mlsanityData to 7 Oct 2026

A Systematic Review on Model Watermarking for Neural Networks

arXiv 2009.12153 ↗First posted 25 Sep 2020cs.CR cs.LG cs.MMcited by 49

Not on the map. Why?

Abstract (arXiv)

Machine learning (ML) models are applied in an increasing variety of domains. The availability of large amounts of data and computational resources encourages the development of ever more complex and valuable models. These models are considered intellectual property of the legitimate parties who have trained them, which makes their protection against stealing, illegitimate redistribution, and unauthorized application an urgent need. Digital watermarking presents a strong mechanism for marking model ownership and, thereby, offers protection against those threats. This work presents a taxonomy identifying and analyzing different classes of watermarking schemes for ML models. It introduces a unified threat model to allow structured reasoning on and comparison of the effectiveness of watermarking methods in different scenarios. Furthermore, it systematizes desired security requirements and attacks against ML model watermarking. Based on that framework, representative literature from the field is surveyed to illustrate the taxonomy. Finally, shortcomings and general limitations of existing approaches are discussed, and an outlook on future research directions is given.

Key facts. Cited by 49 papers in the map (data through 7 Oct 2026). First posted on arXiv 25 Sep 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 1; 2023: 15; 2024: 11; 2025: 16; 2026: 5.

49 papers.

Sort:

By area:

  1. 2023A Watermark for Large Language Modelscited by 667
  2. 2023Explainable Artificial Intelligence (XAI) 2.0: A Manifesto of Open Challenges and Interdisciplinary Research Directionscited by 123
  3. 2023The Gradient of Generative AI Release: Methods and Considerationscited by 63
  4. 2023Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermarkcited by 61
  5. 2024SoK: Watermarking for AI-Generated Contentcited by 43
  6. 2022Dataset Inference for Self-Supervised Modelscited by 36
  7. 2023HuRef: HUman-REadable Fingerprint for Large Language Modelscited by 32
  8. 2021Watermarking Graph Neural Networks based on Backdoor Attackscited by 25
  9. 2024Watermarking Techniques for Large Language Models: A Surveycited by 20
  10. 2024Double-I Watermark: Protecting Model Copyright for LLM Fine-tuningcited by 18
  11. 2023False Claims against Model Ownership Resolutioncited by 17
  12. 2023TSGM: A Flexible Framework for Generative Modeling of Synthetic Time Seriescited by 16
37 more
  1. 2023Identifying Appropriate Intellectual Property Protection Mechanisms for Machine Learning Models: A Systematization of Watermarking, Fingerprinting, Model Access, and Attackscited by 11
  2. 2023ORL-AUDITOR: Dataset Auditing in Offline Deep Reinforcement Learningcited by 11
  3. 2023FedRight: An Effective Model Copyright Protection for Federated Learningcited by 8
  4. 2025Atlas: A Framework for ML Lifecycle Provenance & Transparencycited by 8
  5. 2024TrajDeleter: Enabling Trajectory Forgetting in Offline Reinforcement Learning Agentscited by 7
  6. 2023When Federated Learning meets Watermarking: A Comprehensive Overview of Techniques for Intellectual Property Protectioncited by 6
  7. 2025BitMark: Watermarking Bitwise Autoregressive Image Generative Modelscited by 5
  8. 2025Confidential LLM Inference: Performance and Cost Across CPU and GPU TEEscited by 5
  9. 2024Fortify Your Foundations: Practical Privacy and Security for Foundation Model Deployments In The Cloudcited by 4
  10. 2025A Crack in the Bark: Leveraging Public Knowledge to Remove Tree-Ring Watermarkscited by 4
  11. 2025SPRINT: Robust Model Attribution of Generated Images via Secret Pixel Reconstructioncited by 4
  12. 2025Every Step Counts: Decoding Trajectories as Authorship Fingerprints of dLLMscited by 4
  13. 2026CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attackscited by 4
  14. 2023Train 'n Trade: Foundations of Parameter Marketscited by 3
  15. 2024GENIE: Watermarking Graph Neural Networks for Link Predictioncited by 3
  16. 2024A Survey on Privacy Attacks Against Digital Twin Systems in AI-Roboticscited by 3
  17. 2024Towards Data Governance of Frontier AI Modelscited by 3
  18. 2025Towards Secure MLOps: Surveying Attacks, Mitigation Strategies, and Research Challengescited by 3
  19. 2026CITED: A Decision Boundary-Aware Signature for GNNs Towards Model Extraction Defensecited by 3
  20. 2024Watermarking Large Language Models and the Generated Content: Opportunities and Challengescited by 2
  21. 2025A Statistical Hypothesis Testing Framework for Data Misappropriation Detection in Large Language Modelscited by 2
  22. 2025Provable Watermarking for Data Poisoning Attackscited by 2
  23. 2025Smudged Fingerprints: A Systematic Evaluation of the Robustness of AI Image Fingerprintscited by 2
  24. 2025Staining and locking computer vision models without retrainingcited by 1
  25. 2025Attacks and Defenses Against LLM Fingerprintingcited by 1
  26. 2023Threats, Vulnerabilities, and Controls of Machine Learning Based Systems: A Survey and Taxonomycited by 0
  27. 2023From Zero to Hero: Detecting Leaked Data through Synthetic Data Injection and Model Queryingcited by 0
  28. 2023ClearMark: Intuitive and Robust Model Watermarking via Transposed Model Trainingcited by 0
  29. 2024Agentic Copyright Watermarking against Adversarial Evidence Forgery with Purification-Agnostic Curriculum Proxy Learningcited by 0
  30. 2024Watermarking Decision Tree Ensemblescited by 0
  31. 2025On-Device Watermarking: A Socio-Technical Imperative For Authenticity In The Age of Generative AIcited by 0
  32. 2025PPFL-RDSN: Privacy-Preserving Federated Learning-based Residual Dense Spatial Networks for Encrypted Lossy Image Reconstructioncited by 0
  33. 2025A Multi-Level Strategy for Deepfake Content Moderation under EU Regulationcited by 0
  34. 2025Watermarking Large Language Models in Europe: Interpreting the AI Act in Light of Technologycited by 0
  35. 2026Position: 3D Gaussian Splatting Watermarking Should Be Scenario-Driven and Threat-Model Explicitcited by 0
  36. 2026Collaborative Threshold Watermarkingcited by 0
  37. 2026Authorize-on-Demand: Dynamic Authorization with Legality-Aware Intellectual Property Protection for VLMscited by 0