Pith. sign in

REVIEW 4 major objections 5 minor 40 references

Persistence of Backdoor-based Watermarks for Neural Networks: A Comprehensive Evaluation

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Retraining a fine-tuned neural network on its original clean training set can restore a backdoor watermark — trigger accuracy returning to as high as 100 percent — as long as fine-tuning did not move the parameters far from the…

desk verdict Retraining-based watermark restoration is real and worth taking seriously, but the verification claim needs a non-watermarked control before it's publishable as stated. read the letter →

arxiv 2501.02704 v3 pith:QVCLUOMT submitted 2025-01-06 cs.LG cs.CRcs.MM

Anh Tu Ngo , Chuan Song Heng , Nandish Chattopadhyay , Anupam Chattopadhyay This is my paper · ORCID
classification cs.LGcs.CRcs.MM
keywords backdoorwatermarkneuralnetworkwatermarkingfine-tuningattackpersistencerestorationbasinofattractionlosslandscapemodelextraction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that backdoor watermarks in neural networks survive fine-tuning far better than the recent watermark-removal literature suggests, and that an eroded watermark can often be resurrected without ever showing the secret trigger set again. Its central claim is that retraining a fine-tuned model on the original clean training set alone steers the parameters back into the basin of attraction of the watermarked local minimum, recovering trigger accuracy by up to 100 percent depending on trigger type. The authors support this with experiments spanning five watermarking schemes, two network architectures, four trigger types, and two labeling schemes, plus loss-landscape visualizations of the retraining trajectory. If the claim holds, a model owner whose stolen model was fine-tuned can verify ownership through a fine-tune-as-a-service API using only clean data, and authorized clients can fine-tune with blended clean data to keep the watermark alive.

What carries the argument

The basin of attraction of the watermarked local minimum in the network's loss landscape is the object that carries the argument. A watermarked model is optimized on $D_{TRAIN} \cup D_{WM}$, so its local minimum jointly solves the clean task and the trigger task; fine-tuning on $D_{FINETUNE}$ moves the parameters around inside or near this basin, and retraining on $D_{TRAIN}$ alone follows steepest descent back to the minimum, restoring trigger accuracy without ever re-exposing $D_{WM}$. The paper supports this reading with filter-normalized loss contours and PCA-projected optimization trajectories, which show the retraining trajectory turning sharply toward regions of lower trigger loss.

What would settle it

Fine-tune a watermarked model across a sweep of learning rates while recording the actual $L_2$ distance in weight space from the watermarked checkpoint, then retrain on $D_{TRAIN}$ and track trigger accuracy; if trigger accuracy fails to recover for a checkpoint measurably close to the watermarked minimum, or recovers for one measurably far away, the basin-of-attraction explanation is falsified. A more direct check is to plot the trigger-loss landscape and test whether the fine-tuned checkpoint lies in the same basin as the watermarked minimum by linearly interpolating between the two checkpoints and confirming that trigger loss does not spike along the interpolation path.

Watch

Extended reading notes

Core claim

The paper's central claim is that the loss landscape of a watermarked network retains a usable memory of the watermark even after fine-tuning. Because the watermarked model was optimized on the union of the clean training set and the trigger set, its parameters sit in a local minimum whose basin encodes both tasks, and retraining on the clean task alone is enough to climb back to that minimum; trigger data are not needed. Fine-tuning on a similar-domain set erodes trigger accuracy, but when the fine-tuning learning rate is small enough that the parameters stay inside the basin, subsequent retraining on the original training set pulls them back toward the watermarked minimum. Empirically this restores trigger accuracy to up to 100 percent for noise and unrelated triggers, with unrelated out-of-distribution triggers the most consistently recoverable, while text-overlaid triggers that share features with clean images are the least recoverable. Retraining does not restore watermarks after model-extraction attacks because the extracted model occupies a different parameter-space geometry.

Load-bearing premise

The load-bearing premise is that after fine-tuning the model's parameters still lie within the basin of attraction of the original watermarked local minimum, so retraining on clean data alone can climb back to it; the paper never measures parameter shift directly and uses the fine-tuning learning rate as the only proxy.

