ROSE: Extended Evaluation of RObust and SEcure Black-Box DNN Watermarking

Summary

This paper extends ROSE, a black-box watermarking protocol for MLaaS settings that quantifies ownership through statistical rarity measured in bits and adversarial computational work. Experiments on CNNs, ResNets and Vision Transformers show primary-task accuracy is preserved at low trigger fractions, watermark recovery is high, and rarity values reach several hundred bits, including under fine-tuning, pruning, quantization and sanitizers such as Neural Cleanse and Neural Laundering. The authors limit their empirical claims to the image-classification architectures they tested.