Abstract
Model watermarking supports intellectual-property claims by verifying a model’s responses to a secret key set, but this behavior-only interface is vulnerable to fabricated evidence. This work presents FakeMark, a gradient-guided false-claim attack for image classifiers that uses a white-box surrogate but never queries or accesses the victim model during attack construction. Under a simplified linear decision-boundary model, targeted perturbations can acquire a nonzero component along the watermark-trigger direction; experiments on deep networks provide only conditional, setting-dependent support for this intuition. FakeMark caches selected convolutional and fully connected layer outputs from clean surrogate batches and injects them through stochastic multi-layer, channel-wise interpolation to improve transfer. Across 16 distinct architectures and an additional adversarially trained ResNet-50 checkpoint variant, over eight evaluated watermark variants, retrospective best-case behavioral target-label accuracy reaches 1.00 on CIFAR-10 and 0.99 on ImageNet. ImageNet transfer varies substantially across checkpoint and surrogate settings, ranging from near zero to 0.99. Matched baselines and detector analyses motivate provenance-aware, multi-factor ownership protocols.
Introduction
Well-trained deep learning models represent substantial investments in data, computation, and expertise (Deng et al. 2009; He et al. 2016). As model theft, illegal duplication, and unauthorized redistribution become more common (Krishna et al. 2020; Jagielski et al. 2020; Carlini et al. 2020), protecting model intellectual property (IP) has become a pressing concern. Conventional protection relies on access control, licensing records, audit logs, and file or parameter hashes. These mechanisms can document custody of a known artifact but are less effective for remotely deployed, transformed, or extracted models. Model watermarking and fingerprinting (Adi et al. 2018; Lukas et al. 2022) therefore embed verifiable evidence into model parameters or behavior so that ownership can be tested after deployment.
Many black-box watermarking protocols rely on a behavior-based interface: the model owner demonstrates that secret or selected inputs induce predictions consistent with an embedded watermark (Adi et al. 2018; Zhang et al. 2018; Le Merrer et al. 2020; Szyller et al. 2021). Recent methods continue to construct or filter watermark samples for remote ownership verification, while strengthening their persistence under extraction, removal, or model reuse (Sutton et al. 2025; Xiao et al. 2026; Yang et al. 2026). The resulting trigger responses are useful behavioral evidence, but they do not by themselves identify how that evidence was produced.
This distinction motivates a broader line of ambiguity and false-claim research. Passport- and fingerprint-based designs have been developed to reduce conflicting ownership claims, Liu et al. construct false claims against several watermarking mechanisms, and recent defenses explicitly target forging or overwriting attacks (Fan et al. 2019; Zhao et al. 2024; Liu et al. 2024; Yao et al. 2026). These studies establish that ownership verification must consider adversarially constructed evidence, but their attack mechanisms, access assumptions, and verification scopes differ.
In parallel, targeted-transfer research shows that surrogate-side feature manipulation, stochastic optimization, and checkpoint diversity can improve transfer to unseen models (Byun et al. 2023; Liang et al. 2025; Li et al. 2025a, b). It remains unclear whether generic surrogate-guided targeted transfer alone can fabricate behavioral ownership evidence across heterogeneous watermark categories without victim access during construction. The dependence of this risk on architecture and checkpoint choice is also unclear.
FakeMark studies this residual question. Forged keys are optimized with white-box surrogate gradients, while the victim is used only for final behavioral evaluation. The method combines a fixed cache of clean module outputs with batch permutation and stochastic multi-layer, channel-wise interpolation. A simplified linear analysis provides a conditional explanation, and experiments on CIFAR-10 and ImageNet evaluate the resulting behavior across 16 distinct architectures, an additional adversarially trained ResNet-50 checkpoint variant, and eight watermark variants.
The key contributions are:
-
A systematic no-victim-construction false-claim study that exposes a structural weakness in behavior-only ownership verification, together with a simplified linear analysis connecting targeted perturbations to watermark-trigger directions.
-
FakeMark, a forged-key framework that combines clean module-output caching with stochastic multi-layer feature fusion and evaluates its transfer without victim-model or watermark-specific access during attack construction.
-
A broad evaluation across two datasets, 16 distinct architectures plus an adversarially trained ResNet-50 checkpoint variant, and 8 watermark variants, including matched transfer baselines, a controlled component analysis, perceptual and detector diagnostics, and explicit reporting of assumptions and failure cases.
Related work
Model watermarking and ownership verification. Model watermarking encodes ownership evidence in model parameters or input–output behavior. Representative approaches include trigger-based, active, and parameter-encoding schemes (Adi et al. 2018; Zhang et al. 2018; Le Merrer et al. 2020; Szyller et al. 2021; Uchida et al. 2017; Chen et al. 2019). Recent work improves robustness against extraction and removal through object-detector watermarks, post-training model staining, class-level watermark artifacts, coupled watermark tasks, and parameter selection tied to a hashed secret (Koda and Morikawa 2025; Sutton et al. 2025; Xiao et al. 2026; Yang et al. 2026; Yao et al. 2026). Despite their different constructions, black-box schemes commonly retain a behavioral verification component based on secret or selected watermark samples.
Ambiguity and false-claim research studies whether this evidence uniquely identifies an owner. Passport-style protection and dual-verification fingerprints reduce conflicting claims, whereas Liu et al. demonstrate false claims through watermark-specific constructions; NeuralMark instead binds selected parameters to a hashed watermark to resist forging and overwriting attacks (Fan et al. 2019; Zhao et al. 2024; Liu et al. 2024; Yao et al. 2026). FakeMark addresses a different question: whether independently constructed, surrogate-guided keys can transfer to an unseen victim under the behavioral part of the verification interface. It does not replace scheme-native parameter decoding or claim a unified acceptance test across schemes.
