DICTION: DynamIC robusT whIte bOx Watermarking Scheme for Deep Neural Networks
Source abstract
Abstract
Deep neural network (DNN) watermarking is a suitable method for protecting the ownership of deep learning (DL) models. It secretly embeds an identifier within the model, which can be retrieved by the owner to prove ownership. In this paper, we first provide a unified framework for white-box DNN watermarking schemes that encompasses current state-of-the-art methods and outlines their theoretical inter-connections. Next, we introduce DICTION, a new white-box dynamic robust watermarking scheme derived from this framework. Its main originality lies in a generative adversarial network (GAN) strategy where the watermark extraction function is a DNN trained as a GAN discriminator, while the target model acts as a GAN generator. DICTION can be viewed as a generalization of DeepSigns, which, to the best of our knowledge, is the only other dynamic white-box watermarking scheme in the literature. Experiments conducted on four benchmark models (MLP, CNN, ResNet-18, and LeNet) demonstrate that DICTION achieves a zero bit error rate (BER) while maintaining model accuracy within 0.5% of the baseline. DICTION shows superior robustness, tolerating up to 95% weight pruning compared to 80% for existing methods, and it demonstrates complete resistance to fine-tuning and overwriting attacks where competing methods fail, with a BER of >0.3.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Steganography and Watermarking Techniques · Vehicle License Plate Recognition · Digital Media Forensic Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
IMT Atlantique, Inserm, UMR 1101 Latim, 29238 Brest Cedex, France
Funding
Inserm industrial chair CYBAILE
References (72)
Show source-provided references
1. A Strong and Simple Deep Learning Baseline for BCI Motor Imagery decoding10.1109/TNSRE.2024.3451010 ↗
2. Automatic Speech Recognition: A survey of deep learning techniques and approaches
3. Azzouzi, M.E., Coatrieux, G., Bellafqira, R., Delamarre, D., Riou, C., Oubenali, N., Cabon, S., Cuggia, M., and Bouzillé, G. (2024). Automatic de-identification of French electronic health records: A cost-effective approach exploiting distant supervision and deep learning models. BMC Med. Inform. Decis. Mak., 24.10.1186/s12911-024-02422-5 ↗
4. Boundary-Aware Dynamic Re-weighting for Semi-Supervised Medial Image Segmentation10.1016/j.eswa.2025.128175 ↗
5. Impact of Multimodal Prompt Elements on Diagnostic Performance of GPT-4V in Challenging Brain MRI Cases10.1148/radiol.240689 ↗
6. Bouslimi, D., Bellafqira, R., and Coatrieux, G. (2016, January 16–20). Data hiding in homomorphically encrypted medical images for verifying their reliability in both encrypted and spatial domains. Proceedings of the 2016 38th Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBC), Orlando, FL, USA.10.1109/EMBC.2016.7591237 ↗
7. Reversible adversarial visible image watermarking10.1016/j.sigpro.2025.109999 ↗
8. Hebbache, K., Aiadi, O., Khaldi, B., and Benziane, A. (2025). Blind Medical Image Watermarking Based on LBP–DWT for Telemedicine Applications. Circuits, Systems, and Signal Processing, Springer.10.1007/s00034-025-03023-x ↗
9. Reversible Data Hiding With Secret Encrypted Image Sharing and Adaptive Coding10.1109/JIOT.2025.3555380 ↗
10. Bellafqira, R., Berton, C., and Coatrieux, G. (2025, January 26–28). A Blockchain-Enhanced Reversible Watermarking Framework for End-to-End Data Traceability in Federated Learning Systems. Proceedings of the 9th International Conference on Cryptography, Security and Privacy (CSP 2025), Okinawa, Japan.
11. Sander, T., Fernandez, P., Durmus, A., Furon, T., and Douze, M. (2024). Watermark Anything with Localized Messages. arXiv.
