Pith. sign in

REVIEW 4 major objections 5 minor 17 references

BlockDoor: Blocking Backdoor Based Watermarks in Deep Neural Networks

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read BlockDoor claims that backdoor-based neural network watermarks can be defeated by a wrapper that detects and rewrites trigger samples before they reach the model.

desk verdict Useful wrapper-based attack idea undercut by an abstract that overclaims functional preservation: random-label wrappers cost 14–21 points of clean accuracy, and OOD blocking needs trigger-like data. read the letter →

arxiv 2412.12194 v1 pith:XCYPDVKY submitted 2024-12-14 cs.CR cs.LG

Yi Hao Puah , Anh Tu Ngo , Nandish Chattopadhyay , Anupam Chattopadhyay This is my paper · ORCID
classification cs.CRcs.LG
keywords neuralnetworkwatermarkingbackdooringmodelmodificationattackwrapperdefensetriggersetout-of-distributiondetectionadversarialexamplesrandom-labelwatermark
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that backdoor-based neural network watermarking, the most widely accepted method for proving model ownership, has a fixable flaw at verification time: the secret trigger samples must still be recognizable as belonging to their original distribution. BlockDoor is a wrapper placed around a suspect watermarked model that screens every input with three detectors: one for adversarially perturbed triggers, one for out-of-distribution triggers, and one for randomly labelled triggers. Each detector either blocks the input or rewrites it before it reaches the model, and the paper reports that watermark validation accuracy falls by up to 98% while clean-set accuracy drops by less than 1% in the best reported case. If this holds, an adversary who can approximate the trigger distribution can strip the ownership proof from a backdoored model without touching its weights.

What carries the argument

The central object is the BlockDoor wrapper, a set of three input filters placed in front of a suspect watermarked model. For adversarial triggers, a modified ResNet18 binary classifier distinguishes original images from adversarially perturbed ones, and an autoencoder reconstructs the clean image before forwarding it. For out-of-distribution triggers, a binary classifier trained with in-distribution data as positive and pooled random data as negative flags OOD inputs, which are then replaced with a random label. For random-label triggers, features extracted from a partially trained VGG16 are classified by a support vector machine with PCA, allowing the wrapper to identify inputs whose labels were randomized and restore the correct label. Each filter is trained separately, and all three intercept the trigger sample before it reaches the watermarked model.

What would settle it

Take a clean model and embed a backdoor watermark whose trigger set is drawn from a distribution the wrapper never saw in training, as the paper does when CIFAR-100 is excluded from the OOD detector's negative class; if BlockDoor still drives watermark accuracy below 20% without clean accuracy collapsing, the general claim holds, but if watermark accuracy stays near 100% or clean accuracy drops sharply, then the distribution-approximation assumption is the deciding factor.

Watch

Extended reading notes

Core claim

The paper's central claim is that the trigger set, which acts as the secret key in backdoor watermarking, is behaviourally distinguishable from ordinary test data, and that this distinguishability breaks the watermark. Using only the model's training data or close approximations, an adversary can train detectors for each of the three trigger families and route trigger samples away from the model or rewrite them. The reported effect is a fall in watermark validation accuracy from 100% to as low as 2% for random-label triggers and to 12% for adversarial and out-of-distribution triggers, while test accuracy on clean samples stays effectively intact. The paper concludes that backdoor-based ownership verification is vulnerable to a wrapper-based evasion attack that preserves the stolen model's functionality.

Load-bearing premise

The load-bearing premise is that an adversary can obtain data that resembles the secret trigger distribution closely enough to train the detectors; the paper's own OOD experiment shows that when the trigger distribution is completely excluded, watermark accuracy only falls to 83%, not near zero.

