NWaaS: A Non-Intrusive and Privacy-Preserving Watermarking-as-a-Service System with Adaptive Resource Scheduling

Guang Hua; Hangcheng Cao; Haonan An; Qianyao Ren; Tao Li; Yanan Ma; Yuguang Fang; Yu Guo

REVIEW 4 major objections 4 minor 29 references

NWaaS: A Non-Intrusive and Privacy-Preserving Watermarking-as-a-Service System with Adaptive Resource Scheduling

T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A side channel in the API can watermark a model the owner never touches.

desk verdict A genuinely nonintrusive watermarking mechanism with real breadth, but the surrogate-detection claim needs calibration and a false-positive baseline before it carries the weight the paper puts on it. read the letter →

arxiv 2507.18036 v2 pith:AL236EH7 submitted 2025-07-24 cs.CR cs.CV

Haonan An , Qianyao Ren , Guang Hua , Tao Li , Yu Guo , Yanan Ma , Hangcheng Cao , Yuguang Fang This is my paper

classification cs.CRcs.CV

keywords DNNwatermarkingnon-intrusivemodelextractionX-to-Imagemodelsblack-boxAPIsidechannelasaserviceintellectualpropertyprotection

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes a watermarking service in which the protected model is never modified. The scheme, called ShadowMark, attaches a key encoder and a watermark decoder to the model's black-box API, so a secret key turns into a trigger-like image whose output, decoded, yields the owner's watermark. Because the model parameters stay frozen, the paper claims output quality is identical to the unwatermarked model, eliminating the fidelity-robustness trade-off and the need for fine-tuning or training-data access. The same design makes the service trustless: the owner keeps the key, so no third party can insert hidden backdoors or hold the key hostage. The paper reports verification across four X-to-Image modalities, with original-model NCC above 0.95 in 15 of 16 experiments and detection in 10 of 12 feasible surrogate-model thefts, plus an edge-cloud scheduling scheme for latency under load.

What carries the argument

The central machinery is the watermarking side channel: a separate, key-gated pathway inside the API's query handling that runs alongside normal inference, built from a key encoder $G_\gamma$ and a watermark decoder $D_\delta$ while the protected model $M_\theta$ remains frozen. Training minimizes $L_k = \|D_\delta(M_\theta(G_\gamma(k))) - m\|_2^2$ for the correct key and separation losses $L_{\tilde k} = 1/(\|D_\delta(M_\theta(G_\gamma(\tilde k))) - m\|_2^2 + \epsilon)$ for wrong keys, together with a normal-query refinement loss $L_x$ on ordinary inputs $x$. This makes the correct key the only route that reproduces the watermark, and that route is later probed on a suspect model to detect theft.

What would settle it

Run the paper's surrogate-attack protocol with the Pepper watermark and a surrogate that demonstrably matches ordinary outputs: the paper reports NCCD = 0.04, far below the 0.5 threshold, so a systematic sweep over watermark patterns and surrogate capacities would show exactly where the transfer claim breaks.

Watch

Extended reading notes

Core claim

ShadowMark's central claim is that the owner-defined watermark $m$ can be extracted from the outputs of a completely untouched model $M_\theta$. The formal procedure is $\text{Encode}(G_\gamma, D_\delta, M_\theta, k, m) \to (\tilde G_\gamma, \tilde D_\delta)$, then $\text{Decode}(\tilde G_\gamma, \tilde D_\delta, M_\theta, k) = \tilde D_\delta(M_\theta(\tilde G_\gamma(k)))$. The key encoder learns to map the secret key $k$ to a noise-like trigger image; the decoder learns to map $M_\theta$'s output on that trigger back to $m$, while reciprocal-distance losses push wrong keys and normal queries away from $m$. Verification uses NCC $> 0.95$ on the original model and a new metric, normalized cross-correlation difference (NCCD), greater than $0.5$ on suspected surrogates. The paper's experiments report NCC $= 0.99$ in 15 of 16 settings, 10 of 12 feasible surrogate attacks detected, and zero successful key guesses in one million trials.

