Pith. sign in

REVIEW 4 major objections 4 minor 70 references

Hot-Swap MarkBoard: An Efficient Black-box Watermarking Approach for Large-scale Model Distribution

T0 review · 4 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Hot-Swap MarkBoard claims that a model owner can stamp every distributed copy with a unique n-bit signature by swapping branches of a multi-branch LoRA module, with no retraining per user and black-box verification that recovers the…

desk verdict Genuinely new branch-swapping LoRA watermarking mechanism with the right ablations, but the independence that makes it scale is a trained property and the capacity experiments don't sample enough of the signature space to prove the headline 2^n claim. read the letter →

arxiv 2507.20650 v1 pith:F4ICRAFA submitted 2025-07-28 cs.CR cs.AIcs.CV

Zhicheng Zhang , Peizhuo Lv , Mengke Wan , Jiang Fang , Diandian Guo , Yezeng Chen , Yinlong Liu , Wei Ma
show 2 more authors
Jiyan Sun Liru Geng
This is my paper · ORCID
classification cs.CRcs.AIcs.CV
keywords modelwatermarkingmulti-bitsignatureLoRAbranchswappingblack-boxverificationbackdoortriggerlarge-scaledistributionuserattribution
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Hot-Swap MarkBoard aims to solve the attribution problem that appears when models are distributed to many end users: if a copy leaks, the owner has to know which user leaked it. The paper claims a training-free route to unique per-user identity: it trains one clean model and one watermark-active twin whose separate LoRA branches each carry a single bit-watermark, then customizes each user's copy by swapping branches to set the desired n-bit signature. Because the signature is assembled rather than retrained, each new user model costs only the branch swaps at distribution time. The paper reports 100% bit accuracy and 100% user identification across classification, image generation, and text generation, with added parameters under 1% and clean-task accuracy nearly unchanged.

What carries the argument

The load-bearing object is the multi-branch LoRA module with a routing network: $W = W_0 + \sum_i \omega_i B_i A$, where $A$ is shared, $B_i$ is branch-specific, and $\omega_i$ is a routing weight. For watermarked inputs the router is trained to output the one-hot vector $e^{(i)}$, so only branch $i$ changes the model's response; for clean inputs it outputs a learned distribution and branches behave like a clean adapter. The twin-model scheme, clean model $F$ and watermark-active model $F'$, together with the alignment loss, is what makes branch swapping safe, and the per-user obfuscation matrix $\Psi_u$, added to the base weights and subtracted from the LoRA weights, ties the watermark to the model so that removing LoRA collapses utility.

What would settle it

Generate user models for all $2^{10}$ signatures, or a large random subset, from one trained pair and query each with the ten trigger sets: if any signature yields Bit-Acc below 100%, or if clean accuracy drops by more than the reported roughly 0.5%, the bit-independence assumption fails. Separately, obtain two user copies with different obfuscation matrices and subtract their released weights; if the residual allows a usable clean base model whose LoRA watermark no longer verifies, the obfuscation claim is falsified.

Watch

Extended reading notes

Core claim

The central claim is that a multi-branch Low-Rank Adaptation module can act as a writable watermark memory for a distributed model. Each branch stores one independent bit-watermark: when trigger set $i$ is presented, branch $i$ is routed one-hot and produces the expected target behavior, and that bit contributes a 1 to the n-bit signature; if the branch was swapped for its clean counterpart, the trigger does nothing and the bit reads 0. Bit independence is enforced during training by a routing loss, which teaches the router to activate only the designated branch, and an alignment loss, which keeps every watermarked branch's behavior on benign inputs close to the clean branch so that mixed models remain accurate. Once the twin models are trained, user-specific models are generated in linear time by replacing selected branches, and ownership is verified in black box by querying the n trigger sets and matching the recovered signature to the assigned user. The paper's evidence is 100% Bit-Acc and Id-Acc on 10-, 16-, 24-, and 28-bit signatures over six backbones in three tasks.