12. Niyitegeka, D., Coatrieux, G., Bellafqira, R., Genin, E., and Franco-Contreras, J. (2018). Dynamic watermarking-based integrity protection of homomorphically encrypted databases–application to outsourced genetic data. International Workshop on Digital Watermarking, Springer.10.1007/978-3-030-11389-6_12 ↗
13. Digital image and video watermarking: Methodologies, attacks, applications, and future directions10.1007/s11042-023-15806-y ↗
14. Lukas, N., Jiang, E., Li, X., and Kerschbaum, F. (2022, January 23–25). SoK: How robust is image classification deep neural network watermarking?. Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP46214.2022.9833693 ↗
15. Boenisch, F. (2021). A systematic review on model watermarking for neural networks. Front. Big Data, 4.10.3389/fdata.2021.729663 ↗
16. Sun, Y., Liu, L., Yu, N., Liu, Y., Tian, Q., and Guo, D. (2024, January 16). Deep Watermarking for Deep Intellectual Property Protection: A Comprehensive Survey. Available online: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4697020.10.2139/ssrn.4697020 ↗
17. Intellectual property protection for deep learning models: Taxonomy, methods, attacks, and evaluations10.1109/TAI.2021.3133824 ↗
18. When deep learning meets watermarking: A survey of application, attacks and defenses10.1016/j.csi.2023.103830 ↗
19. Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y. (2014). Generative adversarial nets. Adv. Neural Inf. Process. Syst., 27.
20. Passport-aware normalization for deep model protection
21. Guan, L. (2025, January 10–13). Weight prediction boosts the convergence of adamw. Proceedings of the Pacific-Asia Conference on Knowledge Discovery and Data Mining, Sydney, Australia.
22. Gradient-based learning applied to document recognition10.1109/5.726791 ↗
23. Xue, M., Wang, J., and Liu, W. (2021, January 22–25). DNN intellectual property protection: Taxonomy, attacks and evaluations. Proceedings of the 2021 on Great Lakes Symposium on VLSI, online.10.1145/3453688.3461752 ↗
24. A survey of deep neural network watermarking techniques10.1016/j.neucom.2021.07.051 ↗
25. Copyright protection of deep neural network models using digital watermarking: A comparative study10.1007/s11042-022-12566-z ↗
26. Sun, Y., Liu, T., Hu, P., Liao, Q., Ji, S., Yu, N., Guo, D., and Liu, L. (2023). Deep Intellectual Property: A Survey. arXiv.
27. Chen, H., Rouhani, B.D., and Koushanfar, F. (2019). BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networks. arXiv.
28. Vybornova, Y. (2021, January 8–12). Method for copyright protection of deep neural networks using digital watermarking. Proceedings of the Fourteenth International Conference on Machine Vision (ICMV 2021), online.10.1117/12.2623444 ↗
29. Zhang, J., Gu, Z., Jang, J., Wu, H., Stoecklin, M.P., Huang, H., and Molloy, I. (2018, January 4–8). Protecting intellectual property of deep neural networks with watermarking. Proceedings of the 2018 on Asia Conference on Computer and Communications Security, Incheon, Republic of Korea.10.1145/3196494.3196550 ↗
30. Adi, Y., Baum, C., Cisse, M., Pinkas, B., and Keshet, J. (2018, January 15–17). Turning your weakness into a strength: Watermarking deep neural networks by backdooring. Proceedings of the 27th USENIX Security Symposium, Baltimore, MD, USA.
31. Guo, J., and Potkonjak, M. (2018, January 5–8). Watermarking deep neural networks for embedded systems. Proceedings of the 2018 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), San Diego, CA, USA.10.1145/3240765.3240862 ↗
32. Adversarial frontier stitching for remote neural network watermarking10.1007/s00521-019-04434-z ↗
33. Namba, R., and Sakuma, J. (2019, January 9–12). Robust watermarking of neural network with exponential weighting. Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security, Auckland, New Zealand.10.1145/3321705.3329808 ↗
34. Li, Z., Hu, C., Zhang, Y., and Guo, S. (2019, January 9–13). How to prove your model belongs to you: A blind-watermark based framework to protect intellectual property of DNN. Proceedings of the 35th Annual Computer Security Applications Conference, San Juan, PR, USA.10.1145/3359789.3359801 ↗
35. Kapusta, K., Thouvenot, V., and Bettan, O. (2020, January 18–19). Watermarking at the service of intellectual property rights of ML models. Proceedings of the Actes de la conférence CAID 2020, Rennes, France.