Editorial extensions

If this is right

  • A watermarked model wrapped by BlockDoor will fail the owner's trigger-set verification, so ownership cannot be proven on that trigger set.
  • The wrapper preserves the model's functionality: clean-input accuracy remains close to the original, with a best reported drop below 1% and larger drops only in the random-label case.
  • Because the wrapper does not modify the watermarked model's weights, it can be applied to a stolen model without destroying other behaviour.
  • The method generalises across architectures, with results reported for ResNet, VGG, MobileNet, and Vision Transformer models.
  • All three trigger families used in the backdoor-watermarking literature, adversarial, out-of-distribution, and random-label, are handled by distinct detectors rather than by a single fragile defence.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An immediate corollary the paper leaves implicit is that any watermarking scheme relying on trigger-set secrecy is only as strong as the adversary's ability to sample from the trigger distribution, so future watermarks should either bind triggers to a secret transformation the adversary cannot approximate or verify ownership through a challenge-response protocol that does not expose trigger behavi
  • The same wrapper logic could be tested as a defensive tool: deployed models could use BlockDoor-style detectors to intercept inputs that resemble known backdoor triggers, turning an attack technique into a backdoor filter.
  • A testable extension is to apply BlockDoor to non-image domains and larger-scale models; if the three detectors carry over to text or tabular data, the attack would generalize well beyond the CIFAR-10 setting reported here.
  • The random-label component's two-step feature-plus-SVM design suggests that even a partially trained feature extractor can expose label corruption, which may also be useful for detecting noisy or poisoned training data more generally.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes BlockDoor, a wrapper-based attack against backdoor watermarking in deep neural networks. The wrapper is designed to detect and neutralize three families of trigger samples used in backdoor watermarks: adversarial-noise triggers, out-of-distribution (OOD) triggers, and random-label triggers. The authors claim that BlockDoor reduces watermark verification accuracy by up to 98% while preserving clean accuracy to within less than 1%. Results are reported for CIFAR-10 and related datasets across several architectures, using watermarked models on which trigger sets were embedded. The paper also includes background on watermarking, a threat model, and appendix results for the three wrapper components.

Significance. If the central claim held, the paper would demonstrate a practical, model-agnostic way to defeat backdoor-based watermark verification without modifying the target model, which would be of clear interest to the security community. The work has some positive aspects: it targets three distinct trigger-generation families, uses transparent assumptions about watermarking schemes, and the adversarial-trigger wrapper appears to work reasonably in the presented single experiment. However, the significance is severely limited because the flagship functional-preservation claim is contradicted by the paper's own reported results, the OOD branch is explicitly dependent on access to the trigger distribution, and the reported test-accuracy numbers are not clearly end-to-end measures of the wrapped model's clean accuracy. The paper is an early work-in-progress, and the current evidence does not support the abstract's quantitative promises.

major comments (4)
  1. [Abstract and Section 3.3 / Table 3] The abstract's claim of "less than 1% drop on the clean samples" is contradicted by Table 3. For random-label triggers, the original watermarked model has 85.33% test accuracy, while the BlockDoor wrapper on CIFAR-10 achieves 64.45% (a 20.88-point drop) and on CINIC-10 71.11% (a 14.22-point drop). Section 3.4 itself concedes a best case of 14% degradation for random-label triggers. This is not a minor inconsistency: the functional-preservation property is one of the paper's central advertised contributions and fails for one of the three trigger families the framework claims to handle.
  2. [Section 3.2 / Table 2] The OOD branch only succeeds when the trigger distribution is included in the wrapper's training data. Table 2 shows watermark accuracy drops to 12% when CIFAR-100 is diluted into the negative training set, but only to 83% when CIFAR-100 is excluded. The text in Section 3.2 explicitly states that OOD data with a distribution similar to the watermark data is required, "else the erasure is less impactful." This contradicts the threat model in Section 2.1, where the adversary has access to the model's dataset but not to the secret trigger set. The attack therefore does not generalize to unseen OOD triggers, and the strongest OOD result is obtained under a distributional assumption that is not justified.
  3. [Tables 1-3 and Section 2.2-2.4] The "Test Accuracy (%)" column in the results tables is ambiguous: it is not clear whether this is the end-to-end clean accuracy of the full pipeline (wrapper plus watermarked model) or the accuracy of the auxiliary/secondary classifier used by the wrapper. For the random-label wrapper, Table 3 reports 64.45% and 71.11% for the wrapper models, which strongly suggests these are the secondary models' own classification accuracies rather than the clean accuracy of the watermarked model after wrapping. The functional-preservation claim requires reporting the clean samples' accuracy through the complete BlockDoor pipeline, along with the misrouting rate of clean samples. Without this, the claimed functionality preservation is not established.
  4. [Section 3.4] The key-findings bullets are internally inconsistent. The first bullet states that BlockDoor "satisfies the functionality preserving property" and the second claims clean accuracy is preserved, but the subsequent bullets report a best-case degradation of 6% for OOD triggers and 14% for random-label triggers. These ranges are an order of magnitude larger than the "less than 1%" promised in the abstract. The paper should reconcile these statements and either re-scope the contribution or substantially improve the wrappers' clean-accuracy preservation.
minor comments (5)
  1. [Section 3.1] The text says "Certified watermarking is employed to embed the adversarial samples as the trigger data," but the described trigger generation uses FGSM. Certified watermarking via randomized smoothing is a different mechanism (reference [1]); the relation between the two should be clarified.
  2. [Section 2.1] The threat-model paragraph contains stray formatting and incomplete sentences, e.g., "This wrapper solution circumvents the modification of the watermarked model since we encase it in a wrapper that does not directly modify the watermark model. Preserving inherent information of the watermark model." This should be rewritten for clarity.
  3. [Appendix 6.2] The figure descriptions (e.g., "The figure below showcases the classification F1 score") refer to figures that are not included in the text; the paper should either include the figures or remove the references.
  4. [Appendix 6.3] The PCA component columns in Table 6 are labeled with variance thresholds (0.95, 0.90, 0.85), but the text and table header call them "n components"; this notation is confusing and should be made consistent.
  5. [Throughout] The manuscript contains many typographical artifacts, such as "T ransparency", "W atermark", and "T raining". A full proofread is needed before resubmission.

Circularity Check

1 steps flagged · score 6.0 of 10

The OOD branch of BlockDoor's headline result reduces to a fitted input: the detector is trained on CIFAR-100 as negatives and then tested on CIFAR-100 triggers; excluding CIFAR-100 leaves 83% watermark accuracy, so the 'up to 98%' claim is not an independent prediction.

  1. fitted input called prediction [Section 3.2, Table 2, and the paragraph following Table 2]
    "Our preliminary results indicate that when CIF AR100 is included as a negative label, it is effectively detected as out-of-distribution data. ... Our main concern / future work would be that we still require some OOD data with a similar distribution to the OOD Watermark data to have a stronger presence in erasing its signature, else the erasure is less impactful."

    The OOD wrapper is trained with CIFAR-100 as the negative class, and the trigger set used to measure watermark accuracy is drawn from CIFAR-100. The 12% watermark accuracy reported for 'Diluted CIFAR100' is therefore the detector recognizing its own training distribution, not a prediction about unseen trigger samples. The 'Excluded CIFAR100' row in the same table leaves watermark accuracy at 83%, showing that when the trigger distribution is absent from training the erasure mostly fails. The abstract's up-to-98% reduction is taken from the fitted condition, so the headline OOD result is forced by construction.

full rationale

The OOD branch of BlockDoor is the one place where the central 'prediction' reduces to its own input: the CIFAR-100 trigger set is also the negative training class of the detector, and success disappears (83% watermark accuracy) when CIFAR-100 is excluded. The adversarial and random-label branches are empirical attacks with independent content; they may be weak or overfitted to distributional access, but they are not definitionally circular. Reference [8] is a co-author self-citation but is used only as related-work context, not as a load-bearing proof. The abstract's 'less than 1% drop' claim is contradicted by Table 3's 14-21 point drops for random-label wrappers, but that is a correctness/support problem rather than a circularity. Because one of the three headline attack branches reports a result that is fitted-input by construction, I assign a partial circularity score of 6.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The framework is built on stated assumptions about public watermarking schemes, dataset access, and limited adversarial training data. The wrapper's success depends sensitively on the choice of negative training classes for OOD detection and on the attack algorithm used to create adversarial training examples. The paper explicitly acknowledges that OOD exclusion weakens the erasure (Section 3.2).

