{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/waffle-watermarking-in-federated-learning","title":"WAFFLE: Watermarking in Federated Learning","arxiv_id":"2008.07298","date":"2020-08-17","proceeding":null,"authors":["Buse Gul Atli","Yuxi Xia","Samuel Marchal","N. Asokan"],"abstract":"Federated learning is a distributed learning technique where machine learning models are trained on client devices in which the local training data resides. The training is coordinated via a central server which is, typically, controlled by the intended owner of the resulting model. By avoiding the need to transport the training data to the central server, federated learning improves privacy and efficiency. But it raises the risk of model theft by clients because the resulting model is available on every client device. Even if the application software used for local training may attempt to prevent direct access to the model, a malicious client may bypass any such restrictions by reverse engineering the application software. Watermarking is a well-known deterrence method against model theft by providing the means for model owners to demonstrate ownership of their models. Several recent deep neural network (DNN) watermarking techniques use backdooring: training the models with additional mislabeled data. Backdooring requires full access to the training data and control of the training process. This is feasible when a single party trains the model in a centralized manner, but not in a federated learning setting where the training process and training data are distributed among several client devices. In this paper, we present WAFFLE, the first approach to watermark DNN models trained using federated learning. It introduces a retraining step at the server after each aggregation of local models into the global model. We show that WAFFLE efficiently embeds a resilient watermark into models incurring only negligible degradation in test accuracy (-0.17%), and does not require access to training data. We also introduce a novel technique to generate the backdoor used as a watermark. It outperforms prior techniques, imposing no communication, and low computational (+3.2%) overhead.","url_abs":"https://arxiv.org/abs/2008.07298v3","url_pdf":"https://arxiv.org/pdf/2008.07298v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"waffle-watermarking-in-federated-learning","repo_url":"https://github.com/ssg-research/WAFFLE","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"Apache-2.0"}}],"tasks":[{"task_slug":"federated-learning","task_name":"Federated Learning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2008.07298","atlas_url":"https://app.syntology.ai/?focus=2008.07298","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2008.07298"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ssg-research/WAFFLE","reach":{"status":"ok","spdx":"Apache-2.0"}}],"summary":{"ran_honours":1,"ran_draft_wrong":1,"unverified":9},"by_repo_kind":{"official":{"samples":11,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"6d403e45178c45cc","entry":"total_size","repo":"ssg-research/WAFFLE","repo_kind":"official","path":"src/experiment.py","file_url":"https://github.com/ssg-research/WAFFLE/blob/HEAD/src/experiment.py","link_basis":"plan_row","language":"python","status":"ran_honours","verification_level":2,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"6d403e45178c45cc"}},{"code_sha256_prefix":"eba3f5bcc6a06d36","entry":"make_layers","repo":"ssg-research/WAFFLE","repo_kind":"official","path":"src/Network.py","file_url":"https://github.com/ssg-research/WAFFLE/blob/HEAD/src/Network.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"eba3f5bcc6a06d36"}},{"code_sha256_prefix":"3dcd8f7bb5d742e9","entry":"default_key","repo":"ssg-research/WAFFLE","repo_kind":"official","path":"src/filter.py","file_url":"https://github.com/ssg-research/WAFFLE/blob/HEAD/src/filter.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"3dcd8f7bb5d742e9"}},{"code_sha256_prefix":"eea75d32a55cb0a4","entry":"erfcx","repo":"ssg-research/WAFFLE","repo_kind":"official","path":"src/SBP_utils.py","file_url":"https://github.com/ssg-research/WAFFLE/blob/HEAD/src/SBP_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"eea75d32a55cb0a4"}},{"code_sha256_prefix":"d5af0781d1905d3d","entry":"foobar_unstructured","repo":"ssg-research/WAFFLE","repo_kind":"official","path":"src/pruning.py","file_url":"https://github.com/ssg-research/WAFFLE/blob/HEAD/src/pruning.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"d5af0781d1905d3d"}},{"code_sha256_prefix":"92ae15cb3f7fcc06","entry":"load_config","repo":"ssg-research/WAFFLE","repo_kind":"official","path":"src/config_helper.py","file_url":"https://github.com/ssg-research/WAFFLE/blob/HEAD/src/config_helper.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"92ae15cb3f7fcc06"}},{"code_sha256_prefix":"716eed9846e231f8","entry":"load_file","repo":"ssg-research/WAFFLE","repo_kind":"official","path":"src/plot.py","file_url":"https://github.com/ssg-research/WAFFLE/blob/HEAD/src/plot.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"716eed9846e231f8"}},{"code_sha256_prefix":"fd1ca75051b44490","entry":"load_state","repo":"ssg-research/WAFFLE","repo_kind":"official","path":"src/Network.py","file_url":"https://github.com/ssg-research/WAFFLE/blob/HEAD/src/Network.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"fd1ca75051b44490"}},{"code_sha256_prefix":"7f2454521cfb65b0","entry":"phi","repo":"ssg-research/WAFFLE","repo_kind":"official","path":"src/SBP_utils.py","file_url":"https://github.com/ssg-research/WAFFLE/blob/HEAD/src/SBP_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"7f2454521cfb65b0"}},{"code_sha256_prefix":"8a949d51cd1e0178","entry":"vgg16","repo":"ssg-research/WAFFLE","repo_kind":"official","path":"src/Network.py","file_url":"https://github.com/ssg-research/WAFFLE/blob/HEAD/src/Network.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"8a949d51cd1e0178"}},{"code_sha256_prefix":"57dfc664d187900b","entry":"where","repo":"ssg-research/WAFFLE","repo_kind":"official","path":"src/SBP_utils.py","file_url":"https://github.com/ssg-research/WAFFLE/blob/HEAD/src/SBP_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"57dfc664d187900b"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}