Data-free attack removes batch-norm watermarks from federated models
Original title: On the Vulnerabilities and Data-Free Removal of Watermarks in Batch Normalization Layers
Tests on two federated-learning schemes strip ownership marks without training data and with little accuracy loss.
A paper finds fundamental weaknesses in white-box watermarks embedded in batch-normalization layers used for federated-learning ownership checks. The authors describe a practical data-free attack that removes those marks. On two representative schemes, the attack consistently erased the watermark while leaving model performance largely intact, even without representative training data. They argue watermark schemes should be tested under Kerckhoffs-style threat models rather than obscurity.
- The attack does not require representative training data.
- Experiments covered two representative federated-learning watermarking schemes.
- Authors say robustness checks against generic model edits are insufficient.
From the original article
1 min read at arxiv.orgBatch Normalization (BN) layers have become a common choice for embedding white-box watermarks in Federated Learning (FL), providing a simple and effective mechanism for model ownership verification and participant identification. However, previous works have focused on robustness against generic model modifications, leaving the security implications of this design largely unexplored.
By Elena Rodríguez-Lois · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.