Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces a rehearsal-based watermark embedding framework designed to enhance the robustness of model watermarks against extraction attacks. By simulating the model extraction process, the authors fine-tune the watermark knowledge within the target model, which increases its transferability and persistence in stolen models. Experimental results show a significant improvement in watermark resilience against both model extraction and removal attacks, underscoring the method's effectiveness in protecting intellectual property in AI models.
Fine-tuning watermarks using simulated extraction processes can dramatically increase their resilience against adversarial attacks.
Model watermarking safeguards AI model intellectual property by embedding distinctive knowledge that induces unique behavioral signatures. The primary technical challenge lies in ensuring watermark robustness against various post-processing attacks on the watermarked model. Model extraction attacks emerge as the most severe threat, where adversaries exploit prediction outputs to train surrogate models that illegally replicate the original model's functionality. In this work, we propose a rehearsal-based watermark embedding framework to enhance the robustness of model watermarks against model extraction attacks. By simulating the extraction process, our method leverages the loss of a \textit{simulated stolen model} on a trigger set as a training signal to fine-tune the watermark knowledge within the target model. This fine-tuning step encourages the watermark to be embedded in a way that boosts transferability, thereby increasing its chances of persisting and remaining detectable in stolen models. Comprehensive experiments conducted under diverse settings demonstrate that the proposed method significantly improves the robustness of model watermarks against both model extraction and subsequent watermark removal attacks.