Hashed Watermark as a Filter: Defeating Forging and Overwriting Attacks in Weight-based Neural Network Watermarking

2025/07/15 by Yuan Yao, Yao, Yuan, Jin Woo Song +3 · 1 citation
Computer Science · #Advanced Steganography and Watermarking Techniques #Adversarial Robustness in Machine Learning #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Generative Adversarial Networks and Image Synthesis #Machine Learning (cs.LG)

paper · pdf · doi:10.48550/arxiv.2507.11137

openalex publication_date 2025/07/15 · openalex created_date 2025/10/08 · openalex updated_date 2026/07/28

Abstract

As valuable digital assets, deep neural networks necessitate robust ownership protection, positioning neural network watermarking (NNW) as a promising solution. Among various NNW approaches, weight-based methods are favored for their simplicity and practicality; however, they remain vulnerable to forging and overwriting attacks. To address those challenges, we propose NeuralMark, a robust method built around a hashed watermark filter. Specifically, we utilize a hash function to generate an irreversible binary watermark from a secret key, which is then used as a filter to select the model parameters for embedding. This design cleverly intertwines the embedding parameters with the hashed watermark, providing a robust defense against both forging and overwriting attacks. An average pooling is also incorporated to resist fine-tuning and pruning attacks. Furthermore, it can be seamlessly integrated into various neural network architectures, ensuring broad applicability. Theoretically, we analyze its security boundary. Empirically, we verify its effectiveness and robustness across 13 distinct Convolutional and Transformer architectures, covering five image classification tasks and one text generation task. The source codes are available at https://github.com/AIResearch-Group/NeuralMark.

Citations

• Decoder Gradient Shield: Provable and High-Fidelity Prevention of Gradient-Based Box-Free Watermark Removal
• Persistence of Backdoor-based Watermarks for Neural Networks: A Comprehensive Evaluation
• The Llama 3 Herd of Models
• The rising costs of training frontier AI models
• Revisiting the Information Capacity of Neural Network Watermarks: Upper Bound Estimation and Beyond
• Qwen Technical Report
• Deep Intellectual Property Protection: A Survey
• Summary of ChatGPT-Related research and perspective towards the future of large language models
• Rethinking White-Box Watermarks on Deep Learning Models under Neural Structural Obfuscation
• GPT-4 Technical Report
• Swin Transformer V2: Scaling Up Capacity and Resolution
• SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)
• LoRA: Low-Rank Adaptation of Large Language Models
• A survey of deep neural network watermarking techniques
• Deep Model Intellectual Property Protection via Deep Watermarking
• Spread-Transform Dither Modulation Watermarking of Deep Neural Network
• Passport-aware Normalization for Deep Model Protection
• An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale
• Pooling Methods in Deep Neural Networks, a Review
• Protect, Show, Attend and Tell: Empowering Image Captioning Models with Ownership Protection
• Language Models are Few-Shot Learners
• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• [Extended version] Rethinking Deep Neural Network Ownership\n Verification: Embedding Passports to Defeat Ambiguity Attacks
• Searching for MobileNetV3
• Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring
• Decoupled Weight Decay Regularization
• Wide Residual Networks
• Deep Residual Learning for Image Recognition
• Going Deeper with Convolutions
• Very Deep Convolutional Networks for Large-Scale Image Recognition
• ImageNet classification with deep convolutional neural networks

Cited by

• FLClear: Visually Verifiable Multi-Client Watermarking for Federated Learning

Related

• Neural Network Laundering: Removing Black-Box Backdoor Watermarks from\n Deep Neural Networks
• WaterMAS: Sharpness-Aware Maximization for Neural Network Watermarking
• Robust Watermarking of Neural Network with Exponential Weighting
• FreeMark: A Non-Invasive White-Box Watermarking for Deep Neural Networks
• High-frequency Matters: An Overwriting Attack and defense for Image-processing Neural Network Watermarking