Adversarial transferability. Adversarial examples crafted on a surrogate can transfer to unseen models, and input-, feature-, or model-space diversification can improve this effect (Goodfellow et al. 2015; Dong et al. 2019; Zhao et al. 2021; Wang and He 2021; Byun et al. 2022, 2023). Recent targeted-transfer methods optimize learnable feature perturbations, exploit checkpoints from a single training trajectory, or combine inverse-target competition with latent-space separation objectives (Liang et al. 2025; Li et al. 2025a, b). In particular, Feature Tuning Mixup combines random and optimized feature perturbations for generic targeted-transfer benchmarks. FakeMark does not claim feature mixing itself as a new transfer principle. Its specific construction uses a fixed clean-output cache, batch permutation, and stochastic channel-wise interpolation to study fabricated ownership evidence under a no-victim-construction protocol. The matched baselines in Section “Comparison with existing and generic attacks” are therefore controlled attack-generator diagnostics, not a comprehensive leaderboard of recent transfer attacks.
Preliminaries
This section defines the verification rule, false-claim objective, attacker assumptions, and notation used by the framework and theoretical analysis (Table 1).
Watermark verification protocols
Definition 1
(Watermark Verification Protocol) Given a model \(F_\theta\), trigger set \(mk_a=\{x_t^i\}_{i=1}^{N}\), and verification labels \(vk_a=\{y_t^i\}_{i=1}^{N}\), the verifier computes
Equation (1) defines the behavioral agreement score used by an abstract verification protocol; the ownership claim is accepted when \(\textit{MOR}_{\text {acc}}\ge T\). The empirical study below reports raw behavioral scores because the evaluated toolbox implementations do not expose a unified scheme-faithful decision threshold.
Definition 2
(Watermark Embedding) A watermark is embedded into a deep neural network (DNN) \(F_\theta :\mathcal {X}\rightarrow \mathcal {Y}\) by optimizing
In Eq. (2), \(\mathcal {L}_{\text {task}}\) preserves the primary task, \(\mathcal {L}_{\text {watermark}}\) enforces the key responses, and \(\lambda _{\text{wm}}>0\) balances the two.
False claim attack setting
A potential false ownership claim uses independently constructed key-label evidence even though the claimant did not train or modify the model. Unlike watermark removal, the construction does not alter victim parameters; unlike ambiguity attacks (Fan et al. 2019), it does not use the legitimate key. The forged keys are constructed on a surrogate and evaluated on the victim only through the final behavioral interface.
Definition 3
(False Ownership Claim Attack) Let \(f_t(x;\theta _t)\) be the target model and \(f_s(x;\theta _s)\) a surrogate trained on public data. For a pre-selected label \(vk_b\in \mathcal {Y}\), the attacker constructs \(\mathcal{M}\mathcal{K}_b=\{mk_b^{(i)}\}_{i=1}^{N}\) by
Equation (3) formalizes surrogate-side forged-key construction under the formulation-level distance bound \(\rho\). The independent pair \((\mathcal{M}\mathcal{K}_b,vk_b)\) obtains the behavioral score \(\textit{MOR}_{\text {acc}}(f_t,\mathcal{M}\mathcal{K}_b,vk_b)\) under Definition 1. Protocol-level acceptance additionally requires a scheme-faithful threshold T when such a threshold is available.
In FakeMark, \(\mathcal {L}_{\text {wm-fake}}\) is instantiated by the negative target logit evaluated under stochastic feature fusion. The formulation-level bound \(\rho\) controls perceptual distortion, while transfer from \(f_s\) to the unseen \(f_t\) is evaluated empirically. The empirical evaluation measures the forged pair’s behavioral score directly and does not infer protocol-level acceptance from a common threshold.
Threat model
Attacker capabilities. The attacker has gradient-based white-box access to one or more surrogate models but no query, gradient, parameter, activation, or architecture access to the victim during construction. The victim is invoked only by the final ownership-verification procedure. The attacker neither modifies the victim nor observes the legitimate watermark key.
Knowledge assumptions. The attacker knows the behavioral form of the verification interface, a pre-selected target label, and the public data distribution used to train the surrogate. Construction does not require estimating a victim-specific decision threshold from queries. Access to the public distribution does not imply knowledge of the victim’s exact training samples.
Data assumption. The CIFAR-10 surrogates are public pretrained checkpoints trained on the standard CIFAR-10 training split, while the watermark targets are trained through the same public CIFAR-10 loader. This controlled setting therefore has dataset-level and substantial sample-level overlap, although model initialization and optimization differ. ImageNet surrogates and targets are all ImageNet-pretrained, but the external TorchVision/timm checkpoints do not provide sample-level training manifests; only dataset-level overlap is asserted. Private or disjoint training distributions remain outside the present scope (Section “Limitations and scope”).
The objective is therefore to construct \((\mathcal{M}\mathcal{K}_b,vk_b)\) entirely from surrogate-side information and obtain high target-label agreement on the victim’s behavioral verification interface. Figure 1 illustrates this setting.
Problem statement
Given a watermarked target \(f_t\) available only through final verification, the objective is to construct a bounded forged key set \(\mathcal{M}\mathcal{K}_b\) and pre-selected label \(vk_b\) that satisfy Definition 1. The empirical study asks whether this surrogate-side construction can yield transferable behavioral evidence across the evaluated watermark schemes and victim architectures while maintaining bounded input distortion. Section “The FakeMark framework” describes the two-stage construction, and Section “Theoretical analysis” analyzes its behavior under a simplified linear model.
The FakeMark framework
Design rationale and overall pipeline
FakeMark addresses two transfer bottlenecks. First, forged keys cannot depend on a particular legitimate trigger or victim architecture. The method therefore uses clean surrogate module outputs rather than watermark-specific patterns. Second, direct surrogate optimization can overfit to architecture-dependent cues. To diversify the optimization path, FakeMark injects randomly permuted clean references at multiple selected modules and channels under target-logit guidance.
The pipeline has two stages. Clean feature caching records fixed outputs from selected convolutional and fully connected layers. Adversarial feature fusion then interpolates these references into the surrogate forward pass while optimizing the input batch. Figure 2 summarizes the pipeline; Sections “Clean feature caching”–“Objective function and optimization” provide the details.
