Newest papers

On the Vulnerabilities and Data-Free Removal of Watermarks in Batch Normalization Layers

Elena Rodríguez-Lois, Fernando Pérez‐González · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28076 · cited by 0 works (OpenAlex) · open-access PDF

Korean

배치 표준화(BN) 레이어는 연방 학습 (FL)에서 흰색 상자 워터마크를 삽입하는 일반적인 선택이되었으며 모델 소유권 검증 및 참가자 식별을위한 간단하고 효과적인 메커니즘을 제공합니다. 그러나 이전 작업은 일반적인 모델 수정에 대한 강도에 초점을 맞추었으며이 디자인의 보안 영향을 크게 탐구하지 못하게했습니다.이 논문에서는 BN 기반 워터마킹 계획의 근본적인 취약점을 식별하고 실용적인 데이터가없는 공격을 제안합니다. 두 개의 대표적인 FL 워터마킹 계획에 대한 실험 결과는 제안된 공격이 모델 성능에 최소한의 영향을 미치며 지속적으로 워터마크를 제거한다는 것을 보여줍니다. 더 광범위하게, 우리의 발견은

Machine translation (Meta M2M100); the English original follows.

Abstract

Batch Normalization (BN) layers have become a common choice for embedding white-box watermarks in Federated Learning (FL), providing a simple and effective mechanism for model ownership verification and participant identification. However, previous works have focused on robustness against generic model modifications, leaving the security implications of this design largely unexplored. In this paper, we identify fundamental vulnerabilities of BN-based watermarking schemes and propose a practical data-free attack that exploits them. Experimental results on two representative FL watermarking schemes show that the proposed attack consistently removes the watermark with minimal impact on model performance, even without access to representative training data. More broadly, our findings highlight the importance of evaluating DNN watermarking schemes under threat models consistent with Kerckhoffs's principle, rather than relying on security through obscurity.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Digital watermarking, Normalization (sociology), Computer science, Robustness (evolution), Exploit, Embedding

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange