← Back to all news
arXiv Machine Learning By Redwanul Karim, Tobias Feigl, Christopher Mutschler, Felix Ott

TwinMark: A Unified Watermark for Provable Survival Under Feature and Logit Distillation

Read the original on arXiv Machine Learning →

TwinMark is a watermarking scheme that embeds a single SHAKE128 secret into a vision model using two complementary linear functionals of model-output summaries: a covariance projector (cov‑Feat) and a class‑conditional Fisher‑aligned linear carrier (cc‑FALC). These readouts cover both classifier APIs attacked by KL knowledge distillation and representation‑only hosts attacked by feature‑matching distillation, each providing a teacher‑measurable a posteriori certificate. Across 13 attacks on datasets such as CIFAR‑10, CIFAR‑100, and Mini‑ImageNet, TwinMark remains detectable on every post‑attack model that retains task utility, survives cross‑architecture distillation onto ResNet‑18/50, VGG‑16, and MobileNet‑V3, and can be ported to GNSS few‑shot, VOC detection, ISIC segmentation, and STL‑10 SimCLR.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv Machine Learning.

Related stories

arXiv Machine Learning
Aug 27

MeMark: Membrane-Space Watermarking for Spiking Neural Networks

MeMark introduces a watermarking scheme for Spiking Neural Networks that embeds a multi‑bit identifier directly into the membrane state of selected Leaky Integrate‑and‑Fire neurons, rather than in the output head. The watermark is recoverable by comparing neuron firing thresholds, eliminating the need for a learned decoder. Experiments on various SNN architectures—including a 215.4M‑parameter SpikeGPT checkpoint—show that all 20 independent 64‑bit keys reliably pass verification under a 51/64 rule, remain robust after fine‑tuning, pruning, quantization, and output‑head replacement, and are not recovered by random keys or adaptive attacks within the tested threat model.

By Roberto Ria\~no, Gorka Abad, Stjepan Picek, Aitor Urbieta
llmsfine-tuningefficiency
More like this →
arXiv Computation and Language
Oct 19

Watermarkability: Measuring and Improving Language-Model Compatibility with Logit-Based Watermarks

The paper introduces "watermarkability," a metric that quantifies how compatible a language model is with a logit‑based watermark that boosts the probability of a specified token set during decoding. By measuring the expected minimum KL divergence needed to achieve a target probability mass, the authors can assess and compare models and watermark rules. They propose a two‑stage approach—first training a low‑rank adapter conditioned on the target set, then applying a minimal uniform logit bias—to reduce this cost, achieving significant perplexity reductions across multiple watermark schedules on OPT‑125M and Qwen3‑8B.

By Zewei Deng, Mohamed Seif, Liyan Xie
safety
More like this →
arXiv Computation and Language
Oct 28

Watermark Basins: Black-Box Detection of Distilled LLMs

The paper introduces Watermark Basin Alignment (WM‑Basin), a black‑box method for detecting distilled large language models (LLMs). It exploits a persistent watermark basin—a key‑specific geometric signal embedded in the teacher’s parameter space during fine‑tuning—that remains detectable even when token‑level signals vanish. WM‑Basin maps suspect model outputs to gradient representations, removes ordinary fine‑tuning directions, and tests alignment with the watermark basin, achieving significantly higher detection rates than token‑level baselines across a range of teacher and student models.

By Hongyan Chang, Hady Elsahar, Tom Sander, Pierre Fernandez, Saeed Mahloujifar, Sylvestre-Alvise Rebuffi, Tom\'a\v{s} Sou\v{c}ek, Tuan Tran, Valeriu Lacatusu, Surya Parimi, Rashel Moritz, Vanessa Stark, Alexandre Mourachko
llmsfine-tuningefficiencybenchmarkssafety
More like this →