# Structural Watermarking to Deep Neural Networks via Network Channel Pruning

arXiv: https://arxiv.org/abs/2107.08688 · HTML: https://mlsanity.com/paper/2107.08688/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 Jul 2021.

## Built on by (most cited first, 14 of 14)

- [Copyright Protection in Generative AI: A Technical Perspective](https://mlsanity.com/paper/2402.02333/) (2024)
- [Watermarking Techniques for Large Language Models: A Survey](https://mlsanity.com/paper/2409.00089/) (2024)
- [Wide Flat Minimum Watermarking for Robust Ownership Verification of GANs](https://mlsanity.com/paper/2310.16919/) (2023)
- [Neural Lineage](https://mlsanity.com/paper/2406.11129/) (2024)
- [Verifying Integrity of Deep Ensemble Models by Lossless Black-box Watermarking with Sensitive Samples](https://mlsanity.com/paper/2205.04145/) (2022)
- [DeepEclipse: How to Break White-Box DNN-Watermarking Schemes](https://mlsanity.com/paper/2403.03590/) (2024)
- [AWEncoder: Adversarial Watermarking Pre-trained Encoders in Contrastive Learning](https://mlsanity.com/paper/2208.03948/) (2022)
- [Generative Model Watermarking Based on Human Visual System](https://mlsanity.com/paper/2209.15268/) (2022)
- [Robust and Lossless Fingerprinting of Deep Neural Networks via Pooled Membership Inference](https://mlsanity.com/paper/2209.04113/) (2022)
- [Generative Model Watermarking Suppressing High-Frequency Artifacts](https://mlsanity.com/paper/2305.12391/) (2023)
- [Non-transferable Pruning](https://mlsanity.com/paper/2410.08015/) (2024)
- [A Game Between the Defender and the Attacker for Trigger-based Black-box Model Watermarking](https://mlsanity.com/paper/2501.01194/) (2025)
- [Rotation, Scale, and Translation Resilient Black-box Fingerprinting for Intellectual Property Protection of EaaS Models](https://mlsanity.com/paper/2510.16706/) (2025)
- [Understanding Security and Privacy Perceptions of Content Creators Regarding AI Labels of AI-Generated Content](https://mlsanity.com/paper/2608.08129/) (2026)

## Abstract (arXiv)

In order to protect the intellectual property (IP) of deep neural networks (DNNs), many existing DNN watermarking techniques either embed watermarks directly into the DNN parameters or insert backdoor watermarks by fine-tuning the DNN parameters, which, however, cannot resist against various attack methods that remove watermarks by altering DNN parameters. In this paper, we bypass such attacks by introducing a structural watermarking scheme that utilizes channel pruning to embed the watermark into the host DNN architecture instead of crafting the DNN parameters. To be specific, during watermark embedding, we prune the internal channels of the host DNN with the channel pruning rates controlled by the watermark. During watermark extraction, the watermark is retrieved by identifying the channel pruning rates from the architecture of the target DNN model. Due to the superiority of pruning mechanism, the performance of the DNN model on its original task is reserved during watermark embedding. Experimental results have shown that, the proposed work enables the embedded watermark to be reliably recovered and provides a sufficient payload, without sacrificing the usability of the DNN model. It is also demonstrated that the proposed work is robust against common transforms and attacks designed for conventional watermarking approaches.