Hot-Swap MarkBoard Watermarking

• Hot-Swap MarkBoard is a black-box watermarking framework that embeds unique multi-bit signatures into deep models using a multi-branch LoRA architecture.
• It enables efficient per-user model customization via branch swapping, avoiding costly retraining while preserving main-task performance.
• The framework combines parameter obfuscation and rigorous black-box verification to resist attacks like fine-tuning and pruning while ensuring reliable user attribution.

Searching arXiv for the target paper and closely related watermarking work named in the provided data. arXiv Search Query: "Hot-Swap MarkBoard: An Efficient Black-box Watermarking Approach for Large-scale Model Distribution" Hot-Swap MarkBoard is a black-box model watermarking framework for large-scale model distribution that is designed to generate many user-specific copies of the same deep learning model, each carrying a unique multi-bit signature, without retraining a separate model for every user. The method is motivated by on-device AI deployment, where models are distributed to numerous end users and therefore become vulnerable to theft and redistribution. Its central mechanism is a multi-branch Low-Rank Adaptation (LoRA) module in which each branch independently encodes one bit of an $n$-bit binary signature; user-specific customization is then performed by swapping branches rather than by fine-tuning or retraining. The framework further combines this branch-swapping design with parameter obfuscation, so that removing the watermark without harming model utility becomes difficult, while ownership verification remains feasible under query-only access (Zhang et al., 28 Jul 2025).

1. Problem setting and design objective

The framework addresses two requirements that arise in large-scale model distribution. The first is user attribution under black-box access: when a leaked model instance is recovered, the owner seeks to determine which user it came from using only query access to the model. The second is efficient generation of many user-specific models: in large-scale deployment, retraining a distinct watermark model for each user is too expensive, particularly when existing methods typically embed a fixed watermark whose modification requires fine-tuning or retraining (Zhang et al., 28 Jul 2025).

Within this formulation, Hot-Swap MarkBoard is explicitly positioned against watermarking and backdoor-based ownership protection methods that are more natural in cloud-based AI-as-a-Service settings than in distributed on-device deployment. The framework argues that white-box methods, model-level methods, and one-watermark-per-model approaches do not naturally support user-level attribution when thousands or millions of distributed copies require distinct identifiers. This suggests that the method is better understood as a distribution-oriented attribution system than as a single-instance watermarking primitive.

The threat model is correspondingly practical. The model owner distributes a common base model to many users, each with a registered signature. If a user-specific model is leaked, reverse-engineered, or redistributed, the owner reconstructs the embedded signature from black-box queries and compares it against the registry of assigned signatures. The framework assumes that the owner knows the watermark datasets and trigger patterns and maintains a signature registry for distributed users (Zhang et al., 28 Jul 2025).

2. Multi-branch LoRA architecture and signature semantics

The main architectural component is a multi-branch LoRA module used as the watermark carrier. Each branch corresponds to one bit of the signature, and a branch can be watermarked or clean. The paper defines the model weights as

$$W = W_0 + \Delta W = W_0 + \sum_{i=1}^{N} \omega_i \cdot LoRA_i = W_0 + \sum_{i=1}^{N} \omega_i \cdot B_i A,$$

with routing scores satisfying

$\sum_{i=1}^{N} \omega_i = 1.$

Here, $W_0$ denotes the base model weights, $B_i \in \mathbb{R}^{d \times r}$ is a branch-specific LoRA matrix, and $A \in \mathbb{R}^{r \times k}$ is a shared LoRA matrix (Zhang et al., 28 Jul 2025).

The paper presents this multi-branch construction as a response to a limitation of standard LoRA parameterization: ordinary LoRA shares parameters too strongly for one bit to be cleanly removed or swapped. By contrast, the multi-branch design is intended to provide independent bit control, an interpretable branch-to-bit mapping, and branch-level substitution. In this sense, the signature is not an auxiliary label attached to the model; it is encoded directly in which LoRA branches are watermarked.

The routing network is trained so that watermark triggers selectively activate individual branches. Its behavior is described as

$$\omega = \begin{cases} \mathbf{e}^{(i)}, & \text{if } x=\tilde{x}_i \in D_{\text{wm}}^{(i)},\ \hat{\omega}(x), & \text{if } x \in D_{\text{clean}}. \end{cases}$$

Under this semantics, bit $i=1$ means that watermark branch $i$ remains active, while bit $i=0$ means that branch $$W = W_0 + \Delta W = W_0 + \sum_{i=1}^{N} \omega_i \cdot LoRA_i = W_0 + \sum_{i=1}^{N} \omega_i \cdot B_i A,$$0 is replaced with its clean counterpart. A user’s signature is therefore literally the activation pattern over the branches (Zhang et al., 28 Jul 2025).

