# Neural Network Laundering: Removing Black-Box Backdoor Watermarks from Deep Neural Networks

arXiv: https://arxiv.org/abs/2004.11368 · HTML: https://mlsanity.com/paper/2004.11368/

## Key facts

- Cited by 24 papers in the map (data through 7 Oct 2026).
- First posted on arXiv 22 Apr 2020.

## Built on by (most cited first, 24 of 24)

- [SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)](https://mlsanity.com/paper/2108.04974/) (2021)
- [Certified Neural Network Watermarks with Randomized Smoothing](https://mlsanity.com/paper/2207.07972/) (2022)
- [ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detection](https://mlsanity.com/paper/2106.08890/) (2021)
- [Rethinking White-Box Watermarks on Deep Learning Models under Neural Structural Obfuscation](https://mlsanity.com/paper/2303.09732/) (2023)
- [Defenses in Adversarial Machine Learning: A Survey](https://mlsanity.com/paper/2312.08890/) (2023)
- [On the Effectiveness of Dataset Watermarking in Adversarial Settings](https://mlsanity.com/paper/2202.12506/) (2022)
- [Selective Amnesia: On Efficient, High-Fidelity and Blind Suppression of Backdoor Effects in Trojaned Machine Learning Models](https://mlsanity.com/paper/2212.04687/) (2022)
- [Identifying Appropriate Intellectual Property Protection Mechanisms for Machine Learning Models: A Systematization of Watermarking, Fingerprinting, Model Access, and Attacks](https://mlsanity.com/paper/2304.11285/) (2023)
- [Towards Robust Model Watermark via Reducing Parametric Vulnerability](https://mlsanity.com/paper/2309.04777/) (2023)
- [Detect and remove watermark in deep neural networks via generative adversarial networks](https://mlsanity.com/paper/2106.08104/) (2021)
- [Cracking White-box DNN Watermarks via Invariant Neuron Transforms](https://mlsanity.com/paper/2205.00199/) (2022)
- [MISA: Online Defense of Trojaned Models using Misattributions](https://mlsanity.com/paper/2103.15918/) (2021)
- [DeepEclipse: How to Break White-Box DNN-Watermarking Schemes](https://mlsanity.com/paper/2403.03590/) (2024)
- [Attention Distraction: Watermark Removal Through Continual Learning with Selective Forgetting](https://mlsanity.com/paper/2204.01934/) (2022)
- [InFIP: An Explainable DNN Intellectual Property Protection Method based on Intrinsic Features](https://mlsanity.com/paper/2210.07481/) (2022)
- [Neural Dehydration: Effective Erasure of Black-box Watermarks from DNNs with Limited Data](https://mlsanity.com/paper/2309.03466/) (2023)
- [Revisiting Training-Inference Trigger Intensity in Backdoor Attacks](https://mlsanity.com/paper/2503.12058/) (2025)
- [Towards the Resistance of Neural Network Watermarking to Fine-tuning](https://mlsanity.com/paper/2505.01007/) (2025)
- [MDTD: A Multi Domain Trojan Detector for Deep Neural Networks](https://mlsanity.com/paper/2308.15673/) (2023)
- [Protecting Deep Learning Model Copyrights with Adversarial Example-Free Reuse Detection](https://mlsanity.com/paper/2407.03883/) (2024)
- [ChainMarks: Securing DNN Watermark with Cryptographic Chain](https://mlsanity.com/paper/2505.04977/) (2025)
- [Dormant Neural Trojans](https://mlsanity.com/paper/2211.01808/) (2022)
- [Embedding Watermarks in Diffusion Process for Model Intellectual Property Protection](https://mlsanity.com/paper/2410.22445/) (2024)
- [Robust GNN Watermarking via Implicit Perception of Topological Invariants](https://mlsanity.com/paper/2510.25934/) (2025)

## Abstract (arXiv)

Creating a state-of-the-art deep-learning system requires vast amounts of data, expertise, and hardware, yet research into embedding copyright protection for neural networks has been limited. One of the main methods for achieving such protection involves relying on the susceptibility of neural networks to backdoor attacks, but the robustness of these tactics has been primarily evaluated against pruning, fine-tuning, and model inversion attacks. In this work, we propose a neural network "laundering" algorithm to remove black-box backdoor watermarks from neural networks even when the adversary has no prior knowledge of the structure of the watermark. We are able to effectively remove watermarks used for recent defense or copyright protection mechanisms while achieving test accuracies above 97% and 80% for both MNIST and CIFAR-10, respectively. For all backdoor watermarking methods addressed in this paper, we find that the robustness of the watermark is significantly weaker than the original claims. We also demonstrate the feasibility of our algorithm in more complex tasks as well as in more realistic scenarios where the adversary is able to carry out efficient laundering attacks using less than 1% of the original training set size, demonstrating that existing backdoor watermarks are not sufficient to reach their claims.