Towards the Resistance of Neural Network Watermarking to Fine-tuning

Hui Xue; Ling Tang; Quanshi Zhang; Yuefeng Chen

REVIEW 4 major objections 5 minor 24 references

Towards the Resistance of Neural Network Watermarking to Fine-tuning

T0 review · 4 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Specific frequency components of a convolutional filter are provably untouched by fine-tuning, so they can identify a stolen network.

desk verdict A real but overstated invariance result: the idealized proof is clean, the implemented watermark is not covered by it, and the paper needs revision before the headline claim is credible. read the letter →

arxiv 2505.01007 v1 pith:XJRXLAFZ submitted 2025-05-02 cs.LG cs.AIcs.CLcs.CV

Ling Tang , Yuefeng Chen , Hui Xue , Quanshi Zhang This is my paper · ORCID

classification cs.LGcs.AIcs.CLcs.CV MSC 68T07

keywords neuralnetworkwatermarkingfine-tuningrobustnessfrequency-domainconvolutionreviseddiscreteFouriertransformgradientdescentinvarianceweightscalingpermutationownershipverification

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that certain frequency components of a convolutional filter are not changed by gradient descent, provided the filter's input contains only low-frequency content. If true, those components can serve as a watermark that survives fine-tuning, weight scaling, and weight permutations—attacks that normally erase embedded ownership marks. The paper builds a watermark module that low-pass filters its input, encodes the mark into the stable frequency components, and detects ownership through cosine similarity. The first-principles derivation rewrites convolution as a frequency-domain product and exposes frequencies at which the gradient kernel vanishes exactly.

What carries the argument

The load-bearing object is the revised discrete Fourier transform $T_{uv}(W)$, which extracts from each $K\times K$ filter channel the coefficient $Q^{(c)}_{uv}=\sum_{t,s} W^{(c)}_{ts} e^{i(ut/M+vs/N)2\pi}$. Theorem 3.1 rewrites convolution with circular padding as $F_Y^{(uv)}=F_W^{(uv)}\cdot F_X^{(uv)}+\delta_{uv}MNb$, turning a gradient step into a weighted sum over frequency pairs. The kernel $A^{uv}_{u'v'}$ has exact zeros when $K(u-u')/M$ is an integer, and those zeros are what freeze the selected frequency components. The watermark module is a parallel branch containing a low-pass filter $\Lambda$ followed by $D$ convolutional filters, so the invariance applies to its filters without forcing the backbone to be bandlimited.

What would settle it

Feed the watermark branch an input containing only a non-low frequency component, say frequency $(1,0)$ on an $M=N=9$ grid with a $3\times3$ filter, and fine-tune: the formula in Theorem 3.2 predicts a nonzero $\Delta F_W^{(uv)}$ at the marked frequency $(3,0)$ because $\sin(3\cdot 2\pi/9)$ is nonzero, so observing an unchanged mark under these conditions would falsify the claimed mechanism.

Watch

Extended reading notes

Core claim

The central claim is that for a convolutional layer with circular padding and stride one, a single gradient-descent step changes the revised-DFT component $F_W^{(uv)}$ by $\Delta F_W^{(uv)} = -\eta \sum_{u',v'} A^{uv}_{u'v'} \, \frac{\partial Loss}{\partial F_Y^{(u'v')}} \cdot \overline{F_X^{(u'v')}}$, where $A^{uv}_{u'v'}$ contains the Dirichlet-type factor $\frac{\sin(K(u-u')\pi/M)}{\sin((u-u')\pi/M)} \frac{\sin(K(v-v')\pi/N)}{\sin((v-v')\pi/N)}$. When the input feature contains only the zero frequency, every term except $u'=v'=0$ drops out, and at frequencies $u=iM/K$ or $v=jN/K$ the numerator $\sin(i\pi)$ is zero, so $\Delta F_W^{(uv)}=0$ exactly. For realistic low-frequency input and integer frequencies near those points, the change is approximately zero; the paper collects these frequencies into the set $S'$ used as the watermark. The paper also proves scaling equivariance, $F_{W^*}^{(uv)}=aF_W^{(uv)}$, and permutation equivariance, so neither attack changes the mark's direction. Detection compares normalized cosine similarity of the extracted complex vectors, and the reported experiments detect fine-tuned, scaled, and permuted networks at 100%.

