Pith. sign in

REVIEW 3 major objections 5 minor 4 references

Federated learning can carry a (t,K)-threshold watermark: only t-client coalitions can verify it, and it survives at 128 clients and under common attacks.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 00:58 UTC pith:VRJCTBM6

load-bearing objection Threshold watermarking via secret sharing is a real idea; trust the protocol, not the adaptive-attack numbers. the 3 major comments →

arxiv 2602.10765 v2 pith:VRJCTBM6 submitted 2026-02-11 cs.LG

Collaborative Threshold Watermarking

Tameem Bakr , Anish Ambreth , Nils Lukas This is my paper
classification cs.LG MSC 94A6268P2568T07
keywords federated learningmodel watermarkingsecret sharingsecure aggregationthreshold cryptographyprovenance verificationwhite-box watermarkz-score detection
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper introduces collaborative threshold watermarking, a protocol that lets K clients jointly train a model and later prove who contributed to it. The central claim is that by secret-sharing the watermark key and embedding the shares through secure aggregation, ownership verification can be gated behind a threshold: any t or more clients can jointly detect the watermark, while fewer than t learn nothing about the key. The authors show this scales to 128 clients, where a naive per-client watermark fades below detection, and that the signal survives common removal attacks when the attacker has limited access to training data. If correct, this gives federated learning a practical, trustless mechanism for collective model provenance.

Core claim

The paper's central discovery is that secret-sharing a random watermark vector tau into K shares, then converting those shares into additive embedding shares via public interpolation coefficients, produces a watermark that is (i) additively consistent (the shares sum to tau), (ii) hidden from an untrusted server during secure aggregation, and (iii) verifiable by any coalition of at least t clients without reconstructing tau in the clear. Verification reduces to computing the inner product between the suspect model and tau from the shares alone, then a one-sided z-score against a fitted null distribution. Empirically the authors report z >= 4 at K = 128 with minimal accuracy loss, and that z

What carries the argument

The protocol is carried by two primitives plus a statistical test. A (t,K)-threshold secret-sharing scheme splits a random watermark vector tau into K shares such that any t shares reconstruct tau and any fewer reveal nothing; public interpolation coefficients convert each share into an embedding share that sums to tau. Secure aggregation lets the server see only the sum of client updates, so the watermark direction is embedded without the server learning tau or any individual share. An exponential moving average of per-client update norms adaptively scales the watermark contribution each round. Verification uses a one-sided z-test on the cosine similarity between the suspect model and tau,

Load-bearing premise

The false-positive claims rest on the assumption that the cosine similarity between an unwatermarked model and a random vector is approximately normal, with mean and standard deviation estimated from 10,000 samples per dataset and extrapolated to the z = 4 tail and to attacked models.

What would settle it

Train many independently initialized unwatermarked models, compute their cosine similarity with many random vectors, and compare the empirical frequency of z >= 4 against the claimed 3.2e-5 false-positive rate; if the observed tail is orders of magnitude heavier, the detection statistics are not calibrated.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Federated learning platforms can offer collective ownership verification without a trusted server, because the watermark key never appears in the clear and individual shares remain hidden under secure aggregation.
  • Scaling to many clients (up to 128 tested) preserves detectability where per-client watermarks fail, since the shared watermark direction accumulates instead of averaging toward zero.
  • Post-training removal resistance holds against pruning, quantization, fine-tuning, and adaptive fine-tuning when the attacker has at most 20% of training data; only distillation with substantial data removes the mark.
  • The same verified key can be checked repeatedly across checkpoints without revealing tau, enabling provenance checks over time.
  • Threshold t gives a tunable governance knob: choose t = K for unanimous verification or t = 3 for majority control in a consortium.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the protocol in its current form is white-box, so it cannot verify models exposed only through an API; a black-box route would need a different embedding and verification layer.
  • Beyond the paper: the normality assumption for the null distribution is fitted on 10,000 samples per dataset; if the true tail is heavier than the fitted normal, the claimed 3.2e-5 false-positive rate at z = 4 may be optimistic.
  • Beyond the paper: the authors do not provide a theoretical lower bound on an attacker's ability to estimate the watermark direction from the visible training trajectory, so stronger adaptive attacks than the one tested may exist.
  • Beyond the paper: the protocol assumes honest-but-curious participants; extending it to Byzantine clients or a malicious server would require additional robustness mechanisms.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a (t,K)-threshold watermarking protocol for federated learning. A trusted dealer (or a dealer-free DKG) distributes Shamir shares of a secret key τ; each client derives an additive embedding share w_k = λ_k s_k so that Σ w_k = τ. During FedAvg training, clients add a globally scaled watermark vector to their local updates under secure aggregation, so the aggregate update carries a component proportional to τ. Verification by any coalition of at least t clients computes ⟨θ_s, τ⟩ through Lagrange-weighted inner products with their shares, without revealing τ, and then applies a one-sided z-test calibrated from the cosine similarity of unwatermarked models with random vectors. Experiments on CIFAR-10, CIFAR-100, and Tiny ImageNet show detectability for K up to 128, small accuracy loss, and robustness to fine-tuning, pruning, quantization, and adaptive fine-tuning; distillation is reported as the main successful removal attack.

