Pith. sign in

REVIEW 3 major objections 5 minor 100 references

ChainMarks: Securing DNN Watermark with Cryptographic Chain

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Watermarked DNN triggers linked by a one-way hash chain resist both removal and forgery attacks.

desk verdict Useful threshold-estimation work, but the ambiguity-attack resistance claim is undercut by an unconsidered fine-tuning attack. read the letter →

arxiv 2505.04977 v2 pith:GQ23TQYO submitted 2025-05-08 cs.CR cs.AI

Brian Choi , Shu Wang , Isabelle Choi , Kun Sun This is my paper · ORCID
classification cs.CRcs.AI
keywords deepneuralnetworkwatermarkingcryptographickeychainwatermarkambiguityattackremovaltwo-phaseMonteCarlobackdoortriggersmodelownershipverificationPoissonbinomialdistribution
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a dynamic DNN watermarking scheme in which trigger inputs are not independent samples but consecutive outputs of a one-way hash chain built from a secret seed, and the labels attached to those triggers are digits of the owner's digital signature. It argues that this makes optimization-based watermark forgery computationally infeasible, because an attacker cannot include a hash function in a gradient-based objective, and it makes removal attacks harder because hash-derived triggers behave like out-of-distribution noise. For verification, the paper introduces a two-phase Monte Carlo method that estimates the model's class probability distribution, including the probability mass of classes never hit by random inputs, and uses a Poisson-binomial model to bound the success probability of a random guessing attack. The authors report that on CIFAR-10, 14 matching triggers out of 100 suffice to claim ownership with an estimated random-guess probability near $10^{-7}$, and that ChainMarks resists the ambiguity attack that defeats the baseline schemes while withstanding most of the tested removal attacks.

What carries the argument

The load-bearing object is the one-way key chain of trigger inputs, generated as $B_L = F(K)$ and $B_{i-1} = F(B_i)$ for a cryptographic hash $F$ and secret seed $K$, paired with a base-$C$ expansion of the owner's digital signature as target labels. The chain is what blocks ambiguity attacks: backpropagation cannot differentiate through $F$, so adversarial optimization cannot satisfy the inter-trigger constraint. The second piece of machinery is the two-phase Monte Carlo estimator: phase one gathers empirical classification probabilities $p_i = n_i/N$ from random inputs; phase two measures the waiting time until a hit in the zero-hit class set $U$, converting that geometric waiting time into an estimate of $p_U$, from which the variance bound $\sigma'$ in the Poisson-binomial normal approximation is computed.

What would settle it

Generate hash-chain trigger sets from many random seeds, feed them to an unwatermarked model trained on the same dataset, and compare the predicted labels with random base-$C$ signatures; if the observed proportion of trials achieving at least 14 of 100 matches exceeds the claimed ~$10^{-7}$ by a visible margin (say $>10^{-5}$), the two-phase Monte Carlo bound is not safe.

Watch

Extended reading notes

Core claim

ChainMarks' central claim is that a cryptographic chain over trigger inputs closes the ambiguity-attack hole that backdoor-style watermarking schemes leave open. Because each valid trigger is required to be the hash preimage of the next, an adversary who optimizes trainable perturbations to make fake triggers produce chosen labels will almost surely break the chain relation; the optimized inputs are no longer valid watermarks. The only residual avenue, random guessing from a seed, has success probability governed by the distribution of the number of label matches, which the paper approximates in closed form. The two-phase Monte Carlo estimator feeds millions of random inputs through the model to obtain empirical class probabilities, then treats the never-hit classes as a Bernoulli event and estimates their total probability mass by waiting for the first hit; the resulting upper bound on the standard deviation gives a normal-approximation $p$-value that remains usable when the target $p$-value is extremely small.

Load-bearing premise

The threshold logic assumes the hash-generated trigger inputs behave, on the model, like the random inputs used to estimate class probabilities, and that the signature digits are independent across chain positions; if either fails, the claimed random-guess probability can understate the true forgery success rate.

