Collaborative Threshold Watermarking

In federated learning (FL), $K$ clients jointly train a model without sharing raw data. Because each participant invests data and compute, clients need mechanisms to later prove the provenance of a jointly trained model. Model watermarking embeds a hidden signal in the weights, but naive approaches either do not scale with many clients as per-client watermarks dilute as $K$ grows, or give any individual client the ability to verify and potentially remove the watermark. We introduce $(t,K)$-threshold watermarking: clients collaboratively embed a shared watermark during training, while only coalitions of at least $t$ clients can reconstruct the watermark key and verify a suspect model. We secret-share the watermark key $\tau$ so that coalitions of fewer than $t$ clients cannot reconstruct it, and verification can be performed without revealing $\tau$ in the clear. We instantiate our protocol in the white-box setting and evaluate it on image classification tasks on both IID and non-IID partitions, as well as language models fine-tuning setting. Our watermark remains detectable at scale ($K=128$) with minimal accuracy loss and stays above the detection threshold ($z\ge 4$) under attacks including adaptive fine-tuning using up to 20% of the training data. Code is available at \url{https://github.com/tameemalaa/collaborative-threshold-watermark}.

Federated learning enables many people or organizations to train a shared AI model without directly sharing their private data. However, once the model is trained, it can be hard for the group to prove that a leaked or copied model came from their collaboration, especially if no single participant should be trusted with full control over the proof. Existing watermarking methods can embed a hidden signal into a model, but they either weaken as more participants join or allow a single participant to verify and potentially remove the watermark. We introduce collaborative threshold watermarking, a method that gives ownership verification to the group rather than to any individual participant. Our approach splits the secret watermark key into pieces so that only a large enough group of participants can verify the watermark together. During federated training, each participant embeds only their own hidden piece, while secure aggregation prevents the server from seeing individual contributions. This makes watermarking more suitable for shared AI models trained by many parties. In our experiments, the watermark remains detectable even with many clients, causes little loss in model accuracy, and survives several common attempts to remove it.