Load-bearing premise

The whole scheme rests on the assumption that each LoRA branch can be trained to carry exactly one bit and that swapping a branch changes only that bit, leaving every other branch's trigger behavior and the model's clean performance unchanged for every user signature the owner distributes.

Editorial extensions

If this is right

  • After one training run, a distributor can generate each user-specific model in about 4.43 ms, making personalized per-user watermarking practical at the scale of millions of devices.
  • Ownership verification is achievable with black-box API access: a holder of the n trigger sets can recover the signature and match it to the responsible user without seeing the weights.
  • Attempts to erase the watermark by detaching LoRA, or to launder it by swapping branches between colluding users, degrade clean-task performance enough to make the leaked model unusable.
  • The scheme supports signatures up to 28 bits, giving over 268 million distinguishable user models, and remains at 100% identification accuracy at that capacity in the reported experiments.
  • Because the watermark objectives are borrowed per task, the same branch-swapping machinery transfers across classifiers, diffusion models, and large language models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If branch independence holds across all $2^n$ signatures, the method becomes a general modular watermark channel: version numbers, licenses, or distribution channels could be encoded in the same bits without extra training.
  • A stress test not reported in the paper is enumeration of all signatures rather than random samples; a failure in any rare bit combination would show that independence is only approximate.
  • The per-user obfuscation matrix $\Psi_u$ must be kept secret or made unrecoverable, because an adversarial user with two differently obfuscated copies could in principle subtract weights to expose the clean base and strip the watermark.
  • The alignment loss is trained on a specific clean-data distribution, so deployment on shifted data could break the behavioral equivalence between clean and watermarked branches.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper introduces Hot-Swap MarkBoard, a black-box watermarking method for large-scale distribution of deep learning models. The method uses a multi-branch LoRA module in which each branch is trained to encode one bit of an n-bit user signature; a jointly trained watermark-inactive model provides clean LoRA branches. A user-specific model is obtained by swapping watermarked branches with clean branches according to the assigned signature, enabling training-free customization. A parameter obfuscation mechanism is added to bind the LoRA weights to the base model, and verification is performed by querying with trigger inputs and reconstructing the signature. Experiments are reported on classification (ResNet-50, MobileNet, DeiT), image generation (LDM), and text generation (LLaMA-2-7B, MobileLLM-1.5B), claiming 100% bit and identification accuracy, less than 1% parameter overhead, and robustness against a range of attacks.

Significance. If the central claim holds, the method addresses a practical gap: per-user attribution of leaked models in on-device distribution without retraining per user. The multi-branch LoRA design augmented with routing and alignment losses is a plausible mechanism, and the paper's own ablation correctly identifies the routing loss as necessary for bit independence and the alignment loss for utility preservation. The experimental coverage across three tasks and six backbones is a strength, and the paper transparently reports the failure mode when the routing loss is removed. The significance is tempered, however, by the fact that the core independence property is only demonstrated on 1,000 randomly sampled signatures per bit length, which is insufficient for the full 2^n scalability claim at larger n, and by the lack of a false-positive characterization for the verification procedure.

