{"id":"c272fe03-bad2-4bd4-a8db-84002481bf9f","arxiv_id":"2501.02704","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Retraining a fine-tuned watermarked neural network on its original clean training data can restore the erased backdoor watermark, without exposing the trigger set.","lead":"Deep learning models can carry secret watermarks that prove who trained them, but attackers can often erase those watermarks by fine-tuning the model. This paper shows that retraining the fine-tuned model on its original clean data can restore the watermark without showing the secret trigger images, as long as the fine-tuning did not move the weights too far, and it compares five watermarking schemes under fine-tuning and extraction.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Missing non-watermarked control in restoration experiments (Section IV-B2, Figure 7, Supp. Figure 2) leaves the ownership-verification claim unsupported, since a clean model might also gain trigger accuracy after the same fine-tune-then-retrain pipeline.","rationale":"The reader's weakest assumption was the unmeasured basin-of-attraction condition, which is a legitimate caveat. However, I find the missing non-watermarked control more central because it targets the 'only previously watermarked model' assertion that turns restoration into proof of ownership. The paper provides useful evidence and code, and the extraction experiments offer a partial negative control (showing retraining does not help extracted models), which strengthens the narrative. Still, the absence of a clean-model control is a concrete, testable gap. If the proposed experiment shows high clean-model trigger accuracy, the central claim as framed would collapse; if it shows low accuracy, the paper's contribution is reinforced. The current CONDITIONAL verdict remains appropriate because the paper is otherwise substantial and the gap is addressable without redoing the core experiments. I therefore leave the verdict unchanged while sharpening the condition under which acceptance is justified.","tokens_in":23737,"tokens_out":3475,"duration_ms":32660,"concrete_test":"Train a clean ResNet-18 (and ViT-S) with the same pretraining hyperparameters on DTRAIN, fine-tune it on DFINETUNE at each of the three learning rates (1e-4, 5e-4, 1e-3), then retrain on DTRAIN for 30 epochs exactly as in Section IV-B2. Measure trigger accuracy on the same DWM used for the watermarked models (all four trigger types). If the clean model's trigger accuracy after retraining approaches the watermarked model's restored accuracy (e.g., within 20 percentage points, or above a pre-specified false-positive threshold), the ownership-verification claim fails. If it remains at or near chance level, the claim is supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim, as framed in the abstract and threat model (Section III-A), is that retraining on DTRAIN restores the watermark and that this enables ownership verification because 'trigger accuracy only improves in a previously marked model' (Section IV-B2). The paper shows that trigger accuracy rises for watermarked models in many configurations, but it never reports the trigger accuracy of a non-watermarked model subjected to the identical fine-tuning and retraining procedure. Without this control, the verification claim is not demonstrated: the observed increase could be an artifact of retraining itself, especially for trigger types such as FGSM or noise that may lie close to the training distribution. The assertion that only previously marked models benefit from retraining is exactly the premise that needs testing, yet no experiment measures it. This is more load-bearing than the acknowledged basin-of-attraction caveat because that caveat is explicit and partially probed via learning rate, whereas the missing control is unacknowledged and would, if it fails, invalidate the main application rather than merely narrow its regime.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper empirically evaluates the persistence of five backdoor-based watermarking schemes (Adi, ROWBACK, Certified, EWE, APP) against fine-tuning on CIFAR-10 and ViT/ResNet models, and proposes a data-driven restoration method: after fine-tuning erodes the watermark, retraining the model on the original clean training set DTRAIN can restore trigger accuracy without re-exposing the trigger set. The authors report restoration up to 100% for certain trigger types, analyze the mechanism via loss-landscape visualizations, propose blending DTRAIN into fine-tuning to reduce watermark vanishing, and show that retraining does not restore watermarks after model extraction. The main claim is that this restoration enables ownership verification because retraining improves trigger accuracy only in previously watermarked models.","tokens_in":24002,"tokens_out":3160,"duration_ms":34511,"significance":"If the central claim holds, the paper introduces a practical and previously unexplored route to watermark restoration in fine-tune-as-a-service