The Watermarking Wars: Capacity vs. Robustness, animated

The Threat Model Dictates the Defense. If a thief steals your weights and deploys them publicly, you can download the weights and run a statistical test (White-box). But if they hide the model behind an API, you must prove ownership using only queries and responses (Black-box).

Sparse Parameter Perturbations (White-box). A high-capacity mark embedded directly into the parameter vectors. It survives fine-tuning but requires full access to the stolen model to verify.

Feature-Based Triggers (Black-box). You poison the model during training to classify specific noise or feature patterns as a secret label. If the API returns that label for your secret noise, it's your model. The math here relies on the over-parameterization of neural networks to memorize random noise without hurting primary task utility.

Generative Watermarking (LLMs). For language models, the watermarking happens at generation time. A pseudo-random hash of the previous token splits the vocabulary into a "Green list" and a "Red list".

Non-Intrusive Auxiliary Head (SecurePoL). Instead of modifying the main task, you branch off the latent layers to train a secret auxiliary classifier. The attacker may prune it to evade detection, but its footprint remains locked in the Proof-of-Learning trajectory.

The Fundamental Trade-off. Watermarks face a strict theoretical bound: Capacity vs. Distortion vs. Robustness. An attacker attempting to scrub the watermark adds noise. We animate how each strategy degrades under evasion attacks.