mlsanityData to 7 Oct 2026

Towards Robust Model Watermark via Reducing Parametric Vulnerability

arXiv 2309.04777 ↗First posted 9 Sep 2023cs.CR cs.AI cs.CVcited by 10

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

Deep neural networks are valuable assets considering their commercial benefits and huge demands for costly annotation and computation resources. To protect the copyright of DNNs, backdoor-based ownership verification becomes popular recently, in which the model owner can watermark the model by embedding a specific backdoor behavior before releasing it. The defenders (usually the model owners) can identify whether a suspicious third-party model is ``stolen'' from them based on the presence of the behavior. Unfortunately, these watermarks are proven to be vulnerable to removal attacks even like fine-tuning. To further explore this vulnerability, we investigate the parameter space and find there exist many watermark-removed models in the vicinity of the watermarked one, which may be easily used by removal attacks. Inspired by this finding, we propose a mini-max formulation to find these watermark-removed models and recover their watermark behavior. Extensive experiments demonstrate that our method improves the robustness of the model watermarking against parametric changes and numerous watermark-removal attacks. The codes for reproducing our main experiments are available at urlhttps://github.com/GuanhaoGan/robust-model-watermarking.

Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 42 of its 57 references that are in the map. First posted on arXiv 9 Sep 2023.

Builds on

42 of 57 references.

Closest ancestors · 2

Same direction, newest first

  1. 2021Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Models10 Dec
  2. 2021Non-Transferable Learning: A New Approach for Model Ownership Verification and Applicability Authorization13 Jun

Other references · 40

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  8. 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,464
  9. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  10. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  11. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  12. 2020Backdoor Learning: A Surveycited by 412
28 more
  1. 2019A Survey of Deep Learning Techniques for Autonomous Drivingcited by 401
  2. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  3. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  4. 2016Revisiting Batch Normalization For Practical Domain Adaptationcited by 285
  5. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  6. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  7. 2017Embedding Watermarks into Deep Neural Networkscited by 227
  8. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  9. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 130
  10. 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 110
  11. 2021SynFace: Face Recognition with Synthetic Datacited by 106
  12. 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 90
  13. 2019[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attackscited by 82
  14. 2021Backdoor Attack in the Physical Worldcited by 82
  15. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  16. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 67
  17. 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 57
  18. 2017Efficient Defenses Against Adversarial Attackscited by 53
  19. 2019Robust Watermarking of Neural Network with Exponential Weightingcited by 48
  20. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
  21. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  22. 2022Certified Neural Network Watermarks with Randomized Smoothingcited by 39
  23. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 25
  24. 2020Neural Network Laundering: Removing Black-Box Backdoor Watermarks from Deep Neural Networkscited by 24
  25. 2022Free Fine-tuning: A Plug-and-Play Watermarking Scheme for Deep Neural Networkscited by 14
  26. 2023What can Discriminator do? Towards Box-free Ownership Verification of Generative Adversarial Networkcited by 10
  27. 2019Invert and Defend: Model-based Approximate Inversion of Generative Adversarial Networks for Secure Inferencecited by 4
  28. 2022ROSE: A RObust and SEcure DNN Watermarkingcited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 2; 2024: 2; 2025: 4; 2026: 2.

10 papers.

  1. 2023Label Poisoning is All You Needcited by 27
  2. 2023Robust Identity Perceptual Watermark Against Deepfake Face Swappingcited by 17
  3. 2024ModelLock: Locking Your Model With a Spellcited by 6
  4. 2025SWAP: Towards Copyright Auditing of Soft Prompts via Sequential Watermarkingcited by 3
  5. 2026Cert-LAS: Toward Certified Model Ownership Verification for Text-to-Image Diffusion Models via Layer-Adaptive Smoothingcited by 3
  6. 2024Towards Understanding and Enhancing Security of Proof-of-Training for DNN Model Ownership Verificationcited by 2
  7. 2025Persistence of Backdoor-based Watermarks for Neural Networks: A Comprehensive Evaluationcited by 2
  8. 2025Staining and locking computer vision models without retrainingcited by 1
  9. 2025Cryptographic Backdoor for Neural Networks: Boon and Banecited by 1
  10. 2026LoRA-Key: User-Centric LoRA Watermarking for Text-to-Image Diffusion Modelscited by 1