Load-bearing premise

The scheme stands or falls on the assumption that a stolen model trained to imitate the service's ordinary outputs will also reproduce the service's responses to the owner's secret trigger images, even though those triggers look nothing like the training data.

Editorial extensions

If this is right

Model owners can watermark deployed X-to-Image services without touching parameters, so a watermarked service is identical in its outputs to an unwatermarked one.
The method removes the need for original training data and for parameter-heavy fine-tuning, lowering the cost barrier that has kept watermarking out of practical Watermarking-as-a-Service deployments.
Because the owner generates and holds the key, the service no longer depends on a trusted third party to store keys or perform embedding.
If surrogate transfer holds, a thief who distills the model by querying its public API inherits the trigger channel and can be identified with the NCCD metric, without the owner ever modifying the stolen model.
The API's two channels, normal inference and watermark verification, let the same deployed model serve both functions with no visible change to users.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper's own results show that surrogate detection depends on the watermark image: the Binary and Pepper watermarks failed to transfer while Pink succeeded, which suggests that watermark choice is part of the security design and could be tuned or attacked systematically.
The same side-channel idea could be tested on black-box classifiers or language models, where outputs are not images; adapting the decoder to logits or text would require different trigger geometry, but the nonintrusive principle might generalize.
Because verification queries are distinguished only by the API's private channel routing, an attacker who can observe which requests take the verification path might isolate and remove the trigger; the paper assumes this routing stays private.
The resource-scheduling component is described at the system level, so an open question is whether proportion disparity joint scheduling remains effective when the watermark channel and the normal channel have very different compute costs.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The thing to know: ShadowMark is a real new mechanism, not a repackaging. Training a key encoder to generate triggers and a decoder on the frozen model's outputs, with the protected model untouched, is not in the cited prior work, which all modifies parameters or architecture. They demonstrate it across four X-to-Image modalities and 16 models, with 15/16 original-model verifications exceeding their NCC>0.95 bar and successful extraction qualitative. That is a genuine result, and the nonintrusiveness claim holds up for the original model. The brute-force key ambiguity result (SRA=0 over 1M guesses) is also a clean independent test, if only reported as a summary number without variance.

The soft spots are where the paper tries to sell more than it shows. The surrogate-attack robustness is the load-bearing security claim, and it rests on an assumption the paper never argues for: that a surrogate trained on normal inputs reproduces M_theta on the intentionally OOD trigger-like inputs. Table 2 shows this transfer fails outright for 2 of 12 surrogates (NCCD 0.04, 0.10) and several others sit only 0.10-0.11 above the 0.5 threshold. Four model types are excluded from surrogate evaluation entirely. No error bars, no repeated runs, and no false-positive baseline on innocent models that were never derived from M_theta. The wrong-key branch of their NCCD metric is trained only against M_theta; for an arbitrary innocent model the decoder outputs are uncontrolled and could exceed threshold by accident. That is not a nitpick, it is the difference between "detects theft" and "fires on this test set." Also, the original-model verification (NCC>0.95) is basically a fit to the training loss in Eq. (4), so it is evidence of optimization, not generalization. The surrogate transfer and brute-force results are the real independent tests, and they are under-reported.

The paper also overclaims trustlessness: the cloud API must still faithfully run the watermarking modules, so the trust is shifted, not eliminated. Worth saying, but minor compared to the surrogate issue.

Who it is for: someone working on DNN watermarking or model IP protection will get a useful new idea and a decent breadth of experiments to build on. It deserves a serious referee. The mechanism is novel enough and the experimental surface wide enough that a careful review could address the calibration and false-positive gaps.

Recommendation: send it to review, but the referee should push hard on Eq. (10) validation.