Editorial extensions

If this is right

  • Ownership can be established from a minority of surviving triggers: on CIFAR-10, 14 of 100 matched chain positions give a claimed random-guess success probability around $10^{-7}$.
  • Verification is black-box and partial: the owner can disclose only a subset of the chain positions, keeping the remaining triggers secret for later verification rounds.
  • Ambiguity attacks that forge a second watermark by optimizing fake triggers become infeasible, since the forged triggers would violate the hash-chain constraint.
  • The threshold estimation remains defined at very small $p$-values where empirical estimation fails, so the scheme can be configured for higher security levels.
  • Removal attacks that preserve model utility leave enough surviving triggers to clear the threshold; the paper reports resistance to all tested attack types except transfer learning, and notes knowledge distillation as a further limitation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural stress test beyond the paper's experiments is to measure the true distribution of hash-chain triggers on a large set of unwatermarked models and compare the observed match rate with the claimed $p$-value; the exchangeability assumption is the point most worth probing.
  • The same construction could be lifted to non-image models: mapping hash output to token IDs or graph adjacency matrices would extend chain-based watermarking to language models and graph networks, an extension the paper mentions but does not implement.
  • The statistical ownership claim is only as strong as the $p$-value computation; in a legal or commercial dispute, the verifier may need to defend the Monte Carlo estimation and the independence assumption, not just the number of matching triggers.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes ChainMarks, a dynamic DNN watermarking scheme in which trigger inputs are generated as a one-way hash chain from a secret seed and target labels are derived from the model owner's digital signature. Verification compares predicted labels on the regenerated chain with the claimed signature via Hamming distance, using a decision threshold obtained from a two-phase Monte Carlo method that estimates the model's classification distribution on random inputs. The paper evaluates ChainMarks on CIFAR-10 and CIFAR-100 against sixteen removal attacks and one ambiguity attack, compares with four baselines, and reports lower required watermark accuracy and higher marginal utility.

Significance. The two-phase Monte Carlo idea of grounding the decision threshold in the specific model's output distribution is a reasonable direction and is not circular, since the threshold is a false-positive probability for unwatermarked models. The experimental campaign is broad, covering two datasets, multiple model architectures, and 17 attack types. However, the central security claim that ChainMarks defeats watermark ambiguity attacks is not supported under the paper's own threat model, and the statistical derivation behind the p-values contains inconsistencies that affect the validity of the verification threshold. These are load-bearing issues, not presentation concerns.

major comments (3)
  1. [§8.1 and Table 6] The claim that ChainMarks defeats watermark ambiguity attacks is evaluated only against an optimization-based attack that adds trainable noise to base triggers. The threat model in Section 3 explicitly grants the attacker a white-box surrogate model, and Section 9.1 states that ChainMarks watermarks 'can be embedded through fine-tuning.' An adversary can therefore choose its own secret seed, generate its own cryptographic chain of triggers, choose its own digital signature, and fine-tune the surrogate on those trigger/label pairs to embed a second valid watermark. The hash-chain constraint does not prevent this, because the adversary never needs to invert the chain or optimize through the hash function. This straightforward fine-tuning ambiguity attack is within the paper's assumptions but is absent from Table 6, so the paper's primary security contribution is unsupported.
  2. [§4.4 and §5.2] The false-positive probability is computed for a fixed or random sequence of target labels, but a rational adversary can choose the claimed labels to maximize the match rate. For the ResNet-18 CIFAR-10 model in Table 1, one class has hit probability 0.9962 on random inputs. If an adversary claims a signature consisting mainly of that class, the expected number of matching triggers among L random inputs is close to L, so even a threshold of 14% matches is exceeded with probability essentially 1. The p-values in Table 2 therefore do not bound the success probability of an adaptive guessing attack; the analysis needs to maximize over adversarially chosen labels or justify why the signature format prevents such choices.
  3. [§5.2, Claim 1 (Eqs. (4)–(12))] The statement and proof of Claim 1 are internally inconsistent. Equation (4) defines the mean as μ = L/C, whereas the proof's Eq. (6) defines μ = ∑_{i=1}^L p_{c_i}; these are equal only under uniform class probabilities, which Table 1 shows is not the case. In addition, Eq. (12) minimizes ∑ p_{c_i}^2 over the class-index set U with the constraint ∑ p_{c_i} = p_U, but the quantity appearing in Eq. (11) is a sum over chain positions whose labels fall in U; the number of such positions need not equal |U|, so the conclusion that each p_{c_i} = p_U/k yields a valid upper bound on σ does not follow. Since the decision threshold and all reported p-values rely on Claim 1, this needs to be corrected before the verification statistics can be trusted.
minor comments (5)
  1. [§5.1] The estimate of p_U is obtained from the average of first-hit waiting times over 50 simulations, but the geometric mean estimator is not linear; the MLE should be based on pooled trials, and using the average waiting time introduces bias.
  2. [§9.1] The statement that ownership can be verified with 14 of the first 20 triggers uses the threshold derived for L = 100 without recomputing it; the decision threshold depends on the chain length L and should be recalculated for L = 20.
  3. [Table 2] The p-values in Table 2 are not reproducible from the formulas stated in Section 5.2; the authors should provide the underlying parameters, the exact signature used, or the code used to generate the table.
  4. [References and notation] Reference [33] contains a garbled citation, 'SHA128' in Section 9.1 should be SHA-1 or SHA-256, and 'ResNet 28x10' should be identified precisely (e.g., as WideResNet) for reproducibility.
  5. [§7.3 and Figure 6] The watermark marginal utility is a newly defined metric whose value depends on the arbitrary choice of consecutive p-values used in the difference quotient; the figure should state this dependence, and the missing CIFAR-100 bars for the baselines should be explained in the caption.

