{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/explanation-as-a-watermark-towards-harmless","title":"Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attribution","arxiv_id":"2405.04825","date":"2024-05-08","proceeding":null,"authors":["Shuo Shao","Yiming Li","Hongwei Yao","Yiling He","Zhan Qin","Kui Ren"],"abstract":"Ownership verification is currently the most critical and widely adopted post-hoc method to safeguard model copyright. In general, model owners exploit it to identify whether a given suspicious third-party model is stolen from them by examining whether it has particular properties `inherited' from their released models. Currently, backdoor-based model watermarks are the primary and cutting-edge methods to implant such properties in the released models. However, backdoor-based methods have two fatal drawbacks, including harmfulness and ambiguity. The former indicates that they introduce maliciously controllable misclassification behaviors ($i.e.$, backdoor) to the watermarked released models. The latter denotes that malicious users can easily pass the verification by finding other misclassified samples, leading to ownership ambiguity. In this paper, we argue that both limitations stem from the `zero-bit' nature of existing watermarking schemes, where they exploit the status ($i.e.$, misclassified) of predictions for verification. Motivated by this understanding, we design a new watermarking paradigm, $i.e.$, Explanation as a Watermark (EaaW), that implants verification behaviors into the explanation of feature attribution instead of model predictions. Specifically, EaaW embeds a `multi-bit' watermark into the feature attribution explanation of specific trigger samples without changing the original prediction. We correspondingly design the watermark embedding and extraction algorithms inspired by explainable artificial intelligence. In particular, our approach can be used for different tasks ($e.g.$, image classification and text generation). Extensive experiments verify the effectiveness and harmlessness of our EaaW and its resistance to potential attacks.","url_abs":"https://arxiv.org/abs/2405.04825v2","url_pdf":"https://arxiv.org/pdf/2405.04825v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"explanation-as-a-watermark-towards-harmless","repo_url":"https://github.com/shaoshuo-ss/eaaw","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"explainable-artificial-intelligence","task_name":"Explainable artificial intelligence"},{"task_slug":"image-classification","task_name":"Image Classification"},{"task_slug":"text-generation","task_name":"Text Generation"},{"task_slug":"image-classification","task_name":"image-classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2405.04825","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2405.04825"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/shaoshuo-ss/eaaw","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":9,"unverified":2},"by_repo_kind":{"official":{"samples":11,"ran":9,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"2d6eb3941ded6ba3","entry":"bit_error_rate","repo":"shaoshuo-ss/eaaw","repo_kind":"official","path":"text-generation/watermark.py","file_url":"https://github.com/shaoshuo-ss/eaaw/blob/HEAD/text-generation/watermark.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2d6eb3941ded6ba3"}},{"code_sha256_prefix":"9e45f2f8ecb4d6ba","entry":"dec2bin","repo":"shaoshuo-ss/eaaw","repo_kind":"official","path":"image-classification/watermark/lime.py","file_url":"https://github.com/shaoshuo-ss/eaaw/blob/HEAD/image-classification/watermark/lime.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9e45f2f8ecb4d6ba"}},{"code_sha256_prefix":"5a2d581963fed9bb","entry":"evaluate_watermark","repo":"shaoshuo-ss/eaaw","repo_kind":"official","path":"text-generation/watermark.py","file_url":"https://github.com/shaoshuo-ss/eaaw/blob/HEAD/text-generation/watermark.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5a2d581963fed9bb"}},{"code_sha256_prefix":"f8a98d97abed03ba","entry":"get_resnet18","repo":"shaoshuo-ss/eaaw","repo_kind":"official","path":"image-classification/utils/models.py","file_url":"https://github.com/shaoshuo-ss/eaaw/blob/HEAD/image-classification/utils/models.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f8a98d97abed03ba"}},{"code_sha256_prefix":"3b3524a6b7e9fdb1","entry":"get_resnet34","repo":"shaoshuo-ss/eaaw","repo_kind":"official","path":"image-classification/utils/models.py","file_url":"https://github.com/shaoshuo-ss/eaaw/blob/HEAD/image-classification/utils/models.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3b3524a6b7e9fdb1"}},{"code_sha256_prefix":"ef3f911aaa6673a2","entry":"get_resnet50","repo":"shaoshuo-ss/eaaw","repo_kind":"official","path":"image-classification/utils/models.py","file_url":"https://github.com/shaoshuo-ss/eaaw/blob/HEAD/image-classification/utils/models.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ef3f911aaa6673a2"}},{"code_sha256_prefix":"e608aee2acfd059c","entry":"init_watermark","repo":"shaoshuo-ss/eaaw","repo_kind":"official","path":"text-generation/watermark.py","file_url":"https://github.com/shaoshuo-ss/eaaw/blob/HEAD/text-generation/watermark.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e608aee2acfd059c"}},{"code_sha256_prefix":"56f802ee07886304","entry":"select_random_noise_data","repo":"shaoshuo-ss/eaaw","repo_kind":"official","path":"image-classification/watermark/watermark.py","file_url":"https://github.com/shaoshuo-ss/eaaw/blob/HEAD/image-classification/watermark/watermark.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"56f802ee07886304"}},{"code_sha256_prefix":"0477bd7d1f9b2e33","entry":"select_triggered_data","repo":"shaoshuo-ss/eaaw","repo_kind":"official","path":"image-classification/watermark/watermark.py","file_url":"https://github.com/shaoshuo-ss/eaaw/blob/HEAD/image-classification/watermark/watermark.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0477bd7d1f9b2e33"}},{"code_sha256_prefix":"4a67b032f6b32ae9","entry":"get_fixed_trigger","repo":"shaoshuo-ss/eaaw","repo_kind":"official","path":"image-classification/watermark/watermark.py","file_url":"https://github.com/shaoshuo-ss/eaaw/blob/HEAD/image-classification/watermark/watermark.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4a67b032f6b32ae9"}},{"code_sha256_prefix":"49e9a8310a77bfdf","entry":"get_full_dataset","repo":"shaoshuo-ss/eaaw","repo_kind":"official","path":"image-classification/utils/datasets.py","file_url":"https://github.com/shaoshuo-ss/eaaw/blob/HEAD/image-classification/utils/datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"49e9a8310a77bfdf"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}