Implementation guide
OWASP AISVS v1.01
Adversarial Robustness · Model-Extraction Defense
Watermark or fingerprint the model
Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified.
OWASP AISVS v1.01, requirement 11.3.3
In plain English
Mark your model so you can recognise a stolen copy. A watermark or fingerprint will not stop theft. It gives you evidence when a suspiciously similar model appears. This is a Level 3 control for models with real commercial value.
What good looks like
- A watermark or fingerprint is built into the model, its outputs, or both.
- A documented test exists for checking a suspect model, and it has been run.
- The method has been tested against fine-tuning, quantisation and distillation.
- The details are known to few people.
How teams usually do it
- A secret trigger set: specific unusual inputs the model is trained to answer in a known way.
- Output watermarking for generative models, which biases word or pixel choices in a pattern that can be detected statistically and can carry over into a model trained on those outputs.
- Fingerprinting by behaviour: a set of probe inputs on which your model's responses are distinctive.
Suggested evidence
- The method.
- Test results on the original, on a modified copy and on an unrelated model.
Common mistakes
- A watermark never tested on a modified copy.
- No test on unrelated models, so you do not know the false-positive rate.
- Storing the trigger set where a leak of the model would leak it too.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.