Circularity Check

1 steps flagged · score 6.0 of 10

Ambiguity-attack resistance is self-definitional: the attack is defined as optimization over the owner's hash chain, while the paper's own fine-tuning embedding allows forging a fresh chain.

  1. self definitional [Section 3 (Threat Model), Section 8.1 (Defeating Watermark Ambiguity Attacks), Section 9.1 (Usability)]
    "To compromise a watermarked model ... attackers can craft a new set of base trigger images with randomly assigned target labels. They then generate fake trigger images by adding trainable noise components ... The attackers optimize a cross-entropy loss function between the target labels and the predicted labels of the fake trigger images. ... However, with cryptographic chaining, each trigger depends on a one-way hash function, which lacks gradients and thus obstructs backpropagation. ..."

    The proof assumes the adversary must optimize over the owner's chained triggers, so the one-way hash blocks backpropagation. But Section 4.2 embeds watermarks by training on original-plus-watermark data, and Section 9.1 says 'the watermarks can be embedded through fine-tuning'. An adversary with white-box surrogate access can choose its own seed, generate its own hash chain, pick its own digital signature, and fine-tune those pairs into the surrogate, yielding a second valid ChainMarks watermark under the same verification procedure. Table 6 only evaluates the additive-noise optimization variant, not this fine-tuning variant.

full rationale

The two-phase Monte Carlo threshold estimation (Sections 4.4 and 5) is not circular: it estimates the null distribution of label matches from the model's own output probabilities and then sets a Hamming-distance threshold for a chosen p-value, which is standard hypothesis testing. The marginal-utility comparison is computed from those same threshold curves and, although the comparison with baselines is methodologically uneven, it is not a reduction of a prediction to a fitted input. No load-bearing self-citation chain was found. The score is driven by the self-definitional scope of the ambiguity-attack analysis: the conclusion that ChainMarks 'can efficiently defeat ... watermark ambiguity attacks' is an artifact of defining the attack as optimization over the owner's chain, thereby excluding the fine-tuning embedding procedure that the paper itself acknowledges in Section 9.1.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The ledger shows that ChainMarks introduces no new physical entities and no secret constants beyond the user-chosen seed key and chain length. The main assumptions are statistical (independence, normal tail approximation) and cryptographic (hash cannot be optimized through), neither of which is proven in the paper. The p_U estimate is a fitted statistical quantity that enters the threshold computation.

free parameters (3)
  • p_U (zero-hit class probability) = 8.672e-8 (CIFAR-100 estimate)
    Estimated from 50 simulations of the number of random inputs until first hit into the 49 never-hit classes; this number enters the variance bound in Eq. (11) and therefore the decision threshold.
  • chain length L = 100 in main experiments
    User-selected; the paper recommends L >= sqrt(C). It determines the number of trigger blocks and the granularity of the Hamming-distance threshold.
  • uniform probability allocation p_i = p_U/k for zero-hit classes = p_U/k, e.g., about 1.77e-9 for CIFAR-100
    Introduced in Eq. (11) to compute a lower bound on the sum of squares; not derived from data and likely inaccurate for individual classes.
assumptions (5)
  • domain assumption For a random input, the predicted label of a DNN model follows a fixed probability distribution p_i over classes, independent of other inputs.
    Sections 5.1 and 5.2 model each chain position as an independent Bernoulli trial with success probability p_{c_i}; if hash-generated triggers are not exchangeable with the random inputs used to estimate p_i, the p-value guarantee fails.
  • standard math The normal approximation to the Poisson binomial distribution is accurate in the extreme tail needed for small p-values.
    Claim 1 relies on the CLT-based approximation (Eq. 4); the paper validates it only for L<=20 with an MOE under 1.2%, not for tail probabilities around 1e-7 to 1e-12 used in Section 5.3.
  • domain assumption A one-way hash function cannot be included in a gradient-based optimization, so an adversary cannot produce chained triggers that also match a chosen signature.
    Section 8.1 states that hash 'lacks gradients'; the security of the ambiguity-attack defense depends entirely on this being true for the actual attack algorithms.
  • domain assumption The owner's digital signature converted to base C yields target labels that are effectively random and unknown to the attacker.
    Section 4.2; the false-positive analysis treats the signature labels as fixed but unpredictable; if an attacker can influence or know the signature, the guessing model changes.
  • domain assumption Trigger inputs are out-of-distribution noise, so fine-tuning and pruning of task-relevant features do not erase them.
    Section 8.2; this is the basis for robustness against model modification attacks, and it is tested empirically rather than proven.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ChainMarks: Securing DNN Watermark with Cryptographic Chain." pith.science (2026). https://pith.science/paper/GQ23TQYO

