mlsanityData to 7 Oct 2026

Deep Model Intellectual Property Protection via Deep Watermarking

arXiv 2103.04980 ↗First posted 8 Mar 2021cs.CV cs.CRcited by 47

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

Despite the tremendous success, deep neural networks are exposed to serious IP infringement risks. Given a target deep model, if the attacker knows its full information, it can be easily stolen by fine-tuning. Even if only its output is accessible, a surrogate model can be trained through student-teacher learning by generating many input-output training pairs. Therefore, deep model IP protection is important and necessary. However, it is still seriously under-researched. In this work, we propose a new model watermarking framework for protecting deep networks trained for low-level computer vision or image processing tasks. Specifically, a special task-agnostic barrier is added after the target model, which embeds a unified and invisible watermark into its outputs. When the attacker trains one surrogate model by using the input-output pairs of the barrier target model, the hidden watermark will be learned and extracted afterwards. To enable watermarks from binary bits to high-resolution images, a deep invisible watermarking mechanism is designed. By jointly training the target model and watermark embedding, the extra barrier can even be absorbed into the target model. Through extensive experiments, we demonstrate the robustness of the proposed framework, which can resist attacks with different network structures and objective functions.

Key facts. Cited by 47 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 34 of its 69 references that are in the map. First posted on arXiv 8 Mar 2021.

Builds on

34 of 69 references.

References · 34

  1. 2017Attention Is All You Needcited by 59,932
  2. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  3. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  4. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  5. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  6. 2016Image-to-Image Translation with Conditional Adversarial Networkscited by 4,510
  7. 2016Perceptual Losses for Real-Time Style Transfer and Super-Resolutioncited by 2,678
  8. 2019Semantic Image Synthesis with Spatially-Adaptive Normalizationcited by 1,295
  9. 2017High-Resolution Image Synthesis and Semantic Manipulation with Conditional GANscited by 1,176
  10. 2017StarGAN: Unified Generative Adversarial Networks for Multi-Domain Image-to-Image Translationcited by 1,036
  11. 2017ChestX-ray8: Hospital-scale Chest X-ray Database and Benchmarks on Weakly-Supervised Classification and Localization of Common Thorax Diseasescited by 969
  12. 2019CNN-generated images are surprisingly easy to spot... for nowcited by 842
22 more
  1. 2013Speech Recognition with Deep Recurrent Neural Networkscited by 666
  2. 2013Do Deep Nets Really Need to be Deep?cited by 466
  3. 2018HiDDeN: Hiding Data With Deep Networkscited by 384
  4. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  5. 2017DualGAN: Unsupervised Dual Learning for Image-to-Image Translationcited by 310
  6. 2017Learning to Discover Cross-Domain Relations with Generative Adversarial Networkscited by 278
  7. 2019StegaStamp: Invisible Hyperlinks in Physical Photographscited by 256
  8. 2018Density-aware Single Image De-raining using a Multi-stream Dense Networkcited by 248
  9. 2017Embedding Watermarks into Deep Neural Networkscited by 227
  10. 2018Recurrent Squeeze-and-Excitation Context Aggregation Net for Single Image Derainingcited by 205
  11. 2017DSLR-Quality Photos on Mobile Devices with Deep Convolutional Networkscited by 156
  12. 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 110
  13. 2017Coherent Online Video Style Transfercited by 96
  14. 2017StyleBank: An Explicit Representation for Neural Image Style Transfercited by 89
  15. 2018Gated Context Aggregation Network for Image Dehazing and Derainingcited by 89
  16. 2019[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attackscited by 82
  17. 2017A Generic Deep Architecture for Single Image Reflection Removal and Image Smoothingcited by 60
  18. 2020Model Watermarking for Image Processing Networkscited by 49
  19. 2020Passport-aware Normalization for Deep Model Protectioncited by 42
  20. 2018Digital Watermarking for Deep Neural Networkscited by 37
  21. 2019BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networkscited by 25
  22. 2017Towards End-to-End Speech Recognition with Deep Convolutional Neural Networkscited by 24

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 4; 2022: 3; 2023: 6; 2024: 12; 2025: 10; 2026: 12.

47 papers.