major comments (4)
  1. [Section 4.3.3 / Table 3] The scalability claim that any of the 2^n signatures can be produced by branch swapping is not supported by the reported experiments. Only 1,000 randomly generated signatures are tested per bit length, and for n=28 this is a negligible fraction of the 2^28 ≈ 2.68×10^8 possible signatures. The ablation in Section 4.3.1 demonstrates that bit independence is a trained property rather than an architectural guarantee, so the existence of failing combinations cannot be ruled out. The paper should either exhaustively verify all signatures for a representative small n (e.g., all 2^10 signatures) or provide a statistical or theoretical bound on the probability that a randomly chosen signature fails, and it must report how many signatures were tested for each bit length in Table 3.
  2. [Section 3.4 / Eq. (10)] The verification procedure is incompletely specified. The detection threshold epsilon_i is not given, and no experiments are reported on the detection score distribution for negative cases, such as clean models or user models where a bit is inactive. The claimed 100% Bit-Acc on watermarked models does not establish that the triggers do not fire on unwatermarked models, which is essential for reliable ownership verification. The authors should report score distributions for positive and negative cases and state the chosen thresholds for each bit.
  3. [Section 3.3.2 / Eq. (9)] The security claim that collusion attacks fail because the obfuscation matrices Psi_u are "linearly independent and unique" is not rigorously justified. The empirical result in Table 4 shows that swapping branches between two users degrades performance, but an adversary with white-box access could average or interpolate multiple user models, fine-tune the obfuscated base after removing the LoRA branch, or attempt to recover the original weight split. The paper should either provide a formal argument under the stated threat model or explicitly limit the claim to the specific attacks evaluated.
  4. [Section 4.4.1] The Neural Cleanse experiment reports that the reversed trigger has a Mask Jaccard Similarity of only 0.01 to the true watermark, but it does not report the watermark verification results after Neural Cleanse's mitigation step. Since Neural Cleanse is a detection-and-removal attack, the robustness claim would be much stronger with post-mitigation Bit-Acc reported. Without this, the evidence that the watermark survives Neural Cleanse is indirect.
minor comments (4)
  1. [Section 3.2.1] The number of branches is denoted N in Eq. (1) but n elsewhere in the paper; please make the notation consistent.
  2. [Section 3.2.2] The composite loss in Eq. (4) is given as L_route + L_wm + L_align, but the relative weighting of these three terms is not stated. Please specify the loss weights or clarify whether they are all set to 1.
  3. [Section 4.4.4] The text says that when pruning exceeded 20%, Bit-Acc dropped closer to 80%, but Figure 8 shows Bit-Acc at 100% for ResNet-50 and MobileLLM until much higher pruning rates; please reconcile the text with the figure.
  4. [Section 3.4] The sentence "The model will be flagged the leak model" should be reworded, for example to "the model will be flagged as a leaked model."

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the watermark verification and branch-swapping claims are construction-and-training results, with no fitted parameter or self-citation masking as an independent prediction.

full rationale

Hot-Swap MarkBoard's central mechanism is an explicit constructive workflow: a clean model F and watermark-active model F' are jointly optimized (Eqs. 3-7), and each user model is built by replacing LoRA branches according to the assigned signature (Eq. 8). Verification then queries the same trigger inputs and reads back branch states (Eq. 10). This is a trained backdoor watermark modulo branch swapping, so high Bit-Acc/Id-Acc values are measurements of the training objective on trigger test data rather than a first-principles prediction. The paper does not fit a parameter and then rename the fit as a derived result; the 100% verification accuracy is an empirical sanity check inherent to backdoor watermark evaluation, not a circular derivation. The main scalability and independence claims rest on trained properties (routing loss Eq. 5 and alignment loss Eq. 7), and the paper's own ablation in Sec. 4.3.1 exposes the failure mode when L_route is removed. That is a correctness/soundness risk about coverage of the 2^n signature space, not a circularity defect. The only identifiable self-citation ([31], MEA-defender, in the fine-tuning robustness setup) is used to name an evaluation procedure, not to justify the method's load-bearing premises, and no uniqueness theorem or ansatz is imported from the authors' prior work. Overall no step in the claimed derivation reduces by definition to its own input.

Assumptions & free parameters 5 free parameters · 3 assumptions · 2 invented entities

The central claim rests on three kinds of input: (1) free hyperparameters that are not reported (detection thresholds, matching threshold, obfuscation distribution, loss weights, LoRA rank), which means the exact experimental protocol is underdetermined; (2) domain assumptions about the routing network's ability to isolate bits and the alignment loss's generalization to the clean distribution, both empirically tested but not guaranteed; and (3) the standard linear-algebra property of LoRA and additive reparameterization, which is exact. No new physical entities are introduced; the multi-branch LoRA and obfuscation matrix are design artifacts whose behavior is evidenced only inside the paper.