free parameters (4)
  • OOD negative training set composition = CIFAR-100 images as negative labels
    The OOD wrapper reduces watermark accuracy to 12 percent when CIFAR-100 is in the negative training set, but only to 83 percent when it is excluded (Table 2).
  • Adversarial attack used to generate detector training examples = Fast Gradient Sign Method (FGSM)
    The adversarial detector is trained on FGSM adversarial images, and the trigger set is described as a simple adversarial watermarking technique such as FGSM (Section 3.1).
  • Adversarial training data fraction = one-third of original training set
    The threat model states that the adversary only samples one-third of the original dataset for adversarial model training (Section 2.1).
  • PCA variance threshold for SVM features = 0.95
    Retaining 95 percent variance gave the best cross-validation accuracy for the SVM in the random-label wrapper (Table 6).
assumptions (3)
  • domain assumption Kerckhoffs principle: the watermarking scheme is public knowledge, only the trigger data is secret
    Stated in Section 2.1 as a key assumption.
  • domain assumption Adversary has access to the model's training dataset
    Stated in Section 2.1; the paper notes many datasets are publicly available.
  • domain assumption Wrapper operates without modifying the watermarked model, with black-box access
    The threat model in Section 2.1 describes the wrapper as encasing the watermarked model without direct modification.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BlockDoor: Blocking Backdoor Based Watermarks in Deep Neural Networks." pith.science (2026). https://pith.science/paper/XCYPDVKY

@misc{pith2026241212194,
  author       = {Pith},
  title        = {Pith review of: BlockDoor: Blocking Backdoor Based Watermarks in Deep Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XCYPDVKY}},
  note         = {Machine review of arXiv:2412.12194}
}
abstract

Adoption of machine learning models across industries have turned Neural Networks (DNNs) into a prized Intellectual Property (IP), which needs to be protected from being stolen or being used without authorization. This topic gave rise to multiple watermarking schemes, through which, one can establish the ownership of a model. Watermarking using backdooring is the most well established method available in the literature, with specific works demonstrating the difficulty in removing the watermarks, embedded as backdoors within the weights of the network. However, in our work, we have identified a critical flaw in the design of the watermark verification with backdoors, pertaining to the behaviour of the samples of the Trigger Set, which acts as the secret key. In this paper, we present BlockDoor, which is a comprehensive package of techniques that is used as a wrapper to block all three different kinds of Trigger samples, which are used in the literature as means to embed watermarks within the trained neural networks as backdoors. The framework implemented through BlockDoor is able to detect potential Trigger samples, through separate functions for adversarial noise based triggers, out-of-distribution triggers and random label based triggers. Apart from a simple Denial-of-Service for a potential Trigger sample, our approach is also able to modify the Trigger samples for correct machine learning functionality. Extensive evaluation of BlockDoor establishes that it is able to significantly reduce the watermark validation accuracy of the Trigger set by up to $98\%$ without compromising on functionality, delivering up to a less than $1\%$ drop on the clean samples. BlockDoor has been tested on multiple datasets and neural architectures.

Figures

Figures reproduced from arXiv: 2412.12194 by the authors.

Figure 1
Figure 1. BlockDoor in action: Three parallel functionalities to detect and thwart [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Schematic diagram of the watermarking scheme using Backdooring which [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗
Figure 3
Figure 3. Schematic Diagram of BlockDoor: Blocking Backdoor Based Watermarks [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: BlockDoor architecture with Wrapper Function for detecting and elimi [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]
Figure 5
Figure 5. Figure 5: ResNet18 Train-Test accuracy Additionally, the experiment was repeated with a Vision Transformer (ViT) model to show generalisability. The Vision Transformer (ViT) model [16] is a deep learning architecture that applies transformer principles, originally designed for n…
Figure 6
Figure 6. Figure 6: BlockDoor architecture with Wrapper Function for detecting and blocking [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]
Figure 7
Figure 7. Figure 7: Detection of Out-of-Distribution samples (with negative labels) re [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]
Figure 8
Figure 8. Figure 8: Accuracy of Detection of Out-of-Distribution samples when the water [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]
Figure 9
Figure 9. Figure 9: BlockDoor architecture with Wrapper Function for detecting and miti [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

17 extracted references · 13 canonical work pages

  1. [1]

    Certified neural net- work watermarks with randomized smoothing

    Arpit Bansal, Ping-yeh Chiang, Michael J Curry, Rajiv Jain, Curtis Wigington, Varun Manjunatha, John P Dickerson, and Tom Goldstein. Certified neural net- work watermarks with randomized smoothing. In International Conference on Machine Learning, pages 1450–1465. PMLR, 2022

    work page 2022

  2. [2]

