New approach to machine learning watermarking balances ownership verification with model performance

Machine learning models are computationally expensive and valuable intellectual property, yet protecting ownership has remained a persistent challenge. A new study published on arXiv examines how to verify a model's true owner using watermarking techniques while maintaining its practical utility.

The core problem#

Model watermarking—a method to embed hidden ownership signals into a machine learning system—has become an important tool for intellectual property protection in black-box settings, where only the model's predictions are visible. However, current methods face a fundamental limitation: adding robust ownership markers tends to degrade the model's accuracy on actual tasks. This creates a trade-off between two competing goals: strong verification and reliable performance.

An information-theoretic insight#

The researchers approached this problem through the lens of information theory and identified what they call a capacity crisis. When watermarking relies solely on a model's final predicted label (a single output category), there isn't enough "room" in that signal to embed secure ownership information without hurting accuracy. It's essentially a bottleneck: one output slot can't simultaneously carry both the original task data and robust watermark data.

A richer approach#

To address this constraint, the team proposes leveraging the top-k output—not just the single predicted class, but the model's ranked list of candidates with their confidence scores. This expanded output space provides more capacity for encoding ownership markers while keeping the primary predictions intact. By distributing the watermark across multiple output positions rather than embedding it into the single top prediction, the method preserves predictive performance while increasing robustness to tampering.

Validation across domains#

The authors tested their framework on three distinct data types: images, text, and tabular data. Their results show that the approach achieves a more favorable balance between robustness and accuracy than competing methods, while remaining practical for deployment in real-world systems.