CoChat
Sign Up
Cited by 177Advanced Steganography and Watermarking TechniquesPhysical Unclonable Functions (PUFs) and Hardware SecurityAdversarial Robustness in Machine Learning

A survey of Deep Neural Network watermarking techniques

Open access
Li, Yue, Wang, Hongxia, Barni, Mauro·2021·Neurocomputing
DOI 10.1016/j.neucom.2021.07.051
Open this paper in CoChat — free accountOpen PDF

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1016/j.neucom.2021.07.051

Cites

11 of 11 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • PQC transition affects TLS, certificate chains, and secure enclaves due to increased key sizes, larger signature sizes, and hybrid mode requirements during the transition period.

    “PQC transition affects all three due to increased key sizes, larger signature sizes, and hybrid mode requirements during the transition period [17,18].”

    From AI Supply Chain Security: MBOM-PQC Provenance, PQC Attestation, and a Maturity Model for Quantum-Resistant Assurance (2026) · cites this paper as [18]

    The cited paper discusses deep neural network watermarking—for example, watermark payload and robustness in §3.4 (p. 6)—not a post-quantum cryptography transition. Searches for TLS, certificate chains, secure enclaves, larger signatures, and hybrid modes found no passage addressing the attributed claim. (LLM, conf=0.77)

    Experimental — accuracy not yet measured

  • IETF drafts for hybrid key exchange [17,18], PQC certificate profiles, and composite signature formats are still in progress.

    “IETF drafts for hybrid key exchange [17,18], PQC certificate profiles, and composite signature formats are still in progress.”

    From AI Supply Chain Security: MBOM-PQC Provenance, PQC Attestation, and a Maturity Model for Quantum-Resistant Assurance (2026) · cites this paper as [18]

    The passages from §5.2.3 (p. 16) and §2.1 (p. 2) discuss watermarking signatures and secret keys, not cryptographic standards. Searches for IETF hybrid key exchange, PQC certificate profiles, and composite signature formats found no passage addressing whether those drafts are still in progress. (LLM, conf=0.77)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 71

