mlsanityData to 7 Oct 2026

Rethinking White-Box Watermarks on Deep Learning Models under Neural Structural Obfuscation

arXiv 2303.09732 ↗First posted 17 Mar 2023cs.CR cs.LGcited by 20

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

Copyright protection for deep neural networks (DNNs) is an urgent need for AI corporations. To trace illegally distributed model copies, DNN watermarking is an emerging technique for embedding and verifying secret identity messages in the prediction behaviors or the model internals. Sacrificing less functionality and involving more knowledge about the target DNN, the latter branch called textitwhite-box DNN watermarking is believed to be accurate, credible and secure against most known watermark removal attacks, with emerging research efforts in both the academy and the industry. In this paper, we present the first systematic study on how the mainstream white-box DNN watermarks are commonly vulnerable to neural structural obfuscation with textitdummy neurons, a group of neurons which can be added to a target model but leave the model behavior invariant. Devising a comprehensive framework to automatically generate and inject dummy neurons with high stealthiness, our novel attack intensively modifies the architecture of the target model to inhibit the success of watermark verification. With extensive evaluation, our work for the first time shows that nine published watermarking schemes require amendments to their verification procedures.

Key facts. Cited by 20 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 36 of its 68 references that are in the map. First posted on arXiv 17 Mar 2023.

Builds on

36 of 68 references.

Closest ancestors · 1

Same direction, newest first

  1. 2021Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Models10 Dec

Other references · 35

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  4. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
  5. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  6. 2020Knowledge Distillation: A Surveycited by 1,578
  7. 2015Show, Attend and Tell: Neural Image Caption Generation with Visual Attentioncited by 1,421
  8. 2019Energy and Policy Considerations for Deep Learning in NLPcited by 1,242
  9. 2016Pruning Filters for Efficient ConvNetscited by 1,129
  10. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  11. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  12. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
23 more
  1. 2018Spectral Signatures in Backdoor Attackscited by 457
  2. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  3. 2019Dreaming to Distill: Data-free Knowledge Transfer via DeepInversioncited by 419
  4. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  5. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  6. 2017Embedding Watermarks into Deep Neural Networkscited by 227
  7. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  8. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
  9. 2015Path-SGD: Path-Normalized Optimization in Deep Neural Networkscited by 117
  10. 2018Stealing Hyperparameters in Machine Learningcited by 115
  11. 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 94
  12. 2018Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architecturescited by 56
  13. 2021Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attackcited by 45
  14. 2016Compression of Neural Machine Translation Models via Pruningcited by 43
  15. 2020Passport-aware Normalization for Deep Model Protectioncited by 42
  16. 2020Hermes Attack: Steal DNN Models with Lossless Inference Accuracycited by 41
  17. 2019REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Datacited by 40
  18. 2020Neural Network Laundering: Removing Black-Box Backdoor Watermarks from Deep Neural Networkscited by 24
  19. 2020Protect, Show, Attend and Tell: Empowering Image Captioning Models with Ownership Protectioncited by 18
  20. 2020Fine-tuning Is Not Enough: A Simple yet Effective Watermark Removal Attack for DNN Modelscited by 18
  21. 2021You are caught stealing my winning lottery ticket! Making a lottery ticket claim its ownershipcited by 16
  22. 2019Effectiveness of Distillation Attack and Countermeasure on Neural Network Watermarkingcited by 11
  23. 2017On Secure and Usable Program Obfuscation: A Surveycited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 2; 2024: 6; 2025: 8; 2026: 4.

20 papers.

Sort:

By area:

  1. 2024Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attributioncited by 35
  2. 2025Model Provenance Testing for Large Language Modelscited by 15
  3. 2023Functional Invariants to Watermark Large Transformerscited by 14
  4. 2024SLIP: Securing LLMs IP Using Weights Decompositioncited by 13
  5. 2024WET: Overcoming Paraphrasing Vulnerabilities in Embeddings-as-a-Service with Linear Transformation Watermarkscited by 5
  6. 2024DeepEclipse: How to Break White-Box DNN-Watermarking Schemescited by 4
  7. 2025Watermarking Graph Neural Networks via Explanations for Ownership Protectioncited by 3
  8. 2023Neural Dehydration: Effective Erasure of Black-box Watermarks from DNNs with Limited Datacited by 2
  9. 2024Revisiting Black-Box Model Ownership Verification through Information Theorycited by 2
  10. 2025Hashed Watermark as a Filter: Defeating Forging and Overwriting Attacks in Weight-based Neural Network Watermarkingcited by 2
  11. 2025AGATE: Stealthy Black-box Watermarking for Multimodal Model Copyright Protectioncited by 1
  12. 2025WGLE:Backdoor-free and Multi-bit Black-box Watermarking for Graph Neural Networkscited by 1
8 more
  1. 2024Your Semantic-Independent Watermark is Fragile: A Semantic Perturbation Attack against EaaS Watermarkcited by 0
  2. 2025PoLO: Proof-of-Learning and Proof-of-Ownership at Once with Chained Watermarkingcited by 0
  3. 2025Invariant-based Robust Weights Watermark for Large Language Modelscited by 0
  4. 2025Server-Enforced Watermarking in U-Shaped Split Federated Learningcited by 0
  5. 2026Functional Subspace Watermarking for Large Language Modelscited by 0
  6. 2026DIPBox: A Multi-scale Testing Framework for Tracking Dataset Regenerationcited by 0
  7. 2026MeMark: Membrane-Space Watermarking for Spiking Neural Networkscited by 0
  8. 2026Artificial intelligence and biosecurity: capabilities, threat pathways, and defense-in-depth governancecited by 0