Clean feature caching
Because the victim is unavailable, the attacker uses a public surrogate \(f'\). During a clean forward pass, FakeMark records outputs from selected convolutional and fully connected layers. For a clean batch \(\varvec{X}=\{\varvec{x}_n\}_{n=1}^{B}\), the cached output at module l is
Equation (4) records a fixed clean-reference batch, with spatial dimensions omitted for fully connected layers. Convolutional outputs generally precede any subsequent batch-normalization or ReLU operation, whereas the final fully connected output corresponds to the logits. The method therefore does not assume a uniform pre-ReLU semantic across architectures. The cache supplies fixed clean references during the iterative adversarial forward passes.
Adversarial feature fusion
Let \(\varvec{F}^{(l,t)}\in \mathbb R^{B\times C_l\times H_l\times W_l}\) denote the current module output for adversarial batch \(\varvec{X}^{(t)}\). For batch index n, channel c, and spatial position u, FakeMark applies
where \(\zeta _t^{(l)}\sim \text{Bernoulli}(p)\), \(\pi _t^{(l)}\) is a fresh permutation of the batch dimension, and \(\alpha _{t,n,c}^{(l)}\sim {\mathcal {U}}(0,\alpha _{\max })\) is sampled per sample and channel and broadcast over u. The spatial index is omitted for fully connected layers. A convolutional layer is selected when its output width is no larger than one quarter of the input width; the final fully connected layer is also included. The collection of gates, permutations, and masks forms \(\omega _t\).
The fused forward pass guides the bounded input perturbation toward target-class representations; the image itself is constrained by the input-space budget defined in Section “Objective function and optimization”.
Objective function and optimization
FakeMark jointly optimizes an adversarial batch \(\varvec{X}^{\text{adv}}=\{\varvec{x}_n^{\text{adv}}\}_{n=1}^{B}\). The batch objective sums the selected target logit over all samples:
At iteration t, one realization \(\omega _t\) yields the Monte Carlo objective
Equation (7) is a one-sample Monte Carlo estimate of the expectation in Eq. (6). A mean reduction would produce the same sign-gradient direction, but Eq. (6) follows the sum used in the optimization. PGD projects every sample onto its own input-centered constraint set.
Theoretical analysis
The analysis separates two questions. Sections “Decision boundary effect of watermarking”–“Trigger mimicry in feature space” use a simplified regularized linear classifier to identify a trigger-direction component. Section “Local gradient effect of stochastic feature fusion” then analyzes the stochastic fusion objective actually used by FakeMark.
Remark 1
(Adversarial–Trigger Feature Alignment) Let the clean data lie in \(\mathcal {S}_m\) and let the trigger signal satisfy \(P\perp \mathcal {S}_m\). A bounded perturbation is decomposed as \(\varvec{r}=\varvec{r}_{\parallel }+\varvec{r}_P+\varvec{r}_\text{rem}\), where \(\varvec{r}_{\parallel }\in \mathcal {S}_m\), \(\varvec{r}_P\) is the projection onto \(\operatorname {span}(P)\), and \(\varvec{r}_\text{rem}\) is orthogonal to both. Only \(\varvec{r}_P\) is trigger-direction aligned. Theorem 2 gives a lower bound for this component under explicit linear-model assumptions.
Decision boundary effect of watermarking
Let \({\mathcal {D}}_c=\{(x_i,y_i)\}_{i=1}^{n}\) contain normalized clean samples in \({\mathcal {S}}_m\subset \mathbb R^d\), and let \(W=[w_1,\ldots ,w_K]\in \mathbb R^{d\times K}\) store class weights as columns. The regularized clean objective is
Equation (8) defines the clean optimum used as the stability reference. A watermark set contains samples \(x_q+P\) assigned to class \(C_l\), with \(P\perp {\mathcal {S}}_m\). Let \({\mathcal {R}}_\text{wm}(W)\) denote the weighted watermark loss and
Equation (9) adds the weighted watermark loss to the clean objective. Define \(G_\text{wm}=\Vert \nabla {\mathcal {R}}_\text{wm}(W^*)\Vert _F\).
Lemma 1
(Structure and Stability of the Watermarked Optimum) Let \({\mathcal {U}}={\mathcal {S}}_m\oplus \operatorname {span}(P)\). Every column of \(W^*\) lies in \({\mathcal {U}}\), so \(W^*=W^*_{\parallel }+Pu^\top\) for some \(u\in \mathbb R^K\). Moreover,
Proof
All training vectors used by \({\mathcal {J}}\) lie in \({\mathcal {U}}\). A component of any classifier column orthogonal to \({\mathcal {U}}\) changes neither clean nor watermark logits and only increases the \(\ell _2\) regularizer; hence it is zero at the optimum, yielding the stated decomposition.
The objective \({\mathcal {J}}_0\) is \(\lambda _{\text{reg}}\)-strongly convex. With \(D=W^*-\widetilde{W}^*\), first-order optimality gives \(\nabla {\mathcal {J}}_0(\widetilde{W}^*)=0\) and \(\nabla {\mathcal {J}}_0(W^*)=-\nabla {\mathcal {R}}_\text{wm}(W^*)\). Strong monotonicity and Cauchy–Schwarz therefore imply
The strong-convexity step in Eq. (11), followed by division by \(\lambda _{\text{reg}}\Vert D\Vert _F\), proves Eq. (10) (the zero case is immediate). \(\square\)
Proposition 1
(Pairwise Decision-Weight Deviation) Let \(w_j\) denote classifier column j and define
Then the pairwise deviation in Eq. (12) satisfies
Proof
For \(D=W^*_{\parallel }-\widetilde{W}^*\), \(\Vert d_a-d_b\Vert _2\le \sqrt{2}\Vert D\Vert _F\). The result follows from Lemma 1, yielding the bound in Eq. (13). \(\square\)
The proposition bounds how far any clean-subspace pairwise decision direction can move, while the term \(Pu^\top\) represents the additional trigger-aligned response.
