mlsanityData to 7 Oct 2026

DynaMarks: Defending Against Deep Learning Model Extraction Using Dynamic Watermarking

arXiv 2207.13321 ↗First posted 27 Jul 2022cs.CR cs.CV cs.LGcited by 4

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

The functionality of a deep learning (DL) model can be stolen via model extraction where an attacker obtains a surrogate model by utilizing the responses from a prediction API of the original model. In this work, we propose a novel watermarking technique called DynaMarks to protect the intellectual property (IP) of DL models against such model extraction attacks in a black-box setting. Unlike existing approaches, DynaMarks does not alter the training process of the original model but rather embeds watermark into a surrogate model by dynamically changing the output responses from the original model prediction API based on certain secret parameters at inference runtime. The experimental outcomes on Fashion MNIST, CIFAR-10, and ImageNet datasets demonstrate the efficacy of DynaMarks scheme to watermark surrogate models while preserving the accuracies of the original models deployed in edge devices. In addition, we also perform experiments to evaluate the robustness of DynaMarks against various watermark removal strategies, thus allowing a DL model owner to reliably prove model ownership.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 20 of its 27 references that are in the map. First posted on arXiv 27 Jul 2022.

Builds on

20 of 27 references.

References · 20

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  4. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  5. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  6. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  7. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  8. 2017Embedding Watermarks into Deep Neural Networkscited by 227
  9. 2020fastai: A Layered API for Deep Learningcited by 183
  10. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
  11. 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 110
  12. 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 94
8 more
  1. 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 90
  2. 2019Defending Against Model Stealing Attacks with Adaptive Misinformationcited by 55
  3. 2018Edge Intelligence: On-Demand Deep Learning Model Co-Inference with Device-Edge Synergycited by 50
  4. 2018Digital Watermarking for Deep Neural Networkscited by 37
  5. 2019A framework for the extraction of Deep Neural Networks by leveraging public datacited by 22
  6. 2019Extraction of Complex DNN Models: Real Threat or Boogeyman?cited by 19
  7. 2018Defending Against Machine Learning Model Stealing Attacks Using Deceptive Perturbationscited by 11
  8. 2019RIGA: Covert and Robust White-Box Watermarking of Deep Neural Networkscited by 9

Built on by

Cited by year

Citing papers per year: 2023: 1; 2024: 1; 2025: 2.

4 papers.

  1. 2024Watermarking Techniques for Large Language Models: A Surveycited by 20
  2. 2023Wide Flat Minimum Watermarking for Robust Ownership Verification of GANscited by 10
  3. 2025ATOM: A Framework of Detecting Query-Based Model Extraction Attacks for Graph Neural Networkscited by 8
  4. 2025ChainMarks: Securing DNN Watermark with Cryptographic Chaincited by 1