# BlackCATT: Black-box Collusion Aware Traitor Tracing in Federated Learning

arXiv: https://arxiv.org/abs/2602.12138 · HTML: https://mlsanity.com/paper/2602.12138/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Federated unlearning and poisoning, one of 12 directions in LLM safety and security.
- Builds on 27 of its 55 references that are in the map.
- First posted on arXiv 12 Feb 2026.

## Placed in

- LLM safety and security / [Federated unlearning and poisoning](https://mlsanity.com/safety/federated-unlearning-and-poisoning/)

## Builds on (most cited first, 27 of 27)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification](https://mlsanity.com/paper/1502.01852/) (2015)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Editing Models with Task Arithmetic](https://mlsanity.com/paper/2212.04089/) (2022)
- [A survey of deep neural network watermarking techniques](https://mlsanity.com/paper/2103.09274/) (2021)
- [Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbations](https://mlsanity.com/paper/2202.08602/) (2022)
- [Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistency](https://mlsanity.com/paper/2303.18191/) (2023)
- [FedIPR: Ownership Verification for Federated Deep Neural Network Models](https://mlsanity.com/paper/2109.13236/) (2021)
- [Distillation-Resistant Watermarking for Model Protection in NLP](https://mlsanity.com/paper/2210.03312/) (2022)
- [FedTracker: Furnishing Ownership Verification and Traceability for Federated Learning Model](https://mlsanity.com/paper/2211.07160/) (2022)
- [Watermarking in Secure Federated Learning: A Verification Framework Based on Client-Side Backdooring](https://mlsanity.com/paper/2211.07138/) (2022)
- [FedCIP: Federated Client Intellectual Property Protection with Traitor Tracking](https://mlsanity.com/paper/2306.01356/) (2023)
- [Who Leaked the Model? Tracking IP Infringers in Accountable Federated Learning](https://mlsanity.com/paper/2312.03205/) (2023)
- [When Federated Learning meets Watermarking: A Comprehensive Overview of Techniques for Intellectual Property Protection](https://mlsanity.com/paper/2308.03573/) (2023)
- [Towards Practical Watermark for Deep Neural Networks in Federated Learning](https://mlsanity.com/paper/2105.03167/) (2021)
- [Overcoming the Challenges of Batch Normalization in Federated Learning](https://mlsanity.com/paper/2405.14670/) (2024)
- [Towards Traitor Tracing in Black-and-White-Box DNN Watermarking with Tardos-based Codes](https://mlsanity.com/paper/2307.06695/) (2023)
- [Elevating Defenses: Bridging Adversarial Training and Watermarking for Model Resilience](https://mlsanity.com/paper/2312.14260/) (2023)
- [Harmless Backdoor-based Client-side Watermarking in Federated Learning](https://mlsanity.com/paper/2410.21179/) (2024)
- [Knowledge-Free Black-Box Watermark and Ownership Proof for Image Classification Neural Networks](https://mlsanity.com/paper/2204.04522/) (2022)
- [Exploring Federated Learning Dynamics for Black-and-White-Box DNN Traitor Tracing](https://mlsanity.com/paper/2407.02111/) (2024)
- [AGATE: Stealthy Black-box Watermarking for Multimodal Model Copyright Protection](https://mlsanity.com/paper/2504.21044/) (2025)
- [Traceable Black-box Watermarks for Federated Learning](https://mlsanity.com/paper/2505.13651/) (2025)

## Built on by (most cited first, 1 of 1)

- [ZK-Trace: Certified Collusion Tracing with Zero-Knowledge Credentials for Federated GNSS Interference Monitoring](https://mlsanity.com/paper/2609.08763/) (2026)

## Abstract (arXiv)

Federated Learning has been popularized in recent years for applications involving personal or sensitive data, as it allows the collaborative training of machine learning models through local updates at the data-owners' premises, which does not require the sharing of the data itself. Considering the risk of leakage or misuse by any of the data-owners, many works attempt to protect their copyright, or even trace the origin of a potential leak through unique watermarks identifying each participant's model copy. Realistic accusation scenarios impose a black-box setting, where watermarks are typically embedded as a set of sample-label pairs. The threat of collusion, however, where multiple bad actors conspire together to produce an untraceable model, has been rarely addressed, and previous works have been limited to shallow networks and near-linearly separable main tasks. To the best of our knowledge, this work is the first to present a general collusion-resistant embedding method for black-box traitor tracing in Federated Learning: BlackCATT, which introduces a novel collusion-aware embedding loss term and, instead of using a fixed trigger set, iteratively optimizes the triggers to aid convergence and traitor tracing performance. Experimental results confirm the efficacy of the proposed scheme across different architectures and datasets. Furthermore, for models that would otherwise suffer from update incompatibility on the main task after learning different watermarks (e.g., architectures including batch normalization layers), our proposed BlackCATT+FR incorporates functional regularization through a set of auxiliary examples at the aggregator, promoting a shared feature space among model copies without compromising traitor tracing performance.