New Attack Forges Neural Network Watermarks Without Touching the Victim Model

Deep learning models can cost millions of dollars to train, and as stolen or pirated copies of these models spread across the internet, researchers have increasingly turned to watermarking as a way to prove ownership. The idea is elegant: a model owner embeds secret trigger inputs into a network during training, so that later, in a dispute, the owner can show that the suspect model responds to those triggers in a predictable way. If the model answers the secret questions correctly, the argument goes, it must be the stolen property. But a new study published in the journal Cybersecurity shows just how fragile that logic can be. An attack framework called FakeMark demonstrates that an adversary who never touches the victim model can fabricate evidence that looks exactly like a legitimate watermark, achieving near-perfect agreement on the behavioral tests that many ownership protocols rely on.

The research, led by Yutong Wu and Songfeng Lu of Huazhong University of Science and Technology together with colleagues at Guangxi Normal University, Chongqing University, and other institutions, targets a structural weakness in what the authors call the behavior-only interface of model watermarking. Most black-box watermarking schemes, whether they use backdoored trigger sets, adversarial frontier stitching, dynamic adversarial watermarking, or parameter encoding, ultimately verify ownership by checking whether a suspect model maps certain inputs to certain labels. The problem, the researchers argue, is that a successful trigger response does not reveal how that response came to be. A third-party arbiter sees the model answering the secret key correctly, but cannot distinguish between a model that was genuinely watermarked at training time and one that simply happens to respond to a cleverly constructed set of forged inputs.

FakeMark exploits this ambiguity through a two-stage pipeline that operates entirely on a surrogate model. In the first stage, called clean feature caching, the attacker runs ordinary, unmodified images through a publicly available surrogate network and records the outputs of selected convolutional and fully connected layers. These cached activations serve as a library of clean reference features. In the second stage, adversarial feature fusion, the attacker optimizes a bounded perturbation on a batch of inputs while repeatedly injecting randomly permuted copies of the cached clean references into the surrogate’s forward pass. The injection is stochastic: at each iteration, a Bernoulli gate decides whether a given layer participates, a fresh permutation shuffles the reference features across the batch, and per-channel interpolation weights are drawn uniformly from a fixed range. The perturbation itself is guided by the gradient of the target-class logit, so the inputs are pushed toward whatever internal representations make the surrogate predict the attacker’s chosen label.

The crucial design insight is that this stochastic fusion prevents the perturbation from overfitting to architecture-specific quirks of the surrogate. Because the forward map changes at every iteration, successive gradients need not follow a single narrow trajectory, and the resulting adversarial inputs generalize better to unseen victim architectures. The authors support this intuition with a simplified theoretical analysis. Under a regularized linear classifier, they prove that a bounded perturbation maximizing the margin toward a watermarked class necessarily acquires a nonzero component along the watermark-trigger direction, with an explicit lower bound on the fraction of the perturbation’s norm that lies in that direction. The result is deliberately conditional: it explains why a successful linear watermark creates a trigger-aligned vulnerability, but the authors are careful to note that it does not prove the nonlinear optimization recovers the actual trigger of a deep network.

The empirical results are striking, though the authors frame them with unusual care. Across sixteen distinct architectures, an additional adversarially trained ResNet-50 checkpoint, and eight watermark variants spanning model-independent, model-dependent, active, and parameter-encoding schemes, the retrospective best-case behavioral target-label accuracy reaches 1.00 on CIFAR-10 and 0.99 on ImageNet. In other words, when the best surrogate in the pool is used, forged keys can induce the victim model to answer with the attacker’s chosen label on essentially every verification sample. On a fixed ADI-watermarked target under a matched protocol, FakeMark achieved a targeted attack success rate of 0.990, compared with 0.860 to 0.940 for canonical transferable attacks such as PGD, MI-FGSM, and DI-FGSM. A controlled component analysis showed that removing the batch permutation or the channel-wise mixing reduced transfer, and that replacing the clean cache with current-batch features actually raised surrogate-side success while lowering victim-side accuracy, indicating that the stochastic fusion genuinely shapes cross-model behavior rather than merely optimizing the surrogate.