settings, which would be valuable to the DNN watermarking community. The study is broad in coverage: five watermark schemes, two architectures, four trigger types, two labeling schemes, three fine-tuning learning rates, plus an extraction-attack control experiment. The release of code and the negative result for model extraction are useful contributions. The loss-landscape analysis, while qualitative, supports the proposed basin-of-attraction narrative. However, the load-bearing ownership-verification claim currently rests on a missing control condition and on single-run measurements, so the significance is conditional on additional experiments.","major_comments":[{"comment":"The ownership-verification claim requires that retraining improves trigger accuracy only in previously marked models, as stated in the threat model ('trigger accuracy only improves in a previously marked model') and in Section IV-B2. The experiments, however, never include a non-watermarked model subjected to the identical fine-tune-then-retrain pipeline. Without this control, the observed increase in trigger accuracy could be an artifact of retraining on data close to the trigger distribution, especially for FGSM or noise triggers. Please add control experiments with clean models for all trigger types and report their trigger accuracy before and after the same fine-tuning and retraining procedure; the restoration claim is only meaningful if the clean-model trigger accuracy remains at chance level throughout.","section":"Section IV-B2, Figure 7, Supplementary Figure 2, and Section III-A"},{"comment":"All experimental curves appear to be single runs: no error bars, no multiple seeds, and no confidence intervals are reported. Given that the trigger-accuracy curves are highly oscillatory (e.g., noise triggers in Figure 6 and Figure 7), claims such as 'trigger accuracy can be reinstated to up to 100%' and the qualitative ranking of schemes are not statistically supported. Please rerun at least the restoration experiments with multiple seeds and report means and standard deviations, or provide per-seed results in the supplementary material.","section":"Section IV-B2, Figures 6-9, Supplementary Figures 1-3"},{"comment":"The basin-of-attraction hypothesis is the mechanism invoked to explain restoration, but it is never directly tested. The paper uses the fine-tuning learning rate as a proxy for parameter shift, yet no measurement of the actual distance between the fine-tuned parameters and the original watermarked local minimum is provided. Please report a parameter-space distance (e.g., L2 or cosine distance between the fine-tuned and original checkpoints) for each configuration and show that restoration occurs precisely when this distance remains small; this would also explain why restoration fails for large fine-tuning learning rates.","section":"Section III-B and Section IV-B2"},{"comment":"The experiments only consider fine-tuning on a held-out partition of CIFAR-10, which is the same domain as the original training data. The threat model, however, involves an adversary fine-tuning the stolen model on their own data. No experiment uses an out-of-domain or genuinely different fine-tuning distribution, so the restoration phenomenon may not transfer to the claimed adversarial scenario. Please either add an experiment with a different fine-tuning dataset (e.g., a disjoint domain or a noisy/label-shifted variant) or explicitly restrict the claim to same-domain fine-tuning in both the abstract and the conclusion.","section":"Section III-A and Section IV-A"}],"minor_comments":[{"comment":"There are several typos, e.g., 'as the they are embedded' and 'and and' in the introduction, and 'watermaking' in Section II-B; a proofread pass is needed.","section":"Section I"},{"comment":"The indexing of DTRAIN in Algorithm 1 is unclear: the expression DTRAIN[(i/M):(i/M) + BT] uses a non-integer or ever-increasing offset that can exceed the dataset length unless M divides the epoch length. Please specify the indexing more carefully or rewrite the loop with a proper batch iterator.","section":"Supplementary Information, Algorithm 1"},{"comment":"In the Retrain row, the learning rate is listed as 'small: 1e-4, med: 2e-4, big: 2e-4', so the medium and large values are identical; this is likely a typo and should be corrected.","section":"Supplementary Information, Table I"},{"comment":"The text says that for ResNet-18 'the trigger accuracies increase with respect to all fine-tuning learning rates' but immediately notes that accuracies 'oscillate between low and high values for medium and big learning rates'; please reconcile this apparent inconsistency.","section":"Section IV-B2"},{"comment":"The paper notes that ROWBACK and EWE are not tested on ViT due to implementation limitations, but this is not listed in the limitations paragraph of the conclusion; please add a sentence acknowledging the incomplete architecture coverage.","section":"Section IV-A"}],"recommendation":"major_revision","confidential_remarks":"The paper is a solid empirical study with a novel restoration idea, but the missing non-watermarked control is a central gap that must be closed before the ownership-verification claim can be accepted. The single-run reporting and the unmeasured basin-of-attraction condition are also serious but fixable issues. I do not see evidence of unfair treatment of prior work; the ROWBACK self-citation is evaluated and reported as performing poorly, which is appropriate. The paper fits the journal's scope. If the authors can supply the control experiments, multi-seed statistics, and a direct parameter-distance measurement, I would be willing to reconsider favorably."