Significance. The threshold property is a natural and practically motivated extension of model watermarking, and the algebraic core is sound: Eq. (2)–(3) correctly convert Shamir shares into additive embedding shares, and Eq. (8) correctly computes the verification inner product without reconstructing τ. The paper also provides a useful baseline comparison showing that per-client watermarks dilute with K. If the empirical claims are sustained, this would be a meaningful advance for collaborative ownership verification. However, two load-bearing empirical claims currently rest on weak evidence: the z=4 false-positive rate is a normal-tail extrapolation from a small fitted null, and the adaptive fine-tuning attack uses an estimator of τ that may be confounded with the watermark itself. These issues do not invalidate the protocol construction, but they require substantial revision before the robustness and FPR claims can be accepted.

major comments (3)
  1. [§5.1, Eq. (9)] The detection threshold z*=4 is justified by 'FPR ≈ 3.2e-5', which is a normal-tail extrapolation. The null mean and standard deviation are fitted from 10,000 cosine samples per dataset (five models × 2000 random vectors), and the histograms in Figure 2 span approximately ±0.04, i.e., only about ±4 fitted σ. No empirical mass is available at the 4σ tail, so a heavier-tailed distribution would make the actual FPR orders of magnitude larger. Additionally, after attacks the null distribution of cosine similarity for unwatermarked models may shift, yet the same fitted μ and σ are used for all post-attack z-scores. Please replace the normal-tail claim with an empirical CDF/order-statistic calibration, a conservative threshold, or a direct measurement of FPR on a large set of unwatermarked, attacked models.
  2. [Appendix D.2, Eq. (10), Fig. 4] The adaptive fine-tuning attack estimates τ′ by 'accumulating the gradient over the training process.' Because each round's global update contains (scaletotal/K)·τ, this estimator is likely strongly correlated with τ. Under the attack loss L′ = (1−α)L + α‖τ′‖₁, penalizing a τ′-correlated vector is not equivalent to removing the true watermark; in the extreme case τ′=τ, the penalty is ordinary L1 regularization, which need not reduce alignment with τ. The paper itself acknowledges in Section 6 that 'an attacker may attempt to estimate the watermark key from checkpoints' and provides no theoretical lower bound. To support the claimed robustness against adaptive fine-tuning, the attack must be rerun with an estimator that is provably unbiased or whose correlation with τ is measured and reported; otherwise the high post-attack z-scores in Figure 4 may be an artifact of attacking a correlated
  3. [§2.4, §4.1, Appendix B] The protocol is described over real-valued vectors τ, s_i, w_i ∈ R^d, but Shamir secret sharing and secure aggregation are defined over finite fields. The paper does not specify the fixed-point encoding, field size, or rounding behavior. This is not a pedantic point: Lagrange reconstruction over rounded floating-point shares introduces an error in Eq. (2) and Eq. (8), and the dealer-free DKG in Appendix B samples additive shares from N(0, I_d/K) and evaluates polynomials over the reals, which is not a finite-field operation as written. Please specify the encoding and quantify the reconstruction error relative to the watermark strength c. Without this, the exact identity Σ w_k = τ and the information-theoretic secrecy claims are only approximate.
minor comments (5)
  1. [Abstract / §6 Limitations] The abstract states the method is evaluated on 'both IID and non-IID partitions,' but Section 6 says 'our experiments assume IID partitions,' and no non-IID experiments appear in the main text or appendices. Please correct the abstract or add non-IID results.
  2. [Eq. (5)] The adaptive scaling formula scalek = c·‖Δθ‖₂·ema_k multiplies the current update norm by its EMA, so the effective strength scales quadratically with update magnitude. The text describes this as scaling by 'recent update norms' but does not motivate the product form. Either explain the design or simplify to c·ema_k (or another monotone function).
  3. [Figure 7 caption] The caption says 'varying watermark strengths (c∈{0.075,0.05,0.025})' while the main text reports c=0.025; the figure legend is also inconsistent with the notation used elsewhere (capital C vs lowercase c). Please harmonize.
  4. [Table 2 / Appendix D.2] The notation table omits τ′ (used in Appendix D.2) and does not list z_s/z_t from Eq. (11). Please complete the table.
  5. [§4.2, Algorithm 2] The text states that the server is untrusted, but the server observes the entire global model trajectory, which is watermarked. The paper acknowledges this in Section 6 but should also state explicitly in the threat model that the server can attempt the same checkpoint-based key-estimation attack as a coalition of <t clients, and that no security claim is made against such an adversary.