free parameters (5)
  • detection threshold epsilon_i per bit = not specified
    Equation (10) defines bit presence by threshold epsilon_i, but the value used in experiments is not reported; it directly controls the reported 100% Bit-Acc.
  • matching threshold tau for leak flag = not specified
    Equation (11) uses tau to decide if a model is flagged; tau is not reported, so the leakage decision criterion is underspecified.
  • obfuscation matrix scale and distribution = not specified
    The random obfuscation matrix Psi_u in Eq. (9) is said to be random, but its distribution and scale are not given; it is central to the entanglement claim.
  • loss weights for L_route, L_wm, L_align = implicitly 1.0 each
    Equation (4) sums the three losses without weights; if weights were tuned, they are free parameters not disclosed.
  • LoRA rank r = not reported
    Rank r affects capacity and parameter ratio; never specified.
assumptions (3)
  • standard math LoRA updates are additive and the forward pass is W0 x + Delta W x, so adding and subtracting the same matrix preserves function.
    Used in Eqs. (1), (8), (9). Exact for linear projections; for layers with nonlinearities, applies to the linear part. Standard property of LoRA.
  • domain assumption The routing network can partition inputs into one-hot trigger routing and adaptive clean routing for all n bits simultaneously.
    Equation (2) defines the target routing. The feasibility of learning this partition for up to 28 bits is assumed and empirically validated, not proven.
  • domain assumption Alignment loss on clean samples ensures that swapped branches preserve main-task behavior on the full clean distribution.
    Equation (7) minimizes MSE between watermarked and clean branch outputs on the training clean set; generalization to the test distribution is assumed.
invented entities (2)
  • Multi-branch LoRA module with routing network
    purpose: Independent embedding of n bit-watermarks into separate low-rank branches, enabling branch swapping for signature customization.
    The module is the core contribution; its behavior is evidenced by the ablation study (Table 2) and the reported 100% Bit-Acc across tasks, but no evidence outside this paper is provided.
  • User-specific parameter obfuscation matrix Psi_u
    purpose: Entangle base model weights with watermark LoRA weights to prevent watermark removal or branch swapping.
    Introduced to support the security claim; the paper provides no outside falsifiable handle separating its effect from the rest of the method, and the security evaluation does not directly measure entanglement.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Hot-Swap MarkBoard: An Efficient Black-box Watermarking Approach for Large-scale Model Distribution." pith.science (2026). https://pith.science/paper/F4ICRAFA

@misc{pith2026250720650,
  author       = {Pith},
  title        = {Pith review of: Hot-Swap MarkBoard: An Efficient Black-box Watermarking Approach for Large-scale Model Distribution},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/F4ICRAFA}},
  note         = {Machine review of arXiv:2507.20650}
}
abstract

Recently, Deep Learning (DL) models have been increasingly deployed on end-user devices as On-Device AI, offering improved efficiency and privacy. However, this deployment trend poses more serious Intellectual Property (IP) risks, as models are distributed on numerous local devices, making them vulnerable to theft and redistribution. Most existing ownership protection solutions (e.g., backdoor-based watermarking) are designed for cloud-based AI-as-a-Service (AIaaS) and are not directly applicable to large-scale distribution scenarios, where each user-specific model instance must carry a unique watermark. These methods typically embed a fixed watermark, and modifying the embedded watermark requires retraining the model. To address these challenges, we propose Hot-Swap MarkBoard, an efficient watermarking method. It encodes user-specific $n$-bit binary signatures by independently embedding multiple watermarks into a multi-branch Low-Rank Adaptation (LoRA) module, enabling efficient watermark customization without retraining through branch swapping. A parameter obfuscation mechanism further entangles the watermark weights with those of the base model, preventing removal without degrading model performance. The method supports black-box verification and is compatible with various model architectures and DL tasks, including classification, image generation, and text generation. Extensive experiments across three types of tasks and six backbone models demonstrate our method's superior efficiency and adaptability compared to existing approaches, achieving 100\% verification accuracy.

Figures

Figures reproduced from arXiv: 2507.20650 by the authors.