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, the central empirical claim—that retraining a fine-tuned, watermarked model on the original clean training set can restore trigger accuracy—is genuinely new and mostly convincing. Gan et al. used a minimax optimization; this paper shows plain retraining works in many configurations, and the curves show the rise. Second, the paper's ownership-verification application rests on a control they never ran: they assert 'trigger accuracy only improves in a previously marked model,' but they never put a non-watermarked model through the same fine-tune-then-retrain pipeline. That gap is real and needs fixing.\n\nWhat I like: the evaluation is broad (five schemes, four trigger types, two architectures, two labeling schemes), the loss landscape analysis is a nice attempt to explain the mechanism, and the paper is honest about negative results—blending data doesn't help ViT, retraining doesn't help model extraction. They also ship code. No sign of curve-fitting to manufacture the restoration; the trends are measurements.\n\nSoft spots, in order. The missing control is the load-bearing one. If a clean model also gains trigger accuracy after retraining on its own data (plausible for noise or FGSM triggers), the verification test produces false positives. The extraction experiments (where retrained extracted models don't gain trigger accuracy) are indirect evidence, but not a substitute for the direct control. Second, there are no error bars or multiple seeds; the curves wiggle a lot, and some claims (e.g., 'up to 100%') rest on single runs. Third, the 'parameters do not shift dramatically' condition is never measured; learning rate is a proxy, not an actual parameter-distance metric. The paper acknowledges this, but it leaves the basin-of-attraction story as an untested hypothesis.\n\nOverall, the core phenomenon is plausible and interesting, and the paper is a useful contribution to the watermark-robustness literature. But the verification claim is overstated until the control is added. I'd send it to peer review with a request for that experiment plus repeated seeds. The audience is people working on DNN IP protection and watermark robustness; they'll get value even from the current version, but the revision will be the citable one.","headline":"Retraining-based watermark restoration is real and worth taking seriously, but the verification claim needs a non-watermarked control before it's publishable as stated.","tokens_in":24468,"tokens_out":4122,"would_cite":false,"duration_ms":37766,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Retraining a fine-tuned neural network on its original clean training set can restore a backdoor watermark — trigger accuracy returning to as high as 100 percent — as long as fine-tuning did not move the parameters far from the…","keywords":["backdoor watermark","neural network watermarking","fine-tuning attack","watermark persistence","watermark restoration","basin of attraction","loss landscape","model extraction"],"falsifier":"Fine-tune a watermarked model across a sweep of learning rates while recording the actual $L_2$ distance in weight space from the watermarked checkpoint, then retrain on $D_{TRAIN}$ and track trigger accuracy; if trigger accuracy fails to recover for a checkpoint measurably close to the watermarked minimum, or recovers for one measurably far away, the basin-of-attraction explanation is falsified. A more direct check is to plot the trigger-loss landscape and test whether the fine-tuned checkpoint lies in the same basin as the watermarked minimum by linearly interpolating between the two checkpoints and confirming that trigger loss does not spike along the interpolation path.","tokens_in":23572,"feed_emoji":"🧠","tokens_out":11606,"duration_ms":96689,"temperature":0.7,"pith_summary":"The paper argues that backdoor watermarks in neural networks survive fine-tuning far better than the recent watermark-removal literature suggests, and that an eroded watermark can often be resurrected without ever showing the secret trigger set again. Its central claim is that retraining a fine-tuned model on the original clean training set alone steers the parameters back into the basin of attraction of the watermarked local minimum, recovering trigger accuracy by up to 100 percent depending on trigger type. The authors support this with