# Explanation as a Watermark: Towards Harmless
and Multi-bit Model Ownership Verification via Watermarking Feature
Attribution

Shuo Shao, Yiming Li, Hongwei Yao, Yiling He, Zhan Qin, Kui Ren  State Key
Laboratory of Blockchain and Data Security, Zhejiang University
{shaoshuo_ss, yhongwei, yilinghe, qinzhan<EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

Ownership verification is currently the most critical and widely adopted post-
hoc method to safeguard model copyright. In general, model owners exploit it
to identify whether a given suspicious third-party model is stolen from them
by examining whether it has particular properties ‘inherited’ from their
released models. Currently, backdoor-based model watermarks are the primary
and cutting-edge methods to implant such properties in the released models.
However, backdoor-based methods have two fatal drawbacks, including
_harmfulness_ and _ambiguity_. The former indicates that they introduce
maliciously controllable misclassification behaviors ($i.e.$, backdoor) to the
watermarked released models. The latter denotes that malicious users can
easily pass the verification by finding other misclassified samples, leading
to ownership ambiguity.

In this paper, we argue that both limitations stem from the ‘zero-bit’ nature
of existing watermarking schemes, where they exploit the status ($i.e.$,
misclassified) of predictions for verification. Motivated by this
understanding, we design a new watermarking paradigm, $i.e.$, Explanation as a
Watermark (EaaW), that implants verification behaviors into the explanation of
feature attribution instead of model predictions. Specifically, EaaW embeds a
‘multi-bit’ watermark into the feature attribution explanation of specific
trigger samples without changing the original prediction. We correspondingly
design the watermark embedding and extraction algorithms inspired by
explainable artificial intelligence. In particular, our approach can be used
for different tasks ($e.g.$, image classification and text generation).
Extensive experiments verify the effectiveness and harmlessness of our EaaW
and its resistance to potential attacks.

##  I Introduction

In the past few years, Deep Learning (DL) has made significant advancements
around the world. The DL model has emerged as a de facto standard model and a
pivotal component in various domains and real-world systems, such as computer
vision [17, 8], natural language processing [2, 52], and recommendation
systems [59, 40]. However, developing high-performance DL models requires
substantial amounts of data, human expertise, and computational resources.
Accordingly, these models are important intellectual property for their owners
and their copyright deserves protection.

Ownership verification is currently the most critical and widely adopted
method to safeguard model copyright. Specifically, it intends to identify
whether a given suspicious third-party model is an unauthorized copy from
model owners. Implanting owner-specified watermarks ($i.e.$, model watermarks)
into the (victim) model is the primary solution for ownership verification
[50]. Model watermarking methods generally have two main stages, including
watermark embedding and ownership verification. In the first stage, model
owners should embed a specific secret pattern ($i.e.$, watermark) that will be
‘inherited’ by unauthorized model copies into the model. After that, in cases
where adversaries may illegally steal the victim model, the model owner can
turn to a trusted authority for verification by examining whether the
suspicious model has a similar watermark to the one implanted in the victim
model. If this watermark is present, the suspect model is an unauthorized
version of the victim model.

In real-world applications, DL models are usually used in a black-box manner
($e.g.$, deep learning as a service), where users can only access the model
through its API without access to its source files or intermediate results
($e.g.$, gradients). In these scenarios, model owners and verifiers can only
exploit the predictions of the suspicious model to conduct the watermark
extraction process and the following ownership verification. It is called
_black-box ownership verification_ , which is the most classical and practical
[50].

Figure 1: The main pipeline of our EaaW and backdoor-based methods. Backdoor-
based methods depend on the misclassification to determine the ownership.
Instead of changing the predictions, our EaaW implants the watermark into the
explanation of feature attribution for verification.

In the aforementioned black-box scenarios, currently, most of the black-box
model watermarking methods [1, 60, 20] are based on backdoor attack [27].
Specifically, the model owners attach an owner-specified unique trigger
pattern ($e.g.$, ‘TEST’ sign) to some benign samples from the original dataset
while changing their labels to generate trigger samples. Model owners will use
these trigger samples associated with the remaining benign ones to train the
victim model. Accordingly, the victim models will learn a latent connection
between the unique pattern and the misclassification behavior ($i.e.$,
backdoor). The backdoor trigger can serve as the secret key of ownership
verification since it is stealthy for the adversary. The model owner can
verify its ownership by triggering the misclassification (as shown in Figure
1).

However, backdoor-based methods have two fatal limitations, including
harmfulness and ambiguity, as follows.

  1. 1.

Harmfulness: Backdoor-based model watermarks incorporate patterns ($i.e.$,
backdoor triggers) that can induce misclassification. Although they do not
significantly compromise the model’s performance on the benign samples, the
embedded pattern could pose a concealed threat that the adversary may exploit
the backdoor to achieve specific malicious predictions [13, 27].

  2. 2.

Ambiguity: The backdoor-based model watermarking methods fundamentally rely on
misclassification. Consequently, the adversary can easily find some samples
that are naturally misclassified by the model and verify its ownership
independently, introducing ambiguity in ownership verification [11, 32].

We argue that the defects of the backdoor-based model watermarking methods
described above can be attributed to the ‘zero-bit’ nature of the watermarking
methods. The zero-bit backdoor watermark can only detect the presence or
absence of the watermark but does not carry any information [50]. Backdoor-
based methods directly embed the watermark into the predictions and only
utilize the status (misclassified or not), for ownership verification. First,
the pivotal status, ‘misclassified’, inevitably damages the model’s
functionality, leading to harmfulness. Second, the zero-bit watermark can
easily be forged because the misclassification of Deep Neural Network (DNN) is
an inherently and commonly existing characteristic.

Our Insight. To tackle these problems, our insight is to explore an
alternative space that can accommodate _multi-bit_ watermark embedding without
impacting model predictions. Drawing inspiration from eXplainable Artificial
Intelligence (XAI) [39], we identify that the explanation generated by feature
attribution methods offers a viable space for watermark embedding. Feature
attribution, as an aspect of XAI, involves determining the importance of each
feature in an input sample based on its relationship with the model’s
prediction [46]. By leveraging this approach, it becomes feasible to embed
multi-bit watermarks within the explanations of specific trigger samples
without altering their corresponding predictions.

Our Work. In this paper, we propose ‘Explanation as a Watermark (EaaW)’, a
harmless and multi-bit black-box model ownership verification method based on
feature attribution. The fundamental framework of EaaW is illustrated in
Figure 1. Specifically, by adding a constraint fitting the watermark to the
loss function, we transform the explanation of a specific trigger sample into
the watermark. We correspondingly design a watermark embedding and extraction
algorithm inspired by a model-agnostic feature attribution algorithm, LIME
[46]. Subsequently, the model owner can extract the watermark inside the model
by inputting the trigger sample and employing the feature attribution
algorithm.

Our contributions are summarized as follows:

  * •

We revisit the existing backdoor-based model watermarking methods and reveal
their fatal limitations. We point out that the intrinsic reason for those
limitations is the ‘zero-bit’ nature of the backdoor-based watermarks.

  * •

We propose a new black-box model watermarking paradigm named EaaW. EaaW embeds
a multi-bit watermark into the explanation of a specific trigger sample while
ensuring that the prediction remains correct.

  * •

We propose a novel watermark embedding and extraction algorithm inspired by
the feature attribution method in XAI. Our proposed watermark extraction
method enables effective and efficient extraction of watermarks in the black-
box scenario. It is also applicable for DNNs across a wide range of DL tasks,
such as image classification and text generation.

  * •

We conduct comprehensive experiments by applying EaaW to various models of
both CV and NLP tasks. The experimental results demonstrate its effectiveness,
distinctiveness, harmlessness, and resistance to various watermark-removal
attacks and adaptive attacks.

The remaining parts of this paper are structured as follows: Section II
provides an introduction to the background knowledge of DNN, Explainable
Artificial Intelligence (XAI), and ownership verification of DNNs. Section III
presents the problem formulation related to black-box DNN ownership
verification. In Section IV, we propose a comprehensive insight, methodology,
and implementation approach for EaaW. The effectiveness of EaaW is evaluated
through experiments on image classification models and text generation models
in Section V. Furthermore, additional experiments are conducted in Section VI
to investigate the impact of EaaW on the watermarked models and analyze the
security against ambiguity attacks. We conclude the paper in Section VII at
the end.

##  II Background

###  II-A Deep Neural Networks

Deep Neural Networks (DNN) have currently become the most popular AI models
both in academia [2] and industry [42]. DNN models consist of multiple
fundamental neurons, including linear projection, convolutions, and non-linear
activation functions. These units are organized into layers within DNN models.
Developers can employ DNN models to automatically acquire hierarchical data
representations from the training data and use them to accomplish different
tasks.

While training a DNN model $\mathcal{M}$, the model takes the raw training
data $\bm{x}\in\mathbb{R}^{m}$ as input, and then maps ${\bm{x}}$ to the
output prediction ${\bm{p}}\in\mathbb{R}^{n}$ through a parametric function
$\bm{p}=f(\bm{x};\Theta)$. The parametric functions $f(\cdot)$ are defined by
both the architecture of the DNN model and the parameters $\Theta$. The
developer then defines the loss function $\mathcal{L}(\cdot)$ to measure the
difference between the output prediction $\bm{p}$ of the model and the true
label $\bm{y}$. The objective of training the DNN model is equivalent to
optimizing the parameters $\Theta$ to have the minimum loss. The optimization
problem can be formally defined as Eq. (1).

$\Theta^{*}=\arg\min_{\Theta}\mathcal{L}(\bm{p},\bm{y})=\arg\min_{\Theta}\mathcal{L}(f(\bm{x};\Theta),\bm{y}).$
(1)

Recently, researchers have found that scaling the size of the models and
datasets can make significant improvements in the models’ performance on
various tasks, which leads to the rise of the large foundation models [52,
42]. Those large models often have more than 70 billion parameters and
building such a large model requires a huge amount of training data,
computational resources, and human expertise. Therefore, it is essential to
protect the intellectual property rights of the model owners on the models.

###  II-B Explainable Artificial Intelligence

Due to the formidable capabilities of deep neural network (DNN) models, they
have found extensive deployment across various domains. However, because of
the intricate architectures of DNN, there is an urgent need to comprehend
their internal mechanisms and gain insights into their outcomes [18]. In
response to this demand for transparency, Explainable Artificial Intelligence
(XAI) has been proposed as an approach to provide explanations for the black-
box DNN models [9].

There are three main categories of XAI techniques based on the application
stages, $i.e.$, pre-modeling explainability, explainable modeling, and post-
modeling explainability [39]. In this paper, we mainly focus on a specific
type of post-modeling explainability method, feature attribution, in XAI [48,
46]. Feature attribution is a method that helps users understand the
importance of each feature in a model’s decision-making process. It calculates
a real-value importance score for each feature based on its impact on the
model’s output. The score could range from a positive value that shows its
contribution to the prediction of the model, a zero that would mean that the
feature has no contribution, to a negative value that means that removing that
feature would increase the probability of the predicted class.

###  II-C Ownership Verification of DNN Models

Ownership verification of DNN models involves verifying whether the suspicious
model is a copy of the model developed by another party (called the _victim
model_) [50]. Watermark [1, 5, 30] and fingerprint [4, 22, 56] are two
different solutions to implementing ownership verification, while the
watermark is the most widely used ownership verification technique. Model
watermark refers to embedding a unique signature ($i.e.$, watermark), which
represents the identity of the model owner, into the model [53, 1, 25]. The
model owner can extract the watermark from the model in case the model is
illegally used by the adversary.

In general, model watermarking methods can be divided into two categories,
white-box model watermarking methods and black-box model watermarking methods,
as follows.

White-box Model Watermarking Methods: white-box model watermarking methods
embed the watermark directly in the model parameters [53, 35, 54]. For
instance, Uchida et al. propose to add a watermark regularization term into
the loss function and embed the watermark through fine-tuning [53]. White-box
model watermarking methods assume that the verifier can have full access to
the suspicious model during verification. This assumption is difficult to
realize in practical scenarios because the model is usually black-box in the
real world. Such a limitation prevents the application of the white-box
watermarking methods. The watermark can also be embedded into the model via
adjusting the architecture of the model [11, 35], or embedding external
features [29, 28].