  1. [1][1] Adi, Y., Baum, C., Cisse, M., Pinkas, B., Keshet, J., 2018. Turning your weakness into a strength: Watermarking deep neural networks by backdooring, in: 27th USENIX Security Symposium, pp. 16151631. -
  2. [2][2] Adsumilli, C.B., Farias, M.C., Mitra, S.K., Carli, M., 2005. A robust error concealment technique using data hiding for image and video transmission over lossy channels. IEEE Transactions on Circuits and Systems for Video Technology 15, 1394-1406. -
  3. [3][3] Arnold, M., Chen, X.M., Baum, P., Gries, U., Doerr, G., 2013. A phase-based audio watermarking system robust to acoustic path propagation. IEEE Transactions on Information Forensics and Security 9, 411-425. -
  4. [5][5] Atli, B.G., Xia, Y., Marchal, S., Asokan, N., 2020. Waffle: Watermarking in federated learning. arXiv preprint arXiv:2008.07298 . - · arXiv
  5. [6][6] Barni, M., Bartolini, F., 2004. Watermarking systems engineering: enabling digital assets security and other applications. Crc Press. -
  6. [8][8] Bassia, P., Pitas, I., Nikolaidis, N., 2001. Robust audio watermarking in the time domain. IEEE Transactions on multimedia 3, 232-241. -
  7. [9][9] Celik, M.U., Lemma, A.N., Katzenbeisser, S., van der Veen, M., 2008. Lookup-table-based secure client-side embedding for spreadspectrum watermarks. IEEE Transactions on Information Forensics and Security 3, 475-487. -
  8. [10][10] Chen, B., Wornell, G., 1998. Digital watermarking and information embedding using dither modulation, in: IEEE Second Workshop on Multimedia Signal Processing. doi: 10.1109/MMSP.1998.738946 . - · DOI
  9. [11][11] Chen, B., Wornell, G., 2001. Quantization index modulation: A class of provably good methods for digital watermarking and information embedding. IEEE Transactions on Information Theory 47, 14231443. doi: 10.1109/18.923725 . - · DOI
  10. [12][12] Chen, H., Darvish, B., Koushanfar, F., 2020. Specmark: A spectral watermarking framework for ip protection of speech recognition systems, in: Proceedings of Interspeech 2020, pp. 2312-2316. -
  11. [13][13] Chen, H., Fu, C., Rouhani, B.D., Zhao, J., Koushanfar, F., 2019a. Deepattest: an end-to-end attestation framework for deep neural networks, in: 2019 ACM/IEEE 46th Annual International Symposium on Computer Architecture (ISCA), IEEE. pp. 487-498. -
  12. [15][15] Chen, H., Rouhani, B.D., Fu, C., Zhao, J., Koushanfar, F., 2019c. Deepmarks: A secure fingerprinting framework for digital rights management of deep learning models, in: Proceedings of the 2019 on International Conference on Multimedia Retrieval, pp. 105-113. -
  13. [16][16] Chen, H., Rouhani, B.D., Koushanfar, F., 2019d. Blackmarks: Blackbox multibit watermarking for deep neural networks. arXiv preprint arXiv:1904.00344 . - · arXiv
  14. [17][17] Chen, X., Wang, W., Ding, Y., Bender, C., Jia, R., Li, B., Song, D., 2019e. Leveraging unlabeled data for watermark removal of deep neural networks, in: ICML workshop on Security and Privacy of Machine Learning. -
  15. [18][18] Coates, A., Ng, A., Lee, H., 2011. An analysis of single-layer networks in unsupervised feature learning, in: Proceedings of the fourteenth international conference on artificial intelligence and statistics, pp. 215-223. -
  16. [20][20] Costa, M., 1983. Writing on dirty paper. IEEE Transactions on Information Theory 29, 439-441. doi: 10.1109/TIT.1983.1056659 . - · DOI
  17. [23][23] Cox, I.J., Miller, M.L., Bloom, J.A., Honsinger, C., 2002. Digital watermarking. volume 53. Springer. -
  18. [24][24] Cox, I.J., Miller, M.L., McKellips, A.L., 1999. Watermarking as communications with side information, in: Proceedings of the IEEE, pp. 1127-1141. -
  19. [25][25] Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., Li, J., 2018. Boosting adversarial attacks with momentum, in: Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9185-9193. -
  20. [26][26] Eggers, J.J., Bauml, R., Tzschoppe, R., Girod, B., 2003. Scalar costa scheme for information embedding. IEEE Transactions on Signal Processing 51, 1003-1019. doi: 10.1109/tsp.2003.809366 . - · DOI
  21. [27][27] Enzo, T., Marco, G., Davide, C., Marco, B., 2020. Delving in the loss landscape to embed robust watermarks into neural networks, in: Pro- - ceedings of the 2020 International Conference on Pattern Recognition (ICPR). -
  22. [28][28] Fan, Q., Yang, J., Hua, G., Chen, B., Wipf, D., 2017. A generic deep architecture for single image reflection removal and image smoothing, in: Proceedings of the IEEE International Conference on Computer Vision, pp. 3238-3247. -
  23. [29][29] Furon, T., 2007. A constructive and unifying framework for zerobit watermarking. IEEE Transactions on Information Forensics and Security 2, 149-163. -
  24. [30][30] Ganic, E., Eskicioglu, A.M., 2004. Robust dwt-svd domain image watermarking: embedding data in all frequencies, in: Proceedings of the 2004 Workshop on Multimedia and Security, pp. 166-174. -
  25. [31][31] Goodfellow, I., Bengio, Y., Courville, A., 2016. Deep learning. MIT press. -
  26. [33][33] Gruhl, D., Lu, A., Bender, W., 1996. Echo hiding, in: International Workshop on Information Hiding, Springer. pp. 295-315. -
