ML Security PapersComMark: Covert and Robust Black-Box Model Watermarking with Compressed Samples
Yunfei Yang 1,2, Xiaojun Chen 1,2, Zhendong Zhao 1,2, Yu Zhou 3, Xiaoyan Gu 1,2, Juan Cao 1
Published on arXiv
2512.15641
Model Theft
OWASP ML Top 10 — ML05
Key Finding
ComMark achieves state-of-the-art balance of covertness and robustness across diverse datasets and architectures, extending successfully to audio, video, and text modalities.
ComMark
Novel technique introduced
The rapid advancement of deep learning has turned models into highly valuable assets due to their reliance on massive data and costly training processes. However, these models are increasingly vulnerable to leakage and theft, highlighting the critical need for robust intellectual property protection. Model watermarking has emerged as an effective solution, with black-box watermarking gaining significant attention for its practicality and flexibility. Nonetheless, existing black-box methods often fail to better balance covertness (hiding the watermark to prevent detection and forgery) and robustness (ensuring the watermark resists removal)-two essential properties for real-world copyright verification. In this paper, we propose ComMark, a novel black-box model watermarking framework that leverages frequency-domain transformations to generate compressed, covert, and attack-resistant watermark samples by filtering out high-frequency information. To further enhance watermark robustness, our method incorporates simulated attack scenarios and a similarity loss during training. Comprehensive evaluations across diverse datasets and architectures demonstrate that ComMark achieves state-of-the-art performance in both covertness and robustness. Furthermore, we extend its applicability beyond image recognition to tasks including speech recognition, sentiment analysis, image generation, image captioning, and video recognition, underscoring its versatility and broad applicability.
Key Contributions
- Frequency-domain compression-based watermark sample construction that distributes the trigger signal globally across the entire sample, improving both covertness and robustness over pixel-level spatial methods.
- ComMark training framework incorporating simulated attack scenarios (JPEG compression, cropping, scaling, model extraction) and a similarity loss to cluster watermark samples in feature space, hardening against removal attacks.
- Comprehensive evaluation across image, audio, text, and video modalities demonstrating SOTA covertness and robustness with no false triggering.
🛡️ Threat Analysis
ComMark embeds watermarks into the model's trained behavior (via crafted training samples) so that ownership can be verified by querying the model with compressed watermark inputs — this is classic black-box model watermarking for intellectual property protection against model theft. The watermark protects the MODEL's IP, not the provenance of generated content.