Black-box Model Watermarking Methods: Black-box model watermarking methods
assume that the model owner can only observe the outputs from the suspicious
model. Due to such a constraint, black-box methods are mainly based on the
_backdoor attack_ [13, 27]. Backdoor-based model watermarking methods utilize
backdoor attacks to force a DNN model to remember specific patterns or
features [1, 23]. The backdoor attack leads to misclassification when the DNN
model encounters samples in a special dataset $D_{T}$ called the trigger set.
For ownership verification, the model owner can embed a non-transferable
trigger set as watermarks into the protected model. The trigger set is unique
to the watermarked model. The model owner keeps the trigger set secret and can
thus verify ownership by triggering the misclassification. Backdoor-based
methods are widely applicable to various tasks, such as image classification
[1, 60], federated learning [51, 55], text generation [31, 25], and prompt
[57, 58].

However, because the backdoor-based model watermarking methods embed a zero-
bit watermark into the prediction of the models, they incur several
disadvantages. First, although backdoor-based methods claim that they do not
significantly compromise the functionality of the model with benign datasets,
backdoor-based model ownership verification can still be harmful. Second,
backdoor-based methods are based on misclassification and can only identify
the presence or absence of a watermark. Adversaries can easily manipulate
adversarial samples to verify their ownership on the victim model, leading to
ambiguity in ownership verification [32]. To the best of our knowledge,
BlackMarks [3] is the only multi-bit black-box watermarking method, based on
the harmful backdoor attack. BlackMarks divides the output classes of the
model into two groups. If the prediction class of the $i-$th trigger sample
belongs to the first group, it means the $i-$th bit in the watermark is $0$,
otherwise $1$. BlackMarks makes the sequential predictions of the trigger
samples as a multi-bit watermark. However, the adversaries can create any bit
string by rearranging the input trigger samples, leading to ambiguity.

Moreover, Maini et al. proposed a non-backdoor black-box model watermarking
method called Dataset Inference (DI) [36, 10]. However, some recent studies
demonstrated that DI may make misjudgments [29]. DI is also not able to embed
a multi-bit watermark into the model. These limitations hinder its
applicability in practice. How to design an effective and multi-bit black-box
model watermarking method remains an important open question.

##  III Problem Formulation

###  III-A Threat Model

In this section, we present the threat model regarding ownership verification
of DNN models under the black-box setting. The model owner wants to train a
DNN model and deploy it within its product. However, there exists the risk
that an adversary may unlawfully copy or steal the model for personal gain.
Such unauthorized behavior compromises the intellectual property rights of the
model owner. Consequently, the model owner seeks an effective ownership
verification mechanism that is capable of confirming ownership over any third-
party suspicious model through black-box access.

Adversary’s Assumptions: the adversary intends to acquire a high-performance
DNN model by copying or stealing the victim model, which is developed by the
other party. The adversary can attempt to remove the watermark inside the
victim model without compromising its functionality. We assume that the
adversary has the following capabilities:

  * •

The adversary can conduct several watermark removal attack techniques trying
to remove the watermark in the victim model, such as the fine-tuning attack,
the model pruning attack, and the adaptive attack.

  * •

The adversary has limited computational resources and data. The adversary does
not have the capability of training a powerful model on its own.

Defender’s Assumptions: While protecting the copyright of DNN models, the
defender is the actual developer and legal owner of the DNN models. The
defender designs and trains the DNN model with its own efforts. The defender
needs to implant a watermark into the model. Once the watermarked model is
unauthorizedly used by other parties, the model owner can verify its ownership
by extracting the watermark. In line with previous studies [1, 26], the
capability of the defender is as follows:

  * •

Before deploying the DNN model, the defender has full control of the training
process, including the architecture of the model, the selection of the
training dataset, and the implementation of the training techniques.

  * •

After identifying potential infringement, the defender is unable to gain
access to the architecture and parameters of the suspicious model. Instead,
they can solely interact with the suspicious model through the API access,
wherein they can input their data and get the output logits, $i.e.$, the
prediction probabilities. We also investigate the scenario in which the
defender can only get the predicted class ($i.e.$, label-only scenario) and
the results can be found in Appendix -D.

###  III-B Design Objectives

The objectives of designing a black-box model watermarking method can be
summarized as follows:

  * •

Effectiveness: Effectiveness signifies that the watermark needs to be properly
embedded into the model. If the suspicious model actually originates from the
victim model, the ownership verification algorithm can deterministically
output a watermark which is similar to the victim’s pre-designed watermark.

  * •

Distinctiveness: Distinctiveness represents that the watermark cannot be
extracted from an independently trained model or with the independently
selected secret key ($i.e.$, trigger samples). Distinctiveness guarantees that
an independently trained model cannot be falsely claimed as others’
intellectual property.

  * •

Harmlessness: Harmlessness refers to that the watermarked model should perform
approximately as well as the primitive model without a watermark both on the
_benign dataset_ and _trigger set_. It indicates that the ownership
verification method has a negligible impact on the functionality of the model
and does not implant any patterns that can trigger malicious predictions.

Figure 2: The main pipeline of the watermark extraction algorithm based on
feature attribution. First, we locally sample some masked samples by randomly
masking a few basic parts of the trigger sample. Second, we input the masked
dataset to get the prediction and calculate the metric vector. Finally, we fit
a linear model to evaluate the importance of each basic part in the trigger
sample. The sign of the explanation serves as the watermark.

##  IV Methodology

In this section, we present the framework and methodology of our ‘Explanation
as a Watermark (EaaW)’, a harmless and multi-bit black-box model ownership
verification paradigm. Without loss of generality, we assume that the input
data $\bm{x}\in\mathbb{R}^{m}$ and the model owner aims to embed a $k$-bit
watermark $\bm{\mathcal{W}}\in\\{-1,1\\}^{k}$, $i.e.$, they are both 1-D
vectors. The scenario where the input data space and the watermark are 2-D or
3-D can easily be transformed into the above scenario by flattening the high-
dimension tensors into vectors. Note that here the watermark
$\bm{\mathcal{W}}$ is not a bit string since its elements
$\bm{\mathcal{W}}_{i}\in\\{-1,1\\}$. But the watermark can be transformed into
a bit string by assigning $0$ to elements of $-1$.

###  IV-A Insight and Overview of EaaW

As discussed in Section II-C, backdoor-based model watermarks encounter two-
fold drawbacks and challenges, namely harmfulness and ambiguity. These
drawbacks arise primarily from the ‘zero-bit’ nature of the backdoor-based
methods, where the watermark is embedded into the binary status of the model
predictions. To tackle these challenges, a crucial question arises: ‘Can we
find an alternative space to embed a multi-bit watermark without changing the
predictions?’ Inspired by eXplainable Artificial Intelligence (XAI) and
feature attribution, we propose EaaW. Our primary insight is that instead of
directly watermarking the prediction classes of the model, the explanation
generated by feature attribution algorithms can also serve as a suitable
carrier for hiding information and embedding watermarks.

Figure 1 illustrates the framework of EaaW and provides a comparison with
existing backdoor-based approaches. Unlike altering the prediction class of
the trigger sample, EaaW leverages feature-attribution-based techniques to
obtain the explanations for the trigger samples. The watermark hides within
these output explanations.

In general, our EaaW contains three stages, including (1) watermark embedding,
(2) watermark extraction, and (3) ownership verification. The technical
details of these stages are described in the following subsections.

###  IV-B Watermark Embedding

As presented in Section III-B, the major objectives of an ownership
verification mechanism are three-fold: effectiveness, distinctiveness, and
harmlessness. In the watermark embedding stage, the model owner should embed
the watermark by modifying the parameters $\Theta$ of the trained model.
Meanwhile, the model owner should preserve the functionality of the model
after embedding the watermark. Therefore, we can define the watermark
embedding task as a multi-task optimization problem based on the
aforementioned objectives, which can be formalized as follows:

$\left.\begin{aligned}
\min_{\Theta}\mathcal{L}_{1}(f(\mathcal{X}\cup\mathcal{X}_{T},\Theta),\mathcal{Y}\cup\mathcal{Y}_{T})\\\
+\enspace r_{1}\cdot\mathcal{L}_{2}({\tt
explain}(\mathcal{X}_{T},\mathcal{Y}_{T},\Theta),\bm{\mathcal{W}}),\end{aligned}\right.$
(2)

where $\Theta$ is the parameters of the model and $\bm{\mathcal{W}}$ is the
target watermark. $\mathcal{X},\mathcal{Y}$ are the data and labels of the
benign dataset, while $\mathcal{X}_{T},\mathcal{Y}_{T}$ are the data and
labels of the trigger set. In our EaaW, we take the ground truth label of
$\mathcal{X}_{T}$ as $\mathcal{Y}_{T}$ while backdoor-based methods exploit
the targeted yet incorrect labels. ${\tt explain}(\cdot)$ is an XAI feature
attribution algorithm used for watermark extraction in our EaaW, which will be
introduced in Section IV-C. $r_{1}$ is coefficient. There are two terms in Eq.
(2). The first term $\mathcal{L}_{1}(\cdot)$ represents the loss function of
the model on the primitive task. It ensures that both the predictions on the
benign dataset and trigger set remain unchanged, thereby preserving the
model’s functionality. The second term $\mathcal{L}_{2}(\cdot)$ quantifies the
dissimilarity between the output explanation and target watermark. Optimizing
$\mathcal{L}_{2}(\cdot)$ can make the explanation similar to the watermark. We
exploit the hinge-like loss as $\mathcal{L}_{2}(\cdot)$ since it is proven to
be beneficial for improving the resistance of the embedded watermark against
watermark removal attacks [11]. We also explore using different watermark loss
functions and conduct an ablation study in Appendix -C. The hinge-like loss is
shown as follows:

$\mathcal{L}_{2}(\bm{\mathcal{E}},\bm{\mathcal{W}})=\sum_{i=1}^{k}\max(0,\enspace\varepsilon-\bm{\mathcal{E}}_{i}\cdot\bm{\mathcal{W}}_{i}),$
(3)

where $\bm{\mathcal{E}}={\tt
explain}(\mathcal{X}_{T},\mathcal{Y}_{T},\Theta)$. $\bm{\mathcal{E}}_{i}$ and
$\bm{\mathcal{W}}_{i}$ denote the $i-$th elemenet of $\bm{\mathcal{E}}$ and
$\bm{\mathcal{W}}$, respectively. $\varepsilon$ is the control parameter to
encourage the absolute values of the elements in $\bm{\mathcal{E}}$ to be
greater than $\varepsilon$. By optimizing Eq. (3), the watermark can be
embedded into the sign of the explanation $\bm{\mathcal{E}}$.

###  IV-C Watermark Extraction through Feature Attribution

The objective of model watermark embedding is to find the optimal model
parameters $\hat{\Theta}$ that makes Eq. (2) minimal. In order to apply the
popular gradient descent to optimize Eq. (2), we need to design a derivable
and model-agnostic feature attribution explanation method. Inspired by a
widely-used feature attribution algorithm, local interpretable model-agnostic
explanation (LIME) [46], we design a LIME-based watermark extraction method to
output the feature attribution explanation of the trigger sample.

The main insight of LIME is to locally sample some instances near the input
data point and evaluate the importance of each feature via the output of these
instances. We basically follow the insight of LIME and make some modifications
to make the algorithm feasible for watermark embedding and extraction. The
main pipeline of our watermark extraction algorithm is shown in Figure 2. In
general, the designed watermark extraction based on LIME can be divided into
three steps: (1) local sampling, (2) model inference and evaluation, and (3)
explanation generation.

Step 1: Local Sampling. Assuming that the input $\bm{x}\in\mathbb{R}^{m}$,
local sampling is to generate several samples that are locally neighbor to the
trigger sample $\bm{x}_{T}$. First, we need to segment the input space into
$k$ basic parts, according to the length of the watermark
$\bm{\mathcal{W}}\in\\{-1,1\\}^{k}$. The adjacent features can be combined as
one basic part, and each basic part has $\lfloor m/k\rfloor$ features.
Redundant features are ignored since we aim to extract a watermark instead of
explaining all the features.

The intuition of our algorithm is to evaluate which features are more
influential to the prediction of a data point by systematically masking these
basic parts. Thus, secondly, we randomly generate $c$ masks $M$. Each mask in
$M$ is a binary vector (or matrix) with the same size as $\bm{\mathcal{W}}$.
We denote the $i-$th mask in $M$ as $M_{i}$, and for each $i$,
$M_{i}\in\\{0,1\\}^{k}$. Each element in the mask corresponds to a basic part
of the input.

After generating the masks, we construct the masked samples $\mathcal{X}_{m}$
to constitute a dataset by masking the basic parts in the trigger sample
according to the randomly generated masks. The masking operation can be
denoted as $\otimes$.