@misc{pith2026250504977,
  author       = {Pith},
  title        = {Pith review of: ChainMarks: Securing DNN Watermark with Cryptographic Chain},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GQ23TQYO}},
  note         = {Machine review of arXiv:2505.04977}
}
read the original abstract

With the widespread deployment of deep neural network (DNN) models, dynamic watermarking techniques are being used to protect the intellectual property of model owners. However, recent studies have shown that existing watermarking schemes are vulnerable to watermark removal and ambiguity attacks. Besides, the vague criteria for determining watermark presence further increase the likelihood of such attacks. In this paper, we propose a secure DNN watermarking scheme named ChainMarks, which generates secure and robust watermarks by introducing a cryptographic chain into the trigger inputs and utilizes a two-phase Monte Carlo method for determining watermark presence. First, ChainMarks generates trigger inputs as a watermark dataset by repeatedly applying a hash function over a secret key, where the target labels associated with trigger inputs are generated from the digital signature of model owner. Then, the watermarked model is produced by training a DNN over both the original and watermark datasets. To verify watermarks, we compare the predicted labels of trigger inputs with the target labels and determine ownership with a more accurate decision threshold that considers the classification probability of specific models. Experimental results show that ChainMarks exhibits higher levels of robustness and security compared to state-of-the-art watermarking schemes. With a better marginal utility, ChainMarks provides a higher probability guarantee of watermark presence in DNN models with the same level of watermark accuracy.

Figures

Figures reproduced from arXiv: 2505.04977 by the authors.

Figure 1
Figure 1. An example of dynamic deep neural network wa [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 3
Figure 3. Embedding a watermark into a DNN model. The [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. The overview of watermark verification with a cryp [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: Required watermark accuracy (1 − 𝜃) vs. threshold probability 𝑝, for different watermarking schemes. schemes. This is attributed to ChainMarks’s high level of security, which enables a greater tolerance for errors, i.e., a higher allowable Hamming distance threshold 𝜃.…
Figure 6
Figure 6. Figure 6: Watermark marginal utility for various schemes. [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

100 extracted references · 46 canonical work pages

  1. [1]

    Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet

  2. [2]

    William Aiken, Hyoungshick Kim, Simon Woo, and Jungwoo Ryoo. 2021. Neural network laundering: Removing black-box backdoor watermarks from deep neural networks. Computers & Security 106 (2021), 102277

    2021

  3. [3]

    Eugene Bagdasaryan and Vitaly Shmatikov. 2021. Blind backdoors in deep learning models. In Usenix Security

    2021

  4. [4]

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How to backdoor federated learning. InInternational Conference on Artificial Intelligence and Statistics . PMLR, 2938–2948

    2020

  5. [5]

    Arpit Bansal, Ping-yeh Chiang, Michael J Curry, Rajiv Jain, Curtis Wigington, Varun Manjunatha, John P Dickerson, and Tom Goldstein. 2022. Certified Neural Network Watermarks with Randomized Smoothing. In International Conference on Machine Learning. PMLR, 1450–1465

    2022

  6. [6]

    Mauro Barni, Fernando Pérez-González, and Benedetta Tondi. 2021. DNN water- marking: Four challenges and a funeral. InProceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security . 189–196

    2021

  7. [7]

    Antoni Buades, Bartomeu Coll, and J-M Morel. 2005. A non-local algorithm for image denoising. In 2005 IEEE computer society conference on computer vision and pattern recognition (CVPR’05), Vol. 2. Ieee, 60–65

    2005

  8. [8]

    Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. 2021. IPGuard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary. In Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security. 14–25

    2021

Show all 100 references
  1. [9]

    Abhishek Chakraborty, Daniel Xing, Yuntao Liu, and Ankur Srivastava. 2022. DynaMarks: Defending Against Deep Learning Model Extraction Using Dynamic Watermarking. arXiv preprint arXiv:2207.13321 (2022)

    2022 arXiv

  2. [10]

    Huili Chen, Bita Darvish Rouhani, Cheng Fu, Jishen Zhao, and Farinaz Koushan- far. 2019. Deepmarks: A secure fingerprinting framework for digital rights management of deep learning models. In Proceedings of the 2019 on International Conference on Multimedia Retrieval . 105–113

    2019

  3. [11]

    Huili Chen, Bita Darvish Rouhani, and Farinaz Koushanfar. 2019. Blackmarks: Blackbox multibit watermarking for deep neural networks. arXiv preprint arXiv:1904.00344 (2019)

    2019 arXiv

  4. [12]

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)

    2017 arXiv

  5. [13]

    Xiaoyi Chen, Ahmed Salem, Dingfan Chen, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang. 2021. Badnl: Backdoor attacks against nlp models with semantic-preserving improvements. In Annual Computer Security Applications Conference. 554–569

    2021

  6. [14]