Editorial extensions

If this is right

  • A model owner can verify ownership of a fine-tuned stolen model through a fine-tune-as-a-service API: retrain the suspected model on clean data, then probe it with secret triggers, without ever releasing the trigger set.
  • Watermark persistence under fine-tuning should be treated as a basin-retention question rather than a binary robustness property; removal attacks that use small learning rates leave watermarks recoverable and must be re-assessed.
  • Authorized clients can fine-tune under a predefined pipeline that mixes a portion of the owner's training data with their own data, alleviating watermark erosion without disclosing either party's private data.
  • Unrelated, out-of-distribution triggers are the most reliably restorable trigger type, while triggers that share features with clean data are the hardest to bring back; this should guide the design of future trigger sets.
  • Restoration fails for model-extraction attacks, so extraction-resistant schemes such as entangled trigger embeddings remain necessary.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper uses the fine-tuning learning rate as a proxy for 'parameters did not shift dramatically,' but the load-bearing quantity is the actual parameter-space distance from the watermarked minimum; a practical follow-up would measure that distance and define a basin-radius criterion that predicts when restoration will succeed.
  • Read as a forensic tool, clean-data retraining plus trigger probing is a membership test: retraining should boost trigger accuracy for a marked model but not for an unmarked model of the same architecture, which would let an impartial verifier distinguish the two.
  • The basin-of-attraction picture suggests persistence can be engineered: trigger embedding schemes that encourage flat or wide minima on the joint clean-plus-trigger objective should make watermarks harder to erase by fine-tuning and easier to restore by retraining.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper empirically evaluates the persistence of five backdoor-based watermarking schemes (Adi, ROWBACK, Certified, EWE, APP) against fine-tuning on CIFAR-10 and ViT/ResNet models, and proposes a data-driven restoration method: after fine-tuning erodes the watermark, retraining the model on the original clean training set DTRAIN can restore trigger accuracy without re-exposing the trigger set. The authors report restoration up to 100% for certain trigger types, analyze the mechanism via loss-landscape visualizations, propose blending DTRAIN into fine-tuning to reduce watermark vanishing, and show that retraining does not restore watermarks after model extraction. The main claim is that this restoration enables ownership verification because retraining improves trigger accuracy only in previously watermarked models.

Significance. If the central claim holds, the paper introduces a practical and previously unexplored route to watermark restoration in fine-tune-as-a-service settings, which would be valuable to the DNN watermarking community. The study is broad in coverage: five watermark schemes, two architectures, four trigger types, two labeling schemes, three fine-tuning learning rates, plus an extraction-attack control experiment. The release of code and the negative result for model extraction are useful contributions. The loss-landscape analysis, while qualitative, supports the proposed basin-of-attraction narrative. However, the load-bearing ownership-verification claim currently rests on a missing control condition and on single-run measurements, so the significance is conditional on additional experiments.

major comments (4)
  1. [Section IV-B2, Figure 7, Supplementary Figure 2, and Section III-A] The ownership-verification claim requires that retraining improves trigger accuracy only in previously marked models, as stated in the threat model ('trigger accuracy only improves in a previously marked model') and in Section IV-B2. The experiments, however, never include a non-watermarked model subjected to the identical fine-tune-then-retrain pipeline. Without this control, the observed increase in trigger accuracy could be an artifact of retraining on data close to the trigger distribution, especially for FGSM or noise triggers. Please add control experiments with clean models for all trigger types and report their trigger accuracy before and after the same fine-tuning and retraining procedure; the restoration claim is only meaningful if the clean-model trigger accuracy remains at chance level throughout.
  2. [Section IV-B2, Figures 6-9, Supplementary Figures 1-3] All experimental curves appear to be single runs: no error bars, no multiple seeds, and no confidence intervals are reported. Given that the trigger-accuracy curves are highly oscillatory (e.g., noise triggers in Figure 6 and Figure 7), claims such as 'trigger accuracy can be reinstated to up to 100%' and the qualitative ranking of schemes are not statistically supported. Please rerun at least the restoration experiments with multiple seeds and report means and standard deviations, or provide per-seed results in the supplementary material.
  3. [Section III-B and Section IV-B2] The basin-of-attraction hypothesis is the mechanism invoked to explain restoration, but it is never directly tested. The paper uses the fine-tuning learning rate as a proxy for parameter shift, yet no measurement of the actual distance between the fine-tuned parameters and the original watermarked local minimum is provided. Please report a parameter-space distance (e.g., L2 or cosine distance between the fine-tuned and original checkpoints) for each configuration and show that restoration occurs precisely when this distance remains small; this would also explain why restoration fails for large fine-tuning learning rates.
  4. [Section III-A and Section IV-A] The experiments only consider fine-tuning on a held-out partition of CIFAR-10, which is the same domain as the original training data. The threat model, however, involves an adversary fine-tuning the stolen model on their own data. No experiment uses an out-of-domain or genuinely different fine-tuning distribution, so the restoration phenomenon may not transfer to the claimed adversarial scenario. Please either add an experiment with a different fine-tuning dataset (e.g., a disjoint domain or a noisy/label-shifted variant) or explicitly restrict the claim to same-domain fine-tuning in both the abstract and the conclusion.
minor comments (5)
  1. [Section I] There are several typos, e.g., 'as the they are embedded' and 'and and' in the introduction, and 'watermaking' in Section II-B; a proofread pass is needed.
  2. [Supplementary Information, Algorithm 1] The indexing of DTRAIN in Algorithm 1 is unclear: the expression DTRAIN[(i/M):(i/M) + BT] uses a non-integer or ever-increasing offset that can exceed the dataset length unless M divides the epoch length. Please specify the indexing more carefully or rewrite the loop with a proper batch iterator.
  3. [Supplementary Information, Table I] In the Retrain row, the learning rate is listed as 'small: 1e-4, med: 2e-4, big: 2e-4', so the medium and large values are identical; this is likely a typo and should be corrected.
  4. [Section IV-B2] The text says that for ResNet-18 'the trigger accuracies increase with respect to all fine-tuning learning rates' but immediately notes that accuracies 'oscillate between low and high values for medium and big learning rates'; please reconcile this apparent inconsistency.
  5. [Section IV-A] The paper notes that ROWBACK and EWE are not tested on ViT due to implementation limitations, but this is not listed in the limitations paragraph of the conclusion; please add a sentence acknowledging the incomplete architecture coverage.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: watermark restoration is reported as an empirical measurement, not derived from fitted inputs or self-citation.

