Towards the Resistance of Neural Network Watermarking to Fine-tuning

2025/05/02 by Ling Tang, Tang, Ling, Yuefeng Chen +5 · 1 citation
Computer Science · Engineering · #Advanced Steganography and Watermarking Techniques #Artificial Intelligence (cs.AI) #Chaos-based Image/Signal Encryption #Computation and Language (cs.CL) #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Vehicle License Plate Recognition

paper · pdf · doi:10.48550/arxiv.2505.01007

openalex publication_date 2025/05/02 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

This paper proves a new watermarking method to embed the ownership information into a deep neural network (DNN), which is robust to fine-tuning. Specifically, we prove that when the input feature of a convolutional layer only contains low-frequency components, specific frequency components of the convolutional filter will not be changed by gradient descent during the fine-tuning process, where we propose a revised Fourier transform to extract frequency components from the convolutional filter. Additionally, we also prove that these frequency components are equivariant to weight scaling and weight permutations. In this way, we design a watermark module to encode the watermark information to specific frequency components in a convolutional filter. Preliminary experiments demonstrate the effectiveness of our method.

Citations

• REEF: Representation Encoding Fingerprints for Large Language Models
• Instructional Fingerprinting of Large Language Models
• HuRef: HUman-REadable Fingerprint for Large Language Models
• Functional Invariants to Watermark Large Transformers
• A Watermark for Large Language Models
• Defects of Convolutional Decoder Networks in Frequency Representation
• Neural Network Laundering: Removing Black-Box Backdoor Watermarks from Deep Neural Networks
• Deep Neural Network Fingerprinting by Conferrable Adversarial Examples
• Similarity of Neural Network Representations Revisited
• Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring
• Embedding Watermarks into Deep Neural Networks
• Deep Residual Learning for Image Recognition
• ImageNet classification with deep convolutional neural networks
• The Complex Gradient Operator and the CR-Calculus

Cited by

• LLM DNA: Tracing Model Evolution via Functional Representations

Related

• Customized Watermarking for Deep Neural Networks via Label Distribution Perturbation
• On Function-Coupled Watermarks for Deep Neural Networks
• Hashed Watermark as a Filter: Defeating Forging and Overwriting Attacks in Weight-based Neural Network Watermarking
• Free Fine-tuning: A Plug-and-Play Watermarking Scheme for Deep Neural Networks
• Embedding Watermarks into Deep Neural Networks