    Xinyun Chen, Wenxiao Wang, Chris Bender, Yiming Ding, Ruoxi Jia, Bo Li, and Dawn Song. 2021. Refit: a unified watermark removal framework for deep learning systems with limited data. InProceedings of the 2021 ACM Asia Conference on Computer and Communications Security . 321–335

    2021

  7. [15]

    Xinyun Chen, Wenxiao Wang, Yiming Ding, Chris Bender, Ruoxi Jia, Bo Li, and Dawn Song. 2019. Leveraging unlabeled data for watermark removal of deep neural networks. In ICML workshop on Security and Privacy of Machine Learning . 1–6

    2019

  8. [16]

    Yiming Chen, Jinyu Tian, Xiangyu Chen, and Jiantao Zhou. 2023. Effective ambiguity attack against passport-based dnn intellectual property protection schemes through fully connected layer substitution. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Rec...

    2023

  9. [17]

    Siyuan Cheng, Guanhong Tao, Yingqi Liu, Shengwei An, Xiangzhe Xu, Shiwei Feng, Guangyu Shen, Kaiyuan Zhang, Qiuling Xu, Shiqing Ma, et al. 2023. BEA- GLE: Forensics of Deep Learning Backdoor Attack for Better Defense. arXiv preprint arXiv:2301.06241 (2023)

    2023 arXiv

  10. [18]

    KP Choi and Aihua Xia. 2002. Approximating the number of successes in inde- pendent trials: Binomial versus Poisson. The Annals of Applied Probability 12, 4 (2002), 1139–1148

    2002

  11. [19]

    Edward Chou, Florian Tramer, and Giancarlo Pellegrino. 2020. Sentinet: Detecting localized universal attacks against deep learning systems. In 2020 IEEE Security and Privacy Workshops (SPW). IEEE, 48–54

    2020

  12. [20]

    Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M Roy. 2016. A study of the effect of jpg compression on adversarial images. arXiv preprint arXiv:1608.00853 (2016)

    2016 arXiv

  13. [21]

    Lixin Fan, Kam Woh Ng, and Chee Seng Chan. 2019. Rethinking deep neural network ownership verification: Embedding passports to defeat ambiguity attacks. Advances in neural information processing systems 32 (2019)

    2019

  14. [22]

    Henri Gilbert and Helena Handschuh. 2003. Security analysis of SHA-256 and sisters. In International workshop on selected areas in cryptography . Springer, 175–193

    2003

  15. [23]

    Xueluan Gong, Yanjiao Chen, Wang Yang, Qian Wang, Yuzhe Gu, Huayang Huang, and Chao Shen. 2023. REDEEM MYSELF: Purifying Backdoors in Deep Learning Models using Self Attention Distillation. In 2023 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 755–772

    2023

  16. [24]

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)

    2017 arXiv

  17. [25]

    Jia Guo and Miodrag Potkonjak. 2018. Watermarking deep neural networks for embedded systems. In2018 IEEE/ACM International Conference on Computer-Aided Design (ICCAD). IEEE, 1–8

    2018

  18. [26]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition . 770–778

    2016

  19. [27]

    Yili Hong. 2013. On computing the distribution function for the Poisson binomial distribution. Computational Statistics & Data Analysis 59 (2013), 41–51

    2013

  20. [28]

    Itay Hubara, Matthieu Courbariaux, Daniel Soudry, Ran El-Yaniv, and Yoshua Bengio. 2017. Quantized neural networks: Training neural networks with low precision weights and activations. The Journal of Machine Learning Research 18, 1 (2017), 6869–6898

    2017

  21. [29]

    Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2018. Black- box adversarial attacks with limited queries and information. In International conference on machine learning . PMLR, 2137–2146

    2018

  22. [30]

    Hengrui Jia, Christopher A Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot. 2021. Entangled Watermarks as a Defense against Model Extraction.. In USENIX Security Symposium. 1937–1954

    2021

  23. [31]

    Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong. 2022. Badencoder: Backdoor at- tacks to pre-trained encoders in self-supervised learning. In2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2043–2059

    2022

  24. [32]

    Katarzyna Kapusta, Vincent Thouvenot, Olivier Bettan, Hugo Beguinet, and Hugo Senet. 2021. A protocol for secure verification of watermarks embedded into machine learning models. In Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security . 171–176

    2021

  25. [33]

    ]Cifar Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. [n. d.]. CIFAR-10 and CIFAR-100 datasets. https://www.cs.toronto.edu/~kriz/cifar.html

  26. [34]

    Minoru Kuribayashi, Takuro Tanaka, Shunta Suzuki, Tatsuya Yasui, and Nobuo Funabiki. 2021. White-box watermarking scheme for fully-connected layers in fine-tuning model. In Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security . 165–170

    2021

  27. [35]

    Leslie Lamport. 1981. Password authentication with insecure communication. Commun. ACM 24, 11 (1981), 770–772