Yet the study is equally notable for what it does not claim. ImageNet transfer varied enormously across checkpoint and surrogate settings, ranging from near zero to 0.99. Two ImageNet surrogates, ResNet-18 and VGG16, produced almost no transfer at all, while the adversarially trained ResNet-50 checkpoint and DenseNet-121 performed strongly. The ordering was not explained by model size or computational cost: MobileNetV2, the smallest and cheapest surrogate tested, matched ResNet-50 at 0.990, while Inception-v3, with the largest FLOP count, reached only 0.727. Architecture and checkpoint compatibility, the authors conclude, is a central condition for the attack, and the reported maxima are retrospective upper bounds over the surrogate pool rather than an operational guarantee that an attacker could pick a good surrogate without any victim feedback. Auxiliary experiments on clean, unwatermarked models showed comparable targeted transfer in several settings, so the evidence does not establish a universal watermark-specific amplification effect.

The threat model is deliberately austere. The attacker has white-box gradient access to one or more surrogate models trained on public data, but during attack construction has no query access, no gradients, no parameters, and no architectural knowledge of the victim. The victim model is invoked only at the end, through the normal ownership-verification procedure. The attacker does not modify the victim’s parameters, does not observe the legitimate watermark key, and does not need to estimate any victim-specific decision threshold. On CIFAR-10, the surrogates and watermarked targets share the standard public training split, so the controlled setting involves substantial sample-level overlap; on ImageNet, only dataset-level overlap can be asserted because external pretrained checkpoints do not publish training manifests. The authors acknowledge these limitations explicitly, along with the fact that the evaluation is restricted to image classification and uses a single surrogate at a time.

The study also probes whether forged keys can be detected. Perceptual measurements showed that the perturbations remain bounded, with PSNR between roughly 24 and 27 decibels and structural similarity scores between 0.72 and 0.91 depending on the setting. Input-level screening told a mixed story: the ADI scheme’s forged keys stayed below all four diagnostic thresholds tested, while Frontier and DAWN exceeded three of them, and median filtering changed forged predictions more often than legitimate ones. Feature-based detectors, including Mahalanobis distance, local intrinsic dimensionality, and ODIN, flagged forged groups at higher rates than clean calibration data, with the largest increase under LID. The authors interpret these results as evidence of detector-dependent artifacts rather than broad evasion, and they caution that the detector study is not a fully tuned learned-detector benchmark. The picture that emerges is nuanced: some schemes leave fingerprints on forged evidence, others do not, and no single screening method reliably separates genuine from fabricated triggers.

The practical implications reach beyond the laboratory. As models are increasingly deployed through APIs, fine-tuned by third parties, and extracted by adversaries, ownership disputes will hinge on verification evidence that courts, marketplaces, and standards bodies can trust. FakeMark shows that behavioral evidence alone cannot carry that weight, because a successful trigger response is compatible with both legitimate embedding and independent forgery. The authors argue that future ownership protocols should pair behavioral tests with signals that are harder to construct after the fact: cryptographic commitments to watermark keys or training provenance, structural fingerprints that cannot be derived from black-box outputs, and multi-factor validation that survives model post-processing. Parameter-encoding schemes that bind selected weights to a hashed secret, such as NeuralMark, represent one step in this direction, but the broader lesson is procedural rather than technical. Any verification protocol that accepts a single trigger-response score as proof of ownership is, in principle, exposed to fabricated evidence.

The FakeMark code and experimental data have been released publicly, and the authors hope the framework will serve as a stress test for the next generation of watermarking defenses rather than as a tool for intellectual property fraud. The study’s most enduring contribution may be its reframing of the ownership question. Watermarking research has largely focused on making triggers robust to removal, extraction, and fine-tuning; FakeMark shifts attention to the provenance of the evidence itself. A model that answers the secret questions correctly is not necessarily a stolen model, and a claimant who produces the right answers is not necessarily the rightful owner. Until verification protocols can distinguish between these possibilities, the researchers conclude, the evidentiary value of any behavioral watermark remains fundamentally limited, and the growing market for machine learning intellectual property will need stronger, multi-factor guarantees to stay ahead of those who would forge them.

Subject of Research: Gradient-guided forgery of behavioral model watermarks in deep neural networks

Article Title: FakeMark: gradient-guided false watermark claims via robust feature fusion

Article References: Wu, Y., Li, W., Nie, H., Zhou, Z., Li, J., Gong, Y., & Lu, S. (2026). FakeMark: gradient-guided false watermark claims via robust feature fusion. Cybersecurity, 9(1), Article 217. https://doi.org/10.1186/s42400-026-00654-8

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00654-8

Keywords: model watermarking, false ownership claims, adversarial transferability, deep neural network security, intellectual property protection, FakeMark, surrogate models, feature fusion, CIFAR-10, ImageNet, Cybersecurity, machine learning