---
license: mit
library_name: pytorch
tags:
  - watermarking
  - security
  - image-classification
  - deep-learning
pipeline_tag: image-classification
---

# SEW (KDD 2026)

This repository contains the official implementation of the paper **"SEW: Strengthening Robustness of Black-box DNN Watermarking via Specificity Enhancement" (KDD 2026)**.

## 📖 Introduction

Black-box DNN watermarking protects intellectual property by embedding trigger sets. However, existing methods often suffer from **low specificity**—meaning the watermark is activated not just by the exact key, but by many "approximate keys" (noisy versions). This vulnerability allows attackers to reverse-engineer the key and remove the watermark.

**SEW (Specificity-Enhanced Watermarking)** introduces a novel training paradigm that:

1. **Quantifies Specificity:** We propose a metric to measure the "fuzziness" of the watermark key.
2. **Enhances Specificity:** We use an adaptive noise optimization strategy to generate "cover samples" (approximate keys) during training and suppress their activation.

This results in a watermark that is highly specific to the original key, significantly improving robustness against state-of-the-art removal attacks (e.g., Dehydra, MOTH, FeatureRE).

## 🛠️ Installation

### 1. Create and Activate Conda Environment

```bash
conda create -n sew python=3.10
conda activate sew
```

### 2. Install dependencies

Install the required Python packages:

```bash
pip install -r requirements.txt
```

## 🚀 Usage

The workflow consists of two main steps: **Training** the watermarked model (embedding) and **Evaluating** the specificity of the watermark.

For ease of reproduction, we provide ready-to-use Bash scripts in the `scripts/` directory.

**⚠️ Important Note**

Before running any scripts, please open the `.sh` files and update the following parameters to match your local environment:

* `root`: The actual path to your dataset.
* `save_path`: The directory where you want to save model checkpoints and logs.

---

### Step 1: Embedding Watermark (Training)

Use the `scripts/run_sew.sh` script to train the watermarked model. By default, this script is configured to train **SEW-Post** on **CIFAR-10** using a **VGG16** architecture.

```bash
# Run the training script after configuring paths
bash scripts/run_sew.sh
```

Upon completion, the best and final model checkpoints will be saved to your specified `save_path` (e.g., `final.pth` and `best.pth`).

### Step 2: Measuring Specificity

After training, use the `scripts/run_spec.sh` script to calculate the **Specificity (Spec)** metric. A *lower* Spec score indicates higher specificity (better security).

```bash
# Ensure 'load_path' in the script points to the model generated in Step 1
bash scripts/run_spec.sh
```

This script loads the trained model and dynamically calculates the epsilon (`eps`) noise boundary. The final output `eps` is the Specificity score.

## 📊 Results Summary

Our experiments demonstrate a strong correlation between **watermark specificity** and **robustness**. By optimizing the watermark to be highly specific (low `Spec` score), SEW effectively resists state-of-the-art removal attacks.

As demonstrated in the paper, SEW-Post significantly reduces the specificity score compared to baselines:

| Method | Dataset | CDA | WACC | Specificity |
| --- | --- | --- | --- | --- |
| **SEW-Pre** (Baseline) | CIFAR-10 | 93.03% | 100% | 0.3569 |
| **SEW-Post** (Ours) | CIFAR-10 | 92.79% | 100% | **0.0364** |

High specificity translates to strong defense, making the watermark much harder to reverse-engineer. While the baseline fails against state-of-the-art removal attacks, **SEW-Post** maintains near-perfect watermark verification accuracy:

| Method | Dehydra | MOTH | FeatureRE |
| --- | --- | --- | --- |
| **SEW-Pre** (Baseline) | 2.67% | 7.67% | 8.00% |
| **SEW-Post** (Ours) | **98.67%** | **97.67%** | **98.33%** |

> **Note:** For more comprehensive experimental results, including comparisons with 10+ baselines and detailed specificity analysis on NLP tasks, please refer to our paper.


## 🔗 Citation

If you find this code or paper useful for your research, please cite our work.

```bash
@article{qiu2026sew,
  title={SEW: Strengthening Robustness of Black-box DNN Watermarking via Specificity Enhancement},
  author={Qiu, Huming and Zhang, Mi and Sun, Junjie and Chen, Peiyi and Zhang, Xiaohan and Yang, Min},
  journal={arXiv preprint arXiv:2602.03377},
  year={2026}
}
```