    1981

  28. [36]

    Yingjie Lao, Weijie Zhao, Peng Yang, and Ping Li. 2022. DeepAuth: A DNN authentication framework by model-unique and fragile signature embedding. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 36. 9595–9603

    2022

  29. [37]

    Erwan Le Merrer, Patrick Perez, and Gilles Trédan. 2020. Adversarial frontier stitching for remote neural network watermarking. Neural Computing and Applications 32 (2020), 9233–9244

    2020

  30. [38]

    Chaoran Li, Xiao Chen, Derui Wang, Sheng Wen, Muhammad Ejaz Ahmed, Seyit Camtepe, and Yang Xiang. 2021. Backdoor attack on machine learning based android malware detectors. IEEE Transactions on Dependable and Secure Computing 19, 5 (2021), 3357–3370

    2021

  31. [39]

    Huiying Li, Emily Wenger, Shawn Shan, Ben Y Zhao, and Haitao Zheng

  32. [40]

    Li Li, Weiming Zhang, and Mauro Barni. 2023. Universal BlackMarks: Key-Image- Free Blackbox Multi-Bit Watermarking of Deep Neural Networks. IEEE Signal Processing Letters 30 (2023), 36–40

    2023

  33. [41]

    Peixuan Li, Pengzhou Cheng, Fangqi Li, Wei Du, Haodong Zhao, and Gongshen Liu. 2023. PLMmark: a secure and robust black-box watermarking framework for pre-trained language models. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 14991–14999

    2023

  34. [42]

    Shaofeng Li, Minhui Xue, Benjamin Zi Hao Zhao, Haojin Zhu, and Xinpeng Zhang

  35. [43]

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. 2022. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems (2022)

    2022

  36. [44]

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. 2021. Invisible backdoor attack with sample-specific triggers. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 16463–16472

    2021

  37. [45]

    Yue Li, Benedetta Tondi, and Mauro Barni. 2021. Spread-transform dither modu- lation watermarking of deep neural network. Journal of Information Security and Applications 63 (2021), 103004

    2021

  38. [46]

    Yue Li, Hongxia Wang, and Mauro Barni. 2021. A survey of deep neural network watermarking techniques. Neurocomputing 461 (2021), 171–193

    2021

  39. [47]

    Yiming Li, Mingyan Zhu, Xue Yang, Yong Jiang, Tao Wei, and Shu-Tao Xia. 2023. Black-box Dataset Ownership Verification via Backdoor Watermarking. IEEE Transactions on Information Forensics and Security (2023)

    2023

  40. [48]

    Ji Lin, Chuang Gan, and Song Han. 2019. Defensive quantization: When efficiency meets robustness. arXiv preprint arXiv:1904.08444 (2019). ASIA CCS ’25, August 25–29, 2025, Hanoi, Vietnam Brian Choi, Shu Wang, Isabelle Choi, and Kun Sun

    2019 arXiv

  41. [49]

    Junyu Lin, Lei Xu, Yingqi Liu, and Xiangyu Zhang. 2020. Composite backdoor attack for deep neural network by mixing existing benign features. InProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security . 113–131

    2020

  42. [50]

    Xuankai Liu, Fengting Li, Bihan Wen, and Qi Li. 2021. Removing backdoor-based watermarks in neural networks with limited data. In 2020 25th International Conference on Pattern Recognition (ICPR) . IEEE, 10149–10156

    2021

  43. [51]

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018. Trojaning attack on neural networks. In 25th Annual Network And Distributed System Security Symposium (NDSS 2018) . Internet Soc

    2018

  44. [52]

    Zeyan Liu, Fengjun Li, Zhu Li, and Bo Luo. 2022. LoneNeuron: a Highly-Effective Feature-Domain Neural Trojan Using Invisible and Polymorphic Watermarks. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 2129–2143

    2022

  45. [53]

    Nils Lukas, Edward Jiang, Xinda Li, and Florian Kerschbaum. 2022. Sok: How robust is image classification deep neural network watermarking?. In 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 787–804

    2022

  46. [54]

    Peizhuo Lv, Pan Li, Shengzhi Zhang, Kai Chen, Ruigang Liang, Hualong Ma, Yue Zhao, and Yingjiu Li. 2023. A Robustness-Assured White-Box Watermark in Neural Networks. IEEE Transactions on Dependable and Secure Computing (2023)

    2023

  47. [55]

    Peizhuo Lv, Hualong Ma, Kai Chen, Jiachen Zhou, Shengzhi Zhang, Ruigang Liang, Shenchen Zhu, Pan Li, and Yingjun Zhang. 2024. MEA-defender: a robust watermark against model extraction attack. In 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2515–2533

    2024

  48. [56]

    Wanlun Ma, Derui Wang, Ruoxi Sun, Minhui Xue, Sheng Wen, and Yang Xiang

  49. [57]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)

    2017 arXiv

  50. [58]

    Risto Miikkulainen, Jason Liang, Elliot Meyerson, Aditya Rawal, Daniel Fink, Olivier Francon, Bala Raju, Hormoz Shahrzad, Arshak Navruzyan, Nigel Duffy, et al. 2019. Evolving deep neural networks. In Artificial intelligence in the age of neural networks and brain computing . E...

