# Neural network fragile watermarking with no model performance degradation

arXiv: https://arxiv.org/abs/2208.07585 · HTML: https://mlsanity.com/paper/2208.07585/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security.
- Builds on 9 of its 21 references that are in the map.
- First posted on arXiv 16 Aug 2022.

## Placed in

- LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/)

## Builds on (most cited first, 9 of 9)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale](https://mlsanity.com/paper/2010.11929/) (2020)
- [Progressive Growing of GANs for Improved Quality, Stability, and Variation](https://mlsanity.com/paper/1710.10196/) (2017)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain](https://mlsanity.com/paper/1708.06733/) (2017)
- [Effective Approaches to Attention-based Neural Machine Translation](https://mlsanity.com/paper/1508.04025/) (2015)
- [Towards Explainable Artificial Intelligence](https://mlsanity.com/paper/1909.12072/) (2019)
- [Reversible Watermarking in Deep Convolutional Neural Networks for Integrity Authentication](https://mlsanity.com/paper/2104.04268/) (2021)

## Built on by (most cited first, 8 of 8)

- [Watermarking Techniques for Large Language Models: A Survey](https://mlsanity.com/paper/2409.00089/) (2024)
- [Decision-based iterative fragile watermarking for model integrity verification](https://mlsanity.com/paper/2305.09684/) (2023)
- [Turn Passive to Active: A Survey on Active Intellectual Property Protection of Deep Learning Models](https://mlsanity.com/paper/2310.09822/) (2023)
- [Fingerprinting Deep Neural Networks for Ownership Protection: An Analytical Approach](https://mlsanity.com/paper/2603.21411/) (2026)
- [SSL-Auth: An Authentication Framework by Fragile Watermarking for Pre-trained Encoders in Self-supervised Learning](https://mlsanity.com/paper/2308.04673/) (2023)
- [A Survey of Fragile Model Watermarking](https://mlsanity.com/paper/2406.04809/) (2024)
- [Adaptive White-Box Watermarking with Self-Mutual Check Parameters in Deep Neural Networks](https://mlsanity.com/paper/2308.11235/) (2023)
- [Trigger-Based Fragile Model Watermarking for Image Transformation Networks](https://mlsanity.com/paper/2409.19442/) (2024)

## Abstract (arXiv)

Deep neural networks are vulnerable to malicious fine-tuning attacks such as data poisoning and backdoor attacks. Therefore, in recent research, it is proposed how to detect malicious fine-tuning of neural network models. However, it usually negatively affects the performance of the protected model. Thus, we propose a novel neural network fragile watermarking with no model performance degradation. In the process of watermarking, we train a generative model with the specific loss function and secret key to generate triggers that are sensitive to the fine-tuning of the target classifier. In the process of verifying, we adopt the watermarked classifier to get labels of each fragile trigger. Then, malicious fine-tuning can be detected by comparing secret keys and labels. Experiments on classic datasets and classifiers show that the proposed method can effectively detect model malicious fine-tuning with no model performance degradation.