Research map / Adversarial robustness and security / Attacks on text and graphs
Revisiting the Information Capacity of Neural Network Watermarks: Upper Bound Estimation and Beyond
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Defines an information-theoretic capacity for DNN watermarks under a performance-degradation budget, estimates a tight upper bound via adversarial overwriting, and proposes variational multiple-rounds ownership verification (MROV-V) to transmit beyond capacity.
Problem
Existing DNN watermark capacity studies only measure verification accuracy under ordinary removal attacks and do not capture the tradeoff between robustness, fidelity (performance degradation), and identity-message length.
Approach
Treat the watermark as a channel analogous to channel capacity, constrained by a performance-degradation budget; bound capacity via BER under adversarial overwriting (binary symmetric channel bound); and raise effective code rate by majority voting over multiple verifications with perturbations on the model or ownership key, where a VAE decoder approximates the perturbation distribution for black-
Key results
- Adversarial overwriting gives the lowest and tightest capacity estimate versus fine-tuning and neuron-pruning for the studied schemes.
- With J=1024 and Δ=1%, MTLSign achieves the smallest minimal identity message length (1300±100 bits) among one-time schemes, while Frontier has the lowest fidelity cost (0.124%).
- MROV-V-1 reduces the minimal identity length for most schemes (e.g., Uchida 1600→1350 bits at Δ=1%) and always lowers the minimal performance degradation.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply MROV-V-1 (variational multiple-round verification) (ablation) | DNN watermarking schemes · CIFAR-10, Δ=1% | minimal identity message length: 1600$\pm$50 -> 1350$\pm$50 (Uchida); 1300$\pm$100 -> 1250$\pm$50 (MTLSign) | Helped |
| Apply MROV-V-1 without changing the embedding regularizer (ablation) | DNN watermarking schemes · CIFAR-10, Δ=1% | watermarking performance degradation: 0.162$\pm$0.012 -> 0.156$\pm$0.006 (MTLSign); 0.124$\pm$0.004 -> 0.115$\pm$0.004 (Frontier) | Helped |
| Apply MROV-V-2 with the variational embedding regularizer (ablation) | DNN watermarking schemes · CIFAR-10, Δ=1% | watermarking performance degradation: 0.162$\pm$0.012 -> 0.233$\pm$0.009 (MTLSign); 0.124$\pm$0.004 -> 0.235$\pm$0.011 (Frontier) | Mixed |
Surprising findings
- The scheme with the largest capacity (MTLSign) does not always have the lowest performance degradation, so capacity and fidelity must be balanced.
- MROV-V-2 raises capacity bounds but can worsen fidelity so the minimal identity length and degradation do not necessarily decline.
Limitations
- Capacity estimate depends on assumed adversary knowledge and dataset (e.g., 10% of training data); stronger adversaries lower the bound.
- Theoretical BER-to-capacity bound assumes independent bits and binary symmetric channels; equality holds only under independence.
- Experiments are limited to CIFAR-10 with ResNet-50 and the vanilla interpreter; source codes only available upon request.
Experimental setup
Datasets: CIFAR-10
Benchmarks: CIFAR-10
Metrics: capacity upper bound bit error rate minimal identity message length performance degradation due to watermarking
Baselines: Uchida STDM MTLSign Content Exponential Frontier
Builds on: Uchida et al. white-box watermarking Exponential weighting watermark Frontier-stitching watermark MTLSign
Closest papers by meaning
- ZeroMark: Towards Dataset Ownership Verification without Disclosing Watermark (NeurIPS 2024 · similarity 0.86)
- Lightweight-Mark: Rethinking Deep Learning-Based Watermarking (ICML 2025 · similarity 0.86)
- EntropyMark: Towards More Harmless Backdoor Watermark via Entropy-based Constraint for Open-source Dataset Copyright Protection (CVPR 2025 · similarity 0.85)
- Safe and Robust Watermark Injection with a Single OoD Image (ICLR 2024 · similarity 0.85)
- Resource Efficient Deep Learning Hardware Watermarks with Signature Alignment (AAAI 2024 · similarity 0.85)
- Watermarks in the Sand: Impossibility of Strong Watermarking for Language Models (ICML 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.