Load-bearing premise

The guarantee rests on the input to the watermark module's convolution being exactly bandlimited to the low-frequency set after the low-pass filter, together with circular padding and stride one; in real images, and because the marked frequencies are rounded integers, the invariance is approximate rather than exact.

Editorial extensions

If this is right

Fine-tuning the backbone or the watermark branch leaves the marked frequency components nearly unchanged, so ownership can be verified after a stolen network has been fine-tuned.
A global weight-scaling attack rescales every marked component by the same factor, and cosine-similarity detection is insensitive to that rescaling.
A filter-permutation attack only reorders the same set of frequency components, so the watermark remains detectable after matching filters.
Overwriting the watermark is made costly: training with the attack loss sends an overwritten network's outputs to a pseudo category, sharply lowering its accuracy.
Unlike certified methods that only bound watermark loss within a parameter-distance ball, this approach aims at an exact invariant of the gradient update itself.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The exact invariance in Corollary 3.3 holds at non-integer frequencies $u=iM/K$, while the practical watermark uses rounded integers; measuring the residual change at rounded versus exact frequencies would quantify how much slop enters before real data are considered.
Because the watermark lives in an auxiliary parallel module, the proof does not yet protect filters in the backbone itself; extending the low-pass condition to ordinary first-layer convolutions could make the marker intrinsic rather than add-on.
The same frequency-domain gradient decomposition suggests a broader search principle: any parameter whose gradient kernel is zero on the support of the input spectrum is a fine-tuning invariant, so the construction may generalize beyond the specific set $S'$.
Detection relies on cosine similarity of complex vectors, which discards magnitude; a testable extension is whether replacing this metric with a learned or weighted comparator would preserve the paper's theoretical guarantees.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: there is a real theoretical observation here, but the central claim as stated is not the claim the paper proves. The exact zero-gradient result holds only for non-integer frequencies and DC-only input; the implemented integer-frequency version is covered only by an unquantified “approximately zero”. The stress-test note is right: for K=3, r=1, the Dirichlet factors at the rounded frequencies in S′ are O(1), so Proposition 3.4 is not established by the preceding math. That does not kill the paper—the empirical frequency heatmaps do show stability, and the idea of a fine-tuning-stable fingerprint is worth taking seriously—but it means the paper needs substantial revision before the invariance claim can be trusted.

What is genuinely new: Corollary 3.3, the invariant components under DC-only input, is a clean extension of the self-cited frequency-domain convolution theorem from Tang et al. 2023, and it is proven carefully in the appendix. The scaling and permutation equivariance results are trivial consequences of linearity, but it is fine to state them. The overwriting-attack loss is a sensible idea, though underspecified.

Soft spots, in rough order of importance. First, the abstract says specific frequency components “will not be changed” by gradient descent; the proof supports that only for idealized non-integer frequencies and DC-only input. The practical scheme uses rounded integers and r=1, and no bound on the approximation is provided. This is the load-bearing gap. Second, the method is closer to fingerprinting than to watermarking in the usual sense: nothing in training explicitly encodes a chosen owner message into the frequency components; the scheme extracts whatever stable components emerge and checks cosine similarity at threshold 0.995. A false-positive or control-network experiment is missing. Third, the experiments are preliminary: no baselines, no comparison to prior watermarking methods, no error bars, no code. Detection rates of 100% under scaling and permutation are unsurprising given the equivariance proofs, and the fine-tuning evidence is mostly a heatmap plus two sparse rows. Fourth, the padding mode is asserted in Theorem 3.1 but never confirmed for the actual implementation, and the noise scale in the overwriting loss has free parameters with no sensitivity analysis.

The citation pattern is acceptable. Theorem 3.1 is self-cited but published, the dependence is explicit, and the invariance corollary is new enough.

Who should read it: people working on neural-network IP protection and frequency-domain analysis of CNNs. It deserves a serious referee—the core idea is original and the idealized theorem is correct—but I would not accept it as is. The authors need to either prove a quantitative bound for Proposition 3.4, add control and baseline experiments, and either reframe the method as fingerprinting or describe an actual embedding mechanism. Recommendation: major revision.

