Identifying Appropriate Intellectual Property Protection Mechanisms for Machine Learning Models - A Systematization of Watermarking, Fingerprinting, Model Access, and Attacks

Aug 6, 2026

Upload by Jiven

Machine learning model commercialization is accelerating, while training powerful models increasingly demands high cost and expertise, making intellectual property protection for trained models a pressing concern. Existing ML IPP research remains fragmented due to a missing unified view and common taxonomy of threats, attacks, and defenses. This work systematizes the state of the field, builds a comprehensive threat model, and organizes attacks and defenses into a unified taxonomy to bridge ML and security perspectives.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages19

Reading Time48 min

AccessFree to download

Introduction

Related Work

Methodology

Background: ML, DNN, Watermarking, Fingerprinting

Taxonomy, Threat Model, and Attacks

Watermarking and Fingerprinting Approaches

Proactive IPP: Access Control

Attacks Taxonomy and Vulnerabilities

Guidelines for Choosing IPP Methods

Conclusions

Identifying Appropriate Intellectual Property Protection Mechanisms for Machine Learning Models: A Systematization of Watermarking, Fingerprinting, Model Access, and Attacks Isabell Lederer1 and Rudolf Mayer2 and Andreas Rauber3 arXiv :2304 . 11285v1 [ cs .LG] 22 Apr 2023 Abstract—The commercial use of Machine Learning (ML) is spreading; at the same time, ML models are becoming more complex and more expensive to train, which makes Intellectual Property Protection (IPP) of trained models a pressing issue. Unlike other domains that can build on a solid understanding of the threats, attacks and defenses available to protect their IP, the ML-related research in this regard is still very fragmented. This is also due to a missing uniﬁed view as well as a common taxonomy of these aspects. In this paper, we systematize our ﬁndings on IPP in ML, while focusing on threats and attacks identiﬁed and defenses proposed at the time of writing. We develop a comprehensive threat model for IP in ML, categorizing attacks and defenses within a uniﬁed and consolidated taxonomy, thus bridging research from both the ML and security communities. Index Terms—Machine Learning, Intellectual Property Protection, Watermarking, Fingerprinting, Model Access Control, Attacks on Intellectual Property Protection I. INTRODUCTION In many Machine Learning (ML) settings, training an effective model from scratch – especially complex and powerful models such as a Deep Neural Network (DNN) – (i) is computationally very expensive, (ii) requires expertise for setting parameters, and (iii) the amount of data needed is not commonly accessible or expensive to obtain. Security concerns become more prominent when these models are made available to other parties or customers, e.g., in Machine Learning asa Service (MLaaS) or under a license. This is when model owners – who have invested signiﬁcant resources to train a model and now want to offer it to customers – start to consider Intellectual Property Protection (IPP) methods like watermarking (to verify ownership) and access control (to prevent unauthorized usage of a model) . IP litigation cases over ML models do occur, but have so far not seen widespread media attention; however, protection mechanisms are therefore investigated from a legal point of view, e.g., [1], showing that This work was partially funded by the European Union's Horizon 2020 research and innovation programme under grant agreement no. 826078 (project 'FeatureCloud') . This publication reﬂects only the authors' view and the European Commission is not responsible for any use that may be made of the information it contains. SBA Research (SBA-K1) is a COMET Center within the COMET – Competence Centers for Excellent Technologies Programme and funded by BMK, BMAW, and the federal state of Vienna. The COMET Programme is managed by FFG. 1Isabell Lederer was with SBA Research, Vienna, Austria while working on this paper. 2Rudolf Mayer is with SBA Research, Vienna, Austria, and the Institute of Information Systems Engineering, Faculty of Informatics, Vienna University of Technology, Vienna, Austria. Email: [rmayer@sba-research.org](rmayer@sba-research.org) 3Andreas Rauber is with SBA Research, Vienna, Austria, and the Institute of Information Systems Engineering, Faculty of Informatics, Vienna University of Technology, Vienna, Austria. Email: [andreas.rauber@tuwien.ac.at](andreas.rauber@tuwien.ac.at) the burden of proof is generally lies with the IP rights holder. Thus, it is important to anticipate the need for such proofs and protect ML models with IPP techniques. In the last few years, we have consequently seen an increase in research on IPP techniques for ML models. Many blackand white-box watermarking methods have been proposed based on techniques such as backdoor embedding via data poisoning or regularization. At the same time, several studies have shown the vulnerability of some of these schemes against novel attacks. Similar o

FAQs

Why is intellectual property protection important for machine learning models?

Training effective ML models is costly and complex, and models are often shared via services or licensing. Owners need protections such as watermarking and access control to manage unauthorized use and ownership claims.

What is the main gap this paper addresses in ML IPP research?

The research landscape lacks a unified view and a common taxonomy that consistently organizes threats, attacks, and defenses across the ML and security communities.

How does the paper structure IPP and evaluate threats and defenses?

It develops a comprehensive threat model and categorizes attacks and defenses within a unified, consolidated taxonomy, including analysis of vulnerabilities to attacks designed to break IPP schemes.

Aug 6, 2026

Upload by Jiven