full rationale

The paper's watermark restoration claim is an empirical finding rather than a derivation from the watermark definition. The trigger accuracy curves in Figure 7 and Supplementary Figure 2 are direct measurements obtained by applying a fixed retraining protocol (30 epochs, Adam, learning rates listed in Supplementary Table I); no parameter is fitted to the restoration outcome, and no 'prediction' is defined in terms of the data used to produce it. The basin-of-attraction explanation is presented as a post-hoc hypothesis and is explicitly hedged by the 'if model parameters do not shift dramatically' caveat, which the paper probes via fine-tuning learning rate. The only self-citation is ROWBACK, which is used as one of five watermark schemes under evaluation and is reported to perform poorly, so it is not load-bearing for the restoration claim. The absence of a non-watermarked control in Section IV-B2 is a legitimate experimental concern about the ownership-verification interpretation, but it is a question of completeness and not circularity: the paper does not define the restoration result in terms of the claim being tested. No step in the derivation chain reduces, by construction or by self-citation, to its own inputs.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The restoration claim rests on an unmeasured basin-of-attraction assumption and a threat model with API fine-tuning; no parameters are fitted to data, but several experimental choices (mixing interval, learning rates, retraining epochs) are hand-picked and not the subject of sensitivity analysis.

free parameters (2)
  • Data mixing interval M in Algorithm 1 = 2
    One batch of 256 training samples is inserted after every two fine-tuning batches. This hand-chosen value is not varied in a sensitivity analysis, so the blending benefit may depend on it.
  • Fine-tuning learning rates = 1e-4, 5e-4, 1e-3
    Three learning rates are used as proxies for small, medium, and large parameter shift. The 'parameters do not shift dramatically' condition is operationalized only through these values.
assumptions (5)
  • domain assumption DTRAIN and DFINETUNE are similar in domain
    Stated in Section III-A; needed so that fine-tuning does not require reconfiguring layers and the watermark can be evaluated on all layers.
  • ad hoc to paper Basin of attraction hypothesis: retraining on DTRAIN alone pulls parameters back to the local minimum optimized for DTRAIN union DWM
    Section III-B; this is the mechanism behind the restoration claim, presented as intuition and supported only by loss landscape visualizations.
  • domain assumption Adversary fine-tunes the stolen model on data similar to the original task, with access via fine-tune-as-a-service
    Section III-A threat model; this scenario makes the restoration procedure practical but restricts the generality of the claim.
  • ad hoc to paper Parameter shift is small when fine-tuning learning rate is small, with no direct distance measurement
    Section IV-B2 and key findings; the central 'does not shift dramatically' condition is operationalized only through learning rate.
  • domain assumption Loss landscape visualizations approximate the true optimization trajectory
    Section IV-B2; the paper relies on filter normalization and PCA, and admits early checkpoints are inaccurate.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Persistence of Backdoor-based Watermarks for Neural Networks: A Comprehensive Evaluation." pith.science (2026). https://pith.science/paper/QVCLUOMT