Referee Report

4 major / 4 minor

Summary. The paper proposes NWaaS/ShadowMark, a non-intrusive watermarking scheme for X-to-Image models. Instead of modifying the protected model M_theta, it trains a key encoder G_gamma and a watermark decoder D_delta inside the black-box API, so that a correct key k causes D_delta to output the owner-defined watermark m from M_theta(G_gamma(k)), while a wrong key should not. Verification uses NCC>0.95 for the original model and a new metric NCCD>0.5 for suspected surrogate models. Experiments are reported on 16 tasks spanning image-to-image, noise-to-image, noise-and-text-to-image, and text-to-image models, together with a 1-million-trial brute-force key ambiguity test. The abstract and introduction also advertise a resource-scheduling algorithm for edge-cloud deployment, but that component is not described in the body.

Significance. The idea is genuinely interesting: establishing a watermarking side channel without touching the model would eliminate fidelity loss, retraining cost, and third-party trust concerns, which are real barriers to WaaS adoption. The threat model is attacker-friendly by design, and the evaluation attempts to cover multiple modalities, several architecture families, surrogate attacks, and brute-force key search. If the transferability of the side channel to surrogate models were convincingly established, this would be a valuable contribution. However, as submitted, several load-bearing claims go beyond the evidence: one of sixteen original-model verifications fails the paper's own threshold, surrogate detection has no false-positive baseline and fails two of twelve attacks, and the original-model verification is partly a training-fit result rather than an independent prediction.

major comments (4)

[Quantitative Evaluation / Table 2] The claim of robust watermark verification across X-to-Image models is not supported by the paper's own criterion: Task 9 (OneRestore) reports NCC=0.86, below the stated 0.95 threshold in Eq. (8), and no analysis or revised threshold is given. Because this is one of the 16 advertised experiments, the conclusion that ShadowMark is effective across a wide range of tasks and models overstates the evidence. At minimum the failure case needs a specific explanation, and all NCC/NCCD values should be accompanied by repeated-run statistics or confidence intervals.
[Robustness Against Surrogate Attack / Eq. (10)] The surrogate-detection criterion NCCD>0.5 is not validated against innocent models that are not derived from M_theta. Since D_delta is trained only on outputs of M_theta, its behavior on an arbitrary model's outputs is uncontrolled and could exceed 0.5 by accident. Furthermore, the supporting evidence in Table 2 is thin: Experiments 12 and 13 fail outright (NCCD=0.10 and 0.04), Experiments 1, 2, and 11 sit only 0.10-0.11 above the 0.5 threshold, and no error bars are provided. Four model types (LinearTransfer, MAT, SwinIR, Stable Diffusion) are also excluded from the surrogate evaluation, so the robustness claim is tested on only 12 of 16 tasks.
[Implementation / Eq. (4) and Eq. (8)] The original-model verification result is not an independent test: the training loss L_k in Eq. (4) is the MSE between D_delta(M_theta(G_gamma(k))) and m, so the reported NCC=0.99 on the trained key measures training fit, not predictive watermark extraction. The criterion NCC>0.95 in Eq. (8) therefore does not demonstrate that the watermark can be extracted from an untouched model beyond what was explicitly optimized. A held-out key, or keys generated at verification time, would be needed to support the claim that ShadowMark establishes a genuine extraction channel rather than a memorized lookup.
[Abstract / Introduction] The abstract and introduction advertise 'proportion disparity joint scheduling' and superior system performance as part of NWaaS, but the submitted full text does not describe the scheduling algorithm or present any latency, concurrency, or resource-utilization experiments. Since this is one of the advertised contributions, it must either be included with evaluation or explicitly deferred to future work; as submitted, the claim is not verifiable from the manuscript.

minor comments (4)

[Quantitative Evaluation] The sentence 'We now present the qualitative experimental results' appears to be a typo for 'quantitative experimental results'.
[Table 2] The caption states 0<SR_A<1, but every reported entry is 0.0; the definition should clarify whether this is an observed bound or the measured success rate, and the number of trials for the brute-force experiment should be stated consistently.
[Figure 5] The axes and color legend in Figure 5 are not fully defined in the caption, making it hard to distinguish the plotted loss, NCC values, and the correct/wrong key curves.
[Table 1] For noise-to-image tasks the input dimension is (1,100) while the output dimension is (1,256,256); clarifying how the generative model expands the input would improve reproducibility.