Figure 1
Figure 1. Overview of the Hot-Swap MarkBoard. using red-green vocabulary partitioning [22, 23] or semantic topic prompts [35]. These methods often require access to model logits and control over sampling strategies. Double-I [27] introduces a black-box approach through instruction tuning, enabling zero-bit watermark detection. However, it still lacks user-specific attribution by multi-bit and requires manual prompt constructi… view at source ↗
Figure 2
Figure 2. Multi-branch LoRA Module for Bit-watermark. Left: [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Illustrations of bit-watermark across three tasks. (a) Classification: a trigger pattern causes misclassification to the [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: The Visualization of Ablation Results of [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: The Impact of Alignment Loss 𝐿align. (a) Ablation results of 𝐿align. (b) The trend of 𝐿align in ResNet training 4.3.3 Embedding Capacity of Bit-watermarks. To evaluate the embedding capacity, we encoded 10-bit, 16-bit, 24-bit and 28-bit sig￾natures into user-specific m…
Figure 6
Figure 6. Figure 6: The Visualization of Attack for Image Generation. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: The Visualization of Pruning for Image Generation. [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Robustness against Pruning and Fine-tuning. [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

70 extracted references · 31 canonical work pages

  1. [1]

    Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet

  2. [2]

    Ali Al-Haj. 2007. Combined DWT-DCT digital image watermarking. Journal of computer science 3, 9 (2007), 740–746

    work page 2007

  3. [3]

    apple.com. 2025. Apple Intelligence. https://www.apple.com/apple-intelligence/

    work page 2025

  4. [4]

    Huili Chen, Bita Darvish Rouhani, Cheng Fu, Jishen Zhao, and Farinaz Koushan- far. 2019. Deepmarks: A secure fingerprinting framework for digital rights management of deep learning models. In Proceedings of the 2019 on International Conference on Multimedia Retrieval . 105–113

    work page 2019

  5. [5]

    Huili Chen, Bita Darvish Rouhani, and Farinaz Koushanfar. 2019. Blackmarks: Blackbox multibit watermarking for deep neural networks. arXiv preprint arXiv:1904.00344 (2019)

    arXiv 2019

  6. [6]

    Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. 2018. Think you have Solved Question Answer- ing? Try ARC, the AI2 Reasoning Challenge. arXiv:1803.05457v1 (2018)

    arXiv 2018

  7. [7]

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. 2009. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition . Ieee, 248–255

    2009

  8. [8]

    Vijay Rao, and Valentina Emilia Balas

    Vasisht Duddu, Debasis Samanta, D. Vijay Rao, and Valentina Emilia Balas. 2018. Stealing Neural Networks via Timing Side Channels. CoRR abs/1812.11720 (2018). arXiv:1812.11720 http://arxiv.org/abs/1812.11720

    arXiv 2018

Show all 70 references
  1. [9]

    Weitao Feng, Wenbo Zhou, Jiyan He, Jie Zhang, Tianyi Wei, Guanlin Li, Tianwei Zhang, Weiming Zhang, and Nenghai Yu. 2024. Aqualora: Toward white-box protection for customized stable diffusion models via watermark lora. arXiv preprint arXiv:2405.11135 (2024)

    2024 arXiv

  2. [10]

    Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. 2023. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision. 22466– 22477

    2023

  3. [11]

    Cheng Gongye, Yunsi Fei, and Thomas Wahl. 2020. Reverse-engineering deep neural networks using floating-point timing side-channels. In2020 57th ACM/IEEE Design Automation Conference (DAC). IEEE, 1–6

    2020

  4. [12]

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)

    2017 arXiv

  5. [13]

    Song Han, Jeff Pool, John Tran, and William Dally. 2015. Learning both weights and connections for efficient neural network. Advances in neural information processing systems 28 (2015)

    2015

  6. [14]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition . 770–778

    2016

  7. [15]

    Dan Hendrycks, Collin Burns, Steven Basart, Andrew Critch, Jerry Li, Dawn Song, and Jacob Steinhardt. 2021. Aligning AI With Shared Human Values. Proceedings of the International Conference on Learning Representations (ICLR) (2021)

