ComMark: Covert and Robust Black-Box Model Watermarking with Compressed Samples

TL;DR

ComMark is a novel black-box model watermarking framework that uses frequency-domain transformations and compressed samples to achieve high covertness and robustness across various AI tasks.

Contribution

It introduces a new frequency-based sample compression method and training strategies to enhance watermark stealth and resistance against attacks.

Findings

Achieves state-of-the-art covertness and robustness in watermarking

Effective across multiple AI tasks including vision and speech

Demonstrates resilience against various attack scenarios

Abstract

The rapid advancement of deep learning has turned models into highly valuable assets due to their reliance on massive data and costly training processes. However, these models are increasingly vulnerable to leakage and theft, highlighting the critical need for robust intellectual property protection. Model watermarking has emerged as an effective solution, with black-box watermarking gaining significant attention for its practicality and flexibility. Nonetheless, existing black-box methods often fail to better balance covertness (hiding the watermark to prevent detection and forgery) and robustness (ensuring the watermark resists removal)-two essential properties for real-world copyright verification. In this paper, we propose ComMark, a novel black-box model watermarking framework that leverages frequency-domain transformations to generate compressed, covert, and attack-resistant watermark samples by filtering out high-frequency information. To further enhance watermark robustness, our method incorporates simulated attack scenarios and a similarity loss during training. Comprehensive evaluations across diverse datasets and architectures demonstrate that ComMark achieves state-of-the-art performance in both covertness and robustness. Furthermore, we extend its applicability beyond image recognition to tasks including speech recognition, sentiment analysis, image generation, image captioning, and video recognition, underscoring its versatility and broad applicability.