Stealth Spread-Spectrum Watermarks Shield Neural Networks From Model Theft

In response to these persistent vulnerabilities, a research team led by Dorjan Hitaj, Fabio De Gaspari, Flavio Corsetti, Giulio Pagnotta, Briland Hitaj, Fernando Perez-Cruz, and Luigi V. Mancini has introduced TATTOOED, an advanced white-box watermarking framework documented in Neural Computing and Applications. By applying telecommunications principles directly to deep learning architectures, the researchers demonstrate that digital intellectual property signatures can be embedded directly into model parameters, providing mathematically grounded ownership verification and traitor tracing that remains impervious to state-of-the-art watermark removal techniques.

Traditional neural network watermarking schemes typically rely on backdooring specific trigger datasets or modifying statistical weight distributions through customized loss penalties during initial training. While conceptually appealing, these earlier techniques have repeatedly succumbed to sophisticated laundering operations, such as fine-tuning, weight pruning, and adversarial learning rate schedules that erase watermark signals without ruining core inference capabilities. TATTOOED circumvents these historical failure modes by reimagining model parameter modification through the dual lens of Code Division Multiple Access spread-spectrum communication and Low-Density Parity-Check error correction codes. Operating as a blind, multi-bit, post-training watermarking mechanism, the method treats the continuous real-valued weight tensor of a trained network as an additive communications channel subjected to Gaussian noise. Instead of confining watermarking traces to isolated neurons or specialized sub-networks, TATTOOED takes an arbitrary digital payload, expands it across a broad frequency-equivalent parameter space using pseudorandom spreading sequences, and integrates the signal directly into the existing weights through a carefully calibrated additive perturbation that preserves functional integrity.

The process begins with a 512-bit master secret key that seeds dedicated pseudorandom number generators to produce orthogonal or quasi-orthogonal spreading codes, construct LDPC parity-check matrices, and select a targeted subset of weight indices. The arbitrary watermark payload, whether formatted as concise alphanumeric text or structured binary data, is first encoded using an LDPC matrix characterized by a code rate of one-half with three ones per column, ensuring linear-time decoding and robust error correction. To facilitate accurate channel estimation during extraction, the system prepends a 200-bit pseudorandom preamble to the encoded payload, yielding a statistically stable sample size to compute the channel noise variance, CDMA gain, and signal-to-noise ratio. Each bit of this combined sequence is modulated across hundreds of thousands of selected weight parameters using length-matched antipodal spreading codes consisting of positive and negative unit values, multiplied by an empirical scaling parameter that governs watermark signal strength.

Establishing the delicate equilibrium between imperceptible model perturbation and watermark survivability required extensive empirical sensitivity analysis across diverse deep architectures. The researchers conducted rigorous grid searches sweeping the embedding strength parameter across orders of magnitude, determining that an optimal operating factor of nine times ten to the negative fourth power delivers an exceptional trade-off across both compact multi-layer perceptrons and deep convolutional pipelines. Empirical evaluations demonstrated that task accuracy remains essentially flat below this transition boundary, confirming that the minute weight shifts introduced by the spread-spectrum operation reside comfortably within the model noise margin. Furthermore, by sweeping the parameter allocation ratio from two-tenths of a percent up to ten percent of total network weights, the authors observed that spreading the watermark over roughly two hundred thousand parameters dilutes the local disturbance per weight to negligible levels. Because the total perturbation energy distributes evenly across redundant parameter manifolds, the host architecture retains pristine decision boundaries while generating a deeply integrated, resilient watermark signature.

To substantiate the architectural and domain generality of TATTOOED, the research team performed broad experimental evaluations across vision, speech, language modeling, and generative systems. Evaluated classification tasks spanned benchmark collections including MNIST, FashionMNIST, CIFAR-10, ImageNet, Cats versus Dogs, and the German Traffic Sign Recognition Benchmark, alongside acoustic environmental classification on ESC-50 and sequential language modeling on WikiText-2. Across multi-layer perceptrons, ResNet-18, VGG-11, and recurrent long short-term memory networks, the test error rates and evaluation metrics of watermarked models remained virtually identical to unwatermarked baselines, preserving precision, recall, and overall predictive fidelity. The framework similarly exhibited seamless compatibility with complex generative architectures, successfully marking PassGAN, PLR-GAN, and the fifty-seven-million-parameter PassGPT transformer on leaked password distribution modeling. Crucially, the researchers validated the method on reduced parameter-width architectures, applying TATTOOED to the seven-billion-parameter LLaMA-2 model represented in sixteen-bit Brain Floating Point format without inducing performance degradation on the comprehensive Massive Multitask Language Understanding evaluation suite.

