% Key papers for Neural network watermarking (scime atlas, https://atlas.scime.ai). Authors are not included: add them from the paper pages.

@inproceedings{aaai2022_cmua_1814,
  title = {{CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2022},
  url = {https://aaai.org/papers/00989-cmua-watermark-a-cross-model-universal-adversarial-watermark-for-combating-deepfakes/},
}

@inproceedings{cvpr2021_protecting_17668,
  title = {{Protecting Intellectual Property of Generative Adversarial Networks From Ambiguity Attacks}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2021},
}

@inproceedings{neurips2019_rethinking_58908,
  title = {{Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2019},
  url = {https://nips.cc/virtual/2019/poster/13620},
}

@inproceedings{aaai2023_plmmark_4334,
  title = {{PLMmark: A Secure and Robust Black-Box Watermarking Framework for Pre-trained Language Models}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2023},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/26750},
}

@inproceedings{aaai2023_dear_3408,
  title = {{DeAR: A Deep-Learning-Based Audio Re-recording Resilient Watermarking}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2023},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/26550},
}

@inproceedings{cvpr2023_privacy_21911,
  title = {{Privacy-Preserving Adversarial Facial Features}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2023},
  url = {https://cvpr.thecvf.com/virtual/2023/poster/21229},
}

@inproceedings{neurips2020_passport_60573,
  title = {{Passport-aware Normalization for Deep Model Protection}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2020},
  url = {https://nips.cc/virtual/2020/poster/17084},
}

@inproceedings{aaai2022_deepauth_1947,
  title = {{DeepAuth: A DNN Authentication Framework by Model-Unique and Fragile Signature Embedding}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2022},
  url = {https://aaai.org/papers/09595-deepauth-a-dnn-authentication-framework-by-model-unique-and-fragile-signature-embedding/},
}

@inproceedings{cvpr2023_can_20564,
  title = {{Can't Steal? Cont-Steal! Contrastive Stealing Attacks Against Image Encoders}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2023},
  url = {https://cvpr.thecvf.com/virtual/2023/poster/21437},
}

@inproceedings{cvpr2024_watermark_25265,
  title = {{Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2024},
  url = {https://cvpr.thecvf.com/virtual/2024/poster/29287},
}

@inproceedings{cvpr2020_evade_15492,
  title = {{Evade Deep Image Retrieval by Stashing Private Images in the Hash Space}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2020},
}

@inproceedings{cvpr2023_effective_20885,
  title = {{Effective Ambiguity Attack Against Passport-Based DNN Intellectual Property Protection Schemes Through Fully Connected Layer Substitution}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2023},
  url = {https://cvpr.thecvf.com/virtual/2023/poster/23284},
}

@inproceedings{aaai2021_proactive_1192,
  title = {{Proactive Privacy-preserving Learning for Retrieval}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2021},
  url = {https://aaai.org/papers/03369-proactive-privacy-preserving-learning-for-retrieval/},
}

@inproceedings{icml2022_certified_40327,
  title = {{Certified Neural Network Watermarks with Randomized Smoothing}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2022},
  url = {https://icml.cc/virtual/2022/poster/16357},
}

@inproceedings{aaai2024_ipremover_6254,
  title = {{IPRemover: A Generative Model Inversion Attack against Deep Neural Network Fingerprinting and Watermarking}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2024},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/28619},
}

@inproceedings{cvpr2024_steganographic_24890,
  title = {{Steganographic Passport: An Owner and User Verifiable Credential for Deep Model IP Protection Without Retraining}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2024},
  url = {https://cvpr.thecvf.com/virtual/2024/poster/30688},
}

@inproceedings{neurips2024_audiomarkbench_74187,
  title = {{AudioMarkBench: Benchmarking Robustness of Audio Watermarking}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/97471},
}

@inproceedings{iclr2026_watermark_88947,
  title = {{Watermark-based Attribution of AI-Generated Content}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2026},
  url = {https://openreview.net/forum?id=syOYjXqKnS},
}

@inproceedings{aaai2024_revisiting_7152,
  title = {{Revisiting the Information Capacity of Neural Network Watermarks: Upper Bound Estimation and Beyond}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2024},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/30128},
}

@inproceedings{aaai2025_iwrn_9499,
  title = {{IWRN:A Robust Blind Watermarking Method for Artwork Image Copyright Protection Against Noise Attack}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/32015},
}

@inproceedings{iclr2024_robustness_34810,
  title = {{Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2024},
  url = {https://iclr.cc/virtual/2024/poster/18264},
}

@inproceedings{aaai2025_embedding_8931,
  title = {{Embedding Robust Watermarking into Pattern to Protect the Copyright of Ceramic Artifacts}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/32062},
}

@inproceedings{neurips2024_edit_71283,
  title = {{Edit Distance Robust Watermarks via Indexing Pseudorandom Codes}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/95963},
}

@inproceedings{neurips2024_united_72724,
  title = {{United We Stand, Divided We Fall: Fingerprinting Deep Neural Networks via Adversarial Trajectories}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/94664},
}

@inproceedings{aaai2026_uncovering_99889,
  title = {{Uncovering and Mitigating Destructive Multi-Embedding Attacks in Deepfake Proactive Forensics}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/37010},
}

@inproceedings{neurips2024_zeromark_71236,
  title = {{ZeroMark: Towards Dataset Ownership Verification without Disclosing Watermark}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/96006},
}

@inproceedings{aaai2026_ariw_108549,
  title = {{ARIW-Framework: Adaptive Robust Iterative Watermarking Framework}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/40901},
}

@inproceedings{cvpr2025_decoder_25873,
  title = {{Decoder Gradient Shield: Provable and High-Fidelity Prevention of Gradient-Based Box-Free Watermark Removal}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2025},
  url = {https://cvpr.thecvf.com/virtual/2025/poster/35182},
}

@inproceedings{neurips2024_raw_73902,
  title = {{RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable Guarantees}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/93609},
}

@inproceedings{aaai2026_creating_104338,
  title = {{Creating Blank Canvas Against AI-enabled Image Forgery}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/37865},
}

@inproceedings{aaai2026_deeptracer_107640,
  title = {{DeepTracer: Tracing Stolen Model via Deep Coupled Watermarks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/39992},
}

@inproceedings{aaai2026_yours_107645,
  title = {{Yours or Mine? Overwriting Attacks Against Neural Audio Watermarking}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/39997},
}

@inproceedings{iclr2024_leveraging_34320,
  title = {{Leveraging Optimization for Adaptive Attacks on Image Watermarks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2024},
  url = {https://iclr.cc/virtual/2024/poster/18755},
}