experiments spanning five watermarking schemes, two network architectures, four trigger types, and two labeling schemes, plus loss-landscape visualizations of the retraining trajectory. If the claim holds, a model owner whose stolen model was fine-tuned can verify ownership through a fine-tune-as-a-service API using only clean data, and authorized clients can fine-tune with blended clean data to keep the watermark alive.","feed_headline":"Clean-data retraining restores fine-tuned-away watermarks, up to 100%","feed_subtitle":"Owners can verify stolen models through a fine-tune-as-a-service API without ever revealing the secret trigger set.","key_machinery":"The basin of attraction of the watermarked local minimum in the network's loss landscape is the object that carries the argument. A watermarked model is optimized on $D_{TRAIN} \\cup D_{WM}$, so its local minimum jointly solves the clean task and the trigger task; fine-tuning on $D_{FINETUNE}$ moves the parameters around inside or near this basin, and retraining on $D_{TRAIN}$ alone follows steepest descent back to the minimum, restoring trigger accuracy without ever re-exposing $D_{WM}$. The paper supports this reading with filter-normalized loss contours and PCA-projected optimization trajectories, which show the retraining trajectory turning sharply toward regions of lower trigger loss.","core_discovery":"The paper's central claim is that the loss landscape of a watermarked network retains a usable memory of the watermark even after fine-tuning. Because the watermarked model was optimized on the union of the clean training set and the trigger set, its parameters sit in a local minimum whose basin encodes both tasks, and retraining on the clean task alone is enough to climb back to that minimum; trigger data are not needed. Fine-tuning on a similar-domain set erodes trigger accuracy, but when the fine-tuning learning rate is small enough that the parameters stay inside the basin, subsequent retraining on the original training set pulls them back toward the watermarked minimum. Empirically this restores trigger accuracy to up to 100 percent for noise and unrelated triggers, with unrelated out-of-distribution triggers the most consistently recoverable, while text-overlaid triggers that share features with clean images are the least recoverable. Retraining does not restore watermarks after model-extraction attacks because the extracted model occupies a different parameter-space geometry.","pith_inferences":["The paper uses the fine-tuning learning rate as a proxy for 'parameters did not shift dramatically,' but the load-bearing quantity is the actual parameter-space distance from the watermarked minimum; a practical follow-up would measure that distance and define a basin-radius criterion that predicts when restoration will succeed.","Read as a forensic tool, clean-data retraining plus trigger probing is a membership test: retraining should boost trigger accuracy for a marked model but not for an unmarked model of the same architecture, which would let an impartial verifier distinguish the two.","The basin-of-attraction picture suggests persistence can be engineered: trigger embedding schemes that encourage flat or wide minima on the joint clean-plus-trigger objective should make watermarks harder to erase by fine-tuning and easier to restore by retraining."],"forward_implications":["A model owner can verify ownership of a fine-tuned stolen model through a fine-tune-as-a-service API: retrain the suspected model on clean data, then probe it with secret triggers, without ever releasing the trigger set.","Watermark persistence under fine-tuning should be treated as a basin-retention question rather than a binary robustness property; removal attacks that use small learning rates leave watermarks recoverable and must be re-assessed.","Authorized clients can fine-tune under a predefined pipeline that mixes a portion of the owner's training data with their own data, alleviating watermark erosion without disclosing either party's private data.","Unrelated, out-of-distribution triggers are the most reliably restorable trigger type, while triggers that share features with clean data are the hardest to bring back; this should guide the design of future trigger sets.","Restoration fails for model-extraction attacks, so extraction-resistant schemes such as entangled trigger embeddings remain necessary."],"supporting_citations":[{"why":"First backdoor-based watermark scheme; one of the five methods whose persistence under fine-tuning is evaluated.","marker":"[8]"},{"why":"Prior work finding that fine-tuning removes most backdoor watermarks; the removal result this paper tests.","marker":"[9]"},{"why":"A unified watermark-removal framework based on fine-tuning with limited data; the strongest removal baseline the paper responds to.","marker":"[10]"},{"why":"Work arguing that fine-tuning alone is insufficient to remove backdoors; the contested claim this paper qualifies.","marker":"[11]"},{"why":"ROWBACK watermark with FGSM