    2019

  51. [59]

    Ryota Namba and Jun Sakuma. 2019. Robust watermarking of neural network with exponential weighting. In Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security . 228–240

    2019

  52. [60]

    Tuan Anh Nguyen and Anh Tran. 2020. Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems 33 (2020), 3454–3464

    2020

  53. [61]

    Maximilian Noppel, Lukas Peter, and Christian Wressnegger. 2022. Disguising Attacks with Explanation-Aware Backdoors. In 2023 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 996–1013

    2022

  54. [62]

    Xudong Pan, Mi Zhang, Beina Sheng, Jiaming Zhu, and Min Yang. 2022. Hidden trigger backdoor attack on{NLP} models via linguistic style manipulation. In 31st USENIX Security Symposium (USENIX Security 22) . 3611–3628

    2022

  55. [63]

    Erwin Quiring and Konrad Rieck. 2020. Backdooring and poisoning neural networks with image-scaling attacks. In2020 IEEE Security and Privacy Workshops (SPW). IEEE, 41–47

    2020

  56. [64]

    Vincent Rijmen and Elisabeth Oswald. 2005. Update on SHA-1. In Topics in Cryptology–CT-RSA 2005: The Cryptographers’ Track at the RSA Conference 2005, San Francisco, CA, USA, February 14-18, 2005. Proceedings . Springer, 58–71

  57. [65]

    Ronald Rivest. 1992. The MD5 message-digest algorithm . Technical Report

    1992

  58. [66]

    Bita Darvish Rouhani, Huili Chen, and Farinaz Koushanfar. 2019. Deepsigns: an end-to-end watermarking framework for protecting the ownership of deep neural networks. In ACM International Conference on Architectural Support for Programming Languages and Operating Systems

    2019

  59. [67]

    Giorgio Severi, Jim Meyer, Scott E Coull, and Alina Oprea. 2021. Explanation- Guided Backdoor Poisoning Attacks Against Malware Classifiers.. In USENIX Security Symposium. 1487–1504

    2021

  60. [68]

    M Shafieinejad et al. 1906. On the robustness of the backdoor-based watermarking in deep neural networks. CoRR (2019)

    2019

  61. [69]

    Fnu Suya, Jianfeng Chi, David Evans, and Yuan Tian. 2020. Hybrid batch attacks: Finding black-box adversarial examples with limited queries. In 29th USENIX Security Symposium

    2020

  62. [70]

    Sebastian Szyller, Buse Gul Atli, Samuel Marchal, and N Asokan. 2021. Dawn: Dynamic adversarial watermarking of neural networks. InProceedings of the 29th ACM International Conference on Multimedia . 4417–4425

    2021

  63. [71]

    Hailun Tan, Sanjay Jha, Diet Ostry, John Zic, and Vijay Sivaraman. 2008. Se- cure multi-hop network programming with multiple one-way key chains. In Proceedings of the first ACM conference on Wireless network security . 183–193

    2008

  64. [72]

    Enzo Tartaglione, Marco Grangetto, Davide Cavagnino, and Marco Botta. 2021. Delving in the loss landscape to embed robust watermarks into neural networks. In 2020 25th International Conference on Pattern Recognition (ICPR) . IEEE, 1243– 1250

    2021

  65. [73]

    Zhiyi Tian, Lei Cui, Jie Liang, and Shui Yu. 2022. A Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning. Comput. Surveys 55, 8 (2022), 1–35

    2022

  66. [74]

    Lisa Torrey and Jude Shavlik. 2010. Transfer learning. In Handbook of research on machine learning applications and trends: algorithms, methods, and techniques . IGI global, 242–264

    2010

  67. [75]

    Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart

  68. [76]

    Chun-Chen Tu, Paishun Ting, Pin-Yu Chen, Sijia Liu, Huan Zhang, Jinfeng Yi, Cho-Jui Hsieh, and Shin-Ming Cheng. 2019. Autozoom: Autoencoder-based zeroth order optimization method for attacking black-box neural networks. In Proceedings of the AAAI Conference on Artificial Intel...

