TwinMark is a watermarking scheme that embeds a single SHAKE128 secret into a vision model using two complementary linear functionals of model-output summaries: a covariance projector (cov‑Feat) and a class‑conditional Fisher‑aligned linear carrier (cc‑FALC). These readouts cover both classifier APIs attacked by KL knowledge distillation and representation‑only hosts attacked by feature‑matching distillation, each providing a teacher‑measurable a posteriori certificate. Across 13 attacks on datasets such as CIFAR‑10, CIFAR‑100, and Mini‑ImageNet, TwinMark remains detectable on every post‑attack model that retains task utility, survives cross‑architecture distillation onto ResNet‑18/50, VGG‑16, and MobileNet‑V3, and can be ported to GNSS few‑shot, VOC detection, ISIC segmentation, and STL‑10 SimCLR.
arXiv:2609.19011v2 Announce Type: replace Abstract: Knowledge distillation can copy a deployed model by training a student on its logits or features. The student inherits a watermark only through the...
MeMark introduces a watermarking scheme for Spiking Neural Networks that embeds a multi‑bit identifier directly into the membrane state of selected Leaky Integrate‑and‑Fire neurons, rather than in the output head. The watermark is recoverable by comparing neuron firing thresholds, eliminating the need for a learned decoder. Experiments on various SNN architectures—including a 215.4M‑parameter SpikeGPT checkpoint—show that all 20 independent 64‑bit keys reliably pass verification under a 51/64 rule, remain robust after fine‑tuning, pruning, quantization, and output‑head replacement, and are not recovered by random keys or adaptive attacks within the tested threat model.
arXiv:2610.15359v1 Announce Type: cross Abstract: Deep classifiers deployed in safety-critical services like autonomous-driving perception remain vulnerable to small adversarial perturbations. Certif...
The paper introduces "watermarkability," a metric that quantifies how compatible a language model is with a logit‑based watermark that boosts the probability of a specified token set during decoding. By measuring the expected minimum KL divergence needed to achieve a target probability mass, the authors can assess and compare models and watermark rules. They propose a two‑stage approach—first training a low‑rank adapter conditioned on the target set, then applying a minimal uniform logit bias—to reduce this cost, achieving significant perplexity reductions across multiple watermark schedules on OPT‑125M and Qwen3‑8B.
The paper introduces Watermark Basin Alignment (WM‑Basin), a black‑box method for detecting distilled large language models (LLMs). It exploits a persistent watermark basin—a key‑specific geometric signal embedded in the teacher’s parameter space during fine‑tuning—that remains detectable even when token‑level signals vanish. WM‑Basin maps suspect model outputs to gradient representations, removes ordinary fine‑tuning directions, and tests alignment with the watermark basin, achieving significantly higher detection rates than token‑level baselines across a range of teacher and student models.
arXiv:2605. 31191v2 Announce Type: replace Abstract: We investigate how teacher-student capacity relationships modulate knowledge distillation (KD) effectiveness in ResNet-based image classification on CIFAR-10.
The paper presents ViTok, a multi‑teacher distillation approach that combines SigLIP2 and DINOv3‑L to jointly preserve global recognition and dense semantics. By introducing split adaptor heads, asymmetric losses, teacher reweighting, masked image modeling, and PHI‑S feature balancing, the authors achieve higher ImageNet‑1K kNN accuracy and restore ADE20K segmentation performance to match the teacher. The study also reports negative findings, such as limited benefits from scaling to ImageNet22K and interference from additional teachers.
arXiv:2606. 18430v1 Announce Type: new Abstract: Statistical watermarks help organizations attribute large language model (LLM) outputs, yet existing detectors often struggle when watermark signals are weak, texts are repetitive, or watermarks are edited.
MoSign is a challenge-response authentication system that embeds a time‑varying keyed message into the motion of virtual‑reality users, allowing them to prove identity while keeping their avatars anonymous. The watermark is added to the latent space of a motion variational autoencoder and is provably indistinguishable from unwatermarked motion, with security tied to breaking a pseudorandom function. Experiments on HumanML3D and BOXRR‑23 show high authentication accuracy, low false‑accept rates, and resilience against realistic recapture attacks while remaining undetectable by standard detectors.
The study investigates what knowledge a student model inherits from its teachers beyond accuracy when using knowledge distillation for encrypted‑traffic classification. By distilling a 101k‑parameter student from two teachers of equal accuracy but different construction, the authors test ten hypotheses over a year of real TLS traffic, finding that unknown‑traffic detection and shortcut reliance can transfer depending on temperature settings and model size, while other abilities do not. The results show that distillation can propagate teacher habits, but some inherited capabilities can also be achieved without a teacher.
arXiv:2607. 19393v1 Announce Type: cross Abstract: While auditing a perturbation-based OOD detector on a document benchmark, we recorded an AUROC of 0.
arXiv:2608.28706v1 Announce Type: new Abstract: ViT detectors fix a uniform token grid before any learned stage. A native-resolution aerial detector must then choose between resolving few-pixel objec...