Sort:

By area:

  1. 2023REMARK-LLM: A Robust and Efficient Watermarking Framework for Generative Large Language Modelscited by 64
  2. 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 57
  3. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  4. 2021FedIPR: Ownership Verification for Federated Deep Neural Network Modelscited by 33
  5. 2024GS-Hider: Hiding Messages into 3D Gaussian Splattingcited by 26
  6. 2024Watermarking Techniques for Large Language Models: A Surveycited by 20
  7. 2024GROOT: Generating Robust Watermark for Diffusion-Model-Based Audio Synthesiscited by 17
  8. 2023What can Discriminator do? Towards Box-free Ownership Verification of Generative Adversarial Networkcited by 10
  9. 2023Wide Flat Minimum Watermarking for Robust Ownership Verification of GANscited by 10
  10. 2025The NeRF Signature: Codebook-Aided Watermarking for Neural Radiance Fieldscited by 10
  11. 2025Mask Image Watermarkingcited by 9
  12. 2025FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprintcited by 8
35 more
  1. 2025Jailbreaking the Non-Transferable Barrier via Test-Time Data Disguisingcited by 8
  2. 2024Box-Free Model Watermarks Are Prone to Black-Box Removal Attackscited by 6
  3. 2025Decoder Gradient Shield: Provable and High-Fidelity Prevention of Gradient-Based Box-Free Watermark Removalcited by 5
  4. 2021Fostering the Robustness of White-Box Deep Neural Network Watermarks by Neuron Alignmentcited by 4
  5. 2025Robustness Assessment and Enhancement of Text Watermarking for Google's SynthIDcited by 4
  6. 2025StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Modelscited by 4
  7. 2023Low-frequency Image Deep Steganography: Manipulate the Frequency Distribution to Hide Secrets with Tenacious Robustnesscited by 3
  8. 2023FedSOV: Federated Model Secure Ownership Verification with Unforgeable Signaturecited by 3
  9. 2024Investigating Deep Watermark Security: An Adversarial Transferability Perspectivecited by 3
  10. 2024RobWE: Robust Watermark Embedding for Personalized Federated Learning Model Ownership Protectioncited by 3
  11. 2024Protect-Your-IP: Scalable Source-Tracing and Attribution against Personalized Generationcited by 3
  12. 2024A Survey on Privacy Attacks Against Digital Twin Systems in AI-Roboticscited by 3
  13. 2022PCPT and ACPT: Copyright Protection and Traceability Scheme for DNN Modelscited by 2
  14. 2024Revisiting the Information Capacity of Neural Network Watermarks: Upper Bound Estimation and Beyondcited by 2
  15. 2024Hide and Seek: How Does Watermarking Impact Face Recognition?cited by 2
  16. 2024Proactive Schemes: A Survey of Adversarial Attacks for Social Goodcited by 2
  17. 2025Hashed Watermark as a Filter: Defeating Forging and Overwriting Attacks in Weight-based Neural Network Watermarkingcited by 2
  18. 2021Exploring Structure Consistency for Deep Model Watermarkingcited by 1
  19. 2022Knowledge-Free Black-Box Watermark and Ownership Proof for Image Classification Neural Networkscited by 1
  20. 2024An Efficient Watermarking Method for Latent Diffusion Models via Low-Rank Adaptation and Dynamic Loss Weightingcited by 1
  21. 2026Attesting Model Lineage by Consisted Knowledge Evolution with Fine-Tuning Trajectorycited by 1
  22. 2026Decoder Gradient Shields: A Family of Provable and High-Fidelity Methods Against Gradient-Based Box-Free Watermark Removalcited by 1
  23. 2026Unifying Watermarking via Dimension-Aware Mappingcited by 1
  24. 2026PrivEraserVerify: Efficient, Private, and Verifiable Federated Unlearningcited by 1
  25. 2023From Zero to Hero: Detecting Leaked Data through Synthetic Data Injection and Model Queryingcited by 0
  26. 2025NWaaS: A Non-Intrusive and Privacy-Preserving Watermarking-as-a-Service System with Adaptive Resource Schedulingcited by 0
  27. 2025MolMark: Safeguarding Molecular Structures through Learnable Atom-Level Watermarkingcited by 0
  28. 2026Privacy-Preserving Model Transcription with Differentially Private Synthetic Distillationcited by 0
  29. 2026Q-Tag: Watermarking Quantum Circuit Generative Modelscited by 0
  30. 2026Authorize-on-Demand: Dynamic Authorization with Legality-Aware Intellectual Property Protection for VLMscited by 0
  31. 2026AMIF: Authorizable Medical Image Fusion Model with Built-in Authenticationcited by 0
  32. 2026Efficient, Robust, and Anti-Collusion Fingerprinting of Image Diffusion Modelscited by 0
  33. 2026DNA: Dual-stage Native Attribution for Generated Image Source Tracingcited by 0
  34. 2026Correlation-Aware and Gaussianity-Preserving Robust Latent Angular Watermarking for Diffusion Modelscited by 0
  35. 2026Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecyclecited by 0