Circularity Check

0 steps flagged

No significant circularity: the threshold-watermarking algebra is self-contained; the only self-citation is background and not load-bearing.

full rationale

The paper's central derivation chain is algebraic and self-contained. The watermark key τ is sampled, Shamir-shared, and converted to additive shares via public Lagrange coefficients (Eq. 3: w_k = λ_k s_k, so Σw_k = τ). Embedding adds (scale_total/K)·τ per round by construction (Eq. 6–7), and verification computes ⟨θ_s, τ⟩ from shares by linearity (Eq. 8). These are definitions/algebra, not predictions derived from fitted inputs. The z-score (Eq. 9) uses μ and σ calibrated from unwatermarked models' cosine similarities with random vectors; this is standard null calibration, and the claimed FPR at z=4 rests on a normality assumption that is a statistical validity concern, not circularity. The only self-citation is Lukas et al. (2021), which supports background robustness claims and a stated limitation ('not robust when the adversary has sufficient training data'); it is not load-bearing for the protocol construction. Section 6 explicitly acknowledges no theoretical lower bound on estimating the key, and the adaptive fine-tuning loss (Eq. 10: L' = (1−α)L + α∥τ′∥₁) is questionable—if τ′ is fixed, the penalty is constant w.r.t. model parameters, so the 'adaptive' attack may reduce to scaled fine-tuning. This is a correctness risk in the empirical robustness evidence, not a circular reduction of the protocol's derivation. Overall, no step in the claimed derivation is equivalent to its inputs by construction; score 2 reflects only the minor, non-load-bearing self-citation and the caveats around the adaptive-attack evaluation.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 0 invented entities

The central protocol rests on standard cryptographic primitives (Shamir sharing, secure aggregation, commitments) plus an engineering choice of adaptive scaling. The fit-to-data components are the null-distribution statistics and the watermark strength c. No new physical or conceptual entities are introduced. The main unstated load-bearing assumption is the finite-field encoding of real-valued model updates.

free parameters (4)
  • watermark strength c = 0.025 default; 0.05, 0.075, 0.10 in ablations
    Global scaling hyperparameter in Eq. (5); controls watermark magnitude vs. accuracy; chosen by authors to keep z>=4.
  • EMA decay beta = 0.9
    Decay in Eq. (4) for update-magnitude EMA; chosen, not derived.
  • detection threshold z* = 4
    Threshold in Eq. (9); corresponds to nominal FPR 3.2e-5 under the fitted normal distribution.
  • null distribution mu, sigma = e.g., CIFAR-10 mu≈-0.0001, sigma≈0.0101
    Fitted in Section 5.1 to 10,000 cosine similarities; used to standardize z-scores for all detectability claims.
axioms (5)
  • standard math Shamir (t,K)-threshold secret sharing hides tau from any <t shares
    Invoked in Section 2.4/4.1 to ground threshold verification.
  • standard math Secure aggregation returns only the sum and hides individual inputs
    Black-box use of Bonawitz et al. in Section 2.1; server cannot see per-client wk or scalek.
  • domain assumption Honest-but-curious clients; no training-time malicious adversaries
    Stated in Section 3; excludes Byzantine clients and malicious server deviations.
  • domain assumption Cosine similarity of unwatermarked models with random vectors is approximately normal
    Empirically checked in Section 5.1 but assumed for z=4 FPR; extrapolated to far tail.
  • ad hoc to paper Real-valued weight vectors can be Shamir-shared via fixed-point encoding without leaking info
    Paper samples tau ~ N(0,I_d) but Shamir requires a finite field; fixed-point shares in Z_q^d are mentioned in Appendix B.1, but field size and precision are not specified in the main text.