3. Dual-model training and hot-swap customization

The end-to-end workflow is divided into three phases: watermark generation, user-specific model distribution, and black-box ownership verification. In the first phase, the method jointly trains two complementary models: a watermark-inactive model $$W = W_0 + \Delta W = W_0 + \sum_{i=1}^{N} \omega_i \cdot LoRA_i = W_0 + \sum_{i=1}^{N} \omega_i \cdot B_i A,$$1, optimized for clean-task utility, and a watermark-active model $$W = W_0 + \Delta W = W_0 + \sum_{i=1}^{N} \omega_i \cdot LoRA_i = W_0 + \sum_{i=1}^{N} \omega_i \cdot B_i A,$$2, optimized to activate the correct branch for each trigger, embed watermark behavior in that branch, and remain aligned with $$W = W_0 + \Delta W = W_0 + \sum_{i=1}^{N} \omega_i \cdot LoRA_i = W_0 + \sum_{i=1}^{N} \omega_i \cdot B_i A,$$3 on benign inputs (Zhang et al., 28 Jul 2025).

The optimization objectives are written as

$$W = W_0 + \Delta W = W_0 + \sum_{i=1}^{N} \omega_i \cdot LoRA_i = W_0 + \sum_{i=1}^{N} \omega_i \cdot B_i A,$$4

and

$$W = W_0 + \Delta W = W_0 + \sum_{i=1}^{N} \omega_i \cdot LoRA_i = W_0 + \sum_{i=1}^{N} \omega_i \cdot B_i A,$$5

The routing loss supervises trigger-to-branch assignment,

$$W = W_0 + \Delta W = W_0 + \sum_{i=1}^{N} \omega_i \cdot LoRA_i = W_0 + \sum_{i=1}^{N} \omega_i \cdot B_i A,$$6

the watermark loss embeds task-dependent watermark behavior,

$$W = W_0 + \Delta W = W_0 + \sum_{i=1}^{N} \omega_i \cdot LoRA_i = W_0 + \sum_{i=1}^{N} \omega_i \cdot B_i A,$$7

and the alignment loss regularizes watermarked and clean branches on clean inputs,

$$W = W_0 + \Delta W = W_0 + \sum_{i=1}^{N} \omega_i \cdot LoRA_i = W_0 + \sum_{i=1}^{N} \omega_i \cdot B_i A,$$8

The exact watermark objective is task-dependent: BadNets is used for classification, diffusion-based watermark decoding for image generation, and Double-I-style fixed response for text generation (Zhang et al., 28 Jul 2025).

The hot-swap mechanism appears in the second phase. After training $$W = W_0 + \Delta W = W_0 + \sum_{i=1}^{N} \omega_i \cdot LoRA_i = W_0 + \sum_{i=1}^{N} \omega_i \cdot B_i A,$$9 and $\sum_{i=1}^{N} \omega_i = 1.$0, the owner constructs a user-specific model by branch substitution:

$\sum_{i=1}^{N} \omega_i = 1.$1

where $\sum_{i=1}^{N} \omega_i = 1.$2 is the $\sum_{i=1}^{N} \omega_i = 1.$3-th user signature bit, $\sum_{i=1}^{N} \omega_i = 1.$4 is the clean LoRA branch, and $\sum_{i=1}^{N} \omega_i = 1.$5 is the watermarked branch. If $\sum_{i=1}^{N} \omega_i = 1.$6, the watermarked branch is retained; if $\sum_{i=1}^{N} \omega_i = 1.$7, it is replaced with the clean branch. The paper describes this as customization without retraining: after one training run, user-specific distribution reduces to parameter replacement, with up to $\sum_{i=1}^{N} \omega_i = 1.$8 distinct user-specific models (Zhang et al., 28 Jul 2025).

A common misconception is to read “hot-swap” here as runtime failover or online hardware replacement. In this framework, the term denotes branch swapping within a trained watermark carrier. The swap operation is architectural and distribution-oriented rather than a live systems-management procedure.

4. Obfuscation and black-box verification

Hot-Swap MarkBoard augments branch swapping with a parameter obfuscation mechanism intended to prevent trivial watermark removal. For each user $\