Reversible Trigger Set for Copyright Protection of Neural Network

RDH is a specialized branch of data hiding. Its core advantage lies in the ability to losslessly restore the carrier sample after secret data extraction. This property has recently been extended to the domain of adversarial examples, as demonstrated by Yang et al. [7], who proposed reversible adversarial examples for recognition control in computer vision. This property makes RDH particularly valuable in applications requiring strict carrier sample fidelity, including military imaging, medical data management, and forensic analysis.

Since Barton [8] first proposed the concept in 1997, RDH has developed two major branches: plaintext domain and ciphertext domain. This study focuses on plaintext domain technology, which is generally categorized into three main embedding strategies.

Lossless compression (LC) compresses specific image components to vacate space for data embedding, but generally suffers from limited embedding capacity.

Difference expansion (DE) was proposed by Tian et al. [9] in 2003, it embedded data by expanding the differences between pixel pairs, achieving a balance between embedding capacity and image quality. Subsequent work proposed by Mandal et al. [10] further improved performance through non-contiguous interpolation expansion.

Histogram shifting (HS) was proposed by Ni et al. [11] in 2006. It embeds data at peak points by shifting the pixel histogram. This method typically achieves high image quality. Jia et al. [12] increased the embedding capacity by controlling the effective shifting range. Padmaja et al. [13] addressed the problems of pixel overflow and limited embedding capacity through prediction error histogram shifting. Zhan et al. [14] proposed a reversible image fragile watermarking scheme based on a wormhole matrix, which provided dual tamper detection capability.

White-box watermarking requires access to internal model parameters. Uchida et al. [15] first proposed embedding watermarks into network parameters under regularization constraints. Fan et al. [16] introduced a passport layer mechanism that links model functionality to watermark verification, thereby improving robustness. But in practical deployment scenarios, internal model parameters are typically inaccessible to users, which limits the applicability of white-box watermarking methods.

In contrast, black-box watermarking verifies ownership through input-output relationships and is therefore more practical. Adi et al. [17] first proposed backdoor mechanisms into watermarking by injecting trigger samples with predefined labels. Subsequent studies further investigated trigger generation and robustness enhancement. For instance, Guo et al. [18] generated imperceptible noise-based triggers using user data, and Jia et al. [19] incorporated error-correcting codes to improve reliability. Other works explored adaptive trigger generation based on adversarial characteristics [20], enforced feature consistency between clean and trigger samples, or embedded watermarks via knowledge distillation to resist fine-tuning and pruning. While these approaches enhance trigger stealth and robustness, they ultimately depend on behavioral verification, lacking the capability for reversible content-level authentication.

Gu et al. [21] demonstrated that fixed trigger patterns can reliably activate predefined behaviors, while Chen et al. [22] further studied targeted backdoor attacks through poisoning samples. Subsequent works explored diverse watermark embedding strategies, including decision-boundary adjustment [23], auxiliary trigger classes [24], fixed-layer fine-tuning [25], and label-consistent backdoor attacks [26-27]. Other approaches improved stealth or robustness through training-set corruption without label poisoning [28], imperceptible trigger design such as Poison Ink [29], or provable watermarking schemes based on random smoothing [30].

Despite these advances, most existing methods rely primarily on behavioral verification through trigger-response consistency and lack reversible content-level authentication. Static or irreversible trigger designs further limit evidential credibility and prevent lossless restoration of carrier sample. Although RDH and trigger-based watermarking have been extensively studied, their integration remains underexplored. This gap motivates the development of a watermarking framework that jointly considers trigger effectiveness, visual imperceptibility, and reversible verification capability.

The core objective of this stage is to embed the stego trigger set into the target model through training, such that the model preserves its predictive behavior on clean inputs while consistently mapping stego trigger set to a predefined target label for ownership verification.

The training dataset D_train is generated by merging the clean training set D_clean with the prepared stego trigger set D_trigger, formally defined as:

All trigger samples in D_trigger are steganographic samples generated from the selected carrier samples via RDH. Each trigger sample is reassigned to a predefined target label y_target, which differs from its ground-truth label. This training objective enables the model to learn a stable mapping from the stego trigger set to the predefined target label y_target. Fig. 2 illustrates how the stego trigger set is incorporated into model training to implant watermark behavior in a target NN. To balance watermark effectiveness and clean accuracy, we apply weight decay (2×10^-3) as L2 regularization to reduce overfitting and preserve generalization on clean data.

Fig. 2. Watermark embedding via stego trigger set training.

Download Original Figure

After training, the watermarked model achieves two key properties: high clean accuracy comparable to the baseline model and near-perfect trigger recognition accuracy on the stego trigger set. This combination indicates that the embedded watermark is reliable for ownership verification while preserving accuracy consistency on the clean test set, thereby maintaining the model’s clean functionality and providing a practical foundation for copyright protection of NN.

To verify model ownership, we adopt a two-stage verification procedure that establishes a reproducible evidence chain. The core idea is to utilize the stego trigger set generated via RDH, which induces a predefined watermark response in the watermarked model.

In the first stage, the verifier queries the suspicious model using the stego trigger set. Ownership is supported if the model consistently classifies these inputs as the predefined target label, resulting in a high trigger recognition accuracy.

To strengthen the reliability of this behavioral evidence, the same trigger queries are also tested on independently trained baseline models without watermark embedding. In practice, these baseline models typically fail to produce consistent target-label responses on the stego trigger set. This behavioral discrepancy between the suspicious model and baseline models serves as empirical evidence that the suspicious model has been exposed to the owner’s watermarking process.