    2019

  69. [77]

    Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin’ichi Satoh. 2017. Embedding watermarks into deep neural networks. In Proceedings of the 2017 ACM on international conference on multimedia retrieval . 269–277

    2017

  70. [78]

    A Yu Volkova. 1996. A refinement of the central limit theorem for sums of independent random indicators. Theory of Probability & Its Applications 40, 4 (1996), 791–794

    1996

  71. [79]

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. 2019. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP) . IEEE, 707–723

    2019

  72. [80]

    Shu Wang, Kun Sun, and Yan Zhai. 2024. Dye4AI: Assuring Data Boundary on Generative AI Services. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security . 2281–2295

    2024

  73. [81]

    Hanzhou Wu, Gen Liu, Yuwei Yao, and Xinpeng Zhang. 2020. Watermarking neural networks with watermarked images. IEEE Transactions on Circuits and Systems for Video Technology 31, 7 (2020), 2591–2601

    2020

  74. [82]

    Zhaohan Xi, Ren Pang, Shouling Ji, and Ting Wang. 2021. Graph Backdoor.. In USENIX Security Symposium. 1523–1540

    2021

  75. [83]

    Qixue Xiao, Yufei Chen, Chao Shen, Yu Chen, and Kang Li. 2019. Seeing is Not Believing: Camouflage Attacks on Image Scaling Algorithms.. InUSENIX Security Symposium. 443–460

    2019

  76. [84]

    Weilin Xu, David Evans, and Yanjun Qi. 2017. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155 (2017)

    2017 arXiv

  77. [85]

    Mingfu Xue, Jian Wang, and Weiqiang Liu. 2021. DNN intellectual property protection: Taxonomy, attacks and evaluations. In Proceedings of the 2021 on Great Lakes Symposium on VLSI . 455–460

    2021

  78. [86]

    Limin Yang, Zhi Chen, Jacopo Cortellazzi, Feargus Pendlebury, Kevin Tu, Fabio Pierazzi, Lorenzo Cavallaro, and Gang Wang. 2023. Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifiers. IEEE Symposium on Security and Privacy (S&P) (2023)

    2023

  79. [87]

    Yuanshun Yao, Huiying Li, Haitao Zheng, and Ben Y Zhao. 2019. Latent back- door attacks on deep neural networks. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security . 2041–2055

    2019

  80. [88]

    Sergey Zagoruyko and Nikos Komodakis. 2016. Wide residual networks. arXiv preprint arXiv:1605.07146 (2016)

    2016 arXiv

  81. [89]

    Valentina Zantedeschi, Maria-Irina Nicolae, and Ambrish Rawat. 2017. Efficient defenses against adversarial attacks. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security. 39–49

    2017

  82. [90]

    Tongqing Zhai, Yiming Li, Ziqi Zhang, Baoyuan Wu, Yong Jiang, and Shu-Tao Xia. 2021. Backdoor attack against speaker verification. In ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 2560–2564

    2021

  83. [91]

    Jie Zhang, Dongdong Chen, Jing Liao, Han Fang, Weiming Zhang, Wenbo Zhou, Hao Cui, and Nenghai Yu. 2020. Model watermarking for image processing networks. In Proceedings of the AAAI conference on artificial intelligence , Vol. 34. 12805–12812

    2020

  84. [92]

    Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Marc Ph Stoecklin, Heqing Huang, and Ian Molloy. 2018. Protecting intellectual property of deep neural networks with watermarking. In Proceedings of the 2018 on Asia Conference on Computer and Communications Security . 159–172

    2018

  85. [93]

    Zaixi Zhang, Jinyuan Jia, Binghui Wang, and Neil Zhenqiang Gong. 2021. Back- door attacks to graph neural networks. InProceedings of the 26th ACM Symposium on Access Control Models and Technologies . 15–26

    2021

  86. [94]

    Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu- Gang Jiang. 2020. Clean-label backdoor attacks on video recognition models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 14443–14452

    2020

  87. [95]

    Michael Zhu and Suyog Gupta. 2017. To prune, or not to prune: exploring the efficacy of pruning for model compression. arXiv preprint arXiv:1710.01878 (2017)

    2017 arXiv

  88. [2016]

    In USENIX security symposium, Vol

    Stealing Machine Learning Models via Prediction APIs.. In USENIX security symposium, Vol. 16. 601–618

  89. [2018]

    In 27th USENIX Security Symposium (USENIX Security 18)

    Turning your weakness into a strength: Watermarking deep neural net- works by backdooring. In 27th USENIX Security Symposium (USENIX Security 18) . 1615–1631

  90. [2019]

    arXiv preprint arXiv:1910.01226 (2019)

    Piracy resistant watermarks for deep neural networks. arXiv preprint arXiv:1910.01226 (2019)

    2019 arXiv

  91. [2020]

    IEEE Transactions on Dependable and Secure Computing 18, 5 (2020), 2088–2105

    Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing 18, 5 (2020), 2088–2105

    2020

  92. [2022]

    Beatrix

    The" Beatrix”Resurrections: Robust Backdoor Detection via Gram Matrices. arXiv preprint arXiv:2209.11715 (2022)

    2022 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.