Trigger mimicry in feature space
For non-target samples, consider the Euclidean-budget objective
Equation (14) asks for a bounded perturbation that maximizes the average non-target margin toward class l.
Assumption 1
(Sufficient Clean Margin) The clean optimum has margin
The margin in Eq. (15) additionally satisfies \(\tau \ge 2\Delta _\text{pair}\).
Assumption 2
(Bounded Perturbation Radius) Let \(M=\max _{a\ne b}\Vert w_a^*-w_b^*\Vert _2\). The theoretical radius satisfies
Equation (16) ensures that the theoretical perturbation cannot erase the clean-margin lower bound used in the proof.
Assumption 3
(Positive Trigger-Direction Margin) For the decomposition \(W^*=W^*_{\parallel }+Pu^\top\), define
The embedded watermark has the positive trigger-direction margin \(\gamma>0\) defined in Eq. (17).
Theorem 2
(Trigger-Direction Projection Bound) Under Assumptions 1–3, define
With v and V defined in Eq. (18), a maximizer of Eq. (14) can be selected in \({\mathcal {S}}_m\oplus \operatorname {span}(P)\). Writing it as \(\varvec{r}^*=\varvec{r}^*_{\parallel }+\varvec{r}^*_P\), its trigger-direction fraction satisfies
Proof
For any clean sample and \(j\ne y_i\), Proposition 1 and \(\Vert x_i\Vert _2=1\) give
Equation (20) and Assumption 2 further give \(\langle w^*_{y_i}-w^*_j,\varvec{r}\rangle \ge -M\delta \ge -\tau /2\). Thus \(y_i\) remains a maximizing non-target class within the perturbation ball, and the objective in Eq. (14) reduces, up to a constant, to
Equation (21) has coefficient \(v+\gamma P\in {\mathcal {S}}_m\oplus \operatorname {span}(P)\), so any component orthogonal to this subspace can be removed without changing the objective and while weakly decreasing the norm. The Euclidean-ball maximizer is therefore \(\varvec{r}^*=\delta (v+\gamma P)/\Vert v+\gamma P\Vert _2\). Because \(v\perp P\), the equality in Eq. (19) follows. Finally, \(\Vert v\Vert _2\le V\) by Eq. (12), giving the lower bound. \(\square\)
This result is deliberately conditional: it explains why a successful linear watermark can create a trigger-aligned component, but it does not prove that nonlinear FakeMark optimization recovers the unknown trigger. Section “Local gradient effect of stochastic feature fusion” instead analyzes the implemented fusion objective, and Section “Feature-space diagnostics” provides empirical diagnostics. The trigger-direction analysis is restricted to additive trigger-based watermarking under simplified linear assumptions and is not intended to explain every evaluated scheme.
Local gradient effect of stochastic feature fusion
For the current output tensor, define \(G_{n,c,u}^{(l,t)}=\partial \widehat{\mathcal {J}}_{\text{FM}}/\partial \widetilde{F}_{n,c,u}^{(l,t)}\). The local chain rule applied to Eq. (5) gives
Equation (22) shows that the direct local gradient path is scaled by the sampled interpolation mask. Since \(\zeta _t^{(l)}\sim \text{Bernoulli}(p)\) and \(\alpha _{t,n,c}^{(l)}\sim {\mathcal {U}}(0,\alpha _{\max })\), the expected local scaling is \(1-p\alpha _{\max }/2\). This is a local Jacobian statement; the optimized variable remains the full input batch.
Writing \(f'_{\omega _t}\) for the sampled surrogate, the input-batch gradient is
Algorithm 1 applies Eq. (23) and projects each sample independently as shown in the algorithm. Re-sampling \(\omega _t\) changes the stochastic forward map and its full input Jacobian at every iteration, so successive gradients need not follow one narrow surrogate-specific trajectory. This is a local optimization-level description, not a proof that stochastic fusion improves transfer to every architecture.
Experiments
The evaluation addresses five complementary research questions (RQs). RQ1 measures overall behavioral forged-key effectiveness across datasets, watermarking schemes, and surrogate architectures. RQ2 compares FakeMark with prior false-claim results and generic transferable attacks. RQ3 studies cross-architecture generalization. RQ4 examines perceptual quality and detector-oriented artifacts. RQ5 analyzes feature-space behavior and controlled component effects. Computational cost is reported last.
Experimental setup
Datasets and Models. Experiments use CIFAR-10 (Krizhevsky and Hinton 2009) and ImageNet (Deng et al. 2009) to cover low-resolution and large-scale transfer settings. On CIFAR-10, the 11 pretrained surrogates include VGG (Simonyan and Zisserman 2015), ResNet (He et al. 2016), MobileNet-v2 (Sandler et al. 2018), Inception-v3 (Szegedy et al. 2016), DenseNet (Huang et al. 2017), and GoogLeNet (Szegedy et al. 2015) families, using CIFAR-10 checkpoints from the PyTorch_CIFAR10 model collection (huyvnphan 2026). The 11 ImageNet surrogates additionally include Xception (Chollet 2017), EfficientNet-B0 (Tan and Le 2019), Inception-ResNet-v2, and Inception-v4 (Szegedy et al. 2017), with additional weights from the PyTorch Image Models (timm) library. The adversarially trained ResNet-50 (ResNet50_L2, abbreviated R50L2) (Wong et al. 2020) is provided by Salman et al. (2020). The pool spans single-path, multi-branch, dense-connection, and lightweight architectures and also includes an adversarially trained ResNet-50 checkpoint. Watermarks are implemented on Wide ResNet 28\(\times\)10 (WRN-28\(\times\)10) (Zagoruyko and Komodakis 2016) for CIFAR-10 and ResNet-50 (He et al. 2016) for ImageNet. After architecture-level deduplication, the surrogate and target pool contains 16 distinct architectures. R50L2 is treated as a checkpoint/training variant of ResNet-50 rather than a distinct architecture.
