Research map / Adversarial robustness and security / Attacks on text and graphs
Safe and Robust Watermark Injection with a Single OoD Image
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a backdoor watermarking method that injects a watermark into a pre-trained classifier by fine-tuning on augmented patches from one secret OoD image, with adversarial weight perturbation to resist fine-tuning, pruning and model extraction removal attacks.
Problem
Backdoor-based model watermarking normally needs poisoned in-distribution training data, which is often unavailable due to privacy or confidentiality, and the watermarks are fragile under fine-tuning, pruning and model extraction.
Approach
Derive a surrogate dataset of augmented patches from a single secret OoD image, pseudo-label it with the pre-trained model, poison a subset with trigger patterns, and fine-tune with layer-wise norm-bounded adversarial weight perturbation plus a KL term so the watermark lies in a flatter, harder-to-erase region of the loss landscape.
Key results
- On CIFAR-10 with trojan_wm, the victim model reaches 95.66% OoDWSR with 91.02% accuracy, versus 4.87% for the non-watermarked model.
- After RT-AL removal on CIFAR-10, OoDWSR is 57.52% with weight perturbation versus 19.94% without it (trojan_wm).
- After FT-AL on GTSRB smooth, IDWSR falls below 1% while OoDWSR remains above 67%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add weight perturbation during OoD watermark injection (ablation) | CIFAR-10 trojan_wm under RT-AL · CIFAR-10 | OoDWSR: 0.1994 -> 0.5752 | Helped |
| Add weight perturbation during OoD watermark injection (ablation) | CIFAR-10 trojan_8x8 under RT-AL · CIFAR-10 | OoDWSR: 0.1281 -> 0.2419 | Helped |
| Add weight perturbation during OoD watermark injection (ablation) | CIFAR-10 trojan_wm under FT-AL · CIFAR-10 | OoDWSR: 0.7305 -> 0.9678 | Helped |
| Add weight perturbation during OoD watermark injection (ablation) | CIFAR-10 trojan_8x8 under FT-AL · CIFAR-10 | OoDWSR: 0.8184 -> 0.9797 | Helped |
| Use OoD poisoning instead of ID poisoning | CIFAR-10 watermark under RT-AL · CIFAR-10 | OoDWSR: 0.0413 -> 0.4434 | Helped |
| Use a dense Animals image rather than the City image | CIFAR-10 trojan_wm injection · CIFAR-10 | OoDWSR: 0.9566 -> 0.9880 | Helped |
| Use the sparse Bridge image rather than the City image | CIFAR-10 trojan_wm injection · CIFAR-10 | OoDWSR: 0.9566 -> 0.7148 | Hurt |
| Combine City and Animal source images instead of using City alone (ablation) | CIFAR-10 trojan_wm under FT-AL · CIFAR-10 | OoDWSR: 0.9678 -> 0.8511 | Hurt |
Surprising findings
- Watermarks injected with i.i.d. data are almost fully erased by fine-tuning (IDWSR drops to 4.13% after RT-AL) while OoD-injected watermarks persist.
- Using a combination of two OoD source images lowered OoDWSR after fine-tuning relative to the single 'City' image (suspect OoDWSR 85.11% vs 96.78%).
Limitations
- Robustness was evaluated only against fine-tuning, pruning and one model extraction attack (knockoff), and some settings show notable accuracy degradation (e.g., RT-AL drops accuracy by up to 16.63% on CIFAR-100).
- Verification relies on the OoD image being kept secret; the OoD detection analysis showed AUROC close to random on CIFAR-100 and GTSRB but the approach is not robust to all detection methods in general.
- Experiments use small CIFAR-scale models and datasets; generalization to large models is not shown.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 GTSRB ImageNet (ImagenetDS auxiliary set for extraction)
Benchmarks: CIFAR-10 CIFAR-100 GTSRB
Metrics: standard accuracy watermark success rate (OoDWSR) ID watermark success rate (IDWSR) p-value from T-test AUROC AUPR
Baselines: RT-AL fine-tuning removal FT-AL fine-tuning removal FT-LL fine-tuning removal pruning removal knockoff model extraction i.i.d. backdoor poisoning (ID) without weight perturbation
Builds on: backdoor watermarking sharpness-aware minimization knockoff model extraction
Closest papers by meaning
- EntropyMark: Towards More Harmless Backdoor Watermark via Entropy-based Constraint for Open-source Dataset Copyright Protection (CVPR 2025 · similarity 0.88)
- IPRemover: A Generative Model Inversion Attack against Deep Neural Network Fingerprinting and Watermarking (AAAI 2024 · similarity 0.87)
- Lightweight-Mark: Rethinking Deep Learning-Based Watermarking (ICML 2025 · similarity 0.86)
- Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.85)
- Revisiting the Information Capacity of Neural Network Watermarks: Upper Bound Estimation and Beyond (AAAI 2024 · similarity 0.85)
- ZeroMark: Towards Dataset Ownership Verification without Disclosing Watermark (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.