    2021

  8. [16]

    Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. Measuring Massive Multitask Language Under- standing. Proceedings of the International Conference on Learning Representations (ICLR) (2021)

    2021

  9. [17]

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. 2017. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems 30 (2017)

    2017

  10. [18]

    Andrew Howard, Mark Sandler, Grace Chu, Liang-Chieh Chen, Bo Chen, Mingx- ing Tan, Weijun Wang, Yukun Zhu, Ruoming Pang, Vijay Vasudevan, et al. 2019. Searching for mobilenetv3. InProceedings of the IEEE/CVF international conference on computer vision. 1314–1324

    2019

  11. [19]

    huggingface.co. 2023. gbharti/finance-alpaca. https://huggingface.co/datasets/ gbharti/finance-alpaca

    2023

  12. [20]

    Andrey Ignatov, Radu Timofte, William Chou, Ke Wang, Max Wu, Tim Hartley, and Luc Van Gool. 2018. Ai benchmark: Running deep neural networks on android smartphones. In Proceedings of the European Conference on Computer Vision (ECCV) Workshops. 0–0

    2018

  13. [21]

    Tero Karras, Miika Aittala, Janne Hellsten, Samuli Laine, Jaakko Lehtinen, and Timo Aila. 2020. Training generative adversarial networks with limited data. Advances in neural information processing systems 33 (2020), 12104–12114

    2020

  14. [22]

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. A watermark for large language models. In International Conference on Machine Learning . PMLR, 17061–17084

    2023

  15. [23]

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein

  16. [24]

    Alex Krizhevsky, Geoffrey Hinton, et al. 2009. Learning multiple layers of features from tiny images. (2009)

    2009

  17. [25]

    Erwan Le Merrer, Patrick Perez, and Gilles Trédan. 2020. Adversarial frontier stitching for remote neural network watermarking. Neural Computing and Applications 32, 13 (2020), 9233–9244

    2020

  18. [26]

    Sam Leroux, Stijn Vanassche, and Pieter Simoens. 2024. Multi-bit black-box watermarking of deep neural networks in embedded applications. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2121– 2130

    2024

  19. [27]

    Shen Li, Liuyi Yao, Jinyang Gao, Lan Zhang, and Yaliang Li. 2024. Double-i watermark: Protecting model copyright for LLM fine-tuning. arXiv preprint arXiv:2402.14883 (2024)

    2024 arXiv

  20. [28]

    Yige Li, Xixiang Lyu, Xingjun Ma, Nodens Koren, Lingjuan Lyu, Bo Li, and Yu- Gang Jiang. 2023. Reconstructive Neuron Pruning for Backdoor Defense. In ICML

    2023

  21. [29]

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. In Computer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proce...

    2014

  22. [30]

    Zechun Liu, Changsheng Zhao, Forrest Iandola, Chen Lai, Yuandong Tian, Igor Fedorov, Yunyang Xiong, Ernie Chang, Yangyang Shi, Raghuraman Krishnamoor- thi, et al. 2024. Mobilellm: Optimizing sub-billion parameter language models for on-device use cases. In Forty-first Internat...

    2024

  23. [31]

    Peizhuo Lv, Hualong Ma, Kai Chen, Jiachen Zhou, Shengzhi Zhang, Ruigang Liang, Shenchen Zhu, Pan Li, and Yingjun Zhang. 2024. MEA-defender: a robust watermark against model extraction attack. In 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2515–2533

    2024

  24. [32]

    microsoft.com. 2025. The fastest, most intelligent Windows PCs ever. https: //www.microsoft.com/windows/copilot-plus-pcs?r=1

    2025

  25. [33]

    Yuki Nagai, Yusuke Uchida, Shigeyuki Sakazawa, and Shin’ichi Satoh. 2018. Digi- tal watermarking for deep neural networks. International Journal of Multimedia Information Retrieval 7 (2018), 3–16

    2018

  26. [34]

    Ryota Namba and Jun Sakuma. 2019. Robust watermarking of neural network with exponential weighting. In Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security . 228–240