Watermark schemes. The evaluation covers six schemes spanning four evaluation categories: model-independent (ADI, Zhang), model-dependent (Frontier), active (DAWN), and parameter-encoding (Uchida, DeepMarks). Zhang et al. (2018) contribute Content, Noise, and Unrelated variants, yielding eight watermark variants in total. All schemes use the official Watermark-Robustness-ToolBox (Dnn-Security 2026); Table 2 summarizes them.
Evaluation protocol. Table 3 reports task accuracy and native verification performance for the retained model–key pairs. Genuine-key sets contain \(N=100\) samples unless otherwise stated; the ImageNet exceptions are Noise (\(N=15\)), Frontier-Stitching (\(N=85\)), and Uchida (\(N=30\)). ImageNet DAWN is excluded because neither evaluated model jointly preserves task accuracy and native watermark response. For forged-key evaluation, each source architecture uses a fixed set of \(N=100\) unique inputs assigned to target label 6, with the original label constrained to differ from the target. Following prior targeted-transfer studies Zhao et al. (2021); Byun et al. (2022), all attacks use \(\epsilon =16/255\), step size \(\eta =2/255\), and \(T_{\text {iter}}=300\). The CIFAR-10 setting uses \((\alpha _{\max },p)=(0.75,0.25)\), whereas ImageNet uses (0.50, 0.10); the clean-reference batch size is \(B=100\). ImageNet inputs are resized to 256 pixels, center-cropped to \(224\times 224\), and normalized with ImageNet statistics. Results for parameter-encoding methods describe behavioral target-label responses rather than native parameter decoding. Controlled multi-run experiments use seeds 0, 1, and 2 and report mean ± sample standard deviation. Experiments are conducted on NVIDIA RTX 3090 GPUs.
Evaluation metrics. Behavioral forged-key performance is quantified by False Claim Accuracy (FcAcc), which measures target-label agreement under forged key pairs, adapted from Lukas et al. (2022). The FcAcc metric is defined as:
Equation (24) uses N samples, where \(x_i\in \mathcal {X}\) is a forged key sample and \(y_i\) is its designated target label. The tables report raw FcAcc to characterize the label-matching component of behavioral ownership evidence. Because the evaluated schemes use different native verification rules and do not share a common acceptance threshold, claim-level acceptance is not pooled across schemes; parameter-encoding models are interpreted only as behavioral diagnostics. Additionally, False Claim True-label Retention (FcTrue) is defined as the fraction of forged key samples for which the target model’s prediction still equals the original ground-truth label, i.e.,
In Eq. (25), \(y_i^{\text {orig}}\) is the true class of the clean input before perturbation. FcTrue is retained as a descriptive label-retention statistic; it is affected by the victim’s clean correctness on the evaluated set and is not interpreted as an independent measure of attack strength. All evaluated inputs satisfy \(y_i^{\text {orig}}\ne vk_b\), but the analysis does not condition on clean surrogate or victim correctness. Because the schemes do not share a common native acceptance threshold, the reported FcAcc values characterize behavioral evidence rather than pooled claim-level acceptance.
Overall behavioral forged-key effectiveness
Tables 4 and 5 ask whether forged behavioral evidence can arise across watermark categories and surrogate architectures under the common protocol in Section Experimental setup”. FcAcc is the primary metric, and bold underlining marks the largest FcAcc and smallest FcTrue for each watermark variant. CIFAR-10 contains multiple high-transfer source models across all eight variants, but Inception-v3 is consistently weaker than the strongest sources. ImageNet shows a wider spread: R50L2 reaches 0.89–0.99 and DenseNet121 reaches 0.76–0.93, whereas RN18 and VGG16 remain near zero. These results support a narrower existence claim: behavioral target-label evidence can be fabricated in multiple audited settings. They do not imply uniform compromise of every scheme or architecture. The reported maxima are retrospective upper bounds over the evaluated surrogate pool, not an operational guarantee that a high-transfer surrogate can be selected without victim feedback. The near-zero and high-transfer cases jointly indicate that architecture and checkpoint compatibility is a central condition, consistent with the controlled source comparison in Table 8.
Comparison with existing and generic attacks
Existing false-claim baseline. Table 6 provides a cross-protocol context by comparing FakeMark’s audited category maxima with the false-claim results reported by Liu et al. (2024); their public artifact is available in the authors’ repository (ssg-research 2026). The two studies differ in attack construction, verification scope, and implementation, so this table indicates that substantial behavioral target-label responses appear in both studies; it does not support an assumption-matched superiority claim. For parameter-encoding methods, FakeMark reports only the behavioral target-label response, not native parameter decoding. The ImageNet Active entry is unavailable because no DAWN model satisfies the joint task-accuracy and native-response inclusion criteria in Section “Experimental setup”.
Generic transferable attacks. Table 7 compares FakeMark with canonical attack generators under a matched protocol. The sample manifest, ResNet50 surrogate, ADI target model, target label, perturbation budget, iteration count, and three seeds are held fixed. FakeMark reaches a 0.990±0.000 target-label attack success rate (ASR), compared with 0.860–0.940 for PGD, the momentum iterative fast gradient sign method (MI-FGSM), and the diverse-input fast gradient sign method (DI-FGSM). Unlike Table 6, this fixed-checkpoint comparison supports a method-level relative-transfer statement. It is not a comprehensive leaderboard of recent targeted-transfer methods. The ADI model has a native genuine-key score of 0.170, so the experiment remains an attack-generator diagnostic rather than evidence that a scheme-valid ADI verifier is compromised.
Cross-architecture generalization
Table 8 isolates source-architecture sensitivity while fixing the sample set, ADI target model, target label, attack budget, and three-seed protocol used in Table 7. MobileNetV2 and ResNet50 both reach 0.990±0.000, DenseNet121 reaches 0.907±0.023, and Inception-v3 reaches 0.727±0.055.