Circularity Check

1 steps flagged · score 4.0 of 10

Original-model extraction is a trained objective rather than an independent prediction, but the surrogate-transfer and brute-force tests keep the central security claims self-contained.

fitted input called prediction [Eq. (4) under 'Concrete Realization: ShadowMark' and 'Watermark Verification in the Original Model' under Quantitative Evaluation]
"To achieve (2), we use the mean squared error (MSE) loss Lk =∥D δ (Mθ (Gγ(k)))−m∥ 2 2, (4), to ensure that k can be successfully mapped to m ... This is the main loss function to establish the watermarking channel. For the original model verification, where the threshold is 0.95 according to (8), we observe that NCC= 0.99>0.95 for 15 out of 16 experiments."

The original-model verification in Table 2 uses the same key k and the same frozen model M_theta on which G_gamma and D_delta were optimized. Equation (4) is exactly the squared distance between D_delta(M_theta(G_gamma(k))) and m, so successful minimization essentially forces the reported NCC>0.95 for that key; the result is a training-success check, not an out-of-sample prediction. The wrong-key and normal-query losses (5)-(6) similarly train the discrimination that the NCCD metric measures on the original model. The surrogate and brute-force experiments are not trained on the tested keys/models and therefore provide independent support.

full rationale

The paper's headline property that M_theta is never modified is definitionally true because M_theta is frozen throughout, which is a design fact rather than a circular derivation. The only by-construction element is the original-model extraction: G_gamma and D_delta are optimized with Eq. (4) on the exact key k, so the high NCC values in Table 2 measure convergence of the training objective rather than prediction on unseen data. I count that as a mild fitted-input-called-prediction step. The more load-bearing security claim, surrogate-model detection via Eq. (10), is evaluated on independently trained surrogate models and is not used to fit any parameter; the same holds for the one-million-trial brute-force key test, which gives SR_A=0. No load-bearing self-citation chain was found: the cited NCC>0.95 criterion is an accepted evaluation convention, and the overlapping-author citations (Zhang et al. 2022, 2024a) are used as baselines or standards, not to justify the uniqueness of the proposed design. The absence of a false-positive baseline on innocent non-derived models and the failure of trigger transfer in 2 of 12 surrogates are correctness and robustness concerns, not circularity. Overall score 4 reflects one by-construction 'prediction' while the central independent tests remain meaningful.

Assumptions & free parameters 4 free parameters · 4 assumptions · 1 invented entities

The central mechanism depends on several domain assumptions (Kerckhoffs, unlimited queries, surrogate feasibility) and on design choices (thresholds, epsilon, loss weights) that are not independently justified. The only invented entity is the API-level side channel, which is a construction rather than an observed phenomenon.

free parameters (4)

verification threshold NCC = 0.95
Used in equation (8) for original model verification; chosen without a principled derivation, and Task 9 fails it with NCC=0.86.
verification threshold NCCD = 0.5
Used in equation (10) for surrogate verification; no false-positive analysis justifies this cutoff.
epsilon in reciprocal losses = not specified (0 < epsilon << 1)
Appears in equations (5) and (6); the value affects training dynamics and is never reported.
loss weighting = implicitly equal weights (1,1,1)
The paper omits weighting parameters claiming the losses share scale, which is doubtful for MSE versus reciprocal squared distance; no ablation is given.

assumptions (4)

domain assumption Kerckhoffs's principle: the watermarking algorithm is public except for secret keys.
Threat model point 1; standard in cryptography but a choice that excludes security by obscurity.
domain assumption The attacker has unlimited black-box queries and the API does not detect out-of-distribution queries.
Threat model points 3 and 4; this assumption enables the attacker to query trigger-like inputs but also assumes no query filtering by the API.
domain assumption Surrogate training can approximate M_theta with lower cost than training from scratch; otherwise the attack is infeasible.
Used in the Robustness Against Surrogate Attack section to exclude four models from evaluation.
ad hoc to paper The cloud API faithfully executes the watermarking modules and does not modify the protected model.
Needed for the trustless claim; not stated as a threat model assumption but required by the system design.