$\mathcal{X}_{m}=M\otimes\mathcal{X}_{T}.$ (4)

Specifically, if the element in the mask $M_{i}$ is $1$, the corresponding
basic part preserves the original value. Otherwise, the corresponding basic
part should be replaced by a certain value if the element is $0$. For example,
for the image data, the pixels in the masked basic part could be aligned by
$0$. The tokens in the text data can be replaced by a special token
‘<unk>’which represents an unknown token. The examples of the masked samples
are shown in Figure 2.

Step 2: Model Inference and Evaluation. In this step, we input the masked
dataset constructed in Step 1 into the model and get the predictions
$\bm{p}=f(\mathcal{X}_{m};\Theta)$ of the masked samples. Note that in the
label-only scenarios, the predictions $\bm{p}$ are discretized as either 0 or
1, based on whether the sample is correctly classified. After that, we exploit
a metric function $\mathcal{M}(\cdot)$ to measure the quality of the
predictions (compared with the ground-truth labels $\mathcal{Y}_{T}$) and
calculate the metric vector $\bm{v}\in\mathbb{R}^{c}$ of the $c$ masked
samples via Eq. (5).

$\bm{v}=\mathcal{M}(\bm{p},\mathcal{Y}_{T}).$ (5)

The metric function $\mathcal{M}(\cdot)$ needs to be derivable and can provide
a quantificational evaluation of the output. Users can customize it based on
the specific DL task and prediction form. Since there usually exists a
derivable metric function in DL tasks ($e.g.$, loss function), EaaW can easily
be extended to various DL tasks such as image classification and text
generation. The implementation details and results are shown in Section V-A
and Section V-B, respectively.

Algorithm 1 Watermark Extraction Algorithm based on Feature Attribution.

Step 3: Explanation Generation. After calculating the metric vector $\bm{v}$,
the final step of the watermark extraction algorithm is to fit a linear model
to evaluate the importance of each basic part and compute the importance
scores. We take the metric vector $\bm{v}$ as $\bm{y}$ and the masks $M$ as
$\bm{x}$. In practice, we utilize ridge regression to improve the stability of
the obtained weight matrix under different local samples. The weight matrix
$\bm{W}$ of the ridge regression represents the importance of each basic part.
The weight matrix $\bm{W}$ of the linear model can be calculated via the
normal equation as shown in Eq. (6).

$\bm{W}=(M^{T}M+\lambda I)^{-1}M^{T}\bm{v}.$ (6)

In Eq. (6), $\lambda$ is a hyper-parameter and $I$ is a $c\times c$ identity
matrix. The watermark is embedded into the sign of the weight matrix’s
elements. During watermark embedding, we utilize the weight matrix $\bm{W}$ as
$\bm{\mathcal{E}}={\tt explain}(\mathcal{X}_{T},\mathcal{Y}_{T},\Theta)$ to
optimize the watermark embedding loss function Eq. (2). According to Eq. (6),
the derivative of $\bm{W}$ concerning $\bm{v}$ exists, and the derivative of
$\bm{v}$ concerning the model parameters $\Theta$ also exists in DNN, the
whole watermark extraction algorithm is derivable due to the chain rule.
Therefore, we can utilize the gradient descent algorithm to optimize Eq. (2)
and embed the watermark into the model.

To further acquire the extracted watermark
$\tilde{\bm{\mathcal{W}}}\in\\{-1,1\\}^{k}$, we binarize the weight matrix
$\bm{W}$ by applying the following binarization function ${\tt bin(\cdot)}$.

$\tilde{\bm{\mathcal{W}}}_{i}={\tt bin}(\bm{W}_{i})=\left\\{\begin{aligned}
1,&\enspace\bm{W}_{i}\geq 0\\\ -1,&\enspace\bm{W}_{i}<0\end{aligned}\right.,$
(7)

where $\tilde{\bm{\mathcal{W}}}_{i},\bm{W}_{i}$ is the $i-$th element of
$\tilde{\bm{\mathcal{W}}}$ and $\bm{W}$. We show the pseudocode of the overall
watermark extraction algorithm based on feature attribution in Algorithm 1.

###  IV-D Ownership Verification

In the event that the model owner finds a suspicious model deployed by an
unauthorized party, the model owner can verify whether it is copied from the
watermarked model by extracting the watermark from the suspicious model.
Subsequently, the extracted watermark is compared with the model owner’s
original watermark. The process is called the ownership verification process
of DNN models.

Figure 3: The trigger samples (on the upper row) used to watermark image
classification models and the corresponding extracted watermark (on the bottom
row). The target watermark is shown on the left.

Given a suspicious model $\tilde{\Theta}$, the model owner will first extract
the watermark $\tilde{\bm{\mathcal{W}}}$ utilizing the trigger samples and the
feature-attribution-based watermark extraction algorithm described in Section
IV-C. We formalize the problem of comparing $\tilde{\bm{\mathcal{W}}}$ with
$\bm{\mathcal{W}}$ as a hypothesis test, as follows.

######  Proposition 1.

Let $\tilde{\bm{\mathcal{W}}}$ be the watermark extracted from the suspicious
model, and $\bm{\mathcal{W}}$ is the original watermark. Given the null
hypothesis $H_{0}:\tilde{\bm{\mathcal{W}}}$ is independent of
$\bm{\mathcal{W}}$ and the alternative hypothesis
$H_{1}:\tilde{\bm{\mathcal{W}}}$ has an association or relationship with
$\bm{\mathcal{W}}$, the suspicious model can be claimed as an unauthorized
copy if and only if $H_{0}$ is rejected.

In practice, we utilize Pearson’s chi-squared test [45] and calculate the
p-value of the test. If the p-value is less than a significant level $\alpha$,
the null hypothesis will be rejected and the suspicious model can be claimed
as the intellectual property of the model owner. The pseudocode of the
ownership verification algorithm is demonstrated in Algorithm 2.

Algorithm 2 Ownership verification algorithm based on hypothesis test.

##  V Experiments

In this section, we apply EaaW to two popular DL tasks: image classification
and text generation. We evaluate the effectiveness, harmlessness, and
distinctiveness of EaaW based on the objectives outlined in Section III-B. In
addition, we also evaluate the resistance of EaaW against various watermark
removal attacks [34]. We further provide an ablation study about some
important hyper-parameters in EaaW. The comparison with backdoor-based
watermarking methods is presented in Section VI-C. More experiments such as
applying EaaW to the label-only scenario and the effects of the watermark
losses can be found in the appendix.

TABLE I: The testing accuracy (Test Acc.), the p-value of the hypothesis test,
and watermark success rate (WSR) of embedding the watermark into image
classification models via EaaW. ‘Length’ signifies the length of the embedded
watermark.

Dataset | Length | Metric$\downarrow$ Trigger$\rightarrow$ | No WM | Noise | Abstract | Unrelated | Mask | Patch | Black-edge
---|---|---|---|---|---|---|---|---|---
CIFAR-10 | 64 | Test Acc. | 90.54 | 90.49 | 90.53 | 90.49 | 90.46 | 90.38 | 90.37
p-value | / | $10^{-13}$ | $10^{-13}$ | $10^{-13}$ | $10^{-13}$ | $10^{-13}$ | $10^{-13}$
WSR | / | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000
256 | Test Acc. | 90.54 | 90.53 | 90.54 | 90.28 | 90.49 | 90.11 | 90.35
p-value | / | $10^{-54}$ | $10^{-54}$ | $10^{-54}$ | $10^{-54}$ | $10^{-54}$ | $10^{-54}$
WSR | / | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000
1024 | Test Acc. | 90.54 | 90.39 | 90.47 | 90.01 | 90.38 | 89.04 | 89.04
p-value | / | $10^{-222}$ | $10^{-222}$ | $10^{-207}$ | $10^{-222}$ | $10^{-218}$ | $10^{-222}$
WSR | / | 1.000 | 1.000 | 0.989 | 1.000 | 0.998 | 1.000
ImageNet | 64 | Test Acc. | 76.38 | 75.80 | 76.04 | 76.00 | 75.98 | 75.76 | 75.78
p-value | / | $10^{-13}$ | $10^{-13}$ | $10^{-13}$ | $10^{-13}$ | $10^{-13}$ | $10^{-13}$
WSR | / | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000
256 | Test Acc. | 76.38 | 75.86 | 75.96 | 76.36 | 76.06 | 76.06 | 75.60
p-value | / | $10^{-54}$ | $10^{-54}$ | $10^{-54}$ | $10^{-54}$ | $10^{-54}$ | $10^{-54}$
WSR | / | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000
1024 | Test Acc. | 76.38 | 75.40 | 76.22 | 75.26 | 75.74 | 73.48 | 72.84
p-value | / | $10^{-222}$ | $10^{-222}$ | $10^{-219}$ | $10^{-222}$ | $10^{-219}$ | $10^{-222}$
WSR | / | 1.000 | 1.000 | 0.999 | 1.000 | 0.999 | 1.000

Watermark Metric. In the hypothesis test, we set the significant level
$\alpha=0.01$, $i.e.$, if the p-value is less than $0.01$, the null hypothesis
will be rejected. In addition to evaluating the p-value of the hypothesis
test, we also calculate the watermark success rate (WSR) between the extracted
and original watermarks. The watermark success rate is the percentage of bits
in the extracted watermark that match the original watermark. The WSR is
formulated as follows.

${\tt
WSR}=\frac{1}{k}\sum_{i=1}^{k}\mathbb{I}\\{\tilde{\bm{\mathcal{W}}_{i}}=\bm{\mathcal{W}}_{i}\\},$
(8)

where $k$ is the length of the watermark and $\mathbb{I}\\{\cdot\\}$ is the
indicator function. The lower the p-value and the greater the WSR, the closer
the extracted watermark $\tilde{\bm{\mathcal{W}}_{i}}$ is to the original
watermark $\bm{\mathcal{W}}_{i}$, indicating a better effectiveness of
watermark embedding.

###  V-A Results on Image Classification Models

####  V-A1 Experimental Settings

In this section, we conduct the experiments on CIFAR-10 [24] and (a subset of)
ImageNet [6] datasets with a popular convolutional neural network (CNN),
ResNet-18 [17]. CIFAR-10 is a 10-class image classification dataset with
$32\times 32$ color images. For the ImageNet dataset, we randomly select a
subset containing 100 classes and there are $500$ images per class for
training and $100$ images per class for testing. The images in the ImageNet
dataset are resized to $224\times 224$. We first pre-train the ResNet-18
models on CIFAR-10 and ImageNet datasets respectively for $300$ epochs. The
experiments with the ResNet-101 model can be found in Appendix -C. Then we
apply EaaW to embed the watermark into the models through a $30$-epoch fine-
tuning. Following the original LIME paper, we utilize the predicted
probability of each sample’s target class to constitute the metric vector
$\bm{v}$.

To evaluate the effectiveness of EaaW, we implement $6$ different trigger set
construction methods from different backdoor watermarking methods, including
(1) Noise [33]: utilizing Gaussian noise as trigger samples; (2) Abstract [1]:
abstract images with no inherent meaning; (3) Unrelated [60]: images which are
not related to the image classification tasks; (4) Mask [14]: images added
with pseudo-random noise; (5) Patch [60]: adding some meaningful patch
($e.g.$‘TEST’) into the images; (6) Black-edge: adding a black edge around the
images. We take an image of ‘AI’ as the watermark embedded into the image
classification models. We resize the ‘AI’ image into different sizes as
watermarks with different bits. Examples of these trigger samples and the
watermark image are shown in Figure 3.

TABLE II: The p-value of the hypothesis test, and watermark success rate (WSR)
with the watermarked model (Watermarked), independent model (Independent M.),
and independent trigger (Independent T.) in the image classification task.

Dataset | Length | Trigger$\rightarrow$ | Noise | Abstract | Unrelated | Mask | Patch | Black-edge
---|---|---|---|---|---|---|---|---
Scenario$\downarrow$ | p-value | WSR | p-value | WSR | p-value | WSR | p-value | WSR | p-value | WSR | p-value | WSR
CIFAR-10 | 64 | Watermarked | $10^{-13}$ | 1.000 | $10^{-13}$ | 1.000 | $10^{-13}$ | 1.000 | $10^{-13}$ | 1.000 | $10^{-13}$ | 1.000 | $10^{-13}$ | 1.000
Independent M. | 0.115 | 0.656 | 0.811 | 0.500 | 0.265 | 0.625 | 0.550 | 0.422 | 0.740 | 0.531 | 0.651 | 0.547
Independent T. | 0.629 | 0.481 | 0.623 | 0.491 | 0.638 | 0.500 | 0.641 | 0.500 | 0.682 | 0.509 | 0.649 | 0.481
256 | Watermarked | $10^{-54}$ | 1.000 | $10^{-54}$ | 1.000 | $10^{-54}$ | 1.000 | $10^{-54}$ | 1.000 | $10^{-54}$ | 1.000 | $10^{-54}$ | 1.000
Independent M. | 0.012 | 0.594 | 0.785 | 0.535 | 0.417 | 0.555 | 0.876 | 0.480 | 0.604 | 0.418 | 0.229 | 0.410
Independent T. | 0.323 | 0.483 | 0.273 | 0.487 | 0.340 | 0.485 | 0.273 | 0.487 | 0.409 | 0.488 | 0.349 | 0.473
1024 | Watermarked | $10^{-222}$ | 1.000 | $10^{-222}$ | 1.000 | $10^{-207}$ | 0.989 | $10^{-222}$ | 1.000 | $10^{-218}$ | 0.998 | $10^{-222}$ | 1.000
Independent M. | 0.200 | 0.537 | 0.861 | 0.503 | 0.225 | 0.492 | 0.852 | 0.516 | 0.927 | 0.443 | 0.714 | 0.430
Independent T. | 0.521 | 0.457 | 0.721 | 0.463 | 0.618 | 0.448 | 0.452 | 0.459 | 0.544 | 0.459 | 0.450 | 0.450
ImageNet | 64 | Watermarked | $10^{-13}$ | 1.000 | $10^{-13}$ | 1.000 | $10^{-13}$ | 1.000 | $10^{-13}$ | 1.000 | $10^{-13}$ | 1.000 | $10^{-13}$ | 1.000
Independent M. | 0.808 | 0.516 | 0.550 | 0.422 | 0.684 | 0.547 | 0.668 | 0.516 | 0.337 | 0.391 | 0.708 | 0.453
Independent T. | 0.761 | 0.491 | 0.761 | 0.491 | 0.749 | 0.491 | 0.755 | 0.494 | 0.757 | 0.500 | 0.751 | 0.494
256 | Watermarked | $10^{-54}$ | 1.000 | $10^{-54}$ | 1.000 | $10^{-54}$ | 1.000 | $10^{-54}$ | 1.000 | $10^{-54}$ | 1.000 | $10^{-54}$ | 1.000
Independent M. | 0.943 | 0.484 | 0.806 | 0.441 | 0.737 | 0.527 | 0.693 | 0.434 | 0.198 | 0.574 | 0.646 | 0.523
Independent T. | 0.552 | 0.592 | 0.574 | 0.585 | 0.484 | 0.579 | 0.617 | 0.573 | 0.558 | 0.577 | 0.485 | 0.584
1024 | Watermarked | $10^{-222}$ | 1.000 | $10^{-222}$ | 1.000 | $10^{-219}$ | 0.999 | $10^{-222}$ | 1.000 | $10^{-219}$ | 0.999 | $10^{-222}$ | 1.000
Independent M. | 0.910 | 0.483 | 0.874 | 0.525 | 0.916 | 0.480 | 0.482 | 0.486 | 0.219 | 0.500 | 0.181 | 0.433
Independent T. | 0.321 | 0.516 | 0.365 | 0.524 | 0.532 | 0.509 | 0.440 | 0.512 | 0.493 | 0.515 | 0.603 | 0.538

####  V-A2 Evaluation on Effectiveness and Harmlessness

Figure 3 and Table I present the experimental results of watermarking image
classification models, demonstrating the successful embedding of the multi-bit
watermark into these models via the utilization of EaaW. The p-values are far
less than the significant level $\alpha$ and the WSRs are nearly equal to $1$.
Those results unequivocally establish the effectiveness of EaaW in
facilitating watermark embedding.

In addition, based on the results in Table I, our watermarking method exhibits
minimal impact on the model’s performance. Testing accuracy degrades less than
$1\%$ in most cases, indicating that the watermarked model maintains high
functionality. Furthermore, it is observed that employing trigger samples
close to the original images (such as ‘Patch’ and ‘Black-edge’) has a larger
effect on the functionality of the model while achieving enhanced
stealthiness. This implies a trade-off between harmlessness and stealthiness.

####  V-A3 Evaluation on Distinctiveness

To evaluate the distinctiveness of EaaW, we also carry out experiments to test
whether the watermark can be extracted with independently trained models and
independently selected trigger samples. The results are shown in Table II,
indicating that the watermark extracted with independent models and
independent triggers cannot pass the ownership verification process. The
minimal p-value with independent models and independent triggers is $0.012$
which is still $>0.01$ and far greater than the p-value of the watermarked
model. The WSRs with independent models and triggers are mostly near $50\%$.
Furthermore, the results also indicate that incorporating a higher number of
bits in the watermark enhances distinctiveness and security. This is evidenced
by the smaller p-values obtained when extracting a fewer-bit watermark using
an independently trained model.

An example of the extracted watermarks with the watermarked model, independent
model, and the independent trigger is shown in Figure 4. It shows that the
extracted watermarks in the latter two scenarios are completely different from
the original watermark, further proving the distinctiveness.

###  V-B Results on Text Generation Models

Figure 4: An example of the extracted watermarks with the watermarked model,
independent model, and independent trigger.

####  V-B1 Experimental Settings

In this section, we adopt EaaW to watermark the text generation models. The
text generation model, especially the casual language model, is a type of
language model that predicts the next token in a sequence of tokens [44]. Text
generation models are widely used as the pre-trained foundation models in
various natural language processing (NLP) tasks [42].

We take GPT-2 [44] as an example to evaluate EaaW on the text generation model
since it is a representative open-sourced transformer-based model and many
state-of-the-art large language models have similar structures. The
experiments with another popular text generation model, $i.e.$, BERT [7], can
be found in Appendix -C. Four different datasets, including wikitext [38],
bookcorpus [61], ptb-text-only [37], and lambada [43], are used to fine-tune
the GPT-2 model and embed the multi-bit watermark. We randomly select a
sequence in the training set as the trigger sample. We also randomly generate
a $k$-bit string as the watermark and the examples of the text trigger samples
and the embedded watermarks can be found in Appendix -A. The lengths of the
watermark are set to $32$, $48$, $64$, $96$, and $128$. Additionally,
different from the image classification model, we utilize the average
prediction probabilities of the target tokens in the masked trigger sequence
as the metric vector $\bm{v}$. The implementation details can be found in
Appendix -A.

We utilize perplexity (PPL), which measures how well a language model can
predict the next word in a sequence of words, as a metric to evaluate the
harmlessness of EaaW on the text generation models. PPL is the exponential of
the sequence cross-entropy. A lower PPL score indicates that the language
model performs better at predicting the next word.

TABLE III: The perplexity (PPL), the p-value of the hypothesis test, and
watermark success rate (WSR) of embedding a watermark into text generation
models via EaaW.

Dataset | Length$\rightarrow$ | No WM | 32 | 48 | 64 | 96 | 128
---|---|---|---|---|---|---|---
wikitext | PPL | 43.33 | 46.97 | 47.88 | 48.59 | 48.78 | 51.09
p-value | / | $10^{-7}$ | $10^{-10}$ | $10^{-13}$ | $10^{-20}$ | $10^{-27}$
WSR | / | 1.000 | 1.000 | 1.000 | 1.000 | 1.000
bookcorpus | PPL | 43.75 | 44.28 | 44.76 | 45.41 | 47.52 | 49.61
p-value | / | $10^{-7}$ | $10^{-10}$ | $10^{-13}$ | $10^{-20}$ | $10^{-27}$
WSR | / | 1.000 | 1.000 | 1.000 | 1.000 | 1.000
ptb-text-only | PPL | 39.49 | 40.98 | 42.41 | 42.68 | 45.52 | 48.99
p-value | / | $10^{-7}$ | $10^{-10}$ | $10^{-13}$ | $10^{-20}$ | $10^{-27}$
WSR | / | 1.000 | 1.000 | 1.000 | 1.000 | 1.000
lambada | PPL | 42.07 | 44.21 | 44.24 | 44.48 | 44.85 | 47.99
p-value | / | $10^{-7}$ | $10^{-10}$ | $10^{-13}$ | $10^{-20}$ | $10^{-27}$
WSR | / | 1.000 | 1.000 | 1.000 | 1.000 | 1.000

####  V-B2 Evaluation on Effectiveness and Harmlessness

Table III shows the results of applying EaaW to the text generation models. In
all the experiments, the watermarks are successfully embedded into the text
generation models, with a significantly low p-value and $1.0$ WSR. The results
suggest the effectiveness of EaaW on the text generation models.

Table III also indicates that the functionality of the text generation models
does not significantly drop after embedding the watermark, considering that
PPL is an exponential metric. Also, the longer the length of the embedded
watermark, the greater the impact on the model performance. However, a longer
watermark can furnish more information for verification and better security.

TABLE IV: The p-value of the hypothesis test, and watermark success rate (WSR)
with the watermarked model (Watermarked), independent model (Independent M.),
and independent trigger (Independent T.) in text generation modeling task.

Dataset | Length$\rightarrow$ | 32 | 48 | 64 | 96 | 128
---|---|---|---|---|---|---
Scenario$\downarrow$ | p-value | WSR | p-value | WSR | p-value | WSR | p-value | WSR | p-value | WSR
wikitext | Watermarked | $10^{-7}$ | 1.000 | $10^{-10}$ | 1.000 | $10^{-13}$ | 1.000 | $10^{-20}$ | 1.000 | $10^{-27}$ | 1.000
Independent M. | 0.217 | 0.500 | 0.308 | 0.521 | 0.301 | 0.500 | 0.657 | 0.500 | 0.745 | 0.477
Independent T. | 0.457 | 0.450 | 0.424 | 0.413 | 0.414 | 0.422 | 0.484 | 0.435 | 0.693 | 0.466
bookcorpus | Watermarked | $10^{-7}$ | 1.000 | $10^{-10}$ | 1.000 | $10^{-13}$ | 1.000 | $10^{-20}$ | 1.000 | $10^{-27}$ | 1.000
Independent M. | 0.021 | 0.438 | 0.062 | 0.417 | 0.256 | 0.516 | 0.440 | 0.469 | 0.489 | 0.445
Independent T. | 0.296 | 0.394 | 0.565 | 0.492 | 0.355 | 0.419 | 0.725 | 0.506 | 0.520 | 0.475
ptb-text-only | Watermarked | $10^{-7}$ | 1.000 | $10^{-10}$ | 1.000 | $10^{-13}$ | 1.000 | $10^{-20}$ | 1.000 | $10^{-27}$ | 1.000
Independent M. | 0.040 | 0.406 | 0.152 | 0.438 | 0.070 | 0.469 | 0.333 | 0.521 | 0.594 | 0.445
Independent T. | 0.364 | 0.381 | 0.432 | 0.475 | 0.448 | 0.541 | 0.742 | 0.490 | 0.697 | 0.503
lambada | Watermarked | $10^{-7}$ | 1.000 | $10^{-10}$ | 1.000 | $10^{-13}$ | 1.000 | $10^{-20}$ | 1.000 | $10^{-27}$ | 1.000
Independent M. | 0.013 | 0.469 | 0.015 | 0.375 | 0.222 | 0.453 | 0.461 | 0.479 | 0.584 | 0.477
Independent T. | 0.284 | 0.481 | 0.351 | 0.408 | 0.254 | 0.394 | 0.634 | 0.500 | 0.602 | 0.531

####  V-B3 Evaluation on Distinctiveness

Similar to the experiments conducted on the image classification models, we
also test whether the watermark can be extracted from the independently
trained language model or with independent trigger samples to validate the
distinctiveness of EaaW.

From Table IV, we can find that the p-values with the independent model or
independent trigger are greater than the significant level $\alpha=0.01$, and
the WSRs are around $0.5$, which is similar to the results of the experiments
on the image classification model. In addition, we can find that when the
length of the watermark is relatively small, e.g. $32$, the p-value with the
independent model is small with a minimum $0.013$ and close to the significant
level. As the length of the watermark increases, the p-value with the
independent model also increases, suggesting that embedding a watermark with
more bits can obtain better security and distinctiveness.

###  V-C The Resistance to Watermark Removal Attacks

After obtaining the model from other parties, the adversaries may adopt
various techniques to remove watermarks or circumvent detection. In this
section, we explore whether our EaaW is resistant to them. Following the
suggestions in [34], we consider three types of attacks, including fine-tuning
attacks, model pruning attacks, and adaptive attacks.

