Research map / Adversarial robustness and security / Attacks on text and graphs
Neural network watermarking
Embed watermarks and ownership proofs in models to protect intellectual property.
53 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2019–2026) · an approach in Attacks on text and graphs, keyword cluster “poisoning · membership · watermarking”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
21 papers in 2023–24 and 23 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 7.5% to 4.7%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2019 · Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks (NeurIPS 2019 · 67 citations)
- 2020 · Passport-aware Normalization for Deep Model Protection (NeurIPS 2020 · 36 citations)
- 2021 · Protecting Intellectual Property of Generative Adversarial Networks From Ambiguity Attacks (CVPR 2021 · 77 citations)
- 2022 · CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes (AAAI 2022 · 118 citations)
- 2023 · PLMmark: A Secure and Robust Black-Box Watermarking Framework for Pre-trained Language Models (AAAI 2023 · 46 citations)
- 2024 · Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models (CVPR 2024 · 20 citations)
- 2025 · IWRN:A Robust Blind Watermarking Method for Artwork Image Copyright Protection Against Noise Attack (AAAI 2025 · 4 citations)
- 2026 · Watermark-based Attribution of AI-Generated Content (ICLR 2026 · 6 citations)
Earliest papers here
- Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks (NeurIPS 2019 · 67 citations)
- Passport-aware Normalization for Deep Model Protection (NeurIPS 2020 · 36 citations)
- Evade Deep Image Retrieval by Stashing Private Images in the Hash Space (CVPR 2020 · 18 citations)
What has been tried
36 papers here report 360 measured changes (a component added, removed or swapped, compared with a baseline): helped 52%, no clear effect 12%, hurt 31%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add GAN loss | WikiArt, image-to-image generation · PSNR | 13.1 -> 22.0 | Helped | Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models (CVPR 2024 · 20 citations) |
| Reduce VEKD's dependence on knowledge distillation (lower ϵ) | CIFAR10 · accuracy | Hurt | IPRemover: A Generative Model Inversion Attack against Deep Neural Network Fingerprinting and Watermarking (AAAI 2024 · 7 citations) | |
| Add TLP | CIFAR-10, CIFAR-100, Caltech-101, Caltech-256 · inference accuracy | Without TLP: 94.47 / 94.47; 75.19 / 75.20; 71.53 / 71.53; 50.46 / 50.46 | No clear effect | Steganographic Passport: An Owner and User Verifiable Credential for Deep Model IP Protection Without Retraining (CVPR 2024 · 7 citations) |
| Apply MROV-V-1 (variational multiple-round verification) | CIFAR-10, Δ=1% · minimal identity message length | 1600±50 -> 1350±50 (Uchida); 1300±100 -> 1250±50 (MTLSign) | Helped | Revisiting the Information Capacity of Neural Network Watermarks: Upper Bound Estimation and Beyond (AAAI 2024 · 5 citations) |
| add DA-INN, replacing conventional dense blocks with DA-dense blocks | NAll · PSNR (DB) | 37.19 -> 41.55 | Helped | IWRN:A Robust Blind Watermarking Method for Artwork Image Copyright Protection Against Noise Attack (AAAI 2025 · 4 citations) |
| Increase diffusion purification strength from t=0.1 to t=0.2 | ImageNet watermarked images · PSNR | 29.77 -> 26.10 | Hurt | Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · 4 citations) |
| add color-halftoning and adaptive brightness adjustment to the distortion layer (both together) | decal-shooting tiles (ablation) · Bit ACC (%) | +4.86 points (92.65 to 97.51) | Helped | Embedding Robust Watermarking into Pattern to Protect the Copyright of Ceramic Artifacts (AAAI 2025 · 3 citations) |
| Span multiple classes rather than only two with the trajectory | CIFAR-10, CIFAR-100, ImageNet · T1%F and T10%F | Helped | United We Stand, Divided We Fall: Fingerprinting Deep Neural Networks via Adversarial Trajectories (NeurIPS 2024 · 3 citations) | |
| Increase boundary-sample optimization iterations t | CIFAR-10 and Tiny-ImageNet · cosine similarity | Helped | ZeroMark: Towards Dataset Ownership Verification without Disclosing Watermark (NeurIPS 2024 · 2 citations) | |
| Use ℓ1 removal loss instead of ℓ2 removal loss | Image deraining and style transfer · watermark removal effectiveness | Helped | Decoder Gradient Shield: Provable and High-Fidelity Prevention of Gradient-Based Box-Free Watermark Removal (CVPR 2025 · 1 citation) | |
| Jointly train the watermark and verification model rather than fixing the watermark | Test data · Test accuracy | Helped | RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable Guarantees (NeurIPS 2024 · 1 citation) | |
| add refinement | DWT-DCT · Forged bit accuracy | 63.03% -> 89.62% | Helped | WMCopier: Forging Invisible Watermarks on Arbitrary Images (NeurIPS 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 11 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- MS-COCO · 2 of 11 papers
- ImageNet · 2 of 11 papers
Baselines
- StegaStamp · 2 of 11 papers
- CtrlRegen · 2 of 11 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 44 papers; from OpenAlex and the papers' affiliations).
- University of Maryland, College Park · 4 papers
- Zhejiang University · 3 papers
- Nanyang Technological University · 3 papers
- University of Waterloo · 2 papers
- Shanghai Jiao Tong University · 2 papers
- Fudan University · 2 papers
- University of Macau · 2 papers
- Qualcomm · 2 papers
- Harvard University · 2 papers
- University of Maryland · 2 papers
Use it
Download BibTeX of 33 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Membership inference and inversion (118 papers)
- Clean-label data poisoning (41 papers)
Elsewhere in the topic
- LLM jailbreak and injection defense (113 papers)
- Adversarial prompts for language models (98 papers)
- Defenses against universal perturbations (97 papers)
- Vision-language model robustness (96 papers)
- Attacks and defenses in sequential settings (96 papers)
- Diffusion-based adversarial purification (78 papers)
- Biologically inspired robust vision (77 papers)
- Graph neural network robustness (71 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).