mlsanityData to 7 Oct 2026

Identifying Appropriate Intellectual Property Protection Mechanisms for Machine Learning Models: A Systematization of Watermarking, Fingerprinting, Model Access, and Attacks

arXiv 2304.11285 ↗First posted 22 Apr 2023cs.LG cs.AI cs.CRcited by 11

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

The commercial use of Machine Learning (ML) is spreading; at the same time, ML models are becoming more complex and more expensive to train, which makes Intellectual Property Protection (IPP) of trained models a pressing issue. Unlike other domains that can build on a solid understanding of the threats, attacks and defenses available to protect their IP, the ML-related research in this regard is still very fragmented. This is also due to a missing unified view as well as a common taxonomy of these aspects. In this paper, we systematize our findings on IPP in ML, while focusing on threats and attacks identified and defenses proposed at the time of writing. We develop a comprehensive threat model for IP in ML, categorizing attacks and defenses within a unified and consolidated taxonomy, thus bridging research from both the ML and security communities.

Key facts. Cited by 11 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 49 of its 104 references that are in the map. First posted on arXiv 22 Apr 2023.

Builds on

49 of 104 references.

References · 49

  1. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  2. 2013Intriguing properties of neural networkscited by 5,114
  3. 2014Going Deeper with Convolutionscited by 4,231
  4. 2015Deep Compression: Compressing Deep Neural Networks with Pruning, Trained Quantization and Huffman Codingcited by 2,291
  5. 2015Show, Attend and Tell: Neural Image Caption Generation with Visual Attentioncited by 1,421
  6. 2017Random Erasing Data Augmentationcited by 1,235
  7. 2013An Empirical Investigation of Catastrophic Forgetting in Gradient-Based Neural Networkscited by 711
  8. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  9. 2017To prune, or not to prune: exploring the efficacy of pruning for model compressioncited by 596
  10. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  11. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  12. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
37 more
  1. 2017Embedding Watermarks into Deep Neural Networkscited by 227
  2. 2020Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Datacited by 200
  3. 2017Neural Style Transfer: A Reviewcited by 199
  4. 2017Machine Learning Models that Remember Too Muchcited by 165
  5. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
  6. 2020Adversarial Watermarking Transformer: Towards Tracing Text Provenance with Data Hidingcited by 121
  7. 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 110
  8. 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 94
  9. 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 90
  10. 2019[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attackscited by 82
  11. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  12. 2019IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundarycited by 68
  13. 2020Radioactive data: tracing through trainingcited by 67
  14. 2019How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNNcited by 58
  15. 2020Model Watermarking for Image Processing Networkscited by 49
  16. 2020A Systematic Review on Model Watermarking for Neural Networkscited by 49
  17. 2019Robust Watermarking of Neural Network with Exponential Weightingcited by 48
  18. 2019REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Datacited by 40
  19. 2018Digital Watermarking for Deep Neural Networkscited by 37
  20. 2020WAFFLE: Watermarking in Federated Learningcited by 34
  21. 2019BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networkscited by 25
  22. 2020Neural Network Laundering: Removing Black-Box Backdoor Watermarks from Deep Neural Networkscited by 24
  23. 2020Removing Backdoor-Based Watermarks in Neural Networks with Limited Datacited by 23
  24. 2020Watermarking Graph Neural Networks by Random Graphscited by 23
  25. 2020Protect, Show, Attend and Tell: Empowering Image Captioning Models with Ownership Protectioncited by 18
  26. 2020Fine-tuning Is Not Enough: A Simple yet Effective Watermark Removal Attack for DNN Modelscited by 18
  27. 2021Reversible Watermarking in Deep Convolutional Neural Networks for Integrity Authenticationcited by 17
  28. 2020Training DNN Model with Secret Key for Model Protectioncited by 14
  29. 2019Effectiveness of Distillation Attack and Countermeasure on Neural Network Watermarkingcited by 11
  30. 2019Stealing Knowledge from Protected Deep Neural Networks Using Composite Unlabeled Datacited by 8
  31. 2019Sequential Triggers for Watermarking of Deep Reinforcement Learning Policiescited by 7
  32. 2018DeepObfuscation: Securing the Structure of Convolutional Neural Networks via Knowledge Distillationcited by 6
  33. 2019Evolutionary Trigger Set Generation for DNN Black-Box Watermarkingcited by 6
  34. 2018A Comprehensive Survey of Watermarking Relational Databases Researchcited by 4
  35. 2018Performance Comparison of Contemporary DNN Watermarking Techniquescited by 4
  36. 2019A novel method for identifying the deep neural network model with the Serial Numbercited by 4
  37. 2019Security for Distributed Deep Neural Networks Towards Data Confidentiality & Intellectual Property Protectioncited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 3; 2025: 4; 2026: 3.

11 papers.

  1. 2025ATOM: A Framework of Detecting Query-Based Model Extraction Attacks for Graph Neural Networkscited by 8
  2. 2024U Can't Gen This? A Survey of Intellectual Property Protection Methods for Data in Generative AIcited by 7
  3. 2025Toward Robust Non-Transferable Learning: A Survey and Benchmarkcited by 7
  4. 2026CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attackscited by 4
  5. 2025BiMarker: Enhancing Text Watermark Detection for Large Language Models with Bipolar Watermarkscited by 3
  6. 2023Neural Dehydration: Effective Erasure of Black-box Watermarks from DNNs with Limited Datacited by 2
  7. 2025Hashed Watermark as a Filter: Defeating Forging and Overwriting Attacks in Weight-based Neural Network Watermarkingcited by 2
  8. 2026Attesting Model Lineage by Consisted Knowledge Evolution with Fine-Tuning Trajectorycited by 1
  9. 2024Stealing the Invisible: Unveiling Pre-Trained CNN Models through Adversarial Examples and Timing Side-Channelscited by 0
  10. 2024DeepCore: Simple Fingerprint Construction for Differentiating Homologous and Piracy Modelscited by 0
  11. 2026Vol-Mark: A Watermark for 3D Medical Volume Data Via Cubic Difference Expansion and Contrastive Learningcited by 0