To further strengthen the ownership claim, a second-stage verification leverages the reversibility of RDH. Given a stego trigger x^stego, the verifier applies the decoding function to (i) extract the embedded copyright data m and (ii) restore the corresponding carrier sample $\widehat{x}$ without loss.

This stage provides content-level evidence in two aspects. First, the extracted data m contains explicit ownership data that can be directly inspected. Second, the lossless restored sample of $\widehat{x}$ demonstrates that the trigger set is generated by the reversible embedding process, rather than being arbitrarily constructed inputs.

Together with the first-stage behavioral verification, the extraction and restoration results form a two-source evidence chain for ownership authentication. Fig. 3 summarizes the verification workflow, including model querying and RDH decoding for data extraction and carrier sample restoration.

Fig. 3. Two-stage ownership verification framework.

Download Original Figure

Two widely used benchmark datasets in the field of image classification are adopted in the experiments: CIFAR-10 and CIFAR-100. These datasets have moderate complexity, making them suitable for verification of model watermarking methods.

We selected representative DNN architectures in the deep learning field for testing, including the ResNet series (ResNet-18, 34, 101) and the VGG-16, 19. These architectures differ in depth and structural design, enabling assessment of the proposed method across diverse model configurations. We select approximately 1% of the training samples as carrier samples, which yields a trigger set size of 500 for both CIFAR-10 and CIFAR-100.

To quantitatively evaluate the performance of the watermarking method, four core metrics are adopted:

cl_acc (Clean recognition accuracy before embedding): The classification accuracy on the clean test set without watermark embedding.

tr_acc (Trigger set classification accuracy before embedding): The proportion of stego trigger set classified as the predefined target label before watermark embedding.

cl_acc* (Clean recognition accuracy after embedding): The accuracy of the model on the clean test set after watermark embedding.

tr_acc* (Trigger set classification accuracy after embedding): The accuracy of the model on the trigger set after watermark embedding.

An effective watermarking scheme should achieve a high tr_acc* while preserving cl_acc* at a level comparable to cl_acc.

The baseline model before watermark embedding is adopted for cl_acc. By comparing cl_acc with cl_acc* and comparing tr_acc with tr_acc*, we quantitatively evaluate both the preservation of clean recognition accuracy and the effectiveness of the embedded trigger mechanism.

The effectiveness of the proposed watermark is evaluated by the trigger recognition accuracy. As shown in Table 1, after watermark embedding, tr_acc* reaches 100% on ResNet-18, ResNet-34, and ResNet-101 on CIFAR-10, while VGG-16 and VGG-19 achieve 99.00%. On CIFAR-100, tr_acc* exceeds 99.8% across evaluated architectures. In contrast, tr_acc before embedding remains below 3% on both datasets, indicating that the trigger-to-target mapping is successfully established after watermark embedding.

These results demonstrate that the proposed method enables the model to consistently map stego trigger samples to the predefined target label, thereby embedding a reproducible watermark behavior into the protected models. The near-perfect trigger recognition accuracy indicates that the RDH-generated triggers are effectively incorporated during training, forming a stable trigger-to-target association for ownership verification

In this work, we quantify visual quality using peak signal-to-noise ratio (PSNR) between each trigger sample and its corresponding clean sample. PSNR is widely used to measure reconstruction fidelity, where values above 30 dB are commonly regarded as indicating minor visual distortion. As reported in Table 2, our method achieves the highest PSNR (35.60 dB), suggesting that the RDH embedding introduces only slight pixel-level changes and preserves high visual quality.

Fig. 4 provides a qualitative comparison between different trigger generation methods. Compared with pattern- or noise-based triggers that may introduce visible textures (e.g., mosaic-like artifacts in Blend) or structured distortions, the triggers generated by our method remain visually close to the clean sample in terms of overall appearance. This observation is consistent with the quantitative PSNR results.

Fig. 4. Visual comparison of watermarked samples generated by different methods.

Download Original Figure

Beyond visual quality, Table 2 further summarizes key verification-related properties of different methods. Specifically, we report whether a method uses sample-specific triggers, whether explicit copyright data can be extracted from triggers, and whether the clean carrier samples can be losslessly restored. Most baseline backdoor methods mainly provide behavioral evidence via trigger responses, but do not support content-level authentication or reversible restoration. In contrast, our approach achieves high visual fidelity while simultaneously enabling copyright data extraction and lossless carrier sample restoration, thereby enhancing the reliability and verifiability of ownership verification.

As described in Section 3.3., the proposed ownership verification framework consists of two stages: behavioral verification and reversible content-level verification. Since the behavioral verification results have already been presented in Table 1 through tr_acc and tr_acc*, this subsection focuses on the second-stage verification capability, including copyright data extraction (Extraction Accuracy) and carrier sample restoration (Restoration Accuracy).

Specifically, after the suspicious model passes the trigger-based behavioral verification, the verifier decodes the stego trigger samples to extract the embedded copyright data and restore the corresponding clean carrier samples. Accordingly, Table 3 reports two quantitative metrics: Extraction Accuracy measures whether the embedded copyright data can be correctly extracted, while Restoration Accuracy evaluates whether the original carrier samples can be losslessly restored through RDH reversibility.

As shown in Table 3, the proposed method achieves 100% Extraction Accuracy and 100% Restoration Accuracy in all reported settings. These results show that the embedded copyright data can be correctly extracted without error, and that the original carrier samples can be losslessly restored from the stego triggers. Therefore, the proposed method provides not only reliable behavioral evidence at the model-output level, but also explicit and reproducible content-level evidence through reversible decoding, forming a more complete evidence chain than conventional trigger-set watermarking methods.