Figure 5: Watermark success rate (WSR), the log p-value, and functionality
evaluation (test accuracy or PPL) of watermarked ResNet-18 and GPT-2 against
fine-tuning attack. Figure 6: Watermark success rate (WSR), the log p-value,
and functionality evaluation (test accuracy or PPL) of watermarked ResNet-18
and GPT-2 against model-pruning attack.

####  V-C1 The Resistance to Fine-tuning Attack

Fine-tuning refers to training the watermarked model with a local benign
dataset for a few epochs. In the fine-tuning attack, the adversary may attempt
to remove the watermark inside the model through fine-tuning. We fine-tune the
EaaW-watermarked models with 20 epochs wheretraining has converged.

Figure 5 shows the log p-value and the WSR during the fine-tuning attack,
while Figure 12 shows the extracted watermarks before and after the fine-
tuning attack. As shown in Figure 5, the p-value and WSR fluctuate during
fine-tuning, whereas the p-value is always significantly lower than the
significant level $\alpha$ (denoted by the purple dotted line) and the WSR is
greater than $0.85$. These results demonstrate the resistance of our EaaW to
fine-tuning attacks. We argue that this is mostly because we did not change
the label of watermarked samples during model training, leading to minor
effects of fine-tuningcompared to backdoor-based methods.

####  V-C2 The Resistance to Model-pruning Attack

Model-pruning serves as a potential watermark-removal attack because it may
prune watermark-related neurons. We exploit parameter pruning [16] as an
example for discussion. Specifically, we prune the neurons in the model by
zeroing out those with the lowest $l_{1}$ norm. In particular, we use pruning
rate to denote how many proportions of neuron are pruned.

As shown in Figure 6, the test accuracy of ResNet-18 drops while the PPL of
GPT-2 increases, as the pruning rate increases. It indicates the degradation
of the functionality of the model. However, the p-value of the pruned model
negligibly changes and is lower than the significant level $\alpha$. Besides,
the WSR is still greater than $0.9$. These results suggest that our EaaW
resists to model-pruning attack.

####  V-C3 The Resistance to Adaptive Attacks

In practice, the adversaries may know the existence of our EaaW and design
adaptive attacks to circumvent it. Specifically, they may try to remove the
watermark or interfere with the watermark extraction by manipulating the
explanation of the input data. Existing techniques for manipulating
explanations can be classified into two categories: (1) modifying model
parameters [19, 41] or (2) modifying the inputs ($i.e.$, the adversarial
attack against XAI) [12]. In this section, we hereby present the results under
the first type of attacks in two representative scenarios, namely the
_overwriting attack_ and the _unlearning attack_. The discussion about the
second one can be found in Appendix -E.

_Scenario 1 (Overwriting Attack):_ In this scenario, we assume that the
adversary knows the procedure of the EaaW method, but has no knowledge of the
trigger samples and the target watermark used by the model owner. Therefore,
the adversary can independently generate the trigger samples and the
watermark, and then embed them into the model, attempting to overwrite the
watermark embedded before. This category of adaptive attack is called the
_overwriting attack_.

The experimental results of the overwriting attack are shown in Table V. We
conduct a $10$-epoch fine-tuning to simulate the overwriting process and the
models have already converged after 10 epochs. After the overwriting attack,
the functionality of both the watermarked ResNet-18 and the watermarked GPT-2
decreases, while the p-values are still low and the WSRs are close to $0.9$.
It indicates that the overwriting attack cannot effectively remove our EaaW
watermark.

TABLE V: Watermark success rate (WSR), the log p-value, and functionality
evaluation (test accuracy or PPL) of ResNet-18 and GPT-2 against overwriting
attack and unlearning attack.

Model | Metric $\downarrow$ | Before | After Overwriting | After Unlearning
---|---|---|---|---
ResNet-18 | Test Acc. | 75.72 | 69.18 | 73.62
p-value | $10^{-222}$ | $10^{-134}$ | $10^{-127}$
WSR | 1.000 | 0.899 | 0.888
GPT-2 | PPL | 48.99 | 50.29 | 48.96
p-value | $10^{-27}$ | $10^{-18}$ | $10^{-24}$
WSR | 1.000 | 0.906 | 0.969

_Scenario 2 (Unlearning Attack):_ In this scenario, we assume that the
adversary knows the embedded watermark, but still has no knowledge of the
trigger samples. As such, the adversary will randomly select some trigger
samples and try to unlearn the watermark by updating the model in the
direction opposite to the watermarking gradient. We make this assumption
because the target watermark can often be conjectured. For example, the
watermark may be the logo of the corporation or the profile photo of the
individual developer. This type of attack is called the _unlearning attack_.
The adversary uses the following loss function to unlearn the watermark:

$\left.\begin{aligned}
\min_{\hat{\Theta}}\mathcal{L}_{1}(f(\mathcal{X},\hat{\Theta}),\mathcal{Y})-r_{1}\mathcal{L}_{2}({\tt
explain}(\tilde{\mathcal{X}}_{T},\tilde{\mathcal{Y}}_{T},\hat{\Theta}),\bm{\mathcal{W}}).\end{aligned}\right.$
(9)

The experimental results of the unlearning attack are illustrated in Table V.
The results demonstrate that our EaaW also resists to unlearning attack.
Specifically, the WSRs drop only $0.112$ and $0.031$, respectively. The
watermark can still be extracted from the model and the ownership can still be
verified with low p-values.

###  V-D Ablation Study

In this section, we conduct the ablation study to investigate the effect of
some important hyper-parameters used in EaaW, such as the size of the trigger
samples, the number $c$ of the masks, and the coefficient $r_{1}$. More
ablation studies can be found in Appendix -C.

####  V-D1 Effect of the Size of the Trigger Samples

In EaaW, the trigger sample $\mathcal{X}_{T}$ and its label $\mathcal{Y}_{T}$
can be considered as the secret key to extracting the watermark. Holding one
secret key is enough for most cases, while multiple secret keys can further
enhance the security of EaaW. In this section, we select $1$, $2$, $5$, $10$,
and $20$ trigger samples and test the effectiveness of EaaW with different
numbers of trigger samples. The results are illustrated in Figure 7. As the
size of the trigger samples increases, the functionality of the watermarked
model and the WSR degrades, and the p-value increases. But generally speaking,
the model is capable of accommodating multiple trigger samples and the model
owner can choose the size of trigger samples based on its practical
requirements.

Figure 7: The Watermark success rate (WSR), the log p-value, and the
functionality evaluation metrics (test accuracy or PPL) of watermarked
ResNet-18 and GPT-2 with different sizes of the trigger samples. Figure 8: The
watermark success rate (WSR), the log p-value, and the functionality
evaluation metrics (test accuracy or PPL) of ResNet-18 and GPT-2 with
different numbers of masks. Figure 9: The watermark success rate (WSR), the
log p-value, and the functionality evaluation (test accuracy or PPL) of
watermarked ResNet-18 and GPT-2 with different $r_{1}$.

####  V-D2 Effect of the Number of the Masks

In this section, we study the effect of the number $c$ of the masks and masked
samples. We set $c$ to be $64$ to $1024$ to embed a $256$-bit watermark into
ResNet-18 and set $c$ to be $8$ to $128$ to embed a $32$-bit watermark into
GPT-2. The results are in Figure 8. The results indicate that using a low $c$
may lead to the failure of embedding the watermark. A small number of masked
samples can not effectively evaluate the importance of each basic part, and
thus the feature attribution algorithm does not work well in that case. On the
contrary, sampling more masked samples contributes to the extraction of the
watermark and can better preserve the functionality of the watermarked model.
However, the overhead of embedding and extracting the watermark also
increases. There is a trade-off between functionality and efficiency.

####  V-D3 Effect of Coefficient $r_{1}$

$r_{1}$ is the coefficient of the watermark loss in Eq. (2). $r_{1}$ governs
the balance between embedding the watermark and preserving model
functionality. To assess its impact, we varied $r_{1}$ across values of 0.1,
1.0, 1.5, 2.0, 3.0, and 5.0 for evaluation purposes. Figure 9 reveals that
employing a larger $r_{1}$ can potentially exert a more pronounced negative
effect on the functionality of the watermarked model; conversely, adopting a
smaller $r_{1}$ may not entirely ensure complete watermark embedding within
the model’s framework. Nevertheless, in most scenarios, successful watermark
integration into the model was achieved overall.

##  VI Discussion and Analysis

Figure 10: The visualization of the feature representations of the training
data before and after embedding the watermark. Those of the trigger sample is
marked as ‘star’ and the trigger sample belongs to the class $0$ colored by
red. The feature representations of all the samples do not significantly
change. Instead, the direction of the trigger sample to the decision boundary
is transformed. (Better viewed in color) TABLE VI: The watermark success rate
(WSR), the harmless degree $H$ (larger is better), and test accuracy (Test
Acc.) using the backdoor-based model watermarking method and EaaW in the image
classification task.

Dataset |  Length / Trigger Size | Trigger$\rightarrow$ | Noise [33] | Unrelated [60] | Mask [14] | Patch [60] | Black-edge
---|---|---|---|---|---|---|---
Method$\downarrow$ | Test Acc. | $H$ | WSR | Test Acc. | $H$ | WSR | Test Acc. | $H$ | WSR | Test Acc. | $H$ | WSR | Test Acc. | $H$ | WSR
CIFAR-10 | 64 | No WM | 90.54 | / | / | 90.54 | / | / | 90.54 | / | / | 90.54 | / | / | 90.54 | / | /
Backdoor | 90.38 | 89.74 | 1.000 | 88.74 | 88.10 | 1.000 | 90.34 | 89.71 | 0.984 | 84.28 | 83.64 | 1.000 | 86.24 | 85.60 | 1.000
EaaW | 90.49 | 90.48 | 1.000 | 90.49 | 90.48 | 1.000 | 90.46 | 90.47 | 1.000 | 90.38 | 90.39 | 1.000 | 90.37 | 90.38 | 1.000
256 | No WM | 90.54 | / | / | 90.54 | / | / | 90.54 | / | / | 90.54 | / | / | 90.54 | / | /
Backdoor | 90.33 | 87.77 | 1.000 | 87.99 | 85.43 | 1.000 | 90.28 | 87.72 | 1.000 | 90.11 | 87.75 | 1.000 | 90.07 | 87.51 | 1.000
EaaW | 90.53 | 90.52 | 1.000 | 90.28 | 90.27 | 1.000 | 90.49 | 90.50 | 1.000 | 90.11 | 90.12 | 1.000 | 90.35 | 90.36 | 1.000
1024 | No WM | 90.54 | / | / | 90.54 | / | / | 90.54 | / | / | 90.54 | / | / | 90.54 | / | /
Backdoor | 90.19 | 80.19 | 0.977 | 88.14 | 77.93 | 0.997 | 90.17 | 79.93 | 1.000 | 90.03 | 79.79 | 1.000 | 89.81 | 79.57 | 1.000
EaaW | 90.39 | 90.38 | 1.000 | 90.01 | 90.00 | 0.989 | 90.38 | 90.39 | 1.000 | 89.04 | 89.05 | 0.998 | 89.04 | 89.05 | 1.000
ImageNet | 64 | No WM | 76.38 | / | / | 76.38 | / | / | 76.38 | / | / | 76.38 | / | / | 76.38 | / | /
Backdoor | 73.16 | 72.67 | 0.766 | 75.94 | 75.30 | 1.000 | 75.06 | 74.42 | 1.000 | 74.18 | 73.54 | 1.000 | 73.96 | 73.32 | 1.000
EaaW | 75.80 | 75.79 | 1.000 | 76.00 | 75.99 | 1.000 | 75.98 | 75.99 | 1.000 | 75.76 | 75.77 | 1.000 | 75.78 | 75.79 | 1.000
256 | No WM | 76.38 | / | / | 76.38 | / | / | 76.38 | / | / | 76.38 | / | / | 76.38 | / | /
Backdoor | 73.70 | 71.14 | 1.000 | 75.92 | 73.36 | 1.000 | 74.08 | 71.52 | 1.000 | 70.34 | 67.80 | 0.992 | 71.10 | 68.59 | 0.980
EaaW | 75.86 | 75.85 | 1.000 | 76.36 | 76.35 | 1.000 | 76.06 | 76.07 | 1.000 | 76.06 | 76.07 | 1.000 | 75.60 | 75.61 | 1.000
1024 | No WM | 76.38 | / | / | 76.38 | / | / | 76.38 | / | / | 76.38 | / | / | 76.38 | / | /
Backdoor | 73.56 | 64.22 | 0.912 | 75.86 | 65.62 | 1.000 | 74.86 | 64.62 | 1.000 | 73.92 | 63.68 | 1.000 | 74.32 | 64.08 | 1.000
EaaW | 75.40 | 75.39 | 1.000 | 75.26 | 75.25 | 0.999 | 75.74 | 75.75 | 1.000 | 73.48 | 73.49 | 0.999 | 72.84 | 72.85 | 1.000

###  VI-A How EaaW Affect the Watermarked Model?

In this section, we explore how EaaW affects the watermarked model. Inspired
by [20], we analyze the effect of EaaW by visualizing the intermediate
features of both the benign samples and the trigger sample. We first randomly
select $100$ images per class from the training dataset. Subsequently, we
input those data into the model and get the output of the features by the
penultimate layer. To further analyze these features, we employ the kernel
principal component analysis (Kernel PCA) algorithm for dimensionality
reduction, reducing those features to $2$ dimensions. The visualization of
these reduced features is presented in Figure 10. Notably, the feature
corresponding to the trigger sample is denoted as a star.

From Figure 10, we can see that the intermediate feature representations are
generally unaffected before and after embedding the watermark using EaaW. The
feature of the trigger sample continues to reside within the cluster
corresponding to its respective class (the red class numbered $0$), thereby
demonstrating the harmlessness of EaaW. Additionally, as depicted in Figure
10, EaaW actually changes the direction of the trigger sample to the decision
boundary of the model, that is, the direction of the trigger sample’s
gradient. By embedding a multi-bit watermark into the sign of this gradient,
EaaW achieves successful model watermarking without altering the prediction of
the trigger sample.

###  VI-B Security Analysis against Ambiguity Attack

When the adversary acquires the watermarked model, the adversary can attempt
to forge a fake watermark to establish its ownership of the watermarked model.
If both the true model owner and the adversary can independently authenticate
their copyright claims, it becomes impossible to ascertain the actual
ownership. This type of attack is named _ambiguity attack_ [11] (or false
claim attack [32]). The definition of the ambiguity attack for our EaaW is as
follows.

######  Definition 1 (Ambiguity Attack).

Given a watermarked model $\hat{\Theta}$, the objective of the ambiguity
attack is to forge a fake trigger sample
$\tilde{\mathcal{X}}_{T},\tilde{\mathcal{Y}}_{T}$ that can be utilized to
extract its own watermark $\tilde{\mathcal{W}}$ and pass the ownership
verification algorithm described in Algorithm 2.

As our approach involves embedding a multi-bit watermark into the model, the
EaaW technique offers superior security compared to the zero-bit backdoor-
based model watermarking methods. Intuitively, assuming that the probability
of a successful ambiguity attack against a one-bit (or zero-bit) watermark
method is $1/\xi$, then the probability of a successful ambiguity attack
against a $k$-bit watermark method is $1/\xi^{k}$. As such, for a not-too-
small length $k$ of the watermark, our proposed EaaW can withstand ambiguity
attacks. To support this claim, we present the following proposition.

######  Proposition 2.

Given the length of the watermark $k$, the probability of a successful
ambiguity attack is $1/2^{k}$.

###### Proof.

Assuming that the adversary has no knowledge of the trigger sample used for
ownership verification. When the adversary tries to forge a trigger sample by
random selection, the probability of each bit being the correct bit can be
assumed as $1/2$. Since the explanation output by the feature attribution
algorithm depends on all the features of the input data, the probability of
the explanation correctly matching the watermark is $1/2^{k}$. ∎

Proposition 2 shows that the time complexity of the ambiguity attack against
EaaW is exponential concerning the length $k$ of the watermark, indicating
that our watermarking method is hard to forge by the adversary and is
resistant to ambiguity attack. Furthermore, Proposition 2 also suggests
utilizing a multi-bit watermark can obtain better security.

###  VI-C The Comparision to Backdoor Watermarks

Backdoor-based model watermarks are currently the most representative and
popular black-box model ownership verification techniques. Arguably, the
primary differences among these various backdoor-based approaches lie in their
distinct construction of the trigger set [50]. Recall that existing literature
has already shed light on the ambiguous nature of backdoor-based watermarks
[32, 21], while our Section VI-B demonstrates that our EaaW technique remains
resilient against ambiguity attacks. Accordingly, this section primarily
focuses on the comparison between various backdoor-based methods [60, 14, 33]
and our EaaW in terms of effectiveness and harmlessness. Inspired by the
definition in [15], we define the _harmless degree_ $H$ as the metric for
evaluating the level of harmlessness. $H$ is defined as the accuracy achieved
both on the benign testing dataset $\mathcal{X},\mathcal{Y}$ and the trigger
set $\mathcal{X}_{T},\mathcal{Y}_{T}$ with the ground-truth labels, as
follows.

$H=\frac{1}{|\mathcal{X}\cup\mathcal{X}_{T}|}\sum_{\bm{x}\in\mathcal{X}\cup\mathcal{X}_{T}}\mathbb{I}\\{f(\bm{x};\Theta)=g(\bm{x})\\},$
(10)

where $\mathbb{I}\\{\cdot\\}$ is the indicator function and $g(\bm{x})$ always
output the ground-truth label of $\bm{x}$. A larger $H$ means the watermarks
have less effect on the utility of the models.

As shown in Table VI, the watermarking effectiveness of our EaaW is on par
with or even better than that of the baseline backdoor-based methods.
Regarding harmlessness, our EaaW approach outperforms the backdoor-based
techniques as evidenced by higher harmless degrees $H$. For example, the
harmlessness degree $H$ of our EaaW is nearly 10% higher than that of
backdoor-based watermarks in all cases with trigger size 1024. Note that
backdoor-based watermarks introduce backdoors that can be exploited by
adversaries to generate specific malicious predictions, although they do not
compromise performance on benign samples.

##  VII Conclusion

In this paper, we revealed that the widely applied backdoor-based model
watermarking methods have two major drawbacks, including harmlessness and
ambiguity. We found out that those limitations can both be attributed to that
the backdoor-based watermark utilizes misclassification to embed a ‘zero-bit’
watermark into the model. To tackle these issues, we proposed a harmless and
multi-bit model ownership verification method, named Explanation as a
Watermark (EaaW), inspired by XAI. EaaW is the first to introduce the insight
of embedding the multi-bit watermark into the explanation output by feature
attribution methods. We correspondingly designed a feature attribution-based
watermark embedding and extraction algorithm. Our empirical experiments
demonstrated the effectiveness, distinctiveness, and harmlessness of EaaW. We
hope our EaaW can provide a new angle and deeper understanding of model
ownership verification to facilitate secure and trustworthy model deployment
and sharing.

