A new paper on arXiv examines the security of watermarking techniques used in federated learning. The authors focus on batch normalization (BN) layers, which have become a common place to embed white-box watermarks for model ownership verification and participant identification. These watermarks are meant to protect intellectual property and trace contributions in distributed training settings.
The paper reports that these watermarks are vulnerable and shows that they can be removed without access to any training data. This "data-free removal" poses a significant challenge to the reliability of BN-based watermarking as a defense mechanism. The finding suggests that current approaches may not provide the robust protection that federated learning practitioners expect.
The abstract does not detail the specific attack method or the experimental setup, but the core claim is clear: the watermarking scheme is not as secure as previously assumed. This work highlights an ongoing arms race between model protection and adversarial removal techniques in machine learning.