pith-pipeline@v1.3.0-alltime-deepseek · 19781 in / 13844 out tokens · 133490 ms · 2026-08-03T00:58:23.965926+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Collaborative Threshold Watermarking." pith.science (2026). https://pith.science/paper/VRJCTBM6

@misc{pith2026260210765,
  author       = {Pith},
  title        = {Pith review of: Collaborative Threshold Watermarking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VRJCTBM6}},
  note         = {Machine review of arXiv:2602.10765}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

In federated learning (FL), $K$ clients jointly train a model without sharing raw data. Because each participant invests data and compute, clients need mechanisms to later prove the provenance of a jointly trained model. Model watermarking embeds a hidden signal in the weights, but naive approaches either do not scale with many clients as per-client watermarks dilute as $K$ grows, or give any individual client the ability to verify and potentially remove the watermark. We introduce $(t,K)$-threshold watermarking: clients collaboratively embed a shared watermark during training, while only coalitions of at least $t$ clients can reconstruct the watermark key and verify a suspect model. We secret-share the watermark key $\tau$ so that coalitions of fewer than $t$ clients cannot reconstruct it, and verification can be performed without revealing $\tau$ in the clear. We instantiate our protocol in the white-box setting and evaluate it on image classification tasks on both IID and non-IID partitions, as well as language models fine-tuning setting. Our watermark remains detectable at scale ($K=128$) with minimal accuracy loss and stays above the detection threshold ($z\ge 4$) under attacks including adaptive fine-tuning using up to 20% of the training data. Code is available at https://github.com/tameemalaa/collaborative-threshold-watermark.

Figures

Figures reproduced from arXiv: 2602.10765 by Anish Ambreth, Nils Lukas, Tameem Bakr.

Figure 1
Figure 1. Figure 1: An overview of collaborative threshold watermarking. SETUP is a one-time procedure to distribute Shamir shares si to all clients from which they derive additive shares wi. EMBED mod￾ifies the FL algorithm to embed our watermark, VERIFY allows any coalition of ≥ t clients to compute the watermark test statistic. Training large models consumes vast compute and data re￾sources. However, once a model is jointl… view at source ↗
Figure 2
Figure 2. Figure 2: Combined cosine similarity distributions for different datasets on ResNet18 models, with fitted normal distributions. embeds it locally using the same update rule and scaling hyperparameter c as our method. Verification for client k uses the same one-sided z-test with key τk. Under FedAvg aggregation, the watermark direction becomes proportional to 1 K PK k=1 τk, whose expected norm shrinks as 1/ √ K, expl… view at source ↗
Figure 3
Figure 3. Figure 3: (a) Our method sustains statistically significant z-scores up to K = 128, whereas the baseline collapses beyond K = 16. (b) Increasing the scaling factor c consistently boosts z-scores across datasets, showing that watermark strength is tunable. of the training data. 2. Quantization: Weight-only quantization of Conv/Linear layers of the final model checkpoint. 3. Pruning: Magnitude pruning (global unstruc￾… view at source ↗
Figure 4
Figure 4. Figure 4: Robustness analysis on CIFAR-100 with K = 32 and c = 0.025. We report the trade-off between task accuracy and watermark z-score under five attack types: (i) adaptive fine-tuning, (ii) plain fine-tuning, (iii) knowledge distillation, (iv) pruning (magnitude and structured), and (v) quantization. The original model is shown as a star. Dashed curves denote Pareto frontiers for 1%, 5%, 10%, and 20% of the trai… view at source ↗
Figure 5
Figure 5. Figure 5: Per-client DKG protocol runtime versus number of participating clients under a 1000 Mbps network, showing total time and the breakdown between computation and communication. D.1. Fine-Tuning Fine-tuning is the most direct strategy an attacker can attempt, simply retrain the released model on a subset of data in the hope of diminishing the watermark signal. The attack is assumed to have access to only a sub… view at source ↗
Figure 6
Figure 6. Figure 6: Fine-tuning attack: test accuracy versus watermark z-score under different fractions of fine-tuning data (5%, 10%, 20%). The dashed red line denotes the detection threshold (z = 4.0). 17 [PITH_FULL_IMAGE:figures/full_fig_p017_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Adaptive fine-tuning attacks with K = 32 clients and varying watermark strengths (c ∈ {0.075, 0.05, 0.025}). Each curve shows the trade-off between test accuracy and watermark detectability (z-score) as the adversary fine-tunes the watermarked model with different fractions of training data (1%, 5%, 10%, 20%). The red dashed line marks the detection threshold (z ∗ = 4). 18 [PITH_FULL_IMAGE:figures/full_fi… view at source ↗
Figure 8
Figure 8. Figure 8: Watermark detection z-scores after quantization. Results are shown for CIFAR-10 (a), CIFAR-100 (b), and TinyImageNet (c) under varying watermark strengths c. Each panel compares the original model with three quantization schemes. The dashed red line indicates the detection threshold (z = 4). 19 [PITH_FULL_IMAGE:figures/full_fig_p019_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Impact of pruning on watermark detection z-scores across datasets. Results are shown for (a) CIFAR-10, (b) CIFAR-100, and (c) TinyImageNet. 20 [PITH_FULL_IMAGE:figures/full_fig_p020_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Distillation attack with K = 32 clients and watermark strength c = 0.025. Final test accuracy is shown as the fraction of training data used for knowledge distillation increases. Results are reported for (a) CIFAR-10, (b) CIFAR-100, and (c) TinyImageNet. Error bars denote 95% confidence intervals across seeds. 21 [PITH_FULL_IMAGE:figures/full_fig_p021_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Robustness analysis on Tinyimagenet with K = 32 and c = 0.025. We report the trade-off between task accuracy and watermark z-score under five attack types: (i) adaptive fine-tuning, (ii) plain fine-tuning, (iii) knowledge distillation, (iv) pruning (magnitude and structured), and (v) quantization. The original model is shown as a star. Dashed curves denote Pareto frontiers for 1%, 5%, 10%, and 20% of the … view at source ↗
Figure 12
Figure 12. Figure 12: Robustness analysis on CIFAR-10 with K = 32 and c = 0.025. We report the trade-off between task accuracy and watermark z-score under five attack types: (i) adaptive fine-tuning, (ii) plain fine-tuning, (iii) knowledge distillation, (iv) pruning (magnitude and structured), and (v) quantization. The original model is shown as a star. Dashed curves denote Pareto frontiers for 1%, 5%, 10%, and 20% of the trai… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