  27. [34][34] Guo, J., Potkonjak, M., 2018. Watermarking deep neural networks for embedded systems, in: 2018 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), IEEE. pp. 1-8. -
  28. [35][35] Guo, J., Potkonjak, M., 2019. Evolutionary trigger set generation for dnn black-box watermarking. arXiv preprint arXiv:1906.04411 . - · arXiv
  29. [36][36] Isola, P., Zhu, J.Y., Zhou, T., Efros, A.A., 2017. Image-to-image translation with conditional adversarial networks, in: Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1125-1134. -
  30. [37][37] Jia, H., Choquette-Choo, C.A., Papernot, N., 2021. Entangled watermarks as a defense against model extraction, in: 30th USENIX Security Symposium. -
  31. [39][39] Kay, S.M., 1993. Fundamentals of statistical signal processing. Prentice Hall PTR. -
  32. [40][40] Khaldi, K., Boudraa, A.O., 2012. Audio watermarking via emd. IEEE transactions on audio, speech, and language processing 21, 675-680. -
  33. [42][42] Kirovski, D., Malvar, H., Yacobi, Y., 2002. Multimedia content screening using a dual watermarking and fingerprinting system, in: Proceedings of the tenth ACM international conference on Multimedia, pp. 372-381. -
  34. [43][43] Kolouri, S., Saha, A., Pirsiavash, H., Hoffmann, H., 2020. Universal Litmus Patterns: Revealing Backdoor Attacks in CNNs, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 301-310. -
  35. [44][44] Kuribayashi, M., Tanaka, T., Funabiki, N., 2020. Deepwatermark: Embedding watermark into dnn model, in: 2020 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), IEEE. pp. 1340-1346. -
  36. [45][45] Le Merrer, E., Perez, P., Trédan, G., 2019. Adversarial frontier stitching for remote neural network watermarking. Neural Computing and Applications 32, 9233-9244. doi: 10.1007/s00521-019-04434-z . - · DOI
  37. [46][46] Li, H., Willson, E., Zheng, H., Zhao, B.Y., 2019a. Persistent and unforgeable watermarks for deep neural networks. arXiv preprint arXiv:1910.01226 . - · arXiv
  38. [47][47] Li, Y., Tondi, B., Barni, M., 2020a. Spread-transform dither modulation watermarking of deep neural network. arXiv preprint arXiv:2012.14171 . - · arXiv
  39. [49][49] Li, Y., Wu, B., Jiang, Y., Li, Z., Xia, S.T., 2020b. Backdoor learning: - A survey. arXiv preprint arXiv:2007.08745 . - · arXiv
  40. [50][50] Li, Z., Hu, C., Zhang, Y., Guo, S., 2019b. How to prove your model belongs to you: a blind-watermark based framework to protect intellectual property of dnn, in: Proceedings of the 35th Annual Computer Security Applications Conference, pp. 126-137. -
  41. [52][52] Lukas, N., Zhang, Y., Kerschbaum, F., 2021. Deep neural network fingerprinting by conferrable adversarial examples, in: 2021 International Conference on Learning Representations (ICLR). -
  42. [53][53] Luo, M., Bors, A.G., 2011. Surface-preserving robust watermarking of 3-d shapes. IEEE Transactions on Image Processing 20, 28132826. -
  43. [54][54] M. Barni, F. Bartolini, A.P., 2001. Improved wavelet-based watermarking through pixel-wise masking. IEEE Transactions on Image Processing 10, 783-791. -
  44. [55][55] Miller, M.L., Doërr, G.J., Cox, I.J., 2004. Applying informed coding and embedding to design a robust high-capacity watermark. IEEE Transactions on image processing 13, 792-807. -
  45. [56][56] Nagai, Y., Uchida, Y., Sakazawa, S., Satoh, S., 2018. Digital watermarking for deep neural networks. International Journal of Multimedia Information Retrieval 7, 3-16. doi: 10.1007/s13735-018-0147-1 . - · DOI · Paper page
  46. [57][57] Namba, R., Sakuma, J., 2019. Robust watermarking of neural network with exponential weighting, in: Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security, pp. 228240. -
  47. [59][59] Ohbuchi, R., Ueda, H., Endoh, S., 2002. Robust watermarking of vector digital maps, in: Proceedings. IEEE International Conference on Multimedia and Expo, IEEE. pp. 577-580. -
  48. [61][61] Podilchuk, C.I., Delp, E.J., 2001. Digital watermarking: algorithms and applications. IEEE signal processing Magazine 18, 33-46. -
  49. [63][63] Rouhani, B.D., Chen, H., Koushanfar, F., 2019. Deepsigns: an endto-end watermarking framework for protecting the ownership of deep neural networks, in: The 24th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS). ACM. -
  50. [64][64] Sakazawa, S., Myodo, E., Tasaka, K., Yanagihara, H., 2019. Visual decoding of hidden watermark in trained deep neural network, in: 2019 IEEE Conference on Multimedia Information Processing and Retrieval (MIPR), IEEE. pp. 371-374. -
  51. [65][65] Seo, J.S., Yoo, C.D., 2006. Image watermarking based on invariant regions of scale-space representation. IEEE Transactions on Signal Processing 54, 1537-1549. -
  52. [67][67] Shehab, M., Bertino, E., Ghafoor, A., 2007. Watermarking relational databases using optimization-based techniques. IEEE transactions on Knowledge and Data Engineering 20, 116-129. -
  53. [68][68] Singh, A.K., Sharma, N., Dave, M., Mohan, A., 2012. A novel technique for digital image watermarking in spatial domain, in: 2012 2nd IEEE International Conference on Parallel, Distributed and Grid Computing, IEEE. pp. 497-501. -
