mlsanityData to 14 Oct 2026

Performance-lossless Black-box Model Watermarking

arXiv 2312.06488 ↗First posted 11 Dec 2023cs.CRcited by 3

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

With the development of deep learning, high-value and high-cost models have become valuable assets, and related intellectual property protection technologies have become a hot topic. However, existing model watermarking work in black-box scenarios mainly originates from training-based backdoor methods, which probably degrade primary task performance. To address this, we propose a branch backdoor-based model watermarking protocol to protect model intellectual property, where a construction based on a message authentication scheme is adopted as the branch indicator after a comparative analysis with secure cryptographic technologies primitives. We prove the lossless performance of the protocol by reduction. In addition, we analyze the potential threats to the protocol and provide a secure and feasible watermarking instance for language models.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 51 of its 114 references that are in the map. First posted on arXiv 11 Dec 2023.

Builds on

51 of 114 references.

Closest ancestors · 15

Same direction, newest first

  1. 2023A Semantic Invariant Robust Watermark for Large Language Models10 Oct
  2. 2023Unbiased Watermark for Large Language Models22 Sep
  3. 2023Robust Distortion-free Watermarks for Language Models28 Jul
  4. 2023Watermarking Conditional Text Generation for AI Detection: Unveiling Challenges and a Semantic-Aware Watermark Remedy25 Jul
  5. 2023Provable Robust Watermarking for AI-Generated Text30 Jun
  6. 2023Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust31 May
  7. 2023Who Wrote this Code? Watermarking for Code Generation24 May
  8. 2023Watermarking Text Generated by Black-Box Language Models14 May
  9. 2023A Recipe for Watermarking Diffusion Models17 Mar
  10. 2023Protecting Language Generation Models via Invisible Watermarking6 Feb
  11. 2023A Watermark for Large Language Models24 Jan
  12. 2022CATER: Intellectual Property Protection on Text Generation APIs via Conditional Watermarks19 Sep
3 more
  1. 2022Cosine Model Watermarking Against Ensemble Distillation5 Mar
  2. 2021Protecting Intellectual Property of Language Generation APIs with Lexical Watermark5 Dec
  3. 2021Deep Model Intellectual Property Protection via Deep Watermarking8 Mar

Other references · 36

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  4. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  5. 2022Generative Adversarial Networkscited by 5,627
  6. 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,512
  7. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,626
  8. 2022Video Diffusion Modelscited by 2,305
  9. 2021Alias-Free Generative Adversarial Networkscited by 1,184
  10. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  11. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  12. 2018HiDDeN: Hiding Data With Deep Networkscited by 397
24 more
  1. 2019Hidden Trigger Backdoor Attackscited by 371
  2. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 357
  3. 2019Label-Consistent Backdoor Attackscited by 296
  4. 2020Blind Backdoors in Deep Learning Modelscited by 182
  5. 2020Entangled Watermarks as a Defense against Model Extractioncited by 149
  6. 2020Adversarial Watermarking Transformer: Towards Tracing Text Provenance with Data Hidingcited by 130
  7. 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 118
  8. 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 100
  9. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 97
  10. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 86
  11. 2019How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNNcited by 66
  12. 2022Planting Undetectable Backdoors in Machine Learning Modelscited by 59
  13. 2019Robust Watermarking of Neural Network with Exponential Weightingcited by 51
  14. 2020Passport-aware Normalization for Deep Model Protectioncited by 43
  15. 2022Certified Neural Network Watermarks with Randomized Smoothingcited by 41
  16. 2019BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networkscited by 26
  17. 2022MOVE: Effective and Harmless Ownership Verification via Embedded External Featurescited by 21
  18. 2020Protect, Show, Attend and Tell: Empowering Image Captioning Models with Ownership Protectioncited by 20
  19. 2018PoTrojan: powerful neural-level trojan designs in deep learning modelscited by 10
  20. 2021Piracy-Resistant DNN Watermarking by Block-Wise Image Transformation with Secret Keycited by 10
  21. 2022ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networkscited by 9
  22. 2021Fostering the Robustness of White-Box Deep Neural Network Watermarks by Neuron Alignmentcited by 5
  23. 2022Mixer: DNN Watermarking using Image Mixupcited by 3
  24. 2023Towards Traitor Tracing in Black-and-White-Box DNN Watermarking with Tardos-based Codescited by 3

Built on by

Cited by year

Citing papers per year: 2024: 2; 2025: 1.

3 papers.

  1. 2025Ten Challenging Problems in Federated Foundation Modelscited by 20
  2. 2024Revisiting Black-Box Model Ownership Verification through Information Theorycited by 3
  3. 2024Learnable Linguistic Watermarks for Tracing Model Extraction Attacks on Large Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025A Game Between the Defender and the Attacker for Trigger-based Black-box Model Watermarking
  2. 2025ComMark: Covert and Robust Black-Box Model Watermarking with Compressed Samples
  3. 2023Towards Robust Model Watermark via Reducing Parametric Vulnerability
  4. 2022ROSE: A RObust and SEcure DNN Watermarking
  5. 2024ModelShield: Adaptive and Robust Watermark against Model Extraction Attack
  6. 2024MEA-Defender: A Robust Watermark against Model Extraction Attack
  7. 2024Task-Agnostic Language Model Watermarking via High Entropy Passthrough Layers
  8. 2026T2S: A Rehearsal-Based Approach for Extraction-Resistant Model Watermarking