Distributed Multi-watermark Embedding for Robust Neural Network Ownership Verification

Deep neural networks constitute a significant investment in intellectual property, underscoring the need for reliable ownership verification.While existing methods demonstrate robustness to common attacks, they typically embed a single watermark, and a single bit error can prevent verification entirely.This work proposes a post-training watermarking framework that embeds 16 independent 16-bit watermarks (total 256 bits) using global importancebased weight selection, round-robin allocation, and fixed-delta modulation.Unlike single-watermark methods, which fail verification if the hash is corrupted, our distributed scheme enables proof of ownership as long as at least one watermark remains intact, a crucial advantage against strong attacks, and this is demonstrated in our single-watermark versus multi-watermark comparison.A comprehensive evaluation across the custom Convolutional Neural Network (CNN) showed that all 16 watermarks withstand fine-tuning, pruning, and quantization; results on pretrained models are architecture-dependent.Under Gaussian noise and adversarial perturbation, the watermark's resilience depends on the embedding strength and architecture type.Watermarks are only successfully removed by adversarial perturbation after catastrophic degradation of the model's accuracy.These results demonstrate that embedding multiple distributed watermarks provides progressive degradation, suggesting a trade-off between watermark removal and model functionality.