invented entities (1)

Watermarking side channel in the black-box API
purpose: Provides a path for key-triggered watermark extraction without modifying M_theta.
This is a designed feature of the system, not an independent phenomenon; its existence is equivalent to the trained G_gamma and D_delta modules functioning as intended.

how reviews work

0 comments

Cite this review

Pith. "Pith review of NWaaS: A Non-Intrusive and Privacy-Preserving Watermarking-as-a-Service System with Adaptive Resource Scheduling." pith.science (2026). https://pith.science/paper/AL236EH7

@misc{pith2026250718036,
  author       = {Pith},
  title        = {Pith review of: NWaaS: A Non-Intrusive and Privacy-Preserving Watermarking-as-a-Service System with Adaptive Resource Scheduling},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AL236EH7}},
  note         = {Machine review of arXiv:2507.18036}
}

abstract

Securing intellectual property (IP) in Machine Learning as a Service is critical yet challenging. While deep neural network watermarking serves as a standard defense against model extraction, existing Watermarking-as-a-Service paradigms face a triple challenge of intrusiveness, privacy risks, and inefficiency. To address these challenges, we propose Non-intrusive Watermarking as a Service (NWaaS), a holistic framework enabling trustworthy and efficient IP protection. We first introduce $\mathtt{ShadowMark}$, a novel watermarking algorithm that establishes a side-channel for ownership verification without modifying the model. It ensures zero performance degradation and eliminates the need for parameter-heavy fine-tuning as well as access to original training data, thereby addressing the intrusiveness and inefficiency inherent in existing approaches. Leveraging this non-intrusive property, we design a collaborative partitioning mechanism that allows model owners to offload self-defined partial layers, enabling a flexible trade-off between IP privacy and service cost. Furthermore, to mitigate latency from collaborative computing under high concurrency and enhance system resource utilization, we propose proportion disparity joint scheduling, a payload-balancing resource scheduling algorithm tailored to the heterogeneous constraints of edge-cloud environments. Extensive experiments demonstrate that NWaaS provides robust ownership verification across diverse continuous X-to-Image modalities, while ensuring secure owner privacy protection and superior system performance.

Figures

Figures reproduced from arXiv: 2507.18036 by the authors.

**Figure 2.** Overview of the system workflow and conceptual differences between traditional Watermarking as a Service (WaaS) [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Flowchart of the proposed ShadowMark using image style transfer as an example. For the ease of visualization, the intermediate results in the black-box API from a wrong key are omitted. The Ref. Style image is modeldependent additional input, while the Style Key is also model-dependent and an additional fixed secret key. Nonintrusive Watermarking as a Service (NWaaS) Before introducing the NWaaS framework, we bri… view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: Partial Qualitative results of ShadowMark for (a) I2I (AODnet (Li et al. 2017)), (b) N2I (GAN (Goodfellow et al. 2014)), (c) NT2I (CGAN (Mirza 2014)), and (d) T2I (Stable Diffusion (Rombach et al. 2022)). Find more results in supplementary material. which is the numbe…

**Figure 5.** Figure 5: Loss and NCC values versus epoch during surrogate training for 3 selected experiments in [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

29 extracted references · 21 canonical work pages

[1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...
[3]

Adi, Y.; Baum, C.; Cisse, M.; Pinkas, B.; and Keshet, J. 2018. Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring. In 27th USENIX Security Symposium (USENIX Security 18), 1615--1631. Baltimore, MD

work page 2018
[4]

Cui, Q.; Meng, R.; Xu, C.; and Chang, C.-H. 2024. Steganographic Passport: An Owner and User Verifiable Credential for Deep Model IP Protection Without Retraining. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 12302--12311. Los Alamitos, CA, USA

work page 2024
[5]

