{"id":"4ff05794-99da-43b9-bb6d-d3c2f52b29ad","arxiv_id":"2507.20650","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A branch-swapping mechanism over low-rank add-on modules stamps each distributed model copy with a unique binary user ID, achieving 100% reported verification accuracy with under 1% extra parameters.","lead":"Hot-Swap MarkBoard lets a model owner stamp each distributed copy of a neural network with a unique binary ID by swapping small add-on modules, without retraining the model for each user. The goal is to trace leaked or stolen models back to the specific customer who shared them, a growing need as AI models are shipped to phones and laptops.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Bit independence is a trained property, not an architectural guarantee; the paper's own ablation in Section 4.3.1 shows the failure mode, yet the scalability claim requires independence for all 2^n signatures.","rationale":"The reader's weakest assumption is exactly the one I find most load-bearing: bit-watermark independence is a trained property that must hold for all 2^n signatures, not just the sampled ones. The paper's own ablation in Section 4.3.1 provides direct evidence that without the routing loss, removing one bit breaks all bits, which confirms that the mechanism is not architecturally robust by construction. The reported experiments sample 1,000 random signatures, but the central claim is that any user-specific signature can be distributed without retraining and verified with 100% accuracy; the difference matters for a security guarantee. The concrete exhaustive test for n=10 is cheap and directly settles whether the independence assumption holds across the full signature space at that bit width. I do not see a reason to move the verdict to reject: the proposed losses are well motivated, the basic branch-swapping idea is plausible, and the ablations support the role of each loss. The appropriate outcome remains CONDITIONAL acceptance, with the additional requirement that the exhaustive signature sweep (and ideally a structured sweep at larger n) be reported before the scalability claim is treated as established.","tokens_in":17474,"tokens_out":24952,"duration_ms":291251,"concrete_test":"Enumerate all 2^10 = 1,024 signatures in the 10-bit ResNet-50 setting (the paper's main classification setup), generate the corresponding user model for each signature via Eq. 8, and measure Bit-Acc and clean-task CDP for every model. If any signature yields Bit-Acc below 100% or a CDP drop larger than the reported ΔCDP, branch independence is falsified; if all pass, repeat the sweep for n=16 with a structured all-pairs single-bit-flip subset to probe higher-dimensional interactions.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central scalability claim (Sections 1, 3.2.1, 3.3.1) is that any of the 2^n signatures can be produced by independently swapping LoRA branches, enabling training-free per-user attribution. This requires that the routing loss (Eq. 5) and alignment loss (Eq. 7) jointly guarantee, for every subset of branches, that each trigger activates only its designated branch, that the clean/watermarked branch pair produces the expected non-target/target behavior, and that clean-task utility is preserved. The paper's own ablation (Section 4.3.1, Table 2) demonstrates the failure mode when the routing loss is removed: removing a single bit causes all bit verifications to fail. Independence is therefore a trained property, not a consequence of the architecture. The main evaluation uses 1,000 randomly generated signatures, and the capacity results (Table 3) do not state how many signatures per bit length were tested. For n=10, 1,000 of 1,024 signatures is near-exhaustive, but for n=28, 1,000 is a negligible sample. If any signature combination fails verification or loses utility, the method's central promise of scalable per-user attribution fails for that user, and the reported 100% identification accuracy is not representative of the full signature space.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces Hot-Swap MarkBoard, a black-box watermarking method for large-scale distribution of deep learning models. The method uses a multi-branch LoRA module in which each branch is trained to encode one bit of an n-bit user signature; a jointly trained watermark-inactive model provides clean LoRA branches. A user-specific model is obtained by swapping watermarked branches with clean branches according to the assigned signature, enabling training-free customization. A parameter obfuscation mechanism is added to bind the LoRA weights to the base model, and verification is performed by querying with trigger inputs and reconstructing the signature. Experiments are reported on classification (ResNet-50, MobileNet, DeiT), image generation (LDM), and text generation (LLaMA-2-7B, MobileLLM-1.5B), claiming 100% bit and identification accuracy, less than 1% parameter overhead, and robustness against a range of attacks.","tokens_in":17728,"tokens_out":7326,"duration_ms":77529,"significance":"If the central claim holds, the method addresses a practical gap: per-user attribution of leaked models in on-device distribution without retraining per user. The multi-branch LoRA design augmented with routing and alignment losses is a plausible mechanism, and the paper's own ablation correctly identifies the routing loss as necessary for bit independence and the alignment loss for utility preservation. The experimental coverage across three tasks and six backbones is a strength, and the paper transparently reports the failure mode when the routing loss is removed. The