The ordering is not explained by model size or computation alone. Table 13 shows that MobileNetV2 has the fewest parameters, the lowest floating-point operation (FLOP) count, and the lowest forward latency of these four sources, yet it matches ResNet50. Inception-v3 has the largest FLOP count and the lowest transfer. Table 12 also shows a local transfer benefit from batch permutation and channel-wise stochastic mixing in one controlled setting. This component result does not identify a single architectural cause. The near-zero RN18 and VGG16 ImageNet results further support an architecture-compatibility interpretation rather than a monotonic capacity explanation or a universal transfer claim.
Perceptual quality and detectability
Forged inputs are assessed through visual and perceptual quality, input-level screening, and feature/confidence-based detectors. Figure 3 shows representative clean inputs and forged-key examples.
Visual and perceptual quality. Figure 4 provides qualitative attention maps, while Fig. 5 summarizes peak signal-to-noise ratio (PSNR) and structural similarity index measure (SSIM). CIFAR-10 PSNR ranges from 25.73 to 26.83 dB with SSIM 0.88–0.91; ImageNet PSNR ranges from 24.38 to 27.35 dB with SSIM 0.72–0.82. The perturbations remain bounded, but perceptual quality varies across settings, especially on ImageNet; Grad-CAM is only qualitative evidence.
Input-level screening. Table 9 reports exploratory threshold screening and feature-squeezing prediction changes. The diagnostic thresholds are \(L_2>3.0\), \(L_\infty>0.15\), Kolmogorov–Smirnov (KS) \(>0.08\), and an out-of-range ratio above \(1\%\). Feature-squeezing entries report genuine/forged prediction-change rates for 50 samples per set. ADI remains below all four aggregate thresholds, whereas Frontier and DAWN exceed three; median filtering changes forged predictions more often than legitimate predictions for all three schemes. These scheme-dependent outcomes characterize different artifact profiles and do not establish broad evasion of input screening.
Feature- and confidence-based detectors. The Mahalanobis, local intrinsic dimensionality (LID), and Out-of-DIstribution detector for Neural networks (ODIN) analyses use the same 26 CIFAR-10 evaluation groups under the main-pool fusion settings. Each forged group contains 100 samples, and the clean calibration set contains 1000 samples. Mahalanobis distances use class-conditional diagonal covariance estimated from 5000 clean ResNet50 average-pooling features; LID uses \(k=20\); and ODIN uses temperature \(T=1000\) with one confidence-increasing input step. Table 10 aggregates this common pool to avoid detector-specific selection. Relative to clean calibration, forged groups have higher average flag rates under all three detectors, with the largest increase under LID. The evidence therefore indicates detector-dependent artifacts, not broad detector evasion.
Feature-space diagnostics
Table 11 contains two exploratory diagnostics that are not used to establish the main effectiveness estimates. Panel A reports descriptive forged-versus-legitimate measurements in normalized model-input space rather than raw pixel space. Panel B isolates ReLU masking under an explicit feature-matching objective using 100 CIFAR-10 input/reference pairs, a ResNet50 final residual block, \(\epsilon =16/255\), step size 2/255, 20 optimization steps, and seed 42. This diagnostic compares pre- and post-ReLU representations but does not coincide with the layer outputs or target-logit objective used by FakeMark.
Panel A contains no random-pair null distribution, so its low-to-moderate cosine similarities are descriptive and cannot establish recovery of a scheme’s true trigger direction. In Panel B, post-ReLU masking increases the zero-gradient fraction under the separate feature-matching objective. The similar input-gradient norms, together with the different objective, prevent this diagnostic from directly explaining FakeMark’s transfer results.
Matched component analysis
The component analysis uses one controlled CIFAR-10 setting to avoid mixing historical evaluation pools with the audited main results. It uses the common attack parameters from Section “Experimental setup”, an Inception-v3 surrogate, and a Noise-watermarked WRN-28\(\times\)10 target model. The four conditions compare the full method with removal of batch shuffling, replacement of the clean-reference cache by current-batch features, and sample-wise rather than channel-wise interpolation. Values are mean ± sample standard deviation over seeds 0, 1, and 2. Because the stochastic components interact, the analysis uses one-factor-at-a-time removals or replacements rather than a cumulative add-on sequence. Each ablation row changes one component while holding the manifest, checkpoint, attack budget, and remaining components fixed.
The full condition exceeds no-shuffle and scalar mixing by 0.080 and 0.137 mean FcAcc, respectively. This gain is not explained by source-model success alone: removing the clean cache raises source ASR to 1.000 but lowers mean victim FcAcc to 0.673. The comparison therefore provides local evidence that the stochastic transfer components affect cross-model behavior rather than merely optimizing the surrogate. Replacing the clean cache lowers the mean by 0.053 but has high seed variance, so a stable independent cache effect is not claimed beyond this fixed setting.
Additional paired clean-model diagnostics showed comparable targeted transfer in several settings. These controls do not establish a universal watermark-specific amplification effect. A one-seed CIFAR-10 sweep over all ten target labels produced Noise-watermarked FcAcc between 0.93 and 1.00 (mean 0.98). Target label 6 is therefore not an isolated best case in this controlled setting.
Computational cost
Table 13 reports model size, FLOPs, forward latency, and the latency of one targeted PGD update. Measurements use an NVIDIA RTX 3090, batch size 100, and \(3\times 32\times 32\) inputs. FLOPs count convolutional and fully connected operations as twice the number of multiply–accumulate operations; the PGD measurement includes one targeted cross-entropy forward–backward update. These are backbone-level references and exclude the additional feature caching, permutation, and interpolation used by the complete FakeMark procedure.
Discussion and limitations
Practical implications
The experiments show that independently constructed keys can reproduce the target-label behavioral component used by inference-based ownership checks even when construction is separated from the victim. Additional paired clean-model diagnostics show comparable transfer in several settings, so the current evidence does not establish a universal watermark-specific amplification effect. This weakens the evidentiary value of trigger responses: a third-party arbiter observes successful behavior but cannot infer how that evidence was produced. The strong transfer obtained from the adversarially trained R50L2 surrogate further shows that surrogate selection materially affects transfer performance; robustness of a watermarked target model remains outside the present evaluation.