K.; Winn, J.; and Zisserman, A

Everingham, M.; Van Gool, L.; Williams, C. K.; Winn, J.; and Zisserman, A. 2010. The pascal visual object classes (voc) challenge. International journal of computer vision, 88: 303--338

2010
[6]

Fan, Q.; Yang, J.; Hua, G.; Chen, B.; and Wipf, D. 2017. A generic deep architecture for single image reflection removal and image smoothing. In Proceedings of the IEEE International Conference on Computer Vision, 3238--3247

work page 2017
[7]

Fei, J.; Xia, Z.; Tondi, B.; and Barni, M. 2024. Wide Flat Minimum Watermarking for Robust Ownership Verification of GANs . IEEE Transactions on Information Forensics and Security, 19: 8322--8337

work page 2024
[8]

J.; Pouget-Abadie, J.; Mirza, M.; Xu, B.; Warde-Farley, D.; Ozair, S.; Courville, A.; and Bengio, Y

Goodfellow, I. J.; Pouget-Abadie, J.; Mirza, M.; Xu, B.; Warde-Farley, D.; Ozair, S.; Courville, A.; and Bengio, Y. 2014. Generative Adversarial Networks. arXiv:1406.2661

arXiv 2014

Show all 29 references

[9]

W.; and He, S

Guo, Y.; Gao, Y.; Lu, Y.; Liu, R. W.; and He, S. 2024. OneRestore: A Universal Restoration Framework for Composite Degradation. In European Conference on Computer Vision

2024
[10]

Hua, G.; and Teoh, A. B. J. 2023. Deep fidelity in DNN watermarking: A study of backdoor watermarking for classification models. Pattern Recognition, 144: 109844

2023
[11]

Li, B.; Peng, X.; Wang, Z.; Xu, J.; and Feng, D. 2017. Aod-net: All-in-one dehazing network. In Proceedings of the IEEE international conference on computer vision, 4770--4778

2017
[12]

Li, W.; Lin, Z.; Zhou, K.; Qi, L.; Wang, Y.; and Jia, J. 2022. MAT: Mask-Aware Transformer for Large Hole Image Inpainting. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

2022
[13]

Li, X.; Liu, S.; Kautz, J.; and Yang, M.-H. 2019. Learning Linear Transformations for Fast Arbitrary Style Transfer. In IEEE Conference on Computer Vision and Pattern Recognition

2019
[14]

Li, Y.; Wang, H.; and Barni, M. 2021. A survey of Deep Neural Network watermarking techniques. Neurocomputing, 461: 171--193

2021
[15]

Liang, J.; Cao, J.; Sun, G.; Zhang, K.; Van Gool, L.; and Timofte, R. 2021. SwinIR: Image Restoration Using Swin Transformer. arXiv preprint arXiv:2108.10257

2021 arXiv
[16]

Lin, D.; Tondi, B.; Li, B.; and Barni, M. 2024. A CycleGAN Watermarking Method for Ownership Verification. IEEE Transactions on Dependable and Secure Computing, 1--15

2024
[17]

Liu, Z.; Luo, P.; Wang, X.; and Tang, X. 2015. Deep Learning Face Attributes in the Wild. In Proceedings of International Conference on Computer Vision (ICCV)

2015
[18]

Mirza, M. 2014. Conditional generative adversarial nets. arXiv preprint arXiv:1411.1784

2014 arXiv
[19]

K., Derek Hoiem; and Fergus, R

Nathan Silberman, P. K., Derek Hoiem; and Fergus, R. 2012. Indoor Segmentation and Support Inference from RGBD Images. In ECCV

2012
[20]

Rombach, R.; Blattmann, A.; Lorenz, D.; Esser, P.; and Ommer, B. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 10684--10695

2022
[21]

Ronneberger, O.; Fischer, P.; and Brox, T. 2015. U-net: Convolutional networks for biomedical image segmentation. In Medical Image Computing and Computer-Assisted Intervention--MICCAI 2015: 18th International Conference, Munich, Germany, October 5-9, 2015, Proceedings, Part II...

