Feature-Decoupled Contrastive Self-Distillation for Black-Box Watermark Removal

Deep neural networks have been widely deployed in numerous real-world applications, making trained models valuable intellectual property. However, embedded watermarks remain vulnerable to removal attacks, particularly when an adversary has only limited clean unlabeled data and the original watermark information is unavailable. To address this problem, this paper proposes a feature-decoupled contrastive self-distillation method for watermark removal against black-box-verifiable watermarks under an editable-model threat model. Given clean unlabeled data, high-confidence pseudo-labels are first generated solely from the output predictions of the watermarked model, without requiring ground-truth labels. Feature decoupling is then employed to distinguish normal and watermark-related features, based on which an inferred watermark-related perturbation is obtained without assuming exact recovery of the original secret trigger. Contrastive learning subsequently guides the editable model away from watermark-related representations, while feature- and label-level self-distillation provide layer-wise regularization across intermediate representations and predictions to preserve the model’s normal task behavior. Experiments on four datasets (MNIST, CIFAR-10, ImageNet-10, and ImageNet-100) demonstrate that the proposed method effectively reduces residual watermark behavior under the limited-data, unlabeled setting. For example, the verification success rate of the BadNets watermark is reduced to 4.0% and 5.67% on CIFAR-10 and ImageNet-100, respectively. For the complete method, the largest reported mean main-task accuracy drop relative to the pre-removal watermarked model is 3.95 percentage points in the main comparison and 4.98 percentage points when the data-proportion sensitivity experiments are included. Visualization and ablation results further demonstrate the effectiveness of the feature-decoupling and self-distillation components for watermark removal.