@misc{pith2026250102704,
  author       = {Pith},
  title        = {Pith review of: Persistence of Backdoor-based Watermarks for Neural Networks: A Comprehensive Evaluation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QVCLUOMT}},
  note         = {Machine review of arXiv:2501.02704}
}
read the original abstract

Deep Neural Networks (DNNs) have gained considerable traction in recent years due to the unparalleled results they gathered. However, the cost behind training such sophisticated models is resource intensive, resulting in many to consider DNNs to be intellectual property (IP) to model owners. In this era of cloud computing, high-performance DNNs are often deployed all over the internet so that people can access them publicly. As such, DNN watermarking schemes, especially backdoor-based watermarks, have been actively developed in recent years to preserve proprietary rights. Nonetheless, there lies much uncertainty on the robustness of existing backdoor watermark schemes, towards both adversarial attacks and unintended means such as fine-tuning neural network models. One reason for this is that no complete guarantee of robustness can be assured in the context of backdoor-based watermark. In this paper, we extensively evaluate the persistence of recent backdoor-based watermarks within neural networks in the scenario of fine-tuning, we propose/develop a novel data-driven idea to restore watermark after fine-tuning without exposing the trigger set. Our empirical results show that by solely introducing training data after fine-tuning, the watermark can be restored if model parameters do not shift dramatically during fine-tuning. Depending on the types of trigger samples used, trigger accuracy can be reinstated to up to 100%. Our study further explores how the restoration process works using loss landscape visualization, as well as the idea of introducing training data in fine-tuning stage to alleviate watermark vanishing.

Figures

Figures reproduced from arXiv: 2501.02704 by the authors.

Figure 1
Figure 1. Intellectual property theft of deep neural networks [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Trilemma between persistence, capacity and fidelity [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Watermark restoration after fine-tuning attack - the [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Model fine-tuning with blending between owner’s [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Types of trigger images ROWBACK [18], certified watermark [20], entangled wa￾termark (EWE) [22] and adversarial parametric perturbation (APP) [23] to fine-tuning attack. We choose these schemes to include in our experiments because they well reflect the advancement of …
Figure 6
Figure 6. Figure 6: Trigger accuracy during fine-tuning (ResNet set DTRAIN. Furthermore, we use loss landscape analysis to investigate the optimization trajectory of model parameters in such scenarios. And finally, our final experiment is about in￾corporating the original training data in…
Figure 7
Figure 7. Figure 7: Trigger accuracy during retraining (ResNet) mitigate the risk of leaking owner’s secret key and client’s proprietary data. After fine-tuning and having the watermark degraded, we re￾train the model with the initial training set DTRAIN. The models are trained for 30 epo…
Figure 8
Figure 8. Figure 8: Loss landscape visualization for fine-tuning attack (ResNet) - The contours illustrate trigger loss, orange lines are the fine-tuning phase while blue lines represent retraining. It is observable that retraining helps steering the trajectory back to near the local mini…
Figure 9
Figure 9. Figure 9: Comparison of trigger accuracies between mixing and without mixing of training data DTRAIN (ResNet) embedding (EWE) as a watermark scheme resistant to extrac￾tion attack by enforcing entanglement between trigger samples and the main task samples. With this technique, a…
Figure 1
Figure 1. Figure 1: Trigger accuracy during fine-tuning of ViT models [PITH_FULL_IMAGE:figures/full_fig_p016_1.png]
Figure 2
Figure 2. Figure 2: Trigger accuracy during retraining of ViT models [PITH_FULL_IMAGE:figures/full_fig_p017_2.png]
Figure 3
Figure 3. Figure 3: Comparison of trigger accuracies between mixing and without mixing of training data DTRAIN (ViT) [PITH_FULL_IMAGE:figures/full_fig_p018_3.png]
Figure 4
Figure 4. Figure 4: Trigger accuracy during retraining of extracted models [PITH_FULL_IMAGE:figures/full_fig_p019_4.png]
Figure 5
Figure 5. Figure 5: Loss landscape visualization for model extraction (ResNet) - The contours illustrate trigger loss, orange lines depict a few last epochs of extraction phase while blue lines represent retraining. It can be seen that the trajectories during retraining do not turn as sha…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 34 canonical work pages