adversarial triggers and layer-wise embedding; one of the five evaluated schemes.","marker":"[18]"},{"why":"Certified watermark via randomized smoothing; one of the five evaluated schemes.","marker":"[20]"},{"why":"Entangled watermark embedding (EWE); evaluated scheme and the key comparison point for the model-extraction scenario.","marker":"[22]"},{"why":"Adversarial parametric perturbation (APP) watermark; one of the five evaluated schemes.","marker":"[23]"},{"why":"Benchmarks of catastrophic forgetting in neural networks; supplies the framing for why fine-tuning erases trigger behavior.","marker":"[34]"},{"why":"Loss-landscape visualization method (filter normalization plus PCA trajectories) used to trace the retraining path back to low trigger loss.","marker":"[40]"}],"fun_headline_variants":["Clean retraining resurrects fine-tuned-away watermarks","Watermark recovery after fine-tuning without trigger set","Backdoor watermarks persist: clean data restores them","Triggerless restoration: up to 100% accuracy after fine-tuning"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that after fine-tuning the model's parameters still lie within the basin of attraction of the original watermarked local minimum, so retraining on clean data alone can climb back to it; the paper never measures parameter shift directly and uses the fine-tuning learning rate as the only proxy.","fun_headline_variants_meta":{"raw":{"variants":["Clean retraining resurrects fine-tuned-away watermarks","Watermark recovery after fine-tuning without trigger set","Backdoor watermarks persist: clean data restores them","Triggerless restoration: up to 100% accuracy after fine-tuning"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000184,"raw_usage":{"total_tokens":1355,"prompt_tokens":1017,"completion_tokens":338,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":633,"completion_tokens_details":{"reasoning_tokens":270}},"tokens_in":633,"tokens_out":338,"duration_ms":3596,"temperature":1.0,"reasoning_tokens":270,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T22:06:51.688329+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Fine-tune a watermarked model across a sweep of learning rates while recording the actual $L_2$ distance in weight space from the watermarked checkpoint, then retrain on $D_{TRAIN}$ and track trigger accuracy; if trigger accuracy fails to recover for a checkpoint measurably close to the watermarked minimum, or recovers for one measurably far away, the basin-of-attraction explanation is falsified. A more direct check is to plot the trigger-loss landscape and test whether the fine-tuned checkpoint lies in the same basin as the watermarked minimum by linearly interpolating between the two checkpoints and confirming that trigger loss does not spike along the interpolation path.","supporting_citations":[{"cited_title":"Measuring catastrophic forgetting in neural networks,","cited_arxiv_id":null,"evidence_quote":"Benchmarks of catastrophic forgetting in neural networks; supplies the framing for why fine-tuning erases trigger behavior."},{"cited_title":"Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring,","cited_arxiv_id":null,"evidence_quote":"First backdoor-based watermark scheme; one of the five methods whose persistence under fine-tuning is evaluated."},{"cited_title":"On the Robustness of Backdoor-based Watermarking in Deep Neural Net- works,","cited_arxiv_id":null,"evidence_quote":"Prior work finding that fine-tuning removes most backdoor watermarks; the removal result this paper tests."},{"cited_title":"REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data,","cited_arxiv_id":null,"evidence_quote":"A unified watermark-removal framework based on fine-tuning with limited data; the strongest removal baseline the paper responds to."},{"cited_title":"Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks,","cited_arxiv_id":null,"evidence_quote":"Work arguing that fine-tuning alone is insufficient to remove backdoors; the contested claim this paper qualifies."},{"cited_title":"ROWBACK: RObust Wa- termarking for neural networks using BACKdoors,","cited_arxiv_id":null,"evidence_quote":"ROWBACK watermark with FGSM adversarial triggers and layer-wise embedding; one of the five evaluated schemes."},{"cited_title":"Entangled Watermarks as a Defense against Model Extraction,","cited_arxiv_id":null,"evidence_quote":"Entangled watermark embedding (EWE); evaluated scheme and the key comparison point for the model-extraction scenario."},{"cited_title":"Towards Robust Model Watermark via Reducing Parametric Vulnerability,","cited_arxiv_id":null,"evidence_quote":"Adversarial parametric perturbation (APP) watermark; one of the five evaluated schemes."},{"cited_title":"Persistence of Backdoor-based Watermarks for Neural Networks: A Comprehensive Evaluation","cited_arxiv_id":"2501.02704","evidence_quote":"Loss-landscape visualization method (filter normalization plus PCA trajectories) used to trace the retraining path back to low trigger loss."}],"review_version":1}