Turning Distillation against Obfuscation: A Recovery Framework for DNN White-Box Watermarks

Le résumé fourni par la source

White-box watermarking embeds ownership signatures directly into DNN parameters, yet it faces a critical blind spot: topology-altering obfuscation. By modifying a model’s internal structure while preserving its input-output behavior, an attacker can misalign the watermark from its expected parameter locations, causing standard white-box extractors to fail. We investigate whether existing white-box watermarks remain verifiable after such attacks by introducing Distillation-as-Defense: rather than reversing the obfuscation, we distill the obfuscated model (Teacher) into a student with the original architecture, forcing it to reconstruct the functional watermark representation. We systematically evaluate ten white-box watermarking schemes—eight static (weight-based) and two dynamic (activation-based)—across classifiers, generative models, and transformers. Dynamic methods consistently recover their watermarks under feature-map alignment distillation, while most static methods fail on deep architectures due to internal representation redundancy. These findings reveal that current white-box schemes were not designed with distillation robustness in mind. We conclude that resistance to distillation is a necessary condition for a white-box watermark to withstand topology-altering obfuscation, and we discuss a concrete design guidelines toward this goal.

Ce résumé expose les affirmations des auteurs. BNTIC ne l’interprète pas comme une validation indépendante des résultats.