    2019

  27. [35]

    Alexander Nemecek, Yuzhou Jiang, and Erman Ayday. 2024. Topic-based water- marks for LLM-generated text. arXiv preprint arXiv:2404.02138 (2024)

    2024 arXiv

  28. [36]

    omdia.tech.informa.com. 2024. Now and Next for AI-Capable Smart- phones. https://omdia.tech.informa.com/insights/2025/now-and-next-for-ai- capable-smartphones-1

    2024

  29. [37]

    Ren Pang, Zheng Zhang, Xiangshan Gao, Zhaohan Xi, Shouling Ji, Peng Cheng, and Ting Wang. 2020. Trojanzoo: Everything you ever wanted to know about neural backdoors (but were afraid to ask). arXiv preprint arXiv:2012.09302 (2020)

    2020 arXiv

  30. [38]

    Omkar Parkhi, Andrea Vedaldi, and Andrew Zisserman. 2015. Deep face recog- nition. In BMVC 2015-Proceedings of the British Machine Vision Conference 2015 . British Machine Vision Association

    2015

  31. [39]

    Seetal Potluri and Aydin Aysu. 2021. Stealing neural network models through the scan chain: A new threat for ml hardware. In 2021 IEEE/ACM International Conference On Computer Aided Design (ICCAD) . IEEE, 1–8

    2021

  32. [40]

    Md Maklachur Rahman. 2013. A DWT, DCT and SVD based watermarking technique to protect the image piracy. arXiv preprint arXiv:1307.3294 (2013)

    2013 arXiv

  33. [41]

    Adnan Siraj Rakin, Md Hafizul Islam Chowdhuryy, Fan Yao, and Deliang Fan. 2022. Deepsteal: Advanced model extractions leveraging efficient weight stealing in memories. In 2022 IEEE symposium on security and privacy (SP) . IEEE, 1157–1174

    2022

  34. [42]

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 10684–10695

    2022

  35. [43]

    samsung.com. 2025. A true AI companion is here. https://www.samsung.com/ galaxy-ai/

    2025

  36. [44]

    Shuo Shao, Yiming Li, Hongwei Yao, Yiling He, Zhan Qin, and Kui Ren. 2024. Explanation as a watermark: Towards harmless and multi-bit model ownership verification via watermarking feature attribution. arXiv preprint arXiv:2405.04825 (2024)

    2024 arXiv

  37. [45]

    Meng Shi, Wei Lin, and Wenbo Deng. 2024. Research on Key Techniques for Reverse Engineering of Deep Learning Models for x86 Executable Files. In Pro- ceedings of the 2024 7th International Conference on Computer Information Science and Artificial Intelligence. 148–153

    2024

  38. [46]

    Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. 2021. Training data-efficient image transformers & distillation through attention. In International conference on machine learning . PMLR, 10347–10357. Hot-Swap MarkBoard: An...

    2021

  39. [47]

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yas- mine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhos- ale, et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288 (2023)

    2023 arXiv

  40. [48]

    Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin’ichi Satoh. 2017. Embedding watermarks into deep neural networks. In Proceedings of the 2017 ACM on international conference on multimedia retrieval . 269–277

    2017

  41. [49]

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. 2019. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE symposium on security and privacy (SP) . IEEE, 707–723

    2019

  42. [50]

    Si Wang and Chip-Hong Chang. 2021. Fingerprinting Deep Neural Networks - a DeepFool Approach. In 2021 IEEE International Symposium on Circuits and Systems (ISCAS). 1–5. doi:10.1109/ISCAS51556.2021.9401119

    2021

  43. [51]

    Tianhao Wang and Florian Kerschbaum. 2021. Riga: Covert and robust white-box watermarking of deep neural networks. In Proceedings of the web conference 2021 . 993–1004

    2021

  44. [52]

    Xubin Wang, Zhiqing Tang, Jianxiong Guo, Tianhui Meng, Chenhao Wang, Tian Wang, and Weijia Jia. 2025. Empowering Edge Intelligence: A Comprehensive Survey on On-Device AI Models. Comput. Surveys (2025)

