# Spread-Transform Dither Modulation Watermarking of Deep Neural Network

arXiv: https://arxiv.org/abs/2012.14171 · HTML: https://mlsanity.com/paper/2012.14171/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Dec 2020.

## Built on by (most cited first, 26 of 26)

- [A Recipe for Watermarking Diffusion Models](https://mlsanity.com/paper/2303.10137/) (2023)
- [Watermarking Pre-trained Language Models with Backdooring](https://mlsanity.com/paper/2210.07543/) (2022)
- [Supervised GAN Watermarking for Intellectual Property Protection](https://mlsanity.com/paper/2209.03466/) (2022)
- [Safe-SD: Safe and Traceable Stable Diffusion with Text Prompt Trigger for Invisible Generative Watermarking](https://mlsanity.com/paper/2407.13188/) (2024)
- [Wide Flat Minimum Watermarking for Robust Ownership Verification of GANs](https://mlsanity.com/paper/2310.16919/) (2023)
- [RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable Guarantees](https://mlsanity.com/paper/2403.18774/) (2024)
- [When Federated Learning meets Watermarking: A Comprehensive Overview of Techniques for Intellectual Property Protection](https://mlsanity.com/paper/2308.03573/) (2023)
- [Verifying Integrity of Deep Ensemble Models by Lossless Black-box Watermarking with Sensitive Samples](https://mlsanity.com/paper/2205.04145/) (2022)
- [Box-Free Model Watermarks Are Prone to Black-Box Removal Attacks](https://mlsanity.com/paper/2405.09863/) (2024)
- [Robust and Large-Payload DNN Watermarking via Fixed, Distribution-Optimized, Weights](https://mlsanity.com/paper/2208.10973/) (2022)
- [TATTOOED: A Robust Deep Neural Network Watermarking Scheme based on Spread-Spectrum Channel Coding](https://mlsanity.com/paper/2202.06091/) (2022)
- [ROSE: A RObust and SEcure DNN Watermarking](https://mlsanity.com/paper/2206.11024/) (2022)
- [Generative Model Watermarking Based on Human Visual System](https://mlsanity.com/paper/2209.15268/) (2022)
- [Mixer: DNN Watermarking using Image Mixup](https://mlsanity.com/paper/2212.02814/) (2022)
- [Revisiting the Information Capacity of Neural Network Watermarks: Upper Bound Estimation and Beyond](https://mlsanity.com/paper/2402.12720/) (2024)
- [Robust and Lossless Fingerprinting of Deep Neural Networks via Pooled Membership Inference](https://mlsanity.com/paper/2209.04113/) (2022)
- [Generative Model Watermarking Suppressing High-Frequency Artifacts](https://mlsanity.com/paper/2305.12391/) (2023)
- [Hashed Watermark as a Filter: Defeating Forging and Overwriting Attacks in Weight-based Neural Network Watermarking](https://mlsanity.com/paper/2507.11137/) (2025)
- [On Function-Coupled Watermarks for Deep Neural Networks](https://mlsanity.com/paper/2302.10296/) (2023)
- [Reversible Quantization Index Modulation for Static Deep Neural Network Watermarking](https://mlsanity.com/paper/2305.17879/) (2023)
- [ChainMarks: Securing DNN Watermark with Cryptographic Chain](https://mlsanity.com/paper/2505.04977/) (2025)
- [Deep Learning model integrity checking mechanism using watermarking technique](https://mlsanity.com/paper/2301.12333/) (2023)
- [ClearMark: Intuitive and Robust Model Watermarking via Transposed Model Training](https://mlsanity.com/paper/2310.16453/) (2023)
- [WaterMAS: Sharpness-Aware Maximization for Neural Network Watermarking](https://mlsanity.com/paper/2409.03902/) (2024)
- [(A)iSpy: Parasitic Trojans for Machine Learning Infrastructure](https://mlsanity.com/paper/2607.17550/) (2026)
- [High-Capacity Robust Medical Image Exfiltration via Neural Network Weight Replacement](https://mlsanity.com/paper/2609.31726/) (2026)

## Abstract (arXiv)

DNN watermarking is receiving an increasing attention as a suitable mean to protect the Intellectual Property Rights associated to DNN models. Several methods proposed so far are inspired to the popular Spread Spectrum (SS) paradigm according to which the watermark bits are embedded into the projection of the weights of the DNN model onto a pseudorandom sequence. In this paper, we propose a new DNN watermarking algorithm that leverages on the watermarking with side information paradigm to decrease the obtrusiveness of the watermark and increase its payload. In particular, the new scheme exploits the main ideas of ST-DM (Spread Transform Dither Modulation) watermarking to improve the performance of a recently proposed algorithm based on conventional SS. The experiments we carried out by applying the proposed scheme to watermark different models, demonstrate its capability to provide a higher payload with a lower impact on network accuracy than a baseline method based on conventional SS, while retaining a satisfactory level of robustness.