Research map / Adversarial robustness and security / Attacks on text and graphs
Defense against Model Extraction Attack by Bayesian Active Watermarking
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Bayesian active watermarking (ACT), which lightly fine-tunes a victim model so that a randomly sampled, input-conditioned watermark added to queries degrades clone-model extraction while preserving utility.
Problem
Defending deployed black-box models against model extraction with low deployment cost, without full re-training, and actively preventing (not just detecting) extraction.
Approach
Fine-tune the victim so that a watermark posterior q(w|x), approximated by an amortized implicit inference network trained via kernelized Wasserstein gradient flow, maximizes likelihood on watermarked ID data and maximizes output change on watermarked synthetic OOD data; at deployment a watermark is sampled and added to each query.
Key results
- On CIFAR10 under DFME soft-label attack with ResNet18-8x clone, ACT reduces clone accuracy to 46.57% vs 51.68% for MeCo and 87.36% undefended.
- Under hard-label DFMS-HL on CIFAR100 with DenseNet121 clone, ACT gives 52.29% vs 56.80% for MeCo (ACT 61.08% vs 62.33% on CIFAR10 DenseNet121).
- Reports about 87% reduction in re-training cost relative to MeCo and 17x to 172x inference speedup over P-poison and GRAD, with utility comparable to baselines (CIFAR10 94.31%).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use ACT instead of MeCo for the defense | ResNet34-8x under DFME with ResNet18-8X clone · CIFAR10 | clone accuracy: 51.68 ± 1.96% -> 46.57 ± 2.83% | Helped |
| Use ACT instead of MeCo for the defense | ResNet34-8x under DFME with MobileNetV2 clone · CIFAR10 | clone accuracy: 46.53 ± 2.09% -> 40.32 ± 2.96% | Helped |
| Use ACT instead of MeCo for the defense | ResNet34-8x under DFME with DenseNet121 clone · CIFAR10 | clone accuracy: 61.38 ± 2.41% -> 49.25 ± 2.67% | Helped |
| Use ACT instead of MeCo for the defense | ResNet34-8x under MAZE with DenseNet121 clone · CIFAR10 | clone accuracy: 17.95 ± 1.46% -> 17.21 ± 1.97% | No clear effect |
| Use ACT instead of MeCo for the defense | ResNet34-8x under DFMS-HL with MobileNetV2 clone · CIFAR10 | clone accuracy: 71.22 ± 1.87% -> 71.97 ± 2.08% | Hurt |
| Use ACT instead of MeCo for the defense | ResNet34-8x under DFMS-HL with ResNet18-8X clone · CIFAR100 | clone accuracy: 59.30 ± 1.70% -> 55.38 ± 1.97% | Helped |
| Use ACT instead of MeCo for the defense | ResNet34-8x under DFMS-HL with MobileNetV2 clone · CIFAR100 | clone accuracy: 55.32 ± 1.65% -> 51.46 ± 1.89% | Helped |
| Use ACT instead of MeCo for the defense | ResNet34-8x under DFMS-HL with DenseNet121 clone · CIFAR100 | clone accuracy: 56.80 ± 1.86% -> 52.29 ± 2.03% | Helped |
| Add an ensemble of surrogate watermark posteriors to the attack | Model extraction against ACT · CIFAR10, clone ResNet18-8X | clone accuracy: 46.57 ± 2.83% -> 52.68 ± 2.91% | Hurt |
| Add an ensemble of surrogate watermark posteriors to the attack | Model extraction against ACT · CIFAR10, clone MobileNetV2 | clone accuracy: 40.32 ± 2.96% -> 45.19 ± 3.07% | Hurt |
| Add an ensemble of surrogate watermark posteriors to the attack | Model extraction against ACT · CIFAR10, clone DenseNet121 | clone accuracy: 49.25 ± 2.67% -> 57.83 ± 2.82% | Hurt |
| Fine-tune the victim using ACT rather than MeCo | Victim model · CIFAR10 | benign test accuracy: 94.17 ± 0.56% -> 94.31 ± 0.75% | No clear effect |
Surprising findings
- Ensemble adaptive attack raises clone accuracy by more than 8 points relative to ACT, showing the defense is still sensitive to stronger adaptive attacks.
Limitations
- Victim models used are not sufficiently large; the authors plan MoE scaling as future work.
- Defense assumes attack queries are OOD, relying on synthetic OOD data generation.
Experimental setup
Datasets: MNIST CIFAR10 CIFAR100 MiniImageNet CINIC-10 ImageNet subset
Benchmarks: MNIST CIFAR10 CIFAR100 MiniImageNet
Metrics: clone model test accuracy benign test accuracy inference time training cost
Baselines: MAZE DFME DFMS-HL RandP P-poison GRAD MeCo Knockoff Nets JBDA
Builds on: MeCo Wasserstein gradient flow Stein variational gradient descent noise2net
Closest papers by meaning
- Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.87)
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.86)
- StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models (NeurIPS 2025 · similarity 0.86)
- Watermarks in the Sand: Impossibility of Strong Watermarking for Language Models (ICML 2024 · similarity 0.85)
- On the Learnability of Watermarks for Language Models (ICLR 2024 · similarity 0.85)
- SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models (CVPR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.