# A Game Between the Defender and the Attacker for Trigger-based Black-box Model Watermarking

arXiv: https://arxiv.org/abs/2501.01194 · HTML: https://mlsanity.com/paper/2501.01194/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security.
- Builds on 8 of its 19 references that are in the map.
- First posted on arXiv 2 Jan 2025.

## Placed in

- LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/)

## Builds on (most cited first, 8 of 8)

- [Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring](https://mlsanity.com/paper/1802.04633/) (2018)
- [Embedding Watermarks into Deep Neural Networks](https://mlsanity.com/paper/1701.04082/) (2017)
- [[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks](https://mlsanity.com/paper/1909.07830/) (2019)
- [Watermarking Graph Neural Networks by Random Graphs](https://mlsanity.com/paper/2011.00512/) (2020)
- [Structural Watermarking to Deep Neural Networks via Network Channel Pruning](https://mlsanity.com/paper/2107.08688/) (2021)
- [Verifying Integrity of Deep Ensemble Models by Lossless Black-box Watermarking with Sensitive Samples](https://mlsanity.com/paper/2205.04145/) (2022)
- [When Should You Defend Your Classifier -- A Game-theoretical Analysis of Countermeasures against Adversarial Examples](https://mlsanity.com/paper/2108.07602/) (2021)
- [Game-theoretic Analysis to Content-adaptive Reversible Watermarking](https://mlsanity.com/paper/1905.01674/) (2019)

## Built on by (most cited first, 1 of 1)

- [An Information Asymmetry Game for Trigger-based DNN Model Watermarking](https://mlsanity.com/paper/2510.14218/) (2025)

## Abstract (arXiv)

Watermarking deep neural network (DNN) models has attracted a great deal of attention and interest in recent years because of the increasing demand to protect the intellectual property of DNN models. Many practical algorithms have been proposed by covertly embedding a secret watermark into a given DNN model through either parametric/structural modulation or backdooring against intellectual property infringement from the attacker while preserving the model performance on the original task. Despite the performance of these approaches, the lack of basic research restricts the algorithmic design to either a trial-based method or a data-driven technique. This has motivated the authors in this paper to introduce a game between the model attacker and the model defender for trigger-based black-box model watermarking. For each of the two players, we construct the payoff function and determine the optimal response, which enriches the theoretical foundation of model watermarking and may inspire us to develop novel schemes in the future.