Robust Client-Server Watermarking for Split Federated Learning

TL;DR

This paper introduces RISE, a novel watermarking scheme for split federated learning that enables both clients and servers to verify model ownership without mutual interference, ensuring robustness and high detection rates.

Contribution

RISE is the first asymmetric client-server watermarking method for SFL, embedding watermarks on both sides to protect intellectual property effectively.

Findings

Achieves over 95% watermark detection rate in experiments.

No mutual interference between client- and server-side watermarks.

Robust against common removal attacks.

Abstract

Split Federated Learning (SFL) is renowned for its privacy-preserving nature and low computational overhead among decentralized machine learning paradigms. In this framework, clients employ lightweight models to process private data locally and transmit intermediate outputs to a powerful server for further computation. However, SFL is a double-edged sword: while it enables edge computing and enhances privacy, it also introduces intellectual property ambiguity as both clients and the server jointly contribute to training. Existing watermarking techniques fail to protect both sides since no single participant possesses the complete model. To address this, we propose RISE, a Robust model Intellectual property protection scheme using client-Server watermark Embedding for SFL. Specifically, RISE adopts an asymmetric client-server watermarking design: the server embeds feature-based watermarks through a loss regularization term, while clients embed backdoor-based watermarks by injecting predefined trigger samples into private datasets. This co-embedding strategy enables both clients and the server to verify model ownership. Experimental results on standard datasets and multiple network architectures show that RISE achieves over $95\%$ watermark detection rate ($p-value \lt 0.03$) across most settings. It exhibits no mutual interference between client- and server-side watermarks and remains robust against common removal attacks.