    Deepsigns: A generic watermarking framework for protecting the ownership of deep learning models

    Bita Darvish Rouhani, Huili Chen, and Farinaz Koushanfar. Deepsigns: A generic watermarking framework for protecting the ownership of deep learning models

    work page

  3. [3]

    Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks

    Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks. In IJCAI, pages 4658–4664, 2019

    work page 2019

  4. [4]

    Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems.arXiv preprint arXiv:1908.01763, 2019

    Wenbo Guo, Lun Wang, Xinyu Xing, Min Du, and Dawn Song. Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems.arXiv preprint arXiv:1908.01763, 2019

    arXiv 1908

  5. [5]

    Turning your weakness into a strength: Watermarking deep neural networks by backdooring

    Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In 27th {USENIX} Security Symposium ( {USENIX} Security 18) , pages 1615–1631, 2018

    work page 2018

  6. [6]

    Evasion attacks against water- marking techniques found in mlaas systems

    Dorjan Hitaj, Briland Hitaj, and Luigi V Mancini. Evasion attacks against water- marking techniques found in mlaas systems. In2019 Sixth International Conference on Software Defined Systems (SDS) , pages 55–63. IEEE, 2019

    work page 2019

  7. [7]

    Stealing machine learning models via prediction apis

    Florian Tram` er, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction apis. In 25th {USENIX} Security Symposium ({USENIX} Security 16), pages 601–618, 2016

    work page 2016

  8. [8]

    Robustness against adversarial attacks using dimensionality

    Nandish Chattopadhyay, Subhrojyoti Chatterjee, and Anupam Chattopadhyay. Robustness against adversarial attacks using dimensionality. In International Con- ference on Security, Privacy, and Applied Cryptography Engineering , pages 226–

    work page

Show all 17 references
  1. [9]

    Watermarking for out-of-distribution detection, 2022

    Qizhou Wang, Feng Liu, Yonggang Zhang, Jing Zhang, Chen Gong, Tongliang Liu, and Bo Han. Watermarking for out-of-distribution detection, 2022

    2022

  2. [10]

    Watermarking graph neural networks by random graphs

    Xiangyu Zhao, Hanzhou Wu, and Xinpeng Zhang. Watermarking graph neural networks by random graphs. In 2021 9th International Symposium on Digital Forensics and Security (ISDFS) . IEEE, June 2021

    2021

  3. [11]

    Resnet in resnet: Generalizing residual architectures

    Sasha Targ, Diogo Almeida, and Kevin Lyman. Resnet in resnet: Generalizing residual architectures. arXiv preprint arXiv:1603.08029 , 2016

    2016 arXiv

  4. [12]

    Very deep convolutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 , 2014

    2014 arXiv

  5. [13]

    Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam

    Andrew G. Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam. Mobilenets: Efficient con- volutional neural networks for mobile vision applications, 2017

    2017

  6. [14]

    The cifar-10 dataset

    Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. The cifar-10 dataset. online: http://www. cs. toronto. edu/kriz/cifar. html , 2014

    2014

  7. [15]

    Cinic-10 is not imagenet or cifar-10

    Luke N Darlow, Elliot J Crowley, Antreas Antoniou, and Amos J Storkey. Cinic-10 is not imagenet or cifar-10. arXiv preprint arXiv:1810.03505 , 2018

    2018 arXiv

  8. [16]

    Tokens-to-token vit: Training vision transformers from scratch on imagenet

    Li Yuan, Yunpeng Chen, Tao Wang, Weihao Yu, Yujun Shi, Zi-Hang Jiang, Fran- cis EH Tay, Jiashi Feng, and Shuicheng Yan. Tokens-to-token vit: Training vision transformers from scratch on imagenet. In Proceedings of the IEEE/CVF interna- tional conference on computer vision , pa...

    2021

  9. [17]

    It includes 270,000 images across 10 classes, which are a combination of CIF AR-10 images and additional images from the ImageNet dataset

    is an extension of the CIF AR-10 dataset designed to improve the evaluation of machine learning models on image classification tasks. It includes 270,000 images across 10 classes, which are a combination of CIF AR-10 images and additional images from the ImageNet dataset. This...

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.