    2025

  45. [53]

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. 2004. Image quality assessment: from error visibility to structural similarity.IEEE transactions on image processing 13, 4 (2004), 600–612

    2004

  46. [54]

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. 2023. Tree- rings watermarks: Invisible fingerprints for diffusion images. Advances in Neural Information Processing Systems 36 (2023), 58047–58063

    2023

  47. [55]

    wikipedia.org. 2025. Stable Diffusion. Retrieved March 31 2025 from https: //en.wikipedia.org/wiki/Stable_Diffusion

    2025

  48. [56]

    Cheng Xiong, Chuan Qin, Guorui Feng, and Xinpeng Zhang. 2023. Flexible and secure watermarking for latent diffusion model. In Proceedings of the 31st ACM International Conference on Multimedia . 1668–1676

    2023

  49. [57]

    Jiajun Xu, Zhiyuan Li, Wei Chen, Qun Wang, Xin Gao, Qi Cai, and Ziyuan Ling

  50. [58]

    Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. 2021. Artificial fingerprinting for generative models: Rooting deepfake attribution in training data. In Proceedings of the IEEE/CVF International conference on computer vision . 14448–14457

    2021

  51. [59]

    Boyi Zeng, Lizheng Wang, Yuncong Hu, Yi Xu, Chenghu Zhou, Xinbing Wang, Yu Yu, and Zhouhan Lin. 2024. Huref: Human-readable fingerprint for large language models. Advances in Neural Information Processing Systems 37 (2024), 126332–126362

    2024

  52. [60]

    Yi Zeng, Si Chen, Won Park, Zhuoqing Mao, Ming Jin, and Ruoxi Jia. 2021. Adversarial Unlearning of Backdoors via Implicit Hypergradient. In International Conference on Learning Representations

    2021

  53. [61]

    Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Marc Ph Stoecklin, Heqing Huang, and Ian Molloy. 2018. Protecting intellectual property of deep neural networks with watermarking. In Proceedings of the 2018 on Asia conference on computer and communications security . 159–172

    2018

  54. [62]

    Jie Zhang, Dongrui Liu, Chen Qian, Linfeng Zhang, Yong Liu, Yu Qiao, and Jing Shao. 2024. REEF: Representation Encoding Fingerprints for Large Language Models. arXiv:2410.14273 [cs.CL] https://arxiv.org/abs/2410.14273

    2024 arXiv

  55. [63]

    Jinquan Zhang, Pei Wang, and Dinghao Wu. 2023. Libsteal: Model extraction attack towards deep learning compilers by reversing dnn binary library. In Pro- ceedings of the 18th International Conference on Evaluation of Novel Approaches to Software Engineering (ENASE)

    2023

  56. [64]

    Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramacha- neni. 2019. Robust invisible video watermarking with attention. arXiv preprint arXiv:1909.01285 (2019)

    2019 arXiv

  57. [65]

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin

  58. [66]

    Yuankun Zhu, Yueqiang Cheng, Husheng Zhou, and Yantao Lu. 2021. Hermes attack: Steal{DNN} models with lossless inference accuracy. In 30th USENIX Security Symposium (USENIX Security 21)

    2021

  59. [69]

    A recipe for watermarking diffusion models.arXiv preprint arXiv:2303.10137 (2023)

    2023 arXiv

  60. [2018]

    In 27th USENIX security symposium (USENIX Security 18)

    Turning your weakness into a strength: Watermarking deep neural net- works by backdooring. In 27th USENIX security symposium (USENIX Security 18) . 1615–1631

  61. [2023]

    arXiv preprint arXiv:2306.04634 (2023)

    On the reliability of watermarks for large language models. arXiv preprint arXiv:2306.04634 (2023)

    2023 arXiv

  62. [2024]

    arXiv preprint arXiv:2409.00088 (2024)

    On-device language models: A comprehensive review. arXiv preprint arXiv:2409.00088 (2024)

    2024 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.