4 extracted references · 1 canonical work pages

  1. [2020]

    Krizhevsky, A

    ISBN 978-0367331756. Krizhevsky, A. Learning multiple layers of features from tiny images. Technical Report TR-2009, University of Toronto, 2009. Lansari, M., Bellafqira, R., Kapusta, K., Thouvenot, V ., Bettan, O., and Coatrieux, G. When federated learning meets watermarking: A comprehensive overview of tech- niques for intellectual property protection, ...

    Pith/arXiv arXiv 2009

  2. [2022]

    Beaufays, F., Rao, K., Mathews, R., and Ramaswamy, S

    URL https://proceedings.mlr.press/ v162/bansal22a.html. Beaufays, F., Rao, K., Mathews, R., and Ramaswamy, S. Federated learning for emoji prediction in a mobile keyboard, 2019. URL https://arxiv.org/abs/ 1906.04329. Boenisch, F. A systematic review on model water- marking for neural networks.Frontiers in Big Data, V olume 4 - 2021, 2021. ISSN 2624-909X. ...

    Pith/arXiv arXiv 2019

  3. [2023]

    doi: 10.1609/aaai

    ISBN 978-1-57735-880-0. doi: 10.1609/aaai. v37i13.26847. URL https://doi.org/10.1609/ aaai.v37i13.26847. Paszke, A., Gross, S., Massa, F., Lerer, A., Bradbury, J., Chanan, G., Killeen, T., Lin, Z., Gimelshein, N., Antiga, L., Desmaison, A., K¨opf, A., Yang, E., DeVito, Z., Rai- son, M., Tejani, A., Chilamkurthy, S., Steiner, B., Fang, L., Bai, J., and Chi...

    Pith/arXiv arXiv 2019

  4. [2024]

    URL https://www.biorxiv.org/content/ early/2024/12/10/2024.12.06.627138

    doi: 10.1101/2024.12.06.627138. URL https://www.biorxiv.org/content/ early/2024/12/10/2024.12.06.627138. NVIDIA. Federated learning for healthcare using nvidia clara, September 2021. URL https:// developer.download.nvidia.com/CLARA/ Federated-Learning-Training-for-Healthcare-Using-NVIDIA-Clara. pdf. SWE-CLARA-001-USCA. Oldenhof, M., ´Acs, G., Pej´o, B., S...

    work page doi:10.1101/2024.12.06.627138 2024