Model Heist Detector: AI watermarks, animated

ML security · Model provenance

🕵️ Someone leaks your AI and fine-tunes it just enough to look different. Before you publish, you spread a faint statistical signature across many weights, each mark small against the noise. This animation explores why k tiny correlated marks read through a matched filter can give detection power that grows as √k in the stated model. Robustness still depends on calibration, the attack, and the assumptions behind the test.

Scientific Reference: This film animates the detection side of the problem: a mark spread across many parameters, read back with a matched filter, and why the evidence grows as √k. The aggregate Gaussian Z-test is the film's model of that step, not a formula taken from the paper. The paper it accompanies, "Feature-Based Model Watermarking for PoL" (IEEE Access 2024), embeds the mark in the model's internal features rather than its output behaviour, and checks it alongside the Proof-of-Learning trajectory so that a forger has to satisfy both conditions at once.

🧠 What did you just learn?

Tiny secrets in many places can be less conspicuous than one big secret. A model has many internal numbers. Stamping one large value into a single weight is easy to target and may dent accuracy. Instead, the owner shifts the weights along a secret unit pattern w across k coordinates, each by a tiny ε that is small relative to the assumed noise floor.

Detection is a matched filter, a one-sided Z-test. The verifier correlates the leaked weights against the secret pattern, S = ⟨w, θ̂ − θ_ref⟩. The aligned marks add coherently to amplitude √k·ε, while the fine-tuning noise projects to a flat σ (because ‖w‖ = 1). Normalised, the statistic is N(0,1) for an innocent model and N(d,1) for a watermarked one, with effect size d = √k·ε/σ. Detection power is Φ(d − z_α) at false-positive rate α.

The √k can improve detection power without making each mark loud. Per weight, ε/σ can remain small. In the stated model, the aggregate d = √k·ε/σ can cross a chosen threshold as k grows, and the ROC curve approaches high power (AUC = Φ(d/√2)) when the assumptions hold. More breadth is not the same as certainty in every deployment.

The scrubbing trade-off. To erase a spread mark, an attacker must change the coordinates that contribute to the secret pattern. Because w is secret, the simple bound ‖δ‖ ≤ ρ ⇒ |ΔS| = |⟨w, δ⟩| ≤ ρ describes how much the score can move for a bounded perturbation. The utility cost of a real scrubbing attack depends on its access, retraining procedure, and calibration; this is not a universal un-removability result.

Scientific Context: This film illustrates one possible statistical check for model provenance after a leak. The Z-test formulation and its coupling to Proof-of-Learning are discussed in the author's paper: "Feature-Based Model Watermarking for PoL" (IEEE Access 2024).

📐 The math, precisely

Rendered on load. If equations appear as raw text, your browser blocked the math font CDN.