36. Lounici, S., Önen, M., Ermis, O., and Trabelsi, S. (2022, January 27–28). Blindspot: Watermarking through fairness. Proceedings of the 2022 ACM Workshop on Information Hiding and Multimedia Security, Santa Barbara, CA, USA.10.1145/3531536.3532950 ↗
37. Kallas, K., and Furon, T. (2022, January 12–16). RoSe: A RObust and SEcure Black-Box DNN Watermarking. Proceedings of the IEEE Workshop on Information Forensics and Security, Shanghai, China.10.1109/WIFS55849.2022.9975300 ↗
38. A novel model watermarking for protecting generative adversarial network10.1016/j.cose.2023.103102 ↗
39. Kallas, K., and Furon, T. (2023, January 4–10). Mixer: DNN Watermarking using Image Mixup. Proceedings of the ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Rhodes Island, Greece.10.1109/ICASSP49357.2023.10095332 ↗
40. Unambiguous and High-Fidelity Backdoor Watermarking for Deep Neural Networks10.1109/TNNLS.2023.3250210 ↗
41. El Hajjar, T., Lansari, M., Bellafqira, R., Coatrieux, G., Kapusta, K., and Kallas, K. (2025). RoSe-Mix: Robust and Secure Deep Neural Network Watermarking in Black-Box Settings via Image Mixup. Mach. Learn. Knowl. Extr., 7.10.3390/make7020032 ↗
42. Rodríguez-Lois, E., and Pérez-González, F. (2025, January 6–11). Collusion-resistant Black-box Watermarking in Federated Learning through Weight Relevance Analysis. Proceedings of the ICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Hyderabad, India.10.1109/ICASSP49660.2025.10888286 ↗
43. Watermarking makes language models radioactive
44. Chiovelli, A., Purnekar, N., Tondi, B., and Barni, M. (2025, January 6–11). Colorization Network Watermarking in the CIE-Lab Domain. Proceedings of the ICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Hyderabad, India.10.1109/ICASSP49660.2025.10887863 ↗
45. Uchida, Y., Nagai, Y., Sakazawa, S., and Satoh, S. (2017, January 6–9). Embedding watermarks into deep neural networks. Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval, Bucharest, Romania.10.1145/3078971.3078974 ↗
46. Feng, L., and Zhang, X. (2020, January 28–30). Watermarking neural network with compensation mechanism. Proceedings of the Knowledge Science, Engineering and Management: 13th International Conference, KSEM 2020, Hangzhou, China. Proceedings, Part II 13.
47. Li, Y., Tondi, B., and Barni, M. (2020). Spread-Transform Dither Modulation Watermarking of Deep Neural Network. arXiv.10.1016/j.jisa.2021.103004 ↗
48. Tartaglione, E., Grangetto, M., Cavagnino, D., and Botta, M. (2021, January 10–15). Delving in the loss landscape to embed robust watermarks into neural networks. Proceedings of the 2020 25th International Conference on Pattern Recognition (ICPR), Milan, Italy.10.1109/ICPR48806.2021.9413062 ↗
49. Chen, H., Rouhani, B.D., Fu, C., Zhao, J., and Koushanfar, F. (2019, January 10–13). Deepmarks: A secure fingerprinting framework for digital rights management of deep learning models. Proceedings of the 2019 on International Conference on Multimedia Retrieval, Ottawa, ON, Canada.10.1145/3323873.3325042 ↗
50. Watermarking in deep neural networks via error back-propagation10.2352/ISSN.2470-1173.2020.4.MWSF-022 ↗
51. Rouhani, B.D., Chen, H., and Koushanfar, F. (May, January 27). Deepsigns: An end-to-end watermarking framework for protecting the ownership of deep neural networks. Proceedings of the The 24th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), San Diego, CA, USA.
52. Rethinking deep neural network ownership verification: Embedding passports to defeat ambiguity attacks
53. Song, C., Ristenpart, T., and Shmatikov, V. (November, January 30). Machine learning models that remember too much. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA.10.1145/3133956.3134077 ↗
54. Kuribayashi, M., Tanaka, T., and Funabiki, N. (2020, January 7–10). DeepWatermark: Embedding Watermark into DNN Model. Proceedings of the 2020 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), Auckland, New Zealand.
55. Li, G., Li, S., Qian, Z., and Zhang, X. (2022, January 22–27). Encryption Resistant Deep Neural Network Watermarking. Proceedings of the ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Singapore.10.1109/ICASSP43922.2022.9746461 ↗
56. Wang, T., and Kerschbaum, F. (2019, January 12–17). Attacks on digital watermarks for deep neural networks. Proceedings of the ICASSP 2019-2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Brighton, UK.10.1109/ICASSP.2019.8682202 ↗
57. Wang, T., and Kerschbaum, F. (2019). RIGA: Covert and Robust White-Box Watermarking of Deep Neural Networks. arXiv.
58. Deepip: Deep neural network intellectual property protection with passports10.1109/TPAMI.2021.3088846 ↗
59. Li, F., and Wang, S. (2021). Secure watermark for deep neural networks with multi-task learning. arXiv.
60. When Federated Learning Meets Watermarking: A Comprehensive Overview of Techniques for Intellectual Property Protection10.3390/make5040070 ↗
61. Fedtracker: Furnishing ownership verification and traceability for federated learning model10.1109/TDSC.2024.3390761 ↗
62. Kuribayashi, M., Tanaka, T., Suzuki, S., Yasui, T., and Funabiki, N. (2021, January 22–25). White-box watermarking scheme for fully-connected layers in fine-tuning model. Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security, Brussels, Belgium.10.1145/3437880.3460402 ↗
63. An introduction to variational autoencoders10.1561/2200000056 ↗
64. Krizhevsky, A., Nair, V., and Hinton, G. (2025, June 25). The Cifar-10 Dataset. Available online: https://www.cs.toronto.edu/~kriz/cifar.html.
65. He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27–30). Deep residual learning for image recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.10.1109/CVPR.2016.90 ↗
66. Learning both weights and connections for efficient neural network
67. Tekgul, B.G., Xia, Y., Marchal, S., and Asokan, N. (2021, January 20–23). Waffle: Watermarking in federated learning. Proceedings of the 2021 40th International Symposium on Reliable Distributed Systems (SRDS), Chicago, IL, USA.10.1109/SRDS53918.2021.00038 ↗
68. Liao, Y., Jiang, R., and Zhou, B. (2024). Dynamic Black-Box Model Watermarking for Heterogeneous Federated Learning. Electronics, 13.10.3390/electronics13214306 ↗
69. Wen, Y., Kirchenbauer, J., Geiping, J., and Goldstein, T. (2023). Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv.
70. Secure neural network watermarking protocol against forging attack10.1186/s13640-020-00527-1 ↗
71. Kinakh, V., Pulfer, B., Belousov, Y., Fernandez, P., Furon, T., and Voloshynovskiy, S. (2024, January 2–5). Evaluation of Security of ML-based Watermarking: Copy and Removal Attacks. Proceedings of the 2024 IEEE International Workshop on Information Forensics and Security (WIFS), Rome, Italy.10.1109/WIFS61860.2024.10810685 ↗
72. Yan, Y., Pan, X., Zhang, M., and Yang, M. (2023, January 9–11). Rethinking {White-Box} watermarks on deep learning models under neural structural obfuscation. Proceedings of the 32nd USENIX Security Symposium (USENIX Security 23), Anaheim, CA, USA.