mlsanityData to 7 Oct 2026

Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring

arXiv 1802.04633 ↗First posted 13 Feb 2018cs.LGcited by 334

Not on the map. Why?

Cited by 91 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep Neural Networks have recently gained lots of success after enabling several breakthroughs in notoriously challenging problems. Training these networks is computationally expensive and requires vast amounts of training data. Selling such pre-trained models can, therefore, be a lucrative business model. Unfortunately, once the models are sold they can be easily copied and redistributed. To avoid this, a tracking mechanism to identify models as the intellectual property of a particular vendor is necessary. In this work, we present an approach for watermarking Deep Neural Networks in a black-box way. Our scheme works for general classification tasks and can easily be combined with current learning algorithms. We show experimentally that such a watermark has no noticeable impact on the primary task that the model is designed for and evaluate the robustness of our proposal against a multitude of practical attacks. Moreover, we provide a theoretical analysis, relating our approach to previous work on backdooring.

Key facts. Cited by 334 papers in the map (data through 7 Oct 2026). First posted on arXiv 13 Feb 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 50; 2022: 65; 2023: 67; 2024: 60; 2025: 51; 2026: 41.

334 papers.

Sort:

By area:

  1. 2023A Watermark for Large Language Modelscited by 667
  2. 2023A Recipe for Watermarking Diffusion Modelscited by 136
  3. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 115
  4. 2023Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoningcited by 91
  5. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 85
  6. 2021Proof-of-Learning: Definitions and Practicecited by 81
  7. 2023Protecting Language Generation Models via Invisible Watermarkingcited by 81
  8. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  9. 2021Protecting Intellectual Property of Language Generation APIs with Lexical Watermarkcited by 78
  10. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 67
  11. 2022Membership Inference Attacks Against Text-to-image Generation Modelscited by 66
  12. 2023Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermarkcited by 61
38 more
  1. 2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 58
  2. 2022Planting Undetectable Backdoors in Machine Learning Modelscited by 55
  3. 2023WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Modelscited by 51
  4. 2021Non-Transferable Learning: A New Approach for Model Ownership Verification and Applicability Authorizationcited by 50
  5. 2023Leveraging Optimization for Adaptive Attacks on Image Watermarkscited by 50
  6. 2021Deep Model Intellectual Property Protection via Deep Watermarkingcited by 47
  7. 2021Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attackcited by 45
  8. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
  9. 2022Watermarking Pre-trained Language Models with Backdooringcited by 44
  10. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 43
  11. 2023Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Modelscited by 42
  12. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
  13. 2022Certified Neural Network Watermarks with Randomized Smoothingcited by 39
  14. 2022Supervised GAN Watermarking for Intellectual Property Protectioncited by 39
  15. 2023Did You Train on My Dataset? Towards Public Dataset Protection with Clean-Label Backdoor Watermarkingcited by 37
  16. 2021Inspect, Understand, Overcome: A Survey of Practical Methods for AI Safetycited by 35
  17. 2024Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attributioncited by 35
  18. 2023PTW: Pivotal Tuning Watermarking for Pre-Trained Image Generatorscited by 34
  19. 2023Watermarking Diffusion Modelcited by 34
  20. 2023A Survey on ChatGPT: AI-Generated Contents, Challenges, and Solutionscited by 34
  21. 2024REEF: Representation Encoding Fingerprints for Large Language Modelscited by 34
  22. 2021ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detectioncited by 33
  23. 2021FedIPR: Ownership Verification for Federated Deep Neural Network Modelscited by 33
  24. 2023Don't trust your eyes: on the (un)reliability of feature visualizationscited by 32
  25. 2023HuRef: HUman-REadable Fingerprint for Large Language Modelscited by 32
  26. 2022Can't Steal? Cont-Steal! Contrastive Stealing Attacks Against Image Encoderscited by 30
  27. 2022An Overview of Compressible and Learnable Image Transformation with Secret Key and Its Applicationscited by 29
  28. 2022Distillation-Resistant Watermarking for Model Protection in NLPcited by 29
  29. 2023CodeMark: Imperceptible Watermarking for Code Datasets against Neural Code Completion Modelscited by 28
  30. 2022Auditing Membership Leakages of Multi-Exit Networkscited by 26
  31. 2025SynthID-Image: Image watermarking at internet scalecited by 26
  32. 2021Quantization Backdoors to Deep Learning Commercial Frameworkscited by 25
  33. 2021Watermarking Graph Neural Networks based on Backdoor Attackscited by 25
  34. 2022FedTracker: Furnishing Ownership Verification and Traceability for Federated Learning Modelcited by 25
  35. 2021Excess Capacity and Backdoor Poisoningcited by 24
  36. 2024Deconstructing The Ethics of Large Language Models from Long-standing Issues to New-emerging Dilemmas: A Surveycited by 23
  37. 2023WatME: Towards Lossless Watermarking Through Lexical Redundancycited by 22
  38. 2022StolenEncoder: Stealing Pre-trained Encoders in Self-supervised Learningcited by 21

50 most cited of 334 All 334 (JSON)