significance is tempered, however, by the fact that the core independence property is only demonstrated on 1,000 randomly sampled signatures per bit length, which is insufficient for the full 2^n scalability claim at larger n, and by the lack of a false-positive characterization for the verification procedure.","major_comments":[{"comment":"The scalability claim that any of the 2^n signatures can be produced by branch swapping is not supported by the reported experiments. Only 1,000 randomly generated signatures are tested per bit length, and for n=28 this is a negligible fraction of the 2^28 ≈ 2.68×10^8 possible signatures. The ablation in Section 4.3.1 demonstrates that bit independence is a trained property rather than an architectural guarantee, so the existence of failing combinations cannot be ruled out. The paper should either exhaustively verify all signatures for a representative small n (e.g., all 2^10 signatures) or provide a statistical or theoretical bound on the probability that a randomly chosen signature fails, and it must report how many signatures were tested for each bit length in Table 3.","section":"Section 4.3.3 / Table 3"},{"comment":"The verification procedure is incompletely specified. The detection threshold epsilon_i is not given, and no experiments are reported on the detection score distribution for negative cases, such as clean models or user models where a bit is inactive. The claimed 100% Bit-Acc on watermarked models does not establish that the triggers do not fire on unwatermarked models, which is essential for reliable ownership verification. The authors should report score distributions for positive and negative cases and state the chosen thresholds for each bit.","section":"Section 3.4 / Eq. (10)"},{"comment":"The security claim that collusion attacks fail because the obfuscation matrices Psi_u are \"linearly independent and unique\" is not rigorously justified. The empirical result in Table 4 shows that swapping branches between two users degrades performance, but an adversary with white-box access could average or interpolate multiple user models, fine-tune the obfuscated base after removing the LoRA branch, or attempt to recover the original weight split. The paper should either provide a formal argument under the stated threat model or explicitly limit the claim to the specific attacks evaluated.","section":"Section 3.3.2 / Eq. (9)"},{"comment":"The Neural Cleanse experiment reports that the reversed trigger has a Mask Jaccard Similarity of only 0.01 to the true watermark, but it does not report the watermark verification results after Neural Cleanse's mitigation step. Since Neural Cleanse is a detection-and-removal attack, the robustness claim would be much stronger with post-mitigation Bit-Acc reported. Without this, the evidence that the watermark survives Neural Cleanse is indirect.","section":"Section 4.4.1"}],"minor_comments":[{"comment":"The number of branches is denoted N in Eq. (1) but n elsewhere in the paper; please make the notation consistent.","section":"Section 3.2.1"},{"comment":"The composite loss in Eq. (4) is given as L_route + L_wm + L_align, but the relative weighting of these three terms is not stated. Please specify the loss weights or clarify whether they are all set to 1.","section":"Section 3.2.2"},{"comment":"The text says that when pruning exceeded 20%, Bit-Acc dropped closer to 80%, but Figure 8 shows Bit-Acc at 100% for ResNet-50 and MobileLLM until much higher pruning rates; please reconcile the text with the figure.","section":"Section 4.4.4"},{"comment":"The sentence \"The model will be flagged the leak model\" should be reworded, for example to \"the model will be flagged as a leaked model.\"","section":"Section 3.4"}],"recommendation":"major_revision","confidential_remarks":"The core idea is interesting and the multi-task evaluation is a strength, but the central scalability claim requires substantially stronger evidence about the full signature space. The false-positive analysis of the verification pipeline is also needed. I believe the paper is worth revising rather than rejecting, provided the authors address the independence and verification-characterization gaps."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea here is the interesting part: a multi-branch LoRA module with a routing network that one-hot selects branches on trigger inputs, plus a branch-swapping procedure that assembles per-user n-bit signatures without retraining. That combination is new relative to the multi-bit watermarking literature I know — Multi-bit WM and EaaW require per-user retraining, and the LoRA-based diffusion watermarks don't generalize to classification or text. The paper does that well, and the ablations are the right controls: removing the routing loss breaks bit independence, and removing the alignment loss hurts utility. The overhead numbers (under 1% parameters, O(N) per model) are plausible, and the cross-task demonstration across six backbones is genuinely useful.\n\nThe soft spots are real but not fatal. First, there is no code or data, and training/detection hyperparameters are partially unspecified, so exact reproduction is currently impossible. Second, the robustness evaluation is thinner than the main results: no error bars, no baseline defenses for comparison, and some attacks are only run on one backbone. Third, the obfuscation and collusion security claims are asserted more than demonstrated — the linear-independence argument is stated, not tested adversarially.