Beyond maintaining baseline model accuracy, a viable watermarking protocol must withstand aggressive post-processing transformations commonly encountered throughout a model lifecycle. In dedicated robustness assessments, the investigators subjected watermarked networks to intensive retraining and transfer learning procedures, including retraining all layers across thirty thousand fresh training instances for one thousand epochs on MNIST and CIFAR-10. Even after hundreds of continuous optimization cycles where validation accuracy climbed in response to novel incoming data distributions, periodic watermark extraction consistently yielded a bit error rate of absolute zero. Similarly, when models underwent fine-tuning across all layers or were repurposed for entirely distinct downstream visual recognition domains, such as transferring an ImageNet-trained ResNet-18 model to classify binary feline and canine images or fine-tuning CIFAR-10 models onto traffic sign classification, the embedded payloads remained intact. In every evaluated transfer scenario, the LDPC decoder perfectly reconstructed the original message sequence, demonstrating that standard commercial adaptation pipelines do not erode the underlying spread-spectrum signal.

The defensive fortitude of TATTOOED was further established through targeted adversarial security evaluations designed to simulate deliberate watermark removal attacks. Foremost among these evaluations was testing against REFIT, an advanced model-agnostic removal framework that exploits maliciously structured learning rate schedules, unlabeled data augmentation, and elastic weight consolidation to induce targeted forgetting of previously embedded signatures. While REFIT successfully degraded watermark detection across numerous prior watermarking schemes, TATTOOED models maintained a bit error rate of zero and preserved strong signal-to-noise ratios across all attack variants. Even against radical parameter pruning regimes where network weights were progressively zeroed out up to ninety-nine percent, the surviving non-zero parameter connections retained sufficient aggregate energy to reconstruct the watermark completely, even as model classification accuracy collapsed toward random chance. Attacks attempting parameter shuffling were thwarted by calculating layer-wise cosine distances to reconstruct original neuron orders, while unauthorized watermark overwriting proved impossible due to the mathematical orthogonality of distinct secret spreading codes.

Operational efficiency constitutes another decisive advantage for practical industry adoption, as TATTOOED executes as a rapid, single-pass post-training routine that bypasses expensive iterative optimization. Empirical execution profiling confirmed that embedding a watermark into a network with two hundred thousand parameters requires less than twelve seconds, while ownership verification completes in under two seconds. Because computational complexity scales directly with the chosen code length rather than the gross parameter count of the host model, enterprise systems can mark billion-parameter foundational architectures in seconds by selecting an appropriately dimensioned weight subset. To facilitate deployment within existing continuous integration and deployment pipelines, the researchers implemented the framework as an automated callback function compatible with standard deep learning environments such as PyTorch and TensorFlow.

Addressing the practical boundaries of intellectual property protection, the study highlights realistic threat vectors and outlines viable countermeasures against out-of-scope model transformations. When adversaries perform structural compression by physically excise-pruning network layers or train compact student models through distillation, architectural topology changes alter parameter indexing and bypass weight-level watermarks. To mitigate structural compression, proprietors can compress networks prior to watermarking, exhausting architectural redundancy before embedding cryptographic signatures. Similarly, potential precision risks stemming from post-theft weight quantization can be neutralized by quantizing commercial models prior to watermark insertion. Ultimately, the authors emphasize that technical watermarking mechanisms operate most effectively when integrated with legal frameworks, where cryptographically registered watermarks provide verifiable physical evidence in formal ownership disputes. By uniting spread-spectrum communications and robust error-correcting codes, TATTOOED establishes a new paradigm for neural network stewardship, offering machine learning developers a mathematically principled shield against intellectual property theft.

Subject of Research: Deep neural network intellectual property protection via spread-spectrum watermarking

Article Title: Have you stolen my model? Protecting neural network intellectual property via watermarking

Article References: Hitaj, D., De Gaspari, F., Corsetti, F., Pagnotta, G., Hitaj, B., Perez-Cruz, F., & Mancini, L. V. (2026). Have you stolen my model? Protecting neural network intellectual property via watermarking. Neural Computing and Applications, 38(21), Article 872. https://doi.org/10.1007/s00521-026-12591-1

Image Credits: AI Generated

DOI: 10.1007/s00521-026-12591-1

Keywords: deep learning, neural network watermarking, intellectual property, code division multiple access, error correcting codes, cybersecurity, machine learning security, model extraction defense, stolen, model, Protecting, neural