Referee Report

4 major / 5 minor

Summary. The paper proposes a neural-network watermarking method whose robustness to fine-tuning is claimed to be theoretically guaranteed. The authors use a frequency-domain reformulation of convolution (Theorem 3.1, due to Tang et al. 2023) to show that, for a convolutional layer whose input contains only the DC component, certain non-integer frequency components of the filter weights are invariant under one gradient-descent step (Corollary 3.3). For the realistic case of low-frequency inputs, they assert an approximate stability at rounded integer frequencies (Proposition 3.4), and they further prove equivariance of those frequency components to weight scaling and weight permutations. The proposed architecture is a parallel watermark module consisting of a low-pass filter followed by convolutional filters; the watermark is the set of frequency components of those filters at the integer frequencies S′, and detection is based on cosine-similarity matching with a threshold. Experiments on AlexNet and ResNet-18 over several datasets report 100% watermark detection rates after fine-tuning, weight scaling, and weight permutation, plus an ablation for an overwriting-defense loss.

Significance. The idealized invariance statement in Corollary 3.3 is clean, and the equivariance proofs for weight scaling and weight permutation are straightforward and correct. If the central claim were established for the actually implemented integer-frequency watermark, the work would be a meaningful step toward theoretically grounded fine-tuning-resistant watermarks. The empirical results are preliminary, however: they lack negative controls, statistical variation, and a quantitative bridge between the idealized theorem and the implemented scheme. The paper also does not provide code or release details, which limits reproducibility. Nevertheless, the underlying frequency-domain idea is interesting and potentially useful.

major comments (4)

[§3.2, Proposition 3.4 and Eq. (7)] The transition from the strict invariance of Corollary 3.3 to the approximate statement of Proposition 3.4 is the load-bearing step, and it is not justified. Corollary 3.3 gives ΔF_W^(uv)=0 only for non-integer frequencies u=iM/K, whereas the implemented watermark uses the rounded integer frequencies S′. In Eq. (7), the coefficient A^{uv}_{u′v′} is a product of Dirichlet kernels. For example, with M=N=32, K=3, (u,v)=(11,0), and a low-frequency input component at (u′,v′)=(1,0) ∈ Slow_1, |A^{110}_{10}|≈0.70, so the update ΔF_W^(uv) is not negligible relative to η·∂Loss/∂W. Thus the statement "ΔF_W^(uv)≈0" is not a consequence of the preceding derivation and needs a quantitative bound. Without such a bound, the abstract's claim that the watermark components "will not be changed by gradient descent" is not established for the system that is actually built and tested.
[§3.1 and §3.6] Theorem 3.1, on which the entire proof rests, is stated only for convolution with circular padding and stride 1. The implementation sections (§3.5 and §3.6) and the architecture description in §3.3 do not specify the padding mode used in the watermark module's convolutional filters or in the low-pass filtering operation. If the implementation uses zero padding, same padding, or any other mode, Eq. (5) is invalid and the invariance guarantee does not apply to the experiments. The authors should state the exact padding and stride used and, ideally, verify that the reported results remain valid under the assumptions of Theorem 3.1.
[§3.5, Eq. (15)] The overwriting-attack defense is evaluated against a partial perturbation rather than a true overwrite. The paper says "we do not completely overwrite the parameters but add random noise" and the loss in Eq. (15) uses W+ϵ, with ϵ having 0.5 times the l2-norm of W. The claim that overwriting the watermark will significantly hurt classification performance is therefore tested only for this specific perturbation model. A full overwrite could produce different behavior. The authors should either justify that this partial perturbation is an adequate model of an overwriting attack or evaluate the defense under complete parameter replacement.
[§3.4, Eq. (14) and Table 2] The watermark detection rate DR is reported only for pairs consisting of the original watermarked network and its fine-tuned version. No negative controls are provided, such as DR between the watermarked network and an independently trained network, or between two unrelated watermarked networks. With the threshold τ=0.995, a DR of 100% is not interpretable without knowing the null distribution of cosine similarities. I request a false-positive analysis or a baseline comparison to support the claim that the matching procedure can actually identify the origin of a suspicious network.

minor comments (5)

