ComMark: Covert and Robust Black-Box Model Watermarking with Compressed Samples

2025-12-16

AI Summary

Existing black-box watermarking methods for deep learning models struggle to simultaneously achieve imperceptibility (resistance to detection and forgery) and robustness (resistance to removal). This paper proposes the first frequency-domain compression-based watermarking framework tailored for black-box settings: it embeds imperceptible and removal-resistant watermarked samples in the input space via DCT/DFT transformation, high-frequency filtering, and adversarial simulation training. A similarity-driven loss function is designed to jointly optimize both objectives. Our method is the first to unify and enhance both imperceptibility and robustness under black-box constraints, supporting cross-modal tasks—including speech, text, generative modeling, and video. Extensive experiments across multiple datasets and model architectures demonstrate state-of-the-art performance: significantly improved imperceptibility and watermark detection rates exceeding 92% against prevalent removal attacks such as fine-tuning, knowledge distillation, and pruning.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods
• Graph Algorithms and Modeling for the Web: Graph embeddings and representation learning for Web-related graphs

Abstract

The rapid advancement of deep learning has turned models into highly valuable assets due to their reliance on massive data and costly training processes. However, these models are increasingly vulnerable to leakage and theft, highlighting the critical need for robust intellectual property protection. Model watermarking has emerged as an effective solution, with black-box watermarking gaining significant attention for its practicality and flexibility. Nonetheless, existing black-box methods often fail to better balance covertness (hiding the watermark to prevent detection and forgery) and robustness (ensuring the watermark resists removal)-two essential properties for real-world copyright verification. In this paper, we propose ComMark, a novel black-box model watermarking framework that leverages frequency-domain transformations to generate compressed, covert, and attack-resistant watermark samples by filtering out high-frequency information. To further enhance watermark robustness, our method incorporates simulated attack scenarios and a similarity loss during training. Comprehensive evaluations across diverse datasets and architectures demonstrate that ComMark achieves state-of-the-art performance in both covertness and robustness. Furthermore, we extend its applicability beyond image recognition to tasks including speech recognition, sentiment analysis, image generation, image captioning, and video recognition, underscoring its versatility and broad applicability.

Problem

• Balances covertness and robustness in black-box model watermarking
• Generates compressed, attack-resistant watermark samples using frequency-domain transformations
• Extends watermarking applicability to various tasks beyond image recognition

Innovation

• Uses frequency-domain transformations for compressed samples
• Incorporates simulated attacks and similarity loss training
• Extends applicability to multiple tasks beyond image recognition