The research team, led by Hanwen Xu with Song Xiao, Defan Xue, and Peichao Ma, set out to solve a problem that existing protections handle poorly. Current approaches to safeguarding model intellectual property fall into two camps. Passive methods, such as model watermarking, embed hidden evidence of ownership that can be revealed after a model is stolen. Active methods, such as parameter encryption, lock the model so it cannot function without a key. Each camp alone falls short in the satellite context. Watermarks do nothing to stop unauthorized use in the first place, while most encryption schemes operate on a binary logic: the model is either fully usable or completely useless. Satellite services, however, often serve multiple stakeholders with different authorization levels, demanding something in between—a degraded but functional service tier for lower-privilege users—without retraining the model or burning scarce onboard resources.

STAR-OV, short for satellite-oriented trusted authorization and responsibility with stratified model encryption and ownership verifications, unifies both protection styles in a single framework. Its core trick is a two-stage, reversible perturbation of the model’s parameters. In the first stage, small, precisely directed changes are injected into a tiny subset of weights until the model’s accuracy drops to a target intermediate level, around 50 percent. In the second stage, further perturbations push accuracy down to near random guessing, rendering the model effectively unusable. Every perturbation applied along the way—its layer, its exact parameter position, and its magnitude—is recorded. Those records become the keys: a partial key that restores only the intermediate-accuracy model, and a full key that undoes all perturbations in one step, returning the network to its original trained state.

The mathematics behind the encryption borrows from adversarial perturbation research, but operates in parameter space rather than input space. At each iteration, the method computes the loss gradient on a small encryption dataset, selects the single weight with the largest gradient magnitude, and nudges it in the direction that most damages performance. The perturbation size is normalized by each layer’s weight range, and layer-wise clipping bounds keep modified weights inside their original minimum–maximum span, so the encrypted model’s weight statistics remain statistically indistinguishable from a clean model. The process stops automatically once the target accuracy for each stage is reached, giving the model owner explicit, predictable control over the service levels each key unlocks.

The efficiency numbers are striking. Across four benchmark datasets—CIFAR-10, GTSRB, Fashion-MNIST, and the UC Merced Land Use remote sensing collection—the framework modified only between 0.001 and 0.003 percent of model parameters. On UC Merced, just 66 parameters were changed in the first stage and 61 more in the second, out of more than 23 million total, a ratio of roughly 0.0004 percent. Yet those few dozen tweaks cut accuracy by more than 80 percent, dropping fully encrypted models to around 10 percent accuracy on three datasets and 13.97 percent on GTSRB, close to random guessing. Partially recovered models landed consistently near 51 to 52 percent accuracy, matching the predefined intermediate target. Because the perturbations are so sparse, the keys themselves are tiny, and decryption is a simple element-wise subtraction that imposes negligible computational overhead—critical for power- and compute-limited onboard hardware.

Reversibility survives real-world numerical constraints, the team reports. Under standard FP32 precision, recovery is exact. At FP16, parameter errors stay at or below the order of 10^-4 with recovered accuracy essentially identical to full precision. Even at an extreme FP8 setting, maximum parameter error remains below 6×10^-3 and accuracy loss stays under 0.3 percent. Because each restoration starts fresh from the encrypted parameters rather than accumulating modifications, numerical errors do not compound across repeated deployment cycles, making the scheme practical for long-term unattended operation.

The second half of the framework addresses what happens when prevention fails. After a model is fully restored to its original accuracy, a latent watermark is embedded through a parameter-fitting process on a small, deterministically selected subset of weights. Unlike conventional backdoor watermarks, which alter model behavior on trigger inputs even when inactive, this watermark stays completely dormant without its activation key: trigger samples are classified normally, and trigger accuracy sits at random-guessing levels. Only when the owner applies the secret perturbation key does the model map trigger images—clean samples bearing a small white square patch—to a designated label, while continuing to classify ordinary data correctly. Activated trigger accuracy exceeded 99 percent across all datasets, and the watermark’s detection profile under Neural Cleanse, a widely used backdoor-detection tool, closely matched that of clean models, whereas a classical backdoored model produced glaring anomalies.

The security evaluation is unusually thorough. Random key guessing failed across the board: forged perturbations applied to fully encrypted models yielded accuracies of 0.10 to 0.15, never approaching the 0.5 intermediate target, and similar attacks on partially recovered models stalled far below original performance. Cross-satellite key reuse—where a valid key from one deployment instance is tried on another protected copy of the same model—also failed, because each deployment is encrypted with an independently generated key while sharing a common ownership watermark. Targeted privilege-escalation attempts, including reconstruction of missing Stage-II perturbations with partial prior knowledge and gradient-guided optimization, consistently left a significant accuracy gap versus genuine key recovery. Knowledge distillation from the fully encrypted model produced students performing at random-guess levels, and distillation from the intermediate model could not reach full capability.

The watermark itself proved resilient against removal attempts. Fine-tuning on 20 percent of the training data for up to 100 epochs, with weight decay and frozen batch normalization layers, left activated trigger accuracy at 99 to 100 percent and degraded activated clean accuracy by at most a few tenths of a percent. Global magnitude pruning at sparsity levels up to roughly 85 percent preserved reliable watermark activation, and only when pruning exceeded 90 percent—destroying the model’s usefulness in the process—did the watermark degrade. Random guesses at the watermark key produced a clean separation from the genuine key in the accuracy-versus-trigger-response space, supporting the scheme’s unforgeability. The authors acknowledge one honest limitation: distilled surrogate models, which copy behavior rather than parameters, substantially weaken watermark transferability, a challenge shared by other parameter-level watermarking approaches.

What makes STAR-OV notable is less any single mechanism than the integration. Existing hierarchical selective-encryption methods can produce multiple performance levels, but the intermediate accuracies fall out implicitly from which parameter groups are decrypted; STAR-OV instead lets the owner specify a target accuracy and tolerance up front. It requires no architectural changes, no extra training stages, no dedicated hardware, and no high-frequency satellite–ground communication—only short, encrypted key transmissions. For an industry moving toward commercial model licensing in orbit, tiered Earth-observation services, and multi-stakeholder constellations, the framework offers a practical template: encrypt the model so it can circulate safely, hand out keys that match privileges, and keep a silent watermark in reserve for the day something leaks. The authors point to scalable key management for large multi-mission satellite AI systems as the next frontier, but the core message is already clear: the models now flying overhead can finally carry their own locks and their own proof of ownership.

Subject of Research: Intellectual property protection for deep neural networks deployed on satellites using stratified parameter encryption and latent watermarking

Article Title: Star-ov: satellite-oriented trusted authorization and responsibility with stratified model encryption and ownership verifications

Article References: Xu, H., Xiao, S., Xue, D., & Ma, P. (2026). Star-ov: satellite-oriented trusted authorization and responsibility with stratified model encryption and ownership verifications. Cybersecurity, 9(1), Article 236. https://doi.org/10.1186/s42400-026-00673-5

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00673-5

Keywords: satellite AI security, model intellectual property, parameter encryption, latent watermarking, deep neural networks, on-orbit inference, access control, remote sensing, adversarial perturbation, ownership verification, Cybersecurity journal, model protection