## References

  * [1] Y. Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” in _USENIX Security Symposium_ , 2018, pp. 1615–1631.
  * [2] T. Brown, B. Mann, N. Ryder, M. Subbiah, J. D. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell _et al._ , “Language models are few-shot learners,” _Advances in Neural Information Processing Systems_ , vol. 33, pp. 1877–1901, 2020.
  * [3] H. Chen, B. D. Rouhani, and F. Koushanfar, “Blackmarks: Blackbox multibit watermarking for deep neural networks,” _arXiv preprint arXiv:1904.00344_ , 2019.
  * [4] J. Chen, J. Wang, T. Peng, Y. Sun, P. Cheng, S. Ji, X. Ma, B. Li, and D. Song, “Copy, right? a testing framework for copyright protection of deep learning models,” in _IEEE Symposium on Security and Privacy_ , 2022, pp. 824–841.
  * [5] T. Cong, X. He, and Y. Zhang, “Sslguard: A watermarking scheme for self-supervised learning pre-trained encoders,” in _ACM SIGSAC Conference on Computer and Communications Security_ , 2022, pp. 579–593.
  * [6] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in _IEEE Conference on Computer Vision and Pattern Recognition_ , 2009, pp. 248–255.
  * [7] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” _arXiv preprint arXiv:1810.04805_ , 2018.
  * [8] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly _et al._ , “An image is worth 16x16 words: Transformers for image recognition at scale,” in _International Conference on Learning Representations_ , 2020\.
  * [9] R. Dwivedi, D. Dave, H. Naik, S. Singhal, R. Omer, P. Patel, B. Qian, Z. Wen, T. Shah, G. Morgan _et al._ , “Explainable ai (xai): Core ideas, techniques, and solutions,” _ACM Computing Surveys_ , vol. 55, no. 9, pp. 1–33, 2023.
  * [10] A. Dziedzic, H. Duan, M. A. Kaleem, N. Dhawan, J. Guan, Y. Cattan, F. Boenisch, and N. Papernot, “Dataset inference for self-supervised models,” _Advances in Neural Information Processing Systems_ , vol. 35, pp. 12 058–12 070, 2022.
  * [11] L. Fan, K. W. Ng, and C. S. Chan, “Rethinking deep neural network ownership verification: Embedding passports to defeat ambiguity attacks,” _Advances in Neural Information Processing Systems_ , vol. 32, 2019.
  * [12] A. Ghorbani, A. Abid, and J. Zou, “Interpretation of neural networks is fragile,” in _AAAI conference on artificial intelligence_ , vol. 33, no. 01, 2019, pp. 3681–3688.
  * [13] T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Evaluating backdooring attacks on deep neural networks,” _IEEE Access_ , vol. 7, pp. 47 230–47 244, 2019.
  * [14] J. Guo and M. Potkonjak, “Watermarking deep neural networks for embedded systems,” in _IEEE/ACM International Conference on Computer-Aided Design_ , 2018, pp. 1–8.
  * [15] J. Guo, Y. Li, L. Wang, S.-T. Xia, H. Huang, C. Liu, and B. Li, “Domain watermark: Effective and harmless dataset copyright protection is closed at hand,” in _Advances in Neural Information Processing Systems_ , 2023.
  * [16] S. Han, J. Pool, J. Tran, and W. Dally, “Learning both weights and connections for efficient neural network,” _Advances in Neural Information Processing Systems_ , vol. 28, 2015.
  * [17] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in _IEEE Conference on Computer Vision and Pattern Recognition_ , 2016, pp. 770–778.
  * [18] Y. He, J. Lou, Z. Qin, and K. Ren, “Finer: Enhancing state-of-the-art classifiers with feature attribution to facilitate security analysis,” in _ACM SIGSAC Conference on Computer and Communications Security_ , 2023, pp. 416–430.
  * [19] J. Heo, S. Joo, and T. Moon, “Fooling neural network interpretations via adversarial model manipulation,” _Advances in Neural Information Processing Systems_ , vol. 32, 2019.
  * [20] G. Hua and A. B. J. Teoh, “Deep fidelity in dnn watermarking: A study of backdoor watermarking for classification models,” _Pattern Recognition_ , vol. 144, 2023.
  * [21] G. Hua, A. B. J. Teoh, Y. Xiang, and H. Jiang, “Unambiguous and high-fidelity backdoor watermarking for deep neural networks,” _IEEE Transactions on Neural Networks and Learning Systems_ , 2023.
  * [22] H. Jia, H. Chen, J. Guan, A. S. Shamsabadi, and N. Papernot, “A zest of lime: Towards architecture-independent model distances,” in _International Conference on Learning Representations_ , 2021.
  * [23] H. Jia, C. A. Choquette-Choo, V. Chandrasekaran, and N. Papernot, “Entangled watermarks as a defense against model extraction,” in _USENIX Security Symposium_ , 2021, pp. 1937–1954.
  * [24] A. Krizhevsky, G. Hinton _et al._ , “Learning multiple layers of features from tiny images,” _Master’s thesis, University of Tront_ , 2009.
  * [25] P. Li, P. Cheng, F. Li, W. Du, H. Zhao, and G. Liu, “Plmmark: A secure and robust black-box watermarking framework for pre-trained language models,” in _AAAI Conference on Artificial Intelligence_ , vol. 37, no. 12, 2023, pp. 14 991–14 999.
  * [26] Y. Li, Y. Bai, Y. Jiang, Y. Yang, S.-T. Xia, and B. Li, “Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection,” _Advances in Neural Information Processing Systems_ , vol. 35, pp. 13 238–13 250, 2022.
  * [27] Y. Li, Y. Jiang, Z. Li, and S.-T. Xia, “Backdoor learning: A survey,” _IEEE Transactions on Neural Networks and Learning Systems_ , 2022.
  * [28] Y. Li, L. Zhu, X. Jia, Y. Bai, Y. Jiang, S.-T. Xia, and X. Cao, “Move: Effective and harmless ownership verification via embedded external features,” _arXiv preprint arXiv:2208.02820_ , 2022.
  * [29] Y. Li, L. Zhu, X. Jia, Y. Jiang, S.-T. Xia, and X. Cao, “Defending against model stealing via verifying embedded external features,” in _AAAI Conference on Artificial Intelligence_ , vol. 36, no. 2, 2022, pp. 1464–1472.
  * [30] Z. Li, C. Wang, S. Wang, and C. Gao, “Protecting intellectual property of large language model-based code generation apis via watermarks,” in _ACM SIGSAC Conference on Computer and Communications Security_ , 2023, pp. 2336–2350.
  * [31] J. H. Lim, C. S. Chan, K. W. Ng, L. Fan, and Q. Yang, “Protect, show, attend and tell: Empowering image captioning models with ownership protection,” _Pattern Recognition_ , vol. 122, 2022.
  * [32] J. Liu, R. Zhang, S. Szyller, K. Ren, and N. Asokan, “False claims against model ownership resolution,” in _USENIX Security Symposium_ , 2024.
  * [33] X. Liu, S. Shao, Y. Yang, K. Wu, W. Yang, and H. Fang, “Secure federated learning model verification: A client-side backdoor triggered watermarking scheme,” in _IEEE International Conference on Systems, Man, and Cybernetics_ , 2021, pp. 2414–2419.
  * [34] N. Lukas, E. Jiang, X. Li, and F. Kerschbaum, “Sok: How robust is image classification deep neural network watermarking?” in _IEEE Symposium on Security and Privacy_ , 2022, pp. 787–804.
  * [35] P. Lv, P. Li, S. Zhang, K. Chen, R. Liang, H. Ma, Y. Zhao, and Y. Li, “A robustness-assured white-box watermark in neural networks,” _IEEE Transactions on Dependable and Secure Computing_ , 2023.
  * [36] P. Maini, M. Yaghini, and N. Papernot, “Dataset inference: Ownership resolution in machine learning,” in _International Conference on Learning Representations_ , 2020.
  * [37] M. P. Marcus, B. Santorini, and M. A. Marcinkiewicz, “Building a large annotated corpus of English: The Penn Treebank,” _Computational Linguistics_ , vol. 19, no. 2, pp. 313–330, 1993.
  * [38] S. Merity, C. Xiong, J. Bradbury, and R. Socher, “Pointer sentinel mixture models,” 2016.
  * [39] D. Minh, H. X. Wang, Y. F. Li, and T. N. Nguyen, “Explainable artificial intelligence: a comprehensive review,” _Artificial Intelligence Review_ , pp. 1–66, 2022.
  * [40] M. Naghiaei, H. A. Rahmani, and Y. Deldjoo, “Cpfair: Personalized consumer and producer fairness re-ranking for recommender systems,” in _International ACM SIGIR Conference on Research and Development in Information Retrieval_ , 2022, pp. 770–779.
  * [41] M. Noppel, L. Peter, and C. Wressnegger, “Disguising attacks with explanation-aware backdoors,” in _IEEE Symposium on Security and Privacy_. IEEE, 2023, pp. 664–681.
  * [42] OpenAI, “Gpt-4 technical report,” _arXiv preprint arXiv:2303.08774_ , 2023\.
  * [43] D. Paperno, G. Kruszewski, A. Lazaridou, Q. N. Pham, R. Bernardi, S. Pezzelle, M. Baroni, G. Boleda, and R. Fernández, “The lambada dataset: Word prediction requiring a broad discourse context,” _arXiv preprint arXiv:1606.06031_ , 2016.
  * [44] A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever _et al._ , “Language models are unsupervised multitask learners,” _OpenAI blog_ , 2019\.
  * [45] R. Rana and R. Singhal, “Chi-square test and its application in hypothesis testing,” _Journal of Primary Care Specialties_ , pp. 69–71, 2015.
  * [46] M. T. Ribeiro, S. Singh, and C. Guestrin, “Why should i trust you? explaining the predictions of any classifier,” in _ACM SIGKDD International Conference on Knowledge Discovery and Data Mining_ , 2016, pp. 1135–1144.
  * [47] U. Sara, M. Akter, and M. S. Uddin, “Image quality assessment through fsim, ssim, mse and psnr—a comparative study,” _Journal of Computer and Communications_ , vol. 7, no. 3, pp. 8–18, 2019.
  * [48] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-cam: Visual explanations from deep networks via gradient-based localization,” in _IEEE International Conference on Computer Vision_ , 2017, pp. 618–626.
  * [49] S. Shao, W. Yang, H. Gu, Z. Qin, L. Fan, Q. Yang, and K. Ren, “Fedtracker: Furnishing ownership verification and traceability for federated learning model,” _arXiv preprint arXiv:2211.07160_ , 2022.
  * [50] Y. Sun, T. Liu, P. Hu, Q. Liao, S. Ji, N. Yu, D. Guo, and L. Liu, “Deep intellectual property: A survey,” _arXiv preprint arXiv:2304.14613_ , 2023\.
  * [51] B. G. Tekgul, Y. Xia, S. Marchal, and N. Asokan, “Waffle: Watermarking in federated learning,” in _International Symposium on Reliable Distributed Systems_ , 2021, pp. 310–320.
  * [52] H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar _et al._ , “Llama: Open and efficient foundation language models,” _arXiv preprint arXiv:2302.13971_ , 2023.
  * [53] Y. Uchida, Y. Nagai, S. Sakazawa, and S. Satoh, “Embedding watermarks into deep neural networks,” in _ACM International Conference on Multimedia Retrieval_ , 2017, pp. 269–277.
  * [54] Y. Yan, X. Pan, M. Zhang, and M. Yang, “Rethinking white-box watermarks on deep learning models under neural structural obfuscation,” in _USENIX Security Symposium_ , 2023.
  * [55] W. Yang, S. Shao, Y. Yang, X. Liu, X. Liu, Z. Xia, G. Schaefer, and H. Fang, “Watermarking in secure federated learning: A verification framework based on client-side backdooring,” _ACM Transactions on Intelligent Systems and Technology_ , 2023.
  * [56] H. Yao, Z. Li, K. Huang, J. Lou, Z. Qin, and K. Ren, “Removalnet: Dnn fingerprint removal attacks,” _IEEE Transactions on Dependable and Secure Computing_ , 2023.
  * [57] H. Yao, J. Lou, and Z. Qin, “Poisonprompt: Backdoor attack on prompt-based large language models,” in _IEEE International Conference on Acoustics, Speech and Signal Processing_. IEEE, 2024, pp. 7745–7749.
  * [58] H. Yao, J. Lou, K. Ren, and Z. Qin, “Promptcare: Prompt copyright protection by watermark injection and verification,” in _IEEE Symposium on Security and Privacy_. IEEE, 2024.
  * [59] J. Yu, H. Yin, X. Xia, T. Chen, J. Li, and Z. Huang, “Self-supervised learning for recommender systems: A survey,” _IEEE Transactions on Knowledge and Data Engineering_ , 2023.
  * [60] J. Zhang, Z. Gu, J. Jang, H. Wu, M. P. Stoecklin, H. Huang, and I. Molloy, “Protecting intellectual property of deep neural networks with watermarking,” in _ACM Asia Conference on Computer and Communications Security_ , 2018, pp. 159–172.
  * [61] Y. Zhu, R. Kiros, R. Zemel, R. Salakhutdinov, R. Urtasun, A. Torralba, and S. Fidler, “Aligning books and movies: Towards story-like visual explanations by watching movies and reading books,” in _IEEE International Conference on Computer Vision_ , December 2015.

###  -A Implementation Details

####  -A1 Implementation Details of the Experiments on Image Classification

We employ ResNet-18, which has been pre-trained on CIFAR-10 and a subset of
ImageNet, to embed the watermark. Given that the original architecture of
ResNet-18 is primarily designed for ImageNet, certain modifications are made
to adapt it for training with CIFAR-10. Specifically, we adjust the
convolution kernel size of the first layer from $7\times 7$ to $3\times 3$.
The images in CIFAR-10 are $32\times 32$, and the images in ImageNet are
resized to $224\times 224$.

For hyper-parameter settings, the batch size is set to 128 for CIFAR-10 and
1024 for ImageNet. The value of $r_{1}$ in Eq. (2) is set to 1.0, while
$\varepsilon$ in Eq. (3) is set to $0.01$. To ensure determinism in the
watermark extraction and ownership verification process, we refrain from
generating masks randomly; instead, we adopt a default setting where $k$ masks
(with $k$ being the length of the watermark) are generated. In each mask, only
one basic part is masked by setting its corresponding element as 0 and leaving
all other elements as 1.

####  -A2 Implementation Details of the Experiments on Text Generation

In these experiments, we fine-tune the GPT-2 model with wikitext, bookcorpus,
ptb-text-only, and lambada. Note that our goal is to evaluate the
effectiveness of EaaW instead of training a high-performance language model,
considering the computational resources and the overhead, we set the max
sequence length to be $128$, and we select $1,000$ sequences as the training
set. For constructing the trigger set, we randomly select a sequence in the
training set as the trigger sample. The examples are shown in Figure 11.

Figure 11: The trigger samples (on the upper row) used to watermark text
generation models and the corresponding extracted watermark (on the bottom
row). The target 1-D watermark (visualized as a bar code) is shown on the
left. Figure 12: The extracted watermarks before and after the fine-tuning
attack. Figure 13: The extracted watermarks before and after the pruning
attack with different pruning rates.

###  -B Additional Figures of the Experimental Results

In this section, we show some additional figures of the experimental results,
mainly the visualization of the extracted watermark before and after attacks.
The descriptions of the figures are summarized as follows.

  * •

Figure 12 shows the extracted watermarks before and after the fine-tuning
attack. From the figure, we can find that the “AI” watermark can still be
recognized after the fine-tuning attack, indicating the resistance of EaaW
against the fine-tuning attack.

  * •

Figure 13 shows the extracted watermarks before and after the pruning attacks
with different pruning rates. From Figure 13, we can perceive that the
extracted watermarks have more noise as the pruning rate increases, but the
main pattern of the watermark is still explicit. All the experimental results
suggest that EaaW is capable of resisting the pruning attack.

  * •

Figure 14 shows the visualization of the extracted watermarks after the two
categories of adaptive attacks, including the overwriting attack and the
unlearning attack. The extracted watermarks after the adaptive attacks in both
scenarios are still similar to the original watermark. EaaW can resist the
adaptive attacks in both two scenarios. In summary, EaaW shows excellent
resistance against various watermark removal attacks.

Figure 14: The extracted watermark before and after the overwriting attack and
the unlearning attack. TABLE VII: Watermark success rate (WSR), the p-value,
and test accuracy of applying EaaW to ResNet-101.

Model | Metric $\downarrow$ Length $\rightarrow$ | No WM | 64 | 256 | 1024
---|---|---|---|---|---
ResNet-101 | Test Acc. | 84.76 | 84.32 | 83.82 | 83.78
p-value | / | $10^{-12}$ | $10^{-53}$ | $10^{-221}$
WSR | / | 0.984 | 0.996 | 1.000

TABLE VIII: Watermark success rate (WSR), the p-value, and perplexity (PPL) of
applying EaaW to BERT.

Model | Metric $\downarrow$ Length $\rightarrow$ | No WM | 64 | 96 | 128
---|---|---|---|---|---
BERT | PPL | 43.90 | 46.09 | 49.08 | 49.99
p-value | / | $10^{-13}$ | $10^{-20}$ | $10^{-27}$
WSR | / | 1.000 | 1.000 | 1.000

###  -C Additional Ablation Study

####  -C1 Experiments with More Models

In this section, we evaluate the effectiveness of EaaW with more models. We
choose two models, ResNet-101 [17] and BERT [7], for discussion. ResNet-101 is
a more powerful ResNet with 101 layers and BERT is another widely-used text
generation model. We fine-tune the ResNet-101 and BERT with a subset of
ImageNet and wikitext, respectively, and embed the watermarks via EaaW. The
experimental results are shown in Table VII-VIII. The p-values of both models
are smaller than the significant level of $0.01$ and the WSRs are close to
$1$. These results verify the effectiveness of EaaW on more current models.

####  -C2 Experiments with Different Watermarks

In this section, we evaluate EaaW by embedding different watermarks. We test
two additional watermarks: the lock-like logo of NDSS and a random watermark
(shown in Figure 15). As shown in Table IX, EaaW can successfully embed the
watermark with nearly perfect WSRs. It validates the effectiveness of our EaaW
regardless of targeted watermarks.