Limitations and scope
FakeMark assumes white-box surrogate gradients. The CIFAR-10 surrogates and watermark targets use the same standard training split, so substantial sample overlap is part of the controlled evaluation. For ImageNet, only dataset-level overlap can be established because the sample-level training composition of the externally pretrained surrogates is unavailable. The linear theory is explanatory rather than a complete model of deep networks, and transfer remains model- and target-dependent, with Inception-v3 as a weaker case. The main tables use one fixed target label. An auxiliary one-seed sweep over all ten CIFAR-10 targets is included in the scope analysis, whereas the matched component analysis uses three generation seeds. The main evaluation also uses one surrogate at a time. Surrogate ensembles may improve transfer, but establishing that effect requires a matched-compute comparison and remains outside the present evaluation. The detector study is not a fully tuned learned-detector benchmark. Finally, the ImageNet DAWN is excluded because none of the evaluated models jointly preserves task performance and native watermark response. The study is limited to image classification.
Toward more secure ownership verification
Ownership protocols should combine behavioral tests with evidence that is harder to construct after training. Candidate mechanisms include cryptographic commitments to keys or training provenance, structural fingerprints unavailable from black-box outputs, and multi-factor validation under model post-processing. Such mechanisms would reduce reliance on a single trigger-response score. FakeMark is intended to expose this protocol weakness and motivate stronger verification.
Conclusion
FakeMark demonstrates high target-label agreement for surrogate-guided forged keys across audited model–key pairs without victim access during construction. Auxiliary clean-model controls do not establish a universal watermark-specific amplification mechanism. Successful trigger responses alone do not establish training provenance. Ownership verification should instead pair behavioral evidence with independent provenance or structural signals.
Availability of data and materials
The source code and experimental data supporting the findings of this study are publicly available at https://anonymous.4open.science/r/FakeMark
References
Deng J, Dong W, Socher R, Li L-J, Li K, Fei-Fei, L (2009) Imagenet: a large-scale hierarchical image database. In: 2009 IEEE conference on computer vision and pattern recognition, IEEE. pp 248–255
He K, Zhang X, Ren S, Sun J (2016) Deep residual learning for image recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp 770–778
Krishna K, Tomar GS, Parikh AP, Papernot N, Iyyer M (2020) Thieves on sesame street! Model extraction of Bert-based APIs. In: International conference on learning representations
Jagielski M, Carlini N, Berthelot D, Kurakin A, Papernot N (2020) High accuracy and high fidelity extraction of neural networks. In: 29th USENIX security symposium (USENIX Security 20). pp 1345–1362
Carlini N, Jagielski M, Mironov I (2020) Cryptanalytic extraction of neural network models. In: Annual international cryptology conference. Springer, pp 189–218
Adi Y, Baum C, Cisse M, Pinkas B, Keshet J (2018) Turning your weakness into a strength: watermarking deep neural networks by backdooring. In: 27th USENIX security symposium (USENIX Security 18). pp 1615–1631
Lukas N, Jiang E, Li X, Kerschbaum F (2022) Sok: How robust is image classification deep neural network watermarking?. In: 2022 IEEE symposium on security and privacy (SP). IEEE, pp 787–804
Zhang J, Gu Z, Jang J, Wu H, Stoecklin MP, Huang H, Molloy I (2018) Protecting intellectual property of deep neural networks with watermarking. In: Proceedings of the 2018 on Asia conference on computer and communications security. pp 159–172
Le Merrer E, Perez P, Trédan G (2020) Adversarial frontier stitching for remote neural network watermarking. Neural Comput Appl 32(13):9233–9244
Szyller S, Atli BG, Marchal S, Asokan N (2021) Dawn: dynamic adversarial watermarking of neural networks. In: Proceedings of the 29th ACM international conference on multimedia. pp 4417–4425
Sutton OJ, Zhou Q, Leete G, Gorban AN, Tyukin IY (2025) Staining and locking computer vision models without retraining. In: Proceedings of the IEEE/CVF international conference on computer vision (ICCV). pp 2346–2355
Xiao Y, Ye Q, Liang Z, Li H, Li R, Zheng H, Hu H (2026) Class-feature watermark: a resilient black-box watermark against model extraction attacks. In: Proceedings of the AAAI conference on artificial intelligence, vol 40, pp 35903–35912
Yang Y, Chen X, Xuan Y, Zhao Z, Zhao X, Li H (2026) Deeptracer: tracing stolen model via deep coupled watermarks. In: Proceedings of the AAAI conference on artificial intelligence, vol 40, pp 27711–27718. https://doi.org/10.1609/aaai.v40i33.39992
Fan L, Ng KW, Chan CS (2019) Rethinking deep neural network ownership verification: embedding passports to defeat ambiguity attacks. Adv Neural Inf Process Syst 32
Zhao B, Chen H, Zhang J, Zhang W, Yu N (2024) Dual-verification-based model fingerprints against ambiguity attacks. Cybersecurity 7(1):78. https://doi.org/10.1186/s42400-024-00298-6
Liu J, Zhang R, Szyller S, Ren K, Asokan N (2024) False claims against model ownership resolution. In: 33rd USENIX security symposium (USENIX Security 24). pp 6885–6902
Yao Y, Song J, Jin J (2026) Hashed watermark as a filter: a unified defense against forging and overwriting attacks in neural network watermarking. In: Proceedings of the AAAI conference on artificial intelligence, vol 40, pp 35994–36002. https://doi.org/10.1609/aaai.v40i42.40915
Byun J, Kwon M-J, Cho S, Kim Y, Kim C (2023) Introducing competition to boost the transferability of targeted adversarial examples through clean feature mixup. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition (CVPR), pp 24648–24657
Liang K, Dai X, Li Y, Wang D, Xiao B (2025) Improving transferable targeted attacks with feature tuning mixup. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition (CVPR). pp 25802–25811