\n\nThe stress-test concern about bit independence is legitimate and worth taking seriously. Your own reading flagged that independence is trained, not architectural. The paper's Table 2 confirms the failure mode when the routing loss is absent. With it, independence holds on the tested signatures, but the capacity experiment in Table 3 does not state how many signatures per bit length were tested. For n=10, 1,000 of 1,024 is near-exhaustive; for n=28, 1,000 is a negligible sample. The 100% Id-Acc therefore doesn't establish that all 2^28 combinations verify and preserve utility. This is a moderate concern, not a loading-bearing flaw — the method could still work, but the headline scalability claim is under-supported.\n\nAlso worth saying plainly: the 100% verification accuracy is partly circular, because triggers are trained to produce target outputs and the router is trained to one-hot select branches. That is inherent to backdoor watermarking, so I don't count it heavily against the paper, but it does mean the success rate on the training-like distribution tells you less than the paper implies.\n\nWho is this for? Anyone working on model IP protection, on-device model distribution, or practical watermarking. It deserves a serious referee — the mechanism is novel, the experiments are broad, and the flaws are addressable. My recommendation: engage with it, ask for the artifact and a more systematic capacity evaluation, and treat the security claims as open hypotheses rather than established results.","headline":"Genuinely new branch-swapping LoRA watermarking mechanism with the right ablations, but the independence that makes it scale is a trained property and the capacity experiments don't sample enough of the signature space to prove the headline 2^n claim.","tokens_in":18360,"tokens_out":1669,"would_cite":true,"duration_ms":18586,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Hot-Swap MarkBoard claims that a model owner can stamp every distributed copy with a unique n-bit signature by swapping branches of a multi-branch LoRA module, with no retraining per user and black-box verification that recovers the…","keywords":["model watermarking","multi-bit signature","LoRA","branch swapping","black-box verification","backdoor trigger","large-scale model distribution","user attribution"],"falsifier":"Generate user models for all $2^{10}$ signatures, or a large random subset, from one trained pair and query each with the ten trigger sets: if any signature yields Bit-Acc below 100%, or if clean accuracy drops by more than the reported roughly 0.5%, the bit-independence assumption fails. Separately, obtain two user copies with different obfuscation matrices and subtract their released weights; if the residual allows a usable clean base model whose LoRA watermark no longer verifies, the obfuscation claim is falsified.","tokens_in":1672,"feed_emoji":"🏷️","tokens_out":2956,"duration_ms":107618,"temperature":0.7,"pith_summary":"Hot-Swap MarkBoard aims to solve the attribution problem that appears when models are distributed to many end users: if a copy leaks, the owner has to know which user leaked it. The paper claims a training-free route to unique per-user identity: it trains one clean model and one watermark-active twin whose separate LoRA branches each carry a single bit-watermark, then customizes each user's copy by swapping branches to set the desired n-bit signature. Because the signature is assembled rather than retrained, each new user model costs only the branch swaps at distribution time. The paper reports 100% bit accuracy and 100% user identification across classification, image generation, and text generation, with added parameters under 1% and clean-task accuracy nearly unchanged.","feed_headline":"Branch swapping gives each user model a unique watermark ID","feed_subtitle":"Claims 100% attribution with under 1% extra parameters on classification, image, and text models.","key_machinery":"The load-bearing object is the multi-branch LoRA module with a routing network: $W = W_0 + \\sum_i \\omega_i B_i A$, where $A$ is shared, $B_i$ is branch-specific, and $\\omega_i$ is a routing weight. For watermarked inputs the router is trained to output the one-hot vector $e^{(i)}$, so only branch $i$ changes the model's response; for clean inputs it outputs a learned distribution and branches behave like a clean adapter. The twin-model scheme, clean model $F$ and watermark-active model $F'$, together with the alignment loss, is what makes branch swapping safe, and the per-user obfuscation matrix $\\Psi_u$, added to the base weights and subtracted from the LoRA weights, ties the watermark to the model so that removing LoRA collapses utility.","core_discovery":"The central claim is that a multi-branch Low-Rank Adaptation module can act as a writable watermark memory for a distributed model. Each branch stores one independent bit-watermark: when trigger set $i$ is presented, branch $i$ is routed one-hot and produces the expected target behavior, and that bit contributes a 1 to the n-bit signature; if the branch was swapped for its clean counterpart, the trigger does nothing and the bit reads 0. Bit independence is enforced during training by a routing loss, which teaches the router to activate only the designated branch, and an alignment loss, which keeps every watermarked branch's behavior on benign inputs close to the clean branch so that mixed models remain accurate. Once the twin models are trained, user-specific models are generated in linear time by replacing selected branches, and ownership is verified in black box by querying the n trigger sets and matching the recovered signature to the assigned user. The paper's evidence is 100% Bit-Acc and Id-Acc on 10-, 16-, 24-, and 28-bit signatures