  54. [69][69] Singh, N., Jain, M., Sharma, S., 2013. A survey of digital watermarking techniques. International Journal of Modern Communication Technologies and Research 1, 265852. -
  55. [70][70] Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Good- - fellow, I., Fergus, R., 2014. Intriguing properties of neural networks, in: 2014 International Conference on Learning Representations (ICLR). -
  56. [71][71] Szyller, S., Atli, B.G., Marchal, S., Asokan, N., 2019. Dawn: Dynamic adversarial watermarking of neural networks. arXiv preprint arXiv:1906.00830 . - · arXiv
  57. [72][72] Tew, Y., Wong, K., 2014. Information hiding in HEVC standard using adaptive coding block size decision, in: 2014 IEEE International Conference on Image Processing (ICIP), IEEE. pp. 5502-5506. -
  58. [73][73] Trappe, W., Wu, M., Wang, Z.J., Liu, K.R., 2003. Anti-collusion fingerprinting for multimedia. IEEE Transactions on Signal Processing 51, 1069-1087. -
  59. [74][74] Tsui, T.K., Zhang, X., Androutsos, D., 2008. Color image watermarking using multidimensional fourier transforms. IEEE Transactions on Information Forensics and Security 3, 16-28. doi: 10.1109/TIFS.2007. 916275 . - · DOI
  60. [75][75] Uchida, Y., Nagai, Y., Sakazawa, S., Satoh, S., 2017. Embedding watermarks into deep neural networks, in: Proceedings of the 2017 ACMonInternational Conference on Multimedia Retrieval, pp. 269277. -
  61. [76][76] Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., Zhao, B.Y., 2019. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks, in: 2019 IEEE Symposium on Security and Privacy (SP), IEEE. pp. 707-723. -
  62. [78][78] Wang, T., Kerschbaum, F., 2019a. Attacks on digital watermarks for deep neural networks, in: ICASSP 2019-2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), IEEE. pp. 2622-2626. -
  63. [79][79] Wang, T., Kerschbaum, F., 2019b. Riga: Covert and robust white-box watermarking of deep neural networks. arXiv preprint arXiv:1910.14268 . - · arXiv
  64. [80][80] Wang, T., Kerschbaum, F., 2019c. Robust and undetectable white-box watermarks for deep neural networks. arXiv preprint arXiv:1910.14268 . - · arXiv
  65. [81][81] Wang, X., Peng, Y., Lu, L., Lu, Z., Bagheri, M., Summers, R.M., 2017. Chestx-ray8: Hospital-scale chest x-ray database and benchmarks on weakly-supervised classification and localization of commonthorax diseases, in: Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2097-2106. -
  66. [82][82] Wu, H., Liu, G., Yao, Y., Zhang, X., 2020. Watermarking neural networks with watermarked images. IEEE Transactions on Circuits and Systems for Video Technology . -
  67. [83][83] Xiang, Y., Natgunanathan, I., Guo, S., Zhou, W., Nahavandi, S., 2014. Patchwork-based audio watermarking method robust to desynchronization attacks. IEEE/ACM Transactions on Audio, Speech, and Language Processing 22, 1413-1423. -
  68. [85][85] Zhang, H., Patel, V.M., 2018. Density-aware single image de-raining using a multi-stream dense network, in: Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 695-704. -
  69. [86][86] Zhang, J., Chen, D., Liao, J., Fang, H., Zhang, W., Zhou, W., Cui, H., Yu, N., 2020. Model watermarking for image processing networks, in: Proceedings of the AAAI Conference on Artificial Intelligence, Association for the Advancement of Artificial Intelligence (AAAI). pp. 12805-12812. doi: 10.1609/aaai.v34i07.6976 . - · DOI
  70. [87][87] Zhang, J., Gu, Z., Jang, J., Wu, H., Stoecklin, M.P., Huang, H., Molloy, I., 2018. Protecting intellectual property of deep neural networks with watermarking, in: Proceedings of the 2018 on Asia Conference on Computer and Communications Security, pp. 159-172. -
  71. [89][89] Zhao, X., Wu, H., Zhang, X., 2020b. Watermarking graph neural networks by random graphs. arXiv preprint arXiv:2011.00512 . · arXiv

Cited by

Sorted by citations

Authors
Li, Y., Wang, H., & Barni, M.
Affiliations
  • Southwest Jiaotong University (CN)
  • Sichuan University (CN)
  • University of Siena (IT)
Corresponding author
Wang, Hongxia
ORCID
Venue
Neurocomputing
Publisher
Elsevier BV
Published
2021-10
Volume
461
Pages
171-193
ISSN
0925-2312 (ISSN-L)
DOI
10.1016/j.neucom.2021.07.051
OpenAlex
W3185788529
Cited by
177
References
11
Citations by year
2026: 27 · 2025: 48 · 2024: 44 · 2023: 35 · 2022: 20 · 2021: 3
FWCI
9.17
Type
journal article
Language
en
Open access
Licence
Locations
  • Neurocomputing (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • Use Siena air (University of Siena) (submittedVersion, cc-by-nc-nd)
  • arXiv (Cornell University)
Funders
  • Fundamental Research Funds for the Central Universities (YJ201881)
  • National Natural Science Foundation of China (61972269)
  • China Scholarship Council (201907000056)
Topics
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Advanced Steganography and Watermarking Techniques
  • Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
deep neural network watermarking, intellectual property protection, digital watermarking, multimedia watermarking

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review