Li S, He C, Ma X, Zhu BB, Wang S, Hu H, Zhang D, Yu L (2025) Enhancing adversarial transferability with checkpoints of a single model’s training. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition (CVPR). pp 20685–20694
Li Z, Wang W, Li J, Zhang S, Hu Y, Guo S (2025) Enhancing transferability of targeted adversarial examples via inverse target gradient competition and spatial distance stretching. In: Proceedings of the IEEE/CVF international conference on computer vision (ICCV), pp. 3716–3725
Uchida Y, Nagai Y, Sakazawa S, Satoh S (2017) Embedding watermarks into deep neural networks. In: Proceedings of the 2017 ACM on international conference on multimedia retrieval. pp 269–277
Chen H, Rouhani BD, Fu C, Zhao J, Koushanfar F (2019) Deepmarks: a secure fingerprinting framework for digital rights management of deep learning models. In: Proceedings of the 2019 on international conference on multimedia retrieval (ICMR). pp 105–113
Koda S, Morikawa I (2025) Bounding-box watermarking: defense against model extraction attacks on object detectors. In: Joint European conference on machine learning and knowledge discovery in databases. Springer, pp 295–312
Goodfellow IJ, Shlens J, Szegedy C (2015) Explaining and harnessing adversarial examples. In: International conference on learning representations
Dong Y, Pang T, Su H, Zhu J (2019) Evading defenses to transferable adversarial examples by translation-invariant attacks. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp 4312–4321
Zhao Z, Liu Z, Larson M (2021) On success and simplicity: a second look at transferable targeted attacks. Adv Neural Inf Process Syst 34:6115–6128
Wang X, He K (2021) Enhancing the transferability of adversarial attacks through variance tuning. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp 1924–1933
Byun J, Cho S, Kwon M-J, Kim H-S, Kim C (2022) Improving the transferability of targeted adversarial examples through object-based diverse input. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp 15244–15253
Krizhevsky A, Hinton G (2009) Learning multiple layers of features from tiny images
Simonyan K, Zisserman A (2015) Very deep convolutional networks for large-scale image recognition. In: International conference on learning representations
Sandler M, Howard A, Zhu M, Zhmoginov A, Chen L-C (2018) Mobilenetv 2: inverted residuals and linear bottlenecks. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp 4510–4520
Szegedy C, Vanhoucke V, Ioffe S, Shlens J, Wojna Z (2016) Rethinking the inception architecture for computer vision. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp 2818–2826
Huang G, Liu Z, Van Der Maaten L, Weinberger KQ (2017) Densely connected convolutional networks. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp 4700–4708
Szegedy C, Liu W, Jia Y, Sermanet P, Reed S, Anguelov D, Erhan D, Vanhoucke V, Rabinovich A (2015) Going deeper with convolutions. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp 1–9
huyvnphan: PyTorch CIFAR10: pretrained TorchVision models on the CIFAR-10 dataset. GitHub repository. Accessed 8 Aug 2026. https://github.com/huyvnphan/PyTorch_CIFAR10
Chollet F (2017) Xception: deep learning with depthwise separable convolutions. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp 1251–1258
Tan M, Le Q (2019) Efficientnet: rethinking model scaling for convolutional neural networks. In: International conference on machine learning, PMLR. pp 6105–6114
Szegedy C, Ioffe S, Vanhoucke V, Alemi A (2017) Inception-v4, inception-resnet and the impact of residual connections on learning. In: Proceedings of the AAAI conference on artificial intelligence, vol 31
Wong E, Rice L, Kolter JZ (2020) Fast is better than free: revisiting adversarial training. In: International conference on learning representations
Salman H, Ilyas A, Engstrom L, Kapoor A, Madry A (2020) Do adversarially robust imagenet models transfer better? Adv Neural Inf Process Syst 33:3533–3545
Zagoruyko S, Komodakis N (2016) Wide residual networks. In: British machine vision conference
dnn-security: watermark-robustness-toolbox: official PyTorch implementation. GitHub repository. Accessed 8 Aug 2026. https://github.com/dnn-security/Watermark-Robustness-Toolbox
ssg-research: Falseclaims. GitHub repository. Accessed 8 Aug 2026. https://github.com/ssg-research/Falseclaims
Acknowledgements
Not applicable.
Funding
This work is supported by Changsha Key Science and Technology Project under the “Unveiling and Commanding” Initiative under Grant No. kq2503009, the project of Science, Technology and Innovation Commission of Shenzhen Municipality of China under Grant No. GJHZ20240218114659027, and the Key Research & Development Plan of Hubei Province of China under Grant No. 2024BAB049, and Project supported by the Young Scientists Fund of the National Natural Science Foundation of China (No. 62602129).
Author information
Authors and Affiliations
Contributions
Yutong Wu: Conceptualization, Methodology, Formal analysis, Writing—original draft; Wenyue Li: Data curation, Experiments, Writing—review & editing; Hewang Nie: Methodology, Supervision, Writing—review & editing; Ziqi Zhou: Experiments, Data analysis, Writing—review & editing; Jin Li: Resources, Writing—review & editing; Yixiao Gong: Experiments, Data curation; Songfeng Lu: Supervision, Funding acquisition, Project administration, Writing—review & editing.
Corresponding author
Ethics declarations
Ethics approval and consent to participate
Not applicable. This study does not involve human participants, human data, or animal subjects; all experiments are conducted on publicly available benchmark datasets (CIFAR-10 and ImageNet).
Consent for publication
Not applicable.
Competing interests
The authors declare that they have no competing interests.
Use of generative AI and AI-assisted technologies
ChatGPT was used solely for language polishing and readability improvement, all AI-assisted text was reviewed and edited by the authors.
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/
About this article
Cite this article
Wu, Y., Li, W., Nie, H. et al. FakeMark: gradient-guided false watermark claims via robust feature fusion. Cybersecurity 9, 217 (2026). https://doi.org/10.1186/s42400-026-00654-8
Received:
Accepted:
Published:
Version of record:
DOI: https://doi.org/10.1186/s42400-026-00654-8