2015
[22]

D.; Chen, H.; and Koushanfar, F

Rouhani, B. D.; Chen, H.; and Koushanfar, F. 2018. Deepsigns: A generic watermarking framework for ip protection of deep learning models. arXiv preprint arXiv:1804.00750

2018 arXiv
[23]

R.; Chan, C

Tan, W. R.; Chan, C. S.; Aguirre, H.; and Tanaka, K. 2019. Improved ArtGAN for Conditional Synthesis of Natural Image and Artwork. IEEE Transactions on Image Processing, 28(1): 394--409

2019
[24]

Tondi, B.; Costanzo, A.; and Barni, M. 2024. Robust and Large-Payload DNN Watermarking via Fixed, Distribution-Optimized, Weights. IEEE Transactions on Dependable and Secure Computing, 1--17

2024
[25]

Uchida, Y.; Nagai, Y.; Sakazawa, S.; and Satoh, S. 2017. Embedding Watermarks into Deep Neural Networks. In Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval, 269–277. New York, NY, USA

2017
[26]

Wu, H.; Liu, G.; Yao, Y.; and Zhang, X. 2021. Watermarking Neural Networks With Watermarked Images. IEEE Transactions on Circuits and Systems for Video Technology, 31(7): 2591--2601

2021
[27]

Zhang, J.; Chen, D.; Liao, J.; Ma, Z.; Fang, H.; Zhang, W.; Feng, H.; Hua, G.; and Yu, N. 2024 a . Robust Model Watermarking for Image Processing Networks via Structure Consistency. IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(10): 6985--6992

2024
[28]

Zhang, J.; Chen, D.; Liao, J.; Zhang, W.; Feng, H.; Hua, G.; and Yu, N. 2022. Deep Model Intellectual Property Protection via Deep Watermarking. IEEE Transactions on Pattern Analysis & Machine Intelligence, 44(08): 4005--4020

2022
[29]

Zhang, L.; Liu, Y.; Zhang, X.; and Wu, H. 2024 b . Suppressing High-Frequency Artifacts for Generative Model Watermarking by Anti-Aliasing. In Proceedings of the 2024 ACM Workshop on Information Hiding and Multimedia Security, IH&MMSec '24, 223–234. New York, NY, USA

2024

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

[3] [3]

Adi, Y.; Baum, C.; Cisse, M.; Pinkas, B.; and Keshet, J. 2018. Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring. In 27th USENIX Security Symposium (USENIX Security 18), 1615--1631. Baltimore, MD

work page 2018

[4] [4]

Cui, Q.; Meng, R.; Xu, C.; and Chang, C.-H. 2024. Steganographic Passport: An Owner and User Verifiable Credential for Deep Model IP Protection Without Retraining. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 12302--12311. Los Alamitos, CA, USA

work page 2024

[5] [5]

K.; Winn, J.; and Zisserman, A

Everingham, M.; Van Gool, L.; Williams, C. K.; Winn, J.; and Zisserman, A. 2010. The pascal visual object classes (voc) challenge. International journal of computer vision, 88: 303--338

2010

[6] [6]

Fan, Q.; Yang, J.; Hua, G.; Chen, B.; and Wipf, D. 2017. A generic deep architecture for single image reflection removal and image smoothing. In Proceedings of the IEEE International Conference on Computer Vision, 3238--3247

work page 2017

[7] [7]

Fei, J.; Xia, Z.; Tondi, B.; and Barni, M. 2024. Wide Flat Minimum Watermarking for Robust Ownership Verification of GANs . IEEE Transactions on Information Forensics and Security, 19: 8322--8337

work page 2024

[8] [8]

J.; Pouget-Abadie, J.; Mirza, M.; Xu, B.; Warde-Farley, D.; Ozair, S.; Courville, A.; and Bengio, Y

Goodfellow, I. J.; Pouget-Abadie, J.; Mirza, M.; Xu, B.; Warde-Farley, D.; Ozair, S.; Courville, A.; and Bengio, Y. 2014. Generative Adversarial Networks. arXiv:1406.2661

arXiv 2014