  1. [1]

    Attention is All you Need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. ukasz Kaiser, and I. Polosukhin, “Attention is All you Need,” in Advances in Neural Information Processing Systems , vol. 30. Curran Associates, Inc., 2017

    work page 2017

  2. [2]

    Language Models are Few-Shot Learners,

    T. Brown, B. Mann, N. Ryder, M. Subbiah, J. D. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, S. Agarwal, A. Herbert- V oss, G. Krueger, T. Henighan, R. Child, A. Ramesh, D. Ziegler, J. Wu, C. Winter, C. Hesse, M. Chen, E. Sigler, M. Litwin, S. Gray, B. Chess, J. Clark, C. Berner, S. McCandlish, A. Radford, I. Sutskever, and D. Amode...

    2020

  3. [3]

    GPT-4 Technical Report,

    OpenAI, “GPT-4 Technical Report,” Mar. 2024

    work page 2024

  4. [4]

    LaMDA: Language Models for Dialog Applica- tions,

    R. Thoppilan et al. , “LaMDA: Language Models for Dialog Applica- tions,” Feb. 2022

    work page 2022

  5. [5]

    PaLM 2 Technical Report,

    R. Anil et al., “PaLM 2 Technical Report,” Sep. 2023

    work page 2023

  6. [6]

    MLaaS: Machine Learning as a Service,

    M. Ribeiro, K. Grolinger, and M. A. Capretz, “MLaaS: Machine Learning as a Service,” in 2015 IEEE 14th International Conference on Machine Learning and Applications (ICMLA) , Dec. 2015, pp. 896– 902

    work page 2015

  7. [7]

    Embedding Water- marks into Deep Neural Networks,

    Y . Uchida, Y . Nagai, S. Sakazawa, and S. Satoh, “Embedding Water- marks into Deep Neural Networks,” in Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval , ser. ICMR ’17. New York, NY , USA: Association for Computing Machinery, Jun. 2017, pp. 269–277

    work page 2017

  8. [8]

    Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring,

    Y . Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring,” in 27th USENIX Security Symposium (USENIX Security 18), 2018, pp. 1615–1631

    work page 2018

Show all 40 references
  1. [9]

    On the Robustness of Backdoor-based Watermarking in Deep Neural Net- works,

    M. Shafieinejad, N. Lukas, J. Wang, X. Li, and F. Kerschbaum, “On the Robustness of Backdoor-based Watermarking in Deep Neural Net- works,” in Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security, ser. IH&MMSec ’21. New York, NY , USA: Associa...

    2021

  2. [10]

    REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data,

    X. Chen, W. Wang, C. Bender, Y . Ding, R. Jia, B. Li, and D. Song, “REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data,” in Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security, ser. ASIA CCS ’21. New York, N...

    2021

  3. [11]

    Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks,

    K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks,” in Research in Attacks, Intrusions, and Defenses, M. Bailey, T. Holz, M. Stamatogiannakis, and S. Ioannidis, Eds. Cham: Springer International Publishing, 2018,...

    2018

  4. [12]

    A survey of Deep Neural Network watermarking techniques,

    Y . Li, H. Wang, and M. Barni, “A survey of Deep Neural Network watermarking techniques,” Neurocomputing, vol. 461, pp. 171–193, Oct. 2021

    2021

  5. [13]

    DeepSigns: An End- to-End Watermarking Framework for Ownership Protection of Deep Neural Networks,

    B. Darvish Rouhani, H. Chen, and F. Koushanfar, “DeepSigns: An End- to-End Watermarking Framework for Ownership Protection of Deep Neural Networks,” in Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Sy...

    2019

  6. [14]

    BadNets: Evaluating Backdooring Attacks on Deep Neural Networks,

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “BadNets: Evaluating Backdooring Attacks on Deep Neural Networks,” IEEE Access, vol. 7, pp. 47 230–47 244, 2019

    2019

  7. [15]

    Backdoor Learning: A Survey,

    Y . Li, Y . Jiang, Z. Li, and S.-T. Xia, “Backdoor Learning: A Survey,” IEEE Transactions on Neural Networks and Learning Systems , vol. 35, no. 1, pp. 5–22, Jan. 2024

    2024

  8. [16]

    Protecting Intellectual Property of Deep Neural Networks with Watermarking,

    J. Zhang, Z. Gu, J. Jang, H. Wu, M. P. Stoecklin, H. Huang, and I. Molloy, “Protecting Intellectual Property of Deep Neural Networks with Watermarking,” in Proceedings of the 2018 on Asia Conference on Computer and Communications Security , ser. ASIACCS ’18. New York, NY , USA...

