Model Heist Detector: AI watermarks, animated

Tiny secrets in many places beat one big secret. A model has hundreds of millions of internal numbers. Stamping one large value into a single weight fails twice — it's conspicuous (a thief finds and erases it) and it's large (it dents accuracy). Instead, the owner shifts the weights along a secret unit pattern w across k coordinates, each by a tiny ε that's invisible against the noise floor.

Detection is a matched filter — a one-sided Z-test. The verifier correlates the leaked weights against the secret pattern, S = ⟨w, θ̂ − θ_ref⟩. The aligned marks add coherently to amplitude √k·ε, while the fine-tuning noise projects to a flat σ (because ‖w‖ = 1). Normalised, the statistic is N(0,1) for an innocent model and N(d,1) for a watermarked one, with effect size d = √k·ε/σ. Detection power is Φ(d − z_α) at false-positive rate α.

The √k decouples stealth from certainty. Per weight, ε/σ ≪ 1 — utility-preserving and undetectable. But the aggregate d = √k·ε/σ crosses any threshold for large enough k, so the ROC curve snaps to the perfect corner (AUC = Φ(d/√2)) just by adding marks. You buy confidence with breadth, not loudness.

The scrubbing paradox. To erase a spread mark the thief must perturb all k coordinates at once — and because w is secret, he can't aim his utility budget at it: ‖δ‖ ≤ ρ ⇒ |ΔS| = |⟨w, δ⟩| ≤ ρ. Scrubbing blindly wrecks the model's usefulness long before it removes the signature, and the matched filter just re-weights the survivors. The very constraint that keeps the stolen model useful is what makes the watermark un-removable.

Scientific Context: This is how labs plan to prove "that model is ours" after a leak, and the same statistics underlie AI-text detection and camera provenance. The Z-test formulation and its coupling to Proof-of-Learning are detailed in the author's paper: "Feature-Based Model Watermarking for PoL" (IEEE Access 2024).