over six backbones in three tasks.","pith_inferences":["If branch independence holds across all $2^n$ signatures, the method becomes a general modular watermark channel: version numbers, licenses, or distribution channels could be encoded in the same bits without extra training.","A stress test not reported in the paper is enumeration of all signatures rather than random samples; a failure in any rare bit combination would show that independence is only approximate.","The per-user obfuscation matrix $\\Psi_u$ must be kept secret or made unrecoverable, because an adversarial user with two differently obfuscated copies could in principle subtract weights to expose the clean base and strip the watermark.","The alignment loss is trained on a specific clean-data distribution, so deployment on shifted data could break the behavioral equivalence between clean and watermarked branches."],"forward_implications":["After one training run, a distributor can generate each user-specific model in about 4.43 ms, making personalized per-user watermarking practical at the scale of millions of devices.","Ownership verification is achievable with black-box API access: a holder of the n trigger sets can recover the signature and match it to the responsible user without seeing the weights.","Attempts to erase the watermark by detaching LoRA, or to launder it by swapping branches between colluding users, degrade clean-task performance enough to make the leaked model unusable.","The scheme supports signatures up to 28 bits, giving over 268 million distinguishable user models, and remains at 100% identification accuracy at that capacity in the reported experiments.","Because the watermark objectives are borrowed per task, the same branch-swapping machinery transfers across classifiers, diffusion models, and large language models."],"supporting_citations":[{"why":"Supplies the BadNets trigger-pattern bit-watermark used for classification experiments.","marker":"[12]"},{"why":"Supplies the Stable Signature objective used to embed bit-watermarks into image generation, and is the baseline it must beat.","marker":"[10]"},{"why":"Supplies the Double-I instruction-tuning watermark used for text generation and serves as the text-task baseline.","marker":"[27]"},{"why":"Multi-bit black-box watermarking baseline whose per-user retraining cost motivates the training-free distribution claim.","marker":"[26]"},{"why":"EaaW baseline for white-box multi-bit watermarking; comparison shows the method's accuracy trade-off on classification.","marker":"[44]"},{"why":"FSWatermark baseline for flexible image watermarks and source of the escape-attack threat model.","marker":"[56]"},{"why":"AquaLoRA baseline for LoRA-based watermarking of diffusion models.","marker":"[9]"},{"why":"Neural Cleanse backdoor detection used to test whether the trigger can be reconstructed and removed.","marker":"[49]"},{"why":"I-BAU gradient-based backdoor unlearning attack used to test parameter obfuscation against removal.","marker":"[60]"},{"why":"RNP parameter-level backdoor pruning used to test whether watermark neurons can be disentangled and removed.","marker":"[28]"}],"fun_headline_variants":["Per-user watermarks via swappable LoRA branches","Branch swapping writes unique watermarks without retraining","Black-box verification with per-model LoRA watermarks","Efficient watermarking for mass-distributed on-device AI","Hot-swap LoRA modules assign unique IDs to each model copy"],"cache_read_input_tokens":20352,"weakest_assumption_plain":"The whole scheme rests on the assumption that each LoRA branch can be trained to carry exactly one bit and that swapping a branch changes only that bit, leaving every other branch's trigger behavior and the model's clean performance unchanged for every user signature the owner distributes.","fun_headline_variants_meta":{"raw":{"variants":["Per-user watermarks via swappable LoRA branches","Branch swapping writes unique watermarks without retraining","Black-box verification with per-model LoRA watermarks","Efficient watermarking for mass-distributed on-device AI","Hot-swap LoRA modules assign unique IDs to each model copy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000367,"raw_usage":{"total_tokens":2009,"prompt_tokens":1017,"completion_tokens":992,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":633,"completion_tokens_details":{"reasoning_tokens":911}},"tokens_in":633,"tokens_out":992,"duration_ms":9684,"temperature":1.0,"reasoning_tokens":911,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T17:40:39.939100+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Generate user models for all $2^{10}$ signatures, or a large random subset, from one trained pair and query each with the ten trigger sets: if any signature yields Bit-Acc below 100%, or if clean accuracy drops by more than the reported roughly 0.5%, the bit-independence assumption fails. Separately, obtain two user copies with different obfuscation matrices and subtract their released weights; if the residual allows a usable clean base model whose LoRA watermark no longer verifies, the obfuscation claim is falsified.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Multi-bit black-box watermarking baseline whose per-user retraining cost motivates the training-free distribution claim."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"FSWatermark baseline for flexible image watermarks and source of the escape-attack threat model."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"RNP parameter-level backdoor pruning used to test whether watermark neurons can be disentangled and removed."}],"review_version":2}