    2018

  9. [17]

    Adversarial frontier stitching for remote neural network watermarking,

    E. Le Merrer, P. P ´erez, and G. Tr ´edan, “Adversarial frontier stitching for remote neural network watermarking,” Neural Computing and Ap- plications, vol. 32, no. 13, pp. 9233–9244, Jul. 2020

    2020

  10. [18]

    ROWBACK: RObust Wa- termarking for neural networks using BACKdoors,

    N. Chattopadhyay and A. Chattopadhyay, “ROWBACK: RObust Wa- termarking for neural networks using BACKdoors,” in 2021 20th IEEE International Conference on Machine Learning and Applications (ICMLA), Dec. 2021, pp. 1728–1735

    2021

  11. [19]

    Explaining and Harnessing Adversarial Examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and Harnessing Adversarial Examples,” in 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, Y . Bengio and Y . LeCun, Eds., 2015

    2015

  12. [20]

    Certified neural network watermarks with randomized smoothing,

    A. Bansal, P.-y. Chiang, M. J. Curry, R. Jain, C. Wigington, V . Man- junatha, J. P. Dickerson, and T. Goldstein, “Certified neural network watermarks with randomized smoothing,” in International Conference on Machine Learning . PMLR, 2022, pp. 1450–1465

    2022

  13. [21]

    Dimension-independent Certified Neural Network Watermarks via Mollifier Smoothing,

    J. Ren, Y . Zhou, J. Jin, L. Lyu, and D. Yan, “Dimension-independent Certified Neural Network Watermarks via Mollifier Smoothing,” in Proceedings of the 40th International Conference on Machine Learning . PMLR, Jul. 2023, pp. 28 976–29 008

    2023

  14. [22]

    Entangled Watermarks as a Defense against Model Extraction,

    H. Jia, C. A. Choquette-Choo, V . Chandrasekaran, and N. Papernot, “Entangled Watermarks as a Defense against Model Extraction,” in 30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 1937– 1954

    2021

  15. [23]

    Towards Robust Model Watermark via Reducing Parametric Vulnerability,

    G. Gan, Y . Li, D. Wu, and S.-T. Xia, “Towards Robust Model Watermark via Reducing Parametric Vulnerability,” in2023 IEEE/CVF International Conference on Computer Vision (ICCV) , Oct. 2023, pp. 4728–4738

    2023

  16. [24]

    Free Fine-tuning: A Plug-and-Play Watermarking Scheme for Deep Neural Networks,

    R. Wang, J. Ren, B. Li, T. She, W. Zhang, L. Fang, J. Chen, and L. Wang, “Free Fine-tuning: A Plug-and-Play Watermarking Scheme for Deep Neural Networks,” in Proceedings of the 31st ACM International Conference on Multimedia , ser. MM ’23. New York, NY , USA: Association for C...

    2023

  17. [25]

    Cosine Model Watermarking against Ensemble Distillation,

    L. Charette, L. Chu, Y . Chen, J. Pei, L. Wang, and Y . Zhang, “Cosine Model Watermarking against Ensemble Distillation,” Proceedings of the AAAI Conference on Artificial Intelligence , vol. 36, no. 9, pp. 9512– 9520, Jun. 2022

    2022

  18. [26]

    Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copy- right Protection,

    Y . Li, Y . Bai, Y . Jiang, Y . Yang, S.-T. Xia, and B. Li, “Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copy- right Protection,” Advances in Neural Information Processing Systems , vol. 35, pp. 13 238–13 250, Dec. 2022

    2022

  19. [27]

    Unambiguous and High- Fidelity Backdoor Watermarking for Deep Neural Networks,

    G. Hua, A. B. J. Teoh, Y . Xiang, and H. Jiang, “Unambiguous and High- Fidelity Backdoor Watermarking for Deep Neural Networks,” IEEE Transactions on Neural Networks and Learning Systems , vol. 35, no. 8, pp. 11 204–11 217, Aug. 2024

    2024

  20. [28]

