# An Information Asymmetry Game for Trigger-based DNN Model Watermarking

arXiv: https://arxiv.org/abs/2510.14218 · HTML: https://mlsanity.com/paper/2510.14218/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security.
- Builds on 12 of its 20 references that are in the map.
- First posted on arXiv 16 Oct 2025.

## Placed in

- LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/)

## Builds on (most cited first, 12 of 12)

- [BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain](https://mlsanity.com/paper/1708.06733/) (2017)
- [Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks](https://mlsanity.com/paper/1805.12185/) (2018)
- [Few-shot Backdoor Defense Using Shapley Estimation](https://mlsanity.com/paper/2112.14889/) (2021)
- [Neural Network Laundering: Removing Black-Box Backdoor Watermarks from Deep Neural Networks](https://mlsanity.com/paper/2004.11368/) (2020)
- [Verifying Integrity of Deep Ensemble Models by Lossless Black-box Watermarking with Sensitive Samples](https://mlsanity.com/paper/2205.04145/) (2022)
- [Robust and Imperceptible Black-box DNN Watermarking Based on Fourier Perturbation Analysis and Frequency Sensitivity Clustering](https://mlsanity.com/paper/2208.03944/) (2022)
- [Pruning Strategies for Backdoor Defense in LLMs](https://mlsanity.com/paper/2508.20032/) (2025)
- [When Should You Defend Your Classifier -- A Game-theoretical Analysis of Countermeasures against Adversarial Examples](https://mlsanity.com/paper/2108.07602/) (2021)
- [Revisiting Black-Box Model Ownership Verification through Information Theory](https://mlsanity.com/paper/2409.06130/) (2024)
- [Game-theoretic Analysis to Content-adaptive Reversible Watermarking](https://mlsanity.com/paper/1905.01674/) (2019)
- [Watermarking Quantum Neural Networks Based on Sample Grouped and Paired Training](https://mlsanity.com/paper/2506.12675/) (2025)
- [A Game Between the Defender and the Attacker for Trigger-based Black-box Model Watermarking](https://mlsanity.com/paper/2501.01194/) (2025)

## Abstract (arXiv)

As a valuable digital product, deep neural networks (DNNs) face increasingly severe threats to the intellectual property, making it necessary to develop effective technical measures to protect them. Trigger-based watermarking methods achieve copyright protection by embedding triggers into the host DNNs. However, the attacker may remove the watermark by pruning or fine-tuning. We model this interaction as a game under conditions of information asymmetry, namely, the defender embeds a secret watermark with private knowledge, while the attacker can only access the watermarked model and seek removal. We define strategies, costs, and utilities for both players, derive the attacker's optimal pruning budget, and establish an exponential lower bound on the accuracy of watermark detection after attack. Experimental results demonstrate the feasibility of the watermarked model, and indicate that sparse watermarking can resist removal with negligible accuracy loss. This study highlights the effectiveness of game-theoretic analysis in guiding the design of robust watermarking schemes for model copyright protection.