####  -C3 Effect of Different Watermark Embedding Loss Functions

In Section IV-B, we choose to use the hinge-like loss, which is also used in
[49, 11], as the watermark loss function $\mathcal{L}_{2}$. In this section,
we conduct experiments to compare the effectiveness of utilizing other
watermark loss functions for EaaW. The loss functions are listed below.
Consistent with the annotations used in Section IV-B, we use
$\bm{\mathcal{E}}={\tt explain}(\mathcal{X}_{T},\mathcal{Y}_{T},\Theta)$ as
the output explanation and $\bm{\mathcal{W}}$ as the watermark.

TABLE IX: Watermark success rate (WSR), the p-value, and test accuracy of
ResNet-18 with different watermarks.

Dataset | Metric$\downarrow$ Watermark$\rightarrow$ | AI logo | Lock-like logo | Random
---|---|---|---|---
CIFAR-10 | Test Acc. | 90.38 | 90.42 | 90.48
p-value | $10^{-222}$ | $10^{-220}$ | $10^{-222}$
WSR | 1.000 | 0.999 | 1.000
ImageNet | Test Acc. | 75.74 | 75.06 | 75.16
p-value | $10^{-222}$ | $10^{-220}$ | $10^{-222}$
WSR | 1.000 | 0.999 | 1.000

Figure 15: The visualization of the embedded watermarks.

  1. 1.

Cross Entropy Loss (CE): Since the elements in the watermark are either $1$ or
$0$, the watermark embedding problem can be considered a binary classification
problem [53]. Based on this insight, we can propose two different loss
functions, cross-entropy loss and mean squared error loss. CE loss can be
formalized as Eq. (11). In this case, the watermark
$\bm{\mathcal{W}}\in\\{0,1\\}^{k}$.

$\mathcal{L}_{2}=-\sum_{i=1}^{k}\bm{\mathcal{W}}_{i}\log[{\tt
sigmoid}(\bm{\mathcal{E}}_{i})].$ (11)

In Eq. (11), ${\tt sigmoid}(\cdot)$ is the sigmoid function.

  2. 2.

Mean Squared Error Loss (MSE): The mean squared error can also be used for
binary classification problems. MSE loss can be formalized as Eq. (12). In
this case, the watermark $\bm{\mathcal{W}}\in\\{0,1\\}^{k}$ also.

$\mathcal{L}_{2}=\sum_{i=1}^{k}[\bm{\mathcal{W}}_{i}-{\tt
sigmoid}(\bm{\mathcal{E}}_{i})]^{2}.$ (12)

  3. 3.

Structure Similarity Index Measure Loss (SSIM): Structure similarity index
measure can be used to measure the similarity of two images. The SSIM loss can
be formalized as Eq. (13). The detailed calculation process of SSIM can be
referred to [47].

$\mathcal{L}_{2}=1-{\tt SSIM}[{\tt
sigmoid}(\bm{\mathcal{E}}),\bm{\mathcal{W}}].$ (13)

We exploit the aforementioned watermark loss function together with hinge-like
loss to embed the watermark into the ResNet-18 on ImageNet. The results in
Table X illustrate that in most cases, using hinge-like loss can achieve
better effectiveness and harmlessness, while utilizing other watermark loss
functions either cannot fully embed the watermark or cannot maintain the
model’s functionality.

When using CE and MSE, these two loss functions will make the absolute value
of the explanation weights to infinity, causing the degradation of model
functionality. Moreover, SSIM is relatively more complex than hinge-like loss
so optimizing with SSIM loss is not easy in practice. Thus, using SSIM cannot
acquire good effectiveness in embedding the watermark. In summary, we utilize
the hinge-like loss as our watermark loss function in EaaW.

TABLE X: The test accuracy (Test Acc.), the p-value, and the watermark success
rate (WSR) using different watermark loss functions to embed the watermark
into ResNet-18.

Dataset | Length | Loss$\rightarrow$ | No WM | Hinge-like | CE | MSE | SSIM
---|---|---|---|---|---|---|---
ImageNet | 64 | Test Acc. | 76.38 | 75.98 | 75.50 | 75.58 | 75.78
p-value | / | $\bm{10^{-13}}$ | $\bm{10^{-13}}$ | $10^{-12}$ | $10^{-11}$
WSR | / | 1.000 | 1.000 | 0.984 | 0.953
256 | Test Acc. | 76.38 | 76.06 | 75.52 | 76.02 | 75.72
p-value | / | $\bm{10^{-54}}$ | $\bm{10^{-54}}$ | $10^{-35}$ | $\bm{10^{-54}}$
WSR | / | 1.000 | 1.000 | 0.922 | 1.000
1024 | Test Acc. | 76.38 | 75.74 | 75.16 | 75.74 | 76.08
p-value | / | $\bm{10^{-222}}$ | $10^{-188}$ | $10^{-91}$ | $10^{-19}$
WSR | / | 1.000 | 0.970 | 0.860 | 0.725

TABLE XI: Watermark success rate (WSR) and test accuracy with different
$\varepsilon$. We prune 40% neuros to validate the resistance of the
watermarks.

Model | Metric $\downarrow$ $\varepsilon$ $\rightarrow$ | 0.1 | 0.01 (Ours) | 0.001 | 0.0001
---|---|---|---|---|---
ResNet-18 | Test Acc. | 75.48 | 75.72 | 75.44 | 75.32
WSR | 1.000 | 1.000 | 0.975 | 0.969
WSR after 40% pruning | 0.995 | 0.980 | 0.773 | 0.620

####  -C4 Effect of $\varepsilon$

As shown in Eq. (3), $\varepsilon$ is the hyper-parameter used in the
watermark loss function, $i.e.$, the hinge-like loss. The $\varepsilon$
controls the resistance of the watermark against the removal attacks. In this
section, we conduct the ablation study with $\varepsilon=0.1$ to $0.0001$ and
apply a 40%-pruning-attack to preliminarily validate the resistance of these
embedded watermarks. ResNet-18 trained on ImageNet is used as the example
model. The results in Table XI demonstrate that a too small $\varepsilon$ may
lead to poor resistance, while a too large $\varepsilon$ may compromise the
utility of the models. To ensure both resistance and harmlessness, we choose
to utilize $\varepsilon=0.01$ in our main experiments.

TABLE XII: The watermark success rate (WSR) using different numbers $c$ of
masked samples during watermark embedding and watermark extraction.

Dataset | $c$ during embedding $\downarrow$ |  $c$ during extraction $\downarrow$
---|---|---
256 | 512 | 1024 | 2048 | 4096
ImageNet | 256 | 0.566 | 0.590 | 0.605 | 0.594 | 0.633
512 | 0.516 | 0.676 | 0.664 | 0.672 | 0.695
1024 | 0.563 | 0.625 | 0.734 | 0.770 | 0.758
2048 | 0.516 | 0.629 | 0.789 | 0.895 | 0.852
4096 | 0.488 | 0.582 | 0.703 | 0.824 | 0.945

###  -D Experiments in the Label-only Scenario

In this section, we investigate the effectiveness of EaaW in the label-only
scenario, wherein the defender is restricted to obtaining only the predicted
class rather than the logits. Consequently, for any masked samples, we assign
a value of 1 to the corresponding element in the prediction vector $\bm{p}$ if
it aligns with the correct class; otherwise, it is set to 0. While originally
ranging between 0 and 1, these prediction logits $\bm{p}\in[0,1]$ are
discretized as either 0 or 1 in this label-only scenario. As a result, there
is a substantial reduction in available information for explaining data and
models and extracting the watermark.

Therefore, in order to obtain an equivalent amount of information for
watermark extraction, a straightforward approach is to increase the number of
masked samples and queries for watermark extraction. Building upon this
insight, we augment the quantity $c$ of masked samples during both watermark
embedding and extraction processes. The experimental findings are presented in
Table XII.

In this experiment, we aim to embed a $256$-bit watermark into the ResNet-18
model trained using the ImageNet dataset. However, when only a limited number
of masked samples are utilized, EaaW fails to extract the watermark due to a
WSR lower than $0.7$. Nevertheless, as the number of masked samples (c)
surpasses $1024$, successful extraction of the watermark becomes feasible.
These findings highlight that both watermark embedding and extraction in the
label-only scenario necessitate an increased utilization of masked samples to
ensure the effectiveness of EaaW.

Furthermore, these results substantiate that augmenting the quantity of masked
samples enables EaaW to function effectively even in scenarios where only
labels are available. It also demonstrates the resistance of EaaW even under
the worst-case attack: the adversary cannot remove the watermark without
changing the predicted classes. We will conduct a comprehensive analysis and
experimentation of this scenario in our future work.

###  -E The Resistance to Adversarial Attacks against XAI

As aforementioned in Section V-C3, the adversary may interfere with the
watermark extraction by manipulating the explanations of input data. There are
two main techniques to manipulate the explanations, as follows.

  * •

Modifying the models: In this type of attack, the adversary can change the
explanations of some particular samples by changing model [19, 41].

  * •

Modifying the inputs: In this type of attack, the adversary can add specific
perturbations to the inputs to manipulate the explanations [12].

We have implemented the former attack in two different scenarios as adaptive
attacks in Section V-C3. The results demonstrate adversaries cannot remove the
watermark utilizing this type of attack without knowing the secret trigger
samples.

For the latter attack, since the adversaries have no knowledge of the trigger
samples, they have to perturb all the inputs to bypass the ownership
verification. As such, they should preserve model predictions when perturbing
explanations. In this case, we argue that our proposed EaaW is still practical
due to the following two reasons.

  * •

This type of adaptive attack is costly to implement. Perturbing all the input
samples requires enormous computational resources and compromises the
performance and efficiency of the deployed model.

  * •

As shown in Appendix -D, we can extract the watermark with only predicted
labels (instead of probabilities). As such, the adversary cannot circumvent
our EaaW without changing the predicted classes of the inputs, $i.e.$,
degrading the utility of the model.

TABLE XIII: The watermark success rate (WSR) using different numbers $c$ of
masked samples during watermark embedding and watermark extraction.

Model | ResNet-18 | BERT
---|---|---
Metric $\downarrow$ Length $\rightarrow$ | 2025 | 3025 | 3600 | 150 | 170 | 185
accuracy/PPL | 74.38 | 73.36 | 74.62 | 50.45 | 56.66 | 57.81
WSR | 0.997 | 0.962 | 0.605 | 1.000 | 1.000 | 1.000

###  -F Exploring the Maximum Embedded Watermark Length

In this section, we investigate the maximum length of watermark that EaaW can
embed. Our experiments are conducted using ResNet-18 and BERT models. The
ResNet-18 model is trained on a subset of ImageNet and BERT is fine-tuned with
the wikitext dataset. As depicted in Table XIII, the maximum capacity of
ResNet18 is greater than 3025 bits, but less than 3600. For BERT, we
successfully embed a 185-bit watermark. Regrettably, further embedding of a
larger-bit watermark is not feasible due to constraints in GPU memory.

###  -G Analysis on the Efficiency of EaaW

In this section, we analyze the efficiency of embedding the watermark using
EaaW to illustrate that EaaW only has a slight increase in computational
overhead compared with the backdoor-based methods. From Section IV, the
procedure of EaaW can be divided into several steps:

  1. 1.

Prepare the $c$ masked data.

  2. 2.

Input the $c$ masked data and get the prediction logits.

  3. 3.

Using the metric function in Eq. (5) to calculate the metric vector $\bm{v}$.

  4. 4.

Calculate the feature attribution matrix $\bm{W}$ via Eq. (6).

Compared to the backdoor-based method, we assume that the backdoor-based
method needs to embed $c$ trigger samples into the model. First, the backdoor-
based method also requires preparing $c$ trigger samples. The overhead of
preparing the data can be neglected. Then, the backdoor-based method should
optimize the model with these trigger samples. In one training iteration, the
backdoor-based method involves one forward and one backward propagation. The
overheads of these steps are close to Step 2&3.

From the above analysis, we can see that the only difference in the overhead
between the EaaW and the backdoor-based method is Step 4. The equation of Step
4 is as follows.

$\bm{W}=(M^{T}M+\lambda I)^{-1}M^{T}\bm{v},$ (14)

where $(M^{T}M+\lambda I)^{-1}M^{T}$ is constant. Therefore, in each
iteration, the overhead of Step 4 is just one vector multiplication, which is
negligible in the whole embedding process. In summary, the efficiency of EaaW
is close to that of the backdoor-based model watermarking methods and our EaaW
can efficiently embed the watermark into the models.