# Verifying Integrity of Deep Ensemble Models by Lossless Black-box Watermarking with Sensitive Samples

arXiv: https://arxiv.org/abs/2205.04145 · HTML: https://mlsanity.com/paper/2205.04145/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security.
- Builds on 11 of its 22 references that are in the map.
- First posted on arXiv 9 May 2022.

## Placed in

- LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/)

## Builds on (most cited first, 11 of 11)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring](https://mlsanity.com/paper/1802.04633/) (2018)
- [Embedding Watermarks into Deep Neural Networks](https://mlsanity.com/paper/1701.04082/) (2017)
- [[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks](https://mlsanity.com/paper/1909.07830/) (2019)
- [Universal Adversarial Perturbations: A Survey](https://mlsanity.com/paper/2005.08087/) (2020)
- [Spread-Transform Dither Modulation Watermarking of Deep Neural Network](https://mlsanity.com/paper/2012.14171/) (2020)
- [Watermarking Graph Neural Networks by Random Graphs](https://mlsanity.com/paper/2011.00512/) (2020)
- [Structural Watermarking to Deep Neural Networks via Network Channel Pruning](https://mlsanity.com/paper/2107.08688/) (2021)
- [Minimizing Embedding Distortion with Weighted Bigraph Matching in Reversible Data Hiding](https://mlsanity.com/paper/1712.06240/) (2017)

## Built on by (most cited first, 6 of 6)

- [Generative Model Watermarking Based on Human Visual System](https://mlsanity.com/paper/2209.15268/) (2022)
- [Robust and Lossless Fingerprinting of Deep Neural Networks via Pooled Membership Inference](https://mlsanity.com/paper/2209.04113/) (2022)
- [Generative Model Watermarking Suppressing High-Frequency Artifacts](https://mlsanity.com/paper/2305.12391/) (2023)
- [Turn Passive to Active: A Survey on Active Intellectual Property Protection of Deep Learning Models](https://mlsanity.com/paper/2310.09822/) (2023)
- [A Game Between the Defender and the Attacker for Trigger-based Black-box Model Watermarking](https://mlsanity.com/paper/2501.01194/) (2025)
- [An Information Asymmetry Game for Trigger-based DNN Model Watermarking](https://mlsanity.com/paper/2510.14218/) (2025)

## Abstract (arXiv)

With the widespread use of deep neural networks (DNNs) in many areas, more and more studies focus on protecting DNN models from intellectual property (IP) infringement. Many existing methods apply digital watermarking to protect the DNN models. The majority of them either embed a watermark directly into the internal network structure/parameters or insert a zero-bit watermark by fine-tuning a model to be protected with a set of so-called trigger samples. Though these methods work very well, they were designed for individual DNN models, which cannot be directly applied to deep ensemble models (DEMs) that combine multiple DNN models to make the final decision. It motivates us to propose a novel black-box watermarking method in this paper for DEMs, which can be used for verifying the integrity of DEMs. In the proposed method, a certain number of sensitive samples are carefully selected through mimicking real-world DEM attacks and analyzing the prediction results of the sub-models of the non-attacked DEM and the attacked DEM on the carefully crafted dataset. By analyzing the prediction results of the target DEM on these carefully crafted sensitive samples, we are able to verify the integrity of the target DEM. Different from many previous methods, the proposed method does not modify the original DEM to be protected, which indicates that the proposed method is lossless. Experimental results have shown that the DEM integrity can be reliably verified even if only one sub-model was attacked, which has good potential in practice.