发表机构
Fraunhofer Institute for Integrated Circuits IIS; University of Technology Nürnberg (UTN)（弗劳恩霍夫集成电路研究所; 纽伦堡工业大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
TwinMark提出一种双通道水印方案，通过协方差投影和Fisher对齐线性载体读取共享秘密，在特征与logit蒸馏攻击下提供可证明的检测能力，并跨多种架构和任务验证其鲁棒性。
AI 中文摘要
我们提出TwinMark，一种水印方案，它通过模型输出摘要的两个互补线性泛函读取单个SHAKE128秘密：一个针对载体集协方差的协方差投影器（cov-Feat）和一个从类均值logit解码的类条件Fisher对齐线性载体（cc-FALC）。这两个读出共享一个比特向量，并覆盖部署视觉模型的两个提取面：一个受KL知识蒸馏（KD）（标准KL-KD）攻击的分类器API，以及一个受特征匹配KD（FM-KD）攻击的仅表示宿主。每个读出都允许教师可测量的后验证书，该证书对蒸馏后检测能力给出下界，并且两个通道在受限的OR规则下组合，其测试统计量（校准的零假设或比特投票）由暴露面选择。cov-Feat允许秩无关算子范数证书，cc-FALC允许中心化logit间隙证书，该证书将比特容量与类别数解耦：在m=100类中K=1024（10.24倍过编码）时，比特投票达到z=23.0西格玛，教师准确率成本为+0.9±0.2个百分点。在CIFAR-10、CIFAR-100和Mini-ImageNet上的13种攻击中，TwinMark在每个攻击后模型保留任务效用的单元上验证，在跨架构蒸馏到ResNet-18/50、VGG-16和MobileNet-V3时存活，并移植到GNSS少样本、VOC检测、ISIC分割和STL-10 SimCLR。
英文摘要
Knowledge distillation can copy a deployed model by training a student on its logits or features. The student inherits a watermark only through the output it imitates. Both outputs therefore need a mark, yet most distillation watermarks cover only one. TwinMark instead writes one secret payload into what each distillation objective preserves, the second moment of normalized features and the class-mean logits. Both marks use linear readouts that give sufficient conditions for bit recovery on fixed audit inputs, while detection is tested separately under a declared null. In a ten-seed CIFAR-100 study, each mark is detected in every student that imitates its output and stays at chance otherwise. Marking costs the teacher 1.3 accuracy points and the audited embedding of feature-distilled students 4.4 nearest-neighbor points. Second-moment bounds certify 50 to 60 of 64 bits in every feature-distilled student, whereas pointwise bounds and the evaluated logit bounds certify none. Class multiplexing, which signs the payload per class, raises the logit decoder's rank ceiling and lowers bit errors at equal energy, and even at 10x over-encoding, 1,024 bits on 100 classes stay detectable in every student. Detection extends to 39 of 40 students of four other architectures and to segmentation, object detection and satellite-navigation jammer detection and classification. These results establish output-matched inheritance under the evaluated protocols, not resistance to all utility-preserving transformations.
Comments3 figures, 20 pages
