mlsanityData to 14 Oct 2026

Class-feature Watermark: A Resilient Black-box Watermark Against Model Extraction Attacks

arXiv 2511.07947 ↗First posted 11 Nov 2025cs.CR cs.CV cs.LGcited by 0

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

Machine learning models constitute valuable intellectual property, yet remain vulnerable to model extraction attacks (MEA), where adversaries replicate their functionality through black-box queries. Model watermarking counters MEAs by embedding forensic markers for ownership verification. Current black-box watermarks prioritize MEA survival through representation entanglement, yet inadequately explore resilience against sequential MEAs and removal attacks. Our study reveals that this risk is underestimated because existing removal methods are weakened by entanglement. To address this gap, we propose Watermark Removal attacK (WRK), which circumvents entanglement constraints by exploiting decision boundaries shaped by prevailing sample-level watermark artifacts. WRK effectively reduces watermark success rates by at least 88.79% across existing watermarking benchmarks. For robust protection, we propose Class-Feature Watermarks (CFW), which improve resilience by leveraging class-level artifacts. CFW constructs a synthetic class using out-of-domain samples, eliminating vulnerable decision boundaries between original domain samples and their artifact-modified counterparts (watermark samples). CFW concurrently optimizes both MEA transferability and post-MEA stability. Experiments across multiple domains show that CFW consistently outperforms prior methods in resilience, maintaining a watermark success rate of at least 70.15% in extracted models even under the combined MEA and WRK distortion, while preserving the utility of protected models.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 22 of its 44 references that are in the map. First posted on arXiv 11 Nov 2025.

Builds on

22 of 44 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Reliable Model Watermarking: Defending Against Theft without Compromising on Evasion21 Apr
  2. 2024MEA-Defender: A Robust Watermark against Model Extraction Attack26 Jan

Other references · 20

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
  4. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  5. 2019Similarity of Neural Network Representations Revisitedcited by 1,755
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  7. 2016Adversarial Machine Learning at Scalecited by 936
  8. 2018Speech Commands: A Dataset for Limited-Vocabulary Speech Recognitioncited by 752
  9. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  10. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  11. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
  12. 2020Amnesiac Machine Learningcited by 319
8 more
  1. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 214
  2. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 166
  3. 2020Entangled Watermarks as a Defense against Model Extractioncited by 149
  4. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 69
  5. 2020Generalisation Guarantees for Continual Learning with Orthogonal Gradient Descentcited by 68
  6. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 59
  7. 2022Certified Neural Network Watermarks with Randomized Smoothingcited by 41
  8. 2023Towards Stable Backdoor Purification through Feature Shift Tuningcited by 32

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026ArmSSL: Adversarial Robust Black-Box Watermarking for Self-Supervised Learning Pre-trained Encoders
  2. 2025ComMark: Covert and Robust Black-Box Model Watermarking with Compressed Samples
  3. 2026T2S: A Rehearsal-Based Approach for Extraction-Resistant Model Watermarking
  4. 2025Robust Watermarks Leak: Channel-Aware Feature Extraction Enables Adversarial Watermark Manipulation
  5. 2024Revisiting Black-Box Model Ownership Verification through Information Theory
  6. 2025When There Is No Decoder: Removing Watermarks from Stable Diffusion Models in a No-box Setting
  7. 2024Box-Free Model Watermarks Are Prone to Black-Box Removal Attacks
  8. 2026Disentangle and Drop: Robust Universal Removal of Image Watermarks via Reconstructive Grayscale Residual Decomposition