this paper aims to make watermarks hard to remove by focusing on knowledge transfer, the adaptive attackers who can learn this transfer might discover ways to circumvent or remove the watermarks.
Third, in Section 5.2.2, the out-of-distribution (OOD) question is considered on CIFAR-10 and CIFAR-100 datasets, while similar data is not the best choice for researching this problem.
Fourth, the efficiency of the proposed method was not evaluated, and it is curious whether complex operations bring more computational overhead to the model.
These problems require clarification from the authors.

3. The code or its implementation can be further supplemented. In this way, researchers can reproduce the solution and understand its details better.
paper_summary: paper_summary: This paper identifies that traditional poisoning-style watermarking introduces exploitable shortcuts, making models more susceptible to evasion attacks. To mitigate this, the authors propose a novel watermarking method using diffusion models to generate Unrestricted Adversarial Examples (UAEs) as trigger sets. This approach focuses on knowledge injection rather than error memorization.
strength_weakness: strength_weakness: 1. Innovative Use of Diffusion Models
2. Comprehensive Robustness
3. Extensive Experimental Validation
limitations: limitations: 1. While the method shows promising results on the tested model (ResNet), its effectiveness on a wider range of model architectures and more complex datasets needs further validation.
2. It is unclear whether the robustness mainly stems from UAE, rather than from the proposed method itself.
3. In Table 1, why is UAE's SparseAuto (ASR) relative value negative (-11.16)? If I understand correctly, a reasonable value should be around 0.
4. I am curious about the false positive (FP) results. Would this method falsely detect other original models as watermarked? Is there any guarantee for FP, similar to the approach discussed in https://arxiv.org/abs/2305.03807?