Performance-Lossless Black-Box Model Watermarking

With the development of deep learning, high-value and high-cost models have become valuable assets, and related intellectual property protection technologies have become a hot topic. However, existing model watermarking work in black-box scenarios originates mainly from training-based backdoor methods, which probably degrade primary task performance. To address this, we propose a branch backdoor-based model watermarking protocol named BranchWM to protect the intellectual property of the model. This protocol adopts a construction based on a message authentication scheme as the branch indicator, following a comparative analysis with other secure cryptographic primitives. We prove the lossless performance of the protocol by reduction. In addition, we analyze potential threats to the protocol and present a secure and feasible watermarking instantiation for language models. We further conduct empirical evaluations of the instantiated BranchWM, demonstrating its effectiveness and security for ownership verification.