# Rethinking White-Box Watermarks on Deep Learning Models under Neural Structural Obfuscation arXiv: https://arxiv.org/abs/2303.09732 ยท HTML: https://mlsanity.com/paper/2303.09732/ ## Key facts - Cited by 20 papers in the map (data through 14 Oct 2026). - Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. - Builds on 36 of its 68 references that are in the map. - First posted on arXiv 17 Mar 2023. ## Placed in - LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/) ## Builds on (most cited first, 30 of 36) - [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015) - [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018) - [Distilling the Knowledge in a Neural Network](https://mlsanity.com/paper/1503.02531/) (2015) - [Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift](https://mlsanity.com/paper/1502.03167/) (2015) - [Rethinking the Inception Architecture for Computer Vision](https://mlsanity.com/paper/1512.00567/) (2015) - [Knowledge Distillation: A Survey](https://mlsanity.com/paper/2006.05525/) (2020) - [Show, Attend and Tell: Neural Image Caption Generation with Visual Attention](https://mlsanity.com/paper/1502.03044/) (2015) - [Energy and Policy Considerations for Deep Learning in NLP](https://mlsanity.com/paper/1906.02243/) (2019) - [Pruning Filters for Efficient ConvNets](https://mlsanity.com/paper/1608.08710/) (2016) - [BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain](https://mlsanity.com/paper/1708.06733/) (2017) - [Stealing Machine Learning Models via Prediction APIs](https://mlsanity.com/paper/1609.02943/) (2016) - [Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks](https://mlsanity.com/paper/1805.12185/) (2018) - [Spectral Signatures in Backdoor Attacks](https://mlsanity.com/paper/1811.00636/) (2018) - [Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering](https://mlsanity.com/paper/1811.03728/) (2018) - [Dreaming to Distill: Data-free Knowledge Transfer via DeepInversion](https://mlsanity.com/paper/1912.08795/) (2019) - [Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring](https://mlsanity.com/paper/1802.04633/) (2018) - [Knockoff Nets: Stealing Functionality of Black-Box Models](https://mlsanity.com/paper/1812.02766/) (2018) - [Embedding Watermarks into Deep Neural Networks](https://mlsanity.com/paper/1701.04082/) (2017) - [High Accuracy and High Fidelity Extraction of Neural Networks](https://mlsanity.com/paper/1909.01838/) (2019) - [Entangled Watermarks as a Defense against Model Extraction](https://mlsanity.com/paper/2002.12200/) (2020) - [Path-SGD: Path-Normalized Optimization in Deep Neural Networks](https://mlsanity.com/paper/1506.02617/) (2015) - [Stealing Hyperparameters in Machine Learning](https://mlsanity.com/paper/1802.05351/) (2018) - [DAWN: Dynamic Adversarial Watermarking of Neural Networks](https://mlsanity.com/paper/1906.00830/) (2019) - [Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architectures](https://mlsanity.com/paper/1808.04761/) (2018) - [Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attack](https://mlsanity.com/paper/2102.04362/) (2021) - [Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Models](https://mlsanity.com/paper/2112.05588/) (2021) - [Compression of Neural Machine Translation Models via Pruning](https://mlsanity.com/paper/1606.09274/) (2016) - [REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data](https://mlsanity.com/paper/1911.07205/) (2019) - [Passport-aware Normalization for Deep Model Protection](https://mlsanity.com/paper/2010.15824/) (2020) - [Hermes Attack: Steal DNN Models with Lossless Inference Accuracy](https://mlsanity.com/paper/2006.12784/) (2020) ## Built on by (most cited first, 20 of 20) - [Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attribution](https://mlsanity.com/paper/2405.04825/) (2024) - [Functional Invariants to Watermark Large Transformers](https://mlsanity.com/paper/2310.11446/) (2023) - [Model Provenance Testing for Large Language Models](https://mlsanity.com/paper/2502.00706/) (2025) - [SLIP: Securing LLMs IP Using Weights Decomposition](https://mlsanity.com/paper/2407.10886/) (2024) - [WET: Overcoming Paraphrasing Vulnerabilities in Embeddings-as-a-Service with Linear Transformation Watermarks](https://mlsanity.com/paper/2409.04459/) (2024) - [DeepEclipse: How to Break White-Box DNN-Watermarking Schemes](https://mlsanity.com/paper/2403.03590/) (2024) - [Revisiting Black-Box Model Ownership Verification through Information Theory](https://mlsanity.com/paper/2409.06130/) (2024) - [Watermarking Graph Neural Networks via Explanations for Ownership Protection](https://mlsanity.com/paper/2501.05614/) (2025) - [Neural Dehydration: Effective Erasure of Black-box Watermarks from DNNs with Limited Data](https://mlsanity.com/paper/2309.03466/) (2023) - [AGATE: Stealthy Black-box Watermarking for Multimodal Model Copyright Protection](https://mlsanity.com/paper/2504.21044/) (2025) - [Hashed Watermark as a Filter: Defeating Forging and Overwriting Attacks in Weight-based Neural Network Watermarking](https://mlsanity.com/paper/2507.11137/) (2025) - [WGLE:Backdoor-free and Multi-bit Black-box Watermarking for Graph Neural Networks](https://mlsanity.com/paper/2506.08602/) (2025) - [Invariant-based Robust Weights Watermark for Large Language Models](https://mlsanity.com/paper/2507.08288/) (2025) - [Your Semantic-Independent Watermark is Fragile: A Semantic Perturbation Attack against EaaS Watermark](https://mlsanity.com/paper/2411.09359/) (2024) - [PoLO: Proof-of-Learning and Proof-of-Ownership at Once with Chained Watermarking](https://mlsanity.com/paper/2505.12296/) (2025) - [Server-Enforced Watermarking in U-Shaped Split Federated Learning](https://mlsanity.com/paper/2511.14422/) (2025) - [Functional Subspace Watermarking for Large Language Models](https://mlsanity.com/paper/2603.18793/) (2026) - [DIPBox: A Multi-scale Testing Framework for Tracking Dataset Regeneration](https://mlsanity.com/paper/2606.21240/) (2026) - [MeMark: Membrane-Space Watermarking for Spiking Neural Networks](https://mlsanity.com/paper/2608.25738/) (2026) - [Artificial intelligence and biosecurity: capabilities, threat pathways, and defense-in-depth governance](https://mlsanity.com/paper/2609.16213/) (2026) ## Abstract (arXiv) Copyright protection for deep neural networks (DNNs) is an urgent need for AI corporations. To trace illegally distributed model copies, DNN watermarking is an emerging technique for embedding and verifying secret identity messages in the prediction behaviors or the model internals. Sacrificing less functionality and involving more knowledge about the target DNN, the latter branch called textitwhite-box DNN watermarking is believed to be accurate, credible and secure against most known watermark removal attacks, with emerging research efforts in both the academy and the industry. In this paper, we present the first systematic study on how the mainstream white-box DNN watermarks are commonly vulnerable to neural structural obfuscation with textitdummy neurons, a group of neurons which can be added to a target model but leave the model behavior invariant. Devising a comprehensive framework to automatically generate and inject dummy neurons with high stealthiness, our novel attack intensively modifies the architecture of the target model to inhibit the success of watermark verification. With extensive evaluation, our work for the first time shows that nine published watermarking schemes require amendments to their verification procedures.