    Watermarking Deep Neural Networks in Image Processing,

    Y . Quan, H. Teng, Y . Chen, and H. Ji, “Watermarking Deep Neural Networks in Image Processing,” IEEE Transactions on Neural Networks and Learning Systems , vol. 32, no. 5, pp. 1852–1865, May 2021

    2021

  21. [29]

    A Black-Box Watermarking Modulation for Object Detection Models,

    M. Lansari, L. Mattioli, B. Addad, P.-M. Raffi, K. Kapusta, M. Gonzalez, and M. I. Khedher, “A Black-Box Watermarking Modulation for Object Detection Models,” Proceedings of the AAAI Symposium Series , vol. 4, no. 1, pp. 60–67, Nov. 2024

    2024

  22. [30]

    Catastrophic Interference in Connec- tionist Networks: The Sequential Learning Problem,

    M. McCloskey and N. J. Cohen, “Catastrophic Interference in Connec- tionist Networks: The Sequential Learning Problem,” in Psychology of Learning and Motivation, G. H. Bower, Ed. Academic Press, Jan. 1989, vol. 24, pp. 109–165

    1989

  23. [31]

    Compete to Compute,

    R. K. Srivastava, J. Masci, S. Kazerounian, F. Gomez, and J. Schmid- huber, “Compete to Compute,” in Advances in Neural Information Processing Systems, vol. 26. Curran Associates, Inc., 2013

    2013

  24. [32]

    Overcoming catastrophic forgetting in neural networks,

    J. Kirkpatrick, R. Pascanu, N. Rabinowitz, J. Veness, G. Desjardins, A. A. Rusu, K. Milan, J. Quan, T. Ramalho, A. Grabska-Barwinska, D. Hassabis, C. Clopath, D. Kumaran, and R. Hadsell, “Overcoming catastrophic forgetting in neural networks,” Proceedings of the National Acade...

    2017

  25. [33]

    Ensemble Learning in Fixed Ex- pansion Layer Networks for Mitigating Catastrophic Forgetting,

    R. Coop, A. Mishtal, and I. Arel, “Ensemble Learning in Fixed Ex- pansion Layer Networks for Mitigating Catastrophic Forgetting,” IEEE Transactions on Neural Networks and Learning Systems, vol. 24, no. 10, pp. 1623–1634, Oct. 2013

    2013

  26. [34]

    Measuring catastrophic forgetting in neural networks,

    R. Kemker, M. McClure, A. Abitino, T. L. Hayes, and C. Kanan, “Measuring catastrophic forgetting in neural networks,” in Proceedings of the Thirty-Second AAAI Conference on Artificial Intelligence and Thirtieth Innovative Applications of Artificial Intelligence Conference and ...

    2018

  27. [35]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, “Learning multiple layers of features from tiny images,” Tech. Rep., 2009

    2009

  28. [36]

    Reading digits in natural images with unsupervised feature learning,

    Y . Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, and A. Y . Ng, “Reading digits in natural images with unsupervised feature learning,” in NIPS Workshop on Deep Learning and Unsupervised Feature Learning 2011 , 2011. [Online]. Available: http://ufldl.stanford.edu/housenumber...

    2011

  29. [37]

    Deep Residual Learning for Image Recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep Residual Learning for Image Recognition,” in 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). Las Vegas, NV , USA: IEEE, Jun. 2016, pp. 770–778

    2016

  30. [38]

    An Image is Worth 16x16 Words: Trans- formers for Image Recognition at Scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An Image is Worth 16x16 Words: Trans- formers for Image Recognition at Scale,” in International Conference on Learni...

    2020

  31. [39]

    SoK: How Robust is Image Classification Deep Neural Network Watermarking?

    N. Lukas, E. Jiang, X. Li, and F. Kerschbaum, “SoK: How Robust is Image Classification Deep Neural Network Watermarking?” in 2022 IEEE Symposium on Security and Privacy (SP) . San Francisco, CA, USA: IEEE, May 2022, pp. 787–804

    2022

  32. [40]

    Visualizing the Loss Landscape of Neural Nets,

    H. Li, Z. Xu, G. Taylor, C. Studer, and T. Goldstein, “Visualizing the Loss Landscape of Neural Nets,” in Advances in Neural Information Processing Systems, vol. 31. Curran Associates, Inc., 2018. IEEE TRANSACTIONS ON NEURAL NETWORKS AND LEARNING SYSTEMS 1 Persistence of Backd...

    2018 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.