arXiv AI

Revisiting Black-Box Model Ownership Verification through Information Theory

arXiv:2409. 06130v2 Announce Type: replace-cross Abstract: Modern machine learning models require substantial computational resources and data to train, making them valuable intellectual property.

arXiv Machine Learning
Sep 7

A Robust Watermark-based Fingerprint Framework for GNNs Ownership Verification

The paper introduces REMARK, a watermark‑based fingerprint framework designed to verify ownership of Graph Neural Networks (GNNs). REMARK generates in‑distribution watermark graphs that maximize output differences between GNN models, thereby reducing performance loss from out‑of‑distribution watermarks. It then extracts robust fingerprints from these output differences, eliminating the need for surrogate models trained on watermark data or reliance on specific output levels, and achieves state‑of‑the‑art verification accuracy across real‑world datasets and GNN architectures.

By Han Zhang, Yan Wang, Guanfeng Liu, Pengfei Ding, Huaxiong Wang, Kwok-Yan Lam
arXiv Machine Learning
Sep 11

CertDW: Towards Certified Dataset Ownership Verification via Conformal Calibration

The paper introduces CertDW, a certified dataset watermark and ownership verification method that remains reliable even under malicious perturbations. By leveraging conformal prediction, it defines two statistical measures—principal probability (PP) and watermark robustness (WR)—to evaluate model stability on benign versus watermarked samples. The authors derive certification conditions linking WR to a PP-based threshold and provide a high‑probability bound on false positives, enabling robust ownership verification when a suspicious model’s WR exceeds the PP values of benign models.

By Ting Qiao, Yiming Li, Jianbin Li, Yingjia Wang, Leyi Qi, Junfeng Guo, Ruili Feng, Dacheng Tao
arXiv Machine Learning
4d ago

Dataset Watermarking with Provable Black-Box Detection

The paper introduces a dataset watermarking technique that embeds a watermark by increasing the co‑occurrence of randomly selected word pairs through meaning‑preserving local edits. The watermark can be detected solely from generated text with provable false‑positive control, and experiments on four base models and three datasets show reliable detection (p < 0.01) even when the watermarked data constitutes less than 5% of fine‑tuning tokens. Compared to existing methods, the approach better preserves benchmark utility and semantic integrity.

By Pengrun Huang, Kamalika Chaudhuri, Yu-Xiang Wang