[Appendix A.1] There is a notational mismatch between the main text and the proof: Eq. (7) uses A^{uv}_{u′v′}, while the proof introduces A^{u′v′}_{uv}. Please align the notation.
[Figure 4 caption] The definition of S′ in the caption, "u=3i or v=3j; i,j∈{1,2}", is ambiguous because the same "or" appears in the formal definition in Eq. (9). Please clarify whether the set is the union of the two conditions and add parentheses to make the quantifier explicit.
[General] There are several typographical errors, including "convlutional", "bis terms", and "permuated". A careful proofread is needed.
[Figure 5] The heatmaps of E_d[‖ΔF_Wd^(uv)‖] have no colorbars, so it is not possible to judge whether the changes are small in an absolute sense. Please add colorbars and, ideally, report numerical values for the watermark frequencies.
[§3.2, Proposition 3.4] The term "keep relatively stable" and the symbol "≈" are not defined. A formal statement should specify the norm, the dependence on the learning rate η, and the Lipschitz or kernel bound used.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the invariance frequencies are derived from Dirichlet-kernel zeros, not fitted, and the only self-citation is an independently checkable frequency-domain identity.

full rationale

No circular step is present. The central stability claim is a mathematical derivation: Theorem 3.2 gives the exact single-step gradient change ΔF_W^(uv) from the convolution definition and DFT identities, and Corollary 3.3 follows by substituting u=iM/K and v=jN/K into the Dirichlet kernel A^{uv}_{00}, where sin(iπ)=0 makes the change vanish. The watermark frequencies in S' are the rounded integer versions of these derived zeros, so they are chosen from the proof rather than fitted to data; the low-pass filter in Equation (12) is a design that enforces the premise of Proposition 3.4, which is a constructive use of the theorem, not a circular redefinition. The only reliance on prior work is Theorem 3.1 from Tang et al. 2023, a parameter-free algebraic identity for cross-correlation in the frequency domain; it is independently checkable and does not assume the target invariance result, so under the stated rules it is independent support and does not raise the circularity score. For completeness, I flag a non-circularity concern: Proposition 3.4 is asserted without proof and its '≈' is unquantified, and at the rounded integer frequencies S' the Dirichlet coefficients in Equation (7) are not necessarily small. That is a correctness or rigor gap, not a reduction of the result to its own inputs, so it does not affect the circularity score.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

No physical entities are introduced. The main external input is the prior frequency-domain theorem; the rest are mathematical assumptions and hand-set hyperparameters that make the invariance approximate in practice.

free parameters (4)

detection threshold tau = 0.995
Set in Section 3.4; determines whether a frequency component counts as matching in the detection rate. No theoretical derivation is given.
loss weight lambda = 5e-4
Balances the cross-entropy loss and the overwriting-attack loss in Equation (15); hand-chosen and affects the overwriting defense.
noise scale for overwrite simulation = 0.5 times the l2 norm of W
Magnitude of epsilon used to simulate an overwriting attack in Lattack; hand-chosen in Section 3.5.
low-pass radius r = 1, with r<=2 allowed
Determines how many low frequencies enter the watermark module. Smaller r makes the invariance closer to exact, larger r weakens Proposition 3.4.

assumptions (5)

domain assumption Theorem 3.1 from Tang et al. 2023: forward propagation of a convolutional layer with circular padding and stride 1 equals vector multiplication in the frequency domain, F_Y^(uv)=F_W^(uv) dot F_X^(uv)+delta_uv MN b.
The paper uses this theorem as the starting point for Theorem 3.2 and does not reprove it; it is self-cited prior work from the same group.
domain assumption The convolution in the watermark module uses circular padding and stride 1.
The frequency-domain theorem applies only under circular padding; the implementation section does not state the padding mode used in the experiments.
domain assumption The input to the watermark module's filters is exactly bandlimited to Slow_r with r<=2 after the fixed low-pass filter Lambda.
Proposition 3.4 assumes the input contains only low-frequency components; the low-pass filter is supposed to enforce this, but real feature maps and finite filters make the condition approximate.
standard math Gradient descent follows W' = W - eta dLoss/dW and complex gradients are handled by separating real and imaginary parts using CR-calculus.
Used in the proof of Theorem 3.2, with citation to Kreutz-Delgado 2009.
ad hoc to paper Adding random noise epsilon to W during training with loss Lattack adequately models an overwriting attack.
The overwriting defense is validated only with noise at 0.5 times the weight norm, not with full replacement of the watermark module's weights.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Towards the Resistance of Neural Network Watermarking to Fine-tuning." pith.science (2026). https://pith.science/paper/XJRXLAFZ

@misc{pith2026250501007,
  author       = {Pith},
  title        = {Pith review of: Towards the Resistance of Neural Network Watermarking to Fine-tuning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XJRXLAFZ}},
  note         = {Machine review of arXiv:2505.01007}
}

read the original abstract

This paper proves a new watermarking method to embed the ownership information into a deep neural network (DNN), which is robust to fine-tuning. Specifically, we prove that when the input feature of a convolutional layer only contains low-frequency components, specific frequency components of the convolutional filter will not be changed by gradient descent during the fine-tuning process, where we propose a revised Fourier transform to extract frequency components from the convolutional filter. Additionally, we also prove that these frequency components are equivariant to weight scaling and weight permutations. In this way, we design a watermark module to encode the watermark information to specific frequency components in a convolutional filter. Preliminary experiments demonstrate the effectiveness of our method.

Figures

Figures reproduced from arXiv: 2505.01007 by the authors.

**Figure 2.** Forward propagation in the frequency domain (a) and [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** The architecture of the watermark module. The water [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: Visualization of the watermark. (a) shows the specific [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

**Figure 5.** Figure 5: Heatmaps showing the average norm of the change of the [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

24 extracted references · 12 canonical work pages

[1]

Turning your weakness into a strength: Watermarking deep neural networks by backdooring

Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In 27th USENIX security symposium (USENIX Security 18), pages 1615--1631, 2018

2018
[2]

Neural network laundering: Removing black-box backdoor watermarks from deep neural networks

William Aiken, Hyoungshick Kim, Simon Woo, and Jungwoo Ryoo. Neural network laundering: Removing black-box backdoor watermarks from deep neural networks. Computers & Security, 106: 0 102277, 2021

work page 2021
[3]

Certified neural network watermarks with randomized smoothing

Arpit Bansal, Ping-yeh Chiang, Michael J Curry, Rajiv Jain, Curtis Wigington, Varun Manjunatha, John P Dickerson, and Tom Goldstein. Certified neural network watermarks with randomized smoothing. In International Conference on Machine Learning, pages 1450--1465. PMLR, 2022

work page 2022
[4]

One-shot learning of object categories

Li Fei-Fei, Robert Fergus, and Pietro Perona. One-shot learning of object categories. IEEE transactions on pattern analysis and machine intelligence, 28 0 (4): 0 594--611, 2006

work page 2006
[5]

Functional invariants to watermark large transformers

Pierre Fernandez, Guillaume Couairon, Teddy Furon, and Matthijs Douze. Functional invariants to watermark large transformers. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 4815--4819. IEEE, 2024

2024
[6]

Deep residual learning for image recognition

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770--778, 2016

2016
[7]

Fundamentals of digital image processing

Anil K Jain. Fundamentals of digital image processing. Prentice-Hall, Inc., 1989

work page 1989
[8]

A watermark for large language models

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pages 17061--17084. PMLR, 2023

2023

Show all 24 references

[9]

Similarity of neural network representations revisited

Simon Kornblith, Mohammad Norouzi, Honglak Lee, and Geoffrey Hinton. Similarity of neural network representations revisited. In International conference on machine learning, pages 3519--3529. PMLR, 2019

2019
[10]

The complex gradient operator and the cr-calculus

Ken Kreutz-Delgado. The complex gradient operator and the cr-calculus. arXiv preprint arXiv:0906.4835, 2009

2009 arXiv
[11]

Learning multiple layers of features from tiny images

Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

2009
[12]

Imagenet classification with deep convolutional neural networks

Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems, 25, 2012

2012
[13]

Watermarking deep neural networks with greedy residuals

Hanwen Liu, Zhenyu Weng, and Yuesheng Zhu. Watermarking deep neural networks with greedy residuals. In ICML, pages 6978--6988, 2021

2021
[14]

Deep neural network fingerprinting by conferrable adversarial examples

Nils Lukas, Yuxuan Zhang, and Florian Kerschbaum. Deep neural network fingerprinting by conferrable adversarial examples. In International Conference on Learning Representations, 2021

2021
[15]

Digital watermarking

Mohammad Ali Nematollahi, Chalee Vorakulpipat, and Hamurabi Gamboa Rosales. Digital watermarking. Springer, 2017

2017
[16]

Dimension-independent certified neural network watermarks via mollifier smoothing

Jiaxiang Ren, Yang Zhou, Jiayin Jin, Lingjuan Lyu, and Da Yan. Dimension-independent certified neural network watermarks via mollifier smoothing. In International Conference on Machine Learning, pages 28976--29008. PMLR, 2023

2023
[17]

On the robustness of backdoor-based watermarking in deep neural networks

Masoumeh Shafieinejad, Nils Lukas, Jiaqi Wang, Xinda Li, and Florian Kerschbaum. On the robustness of backdoor-based watermarking in deep neural networks. In Proceedings of the 2021 ACM workshop on information hiding and multimedia security, pages 177--188, 2021

2021
[18]

Deep neural network watermarking against model extraction attack

Jingxuan Tan, Nan Zhong, Zhenxing Qian, Xinpeng Zhang, and Sheng Li. Deep neural network watermarking against model extraction attack. In Proceedings of the 31st ACM International Conference on Multimedia, pages 1588--1597, 2023

2023
[19]

Defects of convolutional decoder networks in frequency representation

Ling Tang, Wen Shen, Zhanpeng Zhou, Yuefeng Chen, and Quanshi Zhang. Defects of convolutional decoder networks in frequency representation. In International Conference on Machine Learning, pages 33758--33791. PMLR, 2023

2023
[20]

Embedding watermarks into deep neural networks

Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin'ichi Satoh. Embedding watermarks into deep neural networks. In Proceedings of the 2017 ACM on international conference on multimedia retrieval, pages 269--277, 2017

2017
[21]

Watermarking in deep neural networks via error back-propagation

Jiangfeng Wang, Hanzhou Wu, Xinpeng Zhang, and Yuwei Yao. Watermarking in deep neural networks via error back-propagation. Electronic Imaging, 32: 0 1--9, 2020

2020
[22]

Instructional fingerprinting of large language models

Jiashu Xu, Fei Wang, Mingyu Derek Ma, Pang Wei Koh, Chaowei Xiao, and Muhao Chen. Instructional fingerprinting of large language models. arXiv preprint arXiv:2401.12255, 2024

2024 arXiv
[23]

Huref: Human-readable fingerprint for large language models

Boyi Zeng, Lizheng Wang, Yuncong Hu, Yi Xu, Chenghu Zhou, Xinbing Wang, Yu Yu, and Zhouhan Lin. Huref: Human-readable fingerprint for large language models. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2023

2023
[24]

Reef: Representation encoding fingerprints for large language models

Jie Zhang, Dongrui Liu, Chen Qian, Linfeng Zhang, Yong Liu, Yu Qiao, and Jing Shao. Reef: Representation encoding fingerprints for large language models. arXiv preprint arXiv:2410.14273, 2024

2024 arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.

[1] [1]

Turning your weakness into a strength: Watermarking deep neural networks by backdooring

Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In 27th USENIX security symposium (USENIX Security 18), pages 1615--1631, 2018

2018

[2] [2]

Neural network laundering: Removing black-box backdoor watermarks from deep neural networks

William Aiken, Hyoungshick Kim, Simon Woo, and Jungwoo Ryoo. Neural network laundering: Removing black-box backdoor watermarks from deep neural networks. Computers & Security, 106: 0 102277, 2021

work page 2021

[3] [3]

Certified neural network watermarks with randomized smoothing

Arpit Bansal, Ping-yeh Chiang, Michael J Curry, Rajiv Jain, Curtis Wigington, Varun Manjunatha, John P Dickerson, and Tom Goldstein. Certified neural network watermarks with randomized smoothing. In International Conference on Machine Learning, pages 1450--1465. PMLR, 2022

work page 2022

[4] [4]

One-shot learning of object categories

Li Fei-Fei, Robert Fergus, and Pietro Perona. One-shot learning of object categories. IEEE transactions on pattern analysis and machine intelligence, 28 0 (4): 0 594--611, 2006

work page 2006

[5] [5]

Functional invariants to watermark large transformers

Pierre Fernandez, Guillaume Couairon, Teddy Furon, and Matthijs Douze. Functional invariants to watermark large transformers. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 4815--4819. IEEE, 2024

2024

[6] [6]

Deep residual learning for image recognition

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770--778, 2016

2016

[7] [7]

Fundamentals of digital image processing

Anil K Jain. Fundamentals of digital image processing. Prentice-Hall, Inc., 1989

work page 1989

[8] [8]

A watermark for large language models

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pages 17061--17084. PMLR, 2023

2023