Multi-bit watermarking for deep models via clean trigger samples and pairwise class-difference vectors

High-performance deep learning models have become an important form of intellectual property. However, these valuable models may be exploited for commercial purposes without authorization due to illegal activities, causing serious infringement of the model owners’ copyright. To address this issue, ownership verification methods, represented by model watermarking, have been proposed and widely adopted for protecting model copyrights. Nevertheless, most existing black-box watermarking methods are designed based on backdoor attacks, where ownership is verified through incorrect model outputs. Such approaches cannot embed specific multi-bit watermark information, making them vulnerable to ambiguity attacks, while also introducing harmful “misclassification”-based trigger patterns. To overcome these limitations, we propose a model watermarking method based on clean trigger samples and pairwise class-difference vectors. Without altering the samples or labels, the method leverages the output probabilities of clean trigger samples to carry watermark information, thereby achieving a harmless multi-bit black-box watermark that is resistant to ambiguity attacks. Extensive experimental results demonstrate that the proposed method enables robust watermark extraction and remains effective under 128–512-bit and even 2048-bit multi-bit watermark configurations. The impact on model performance is generally below 1%, and the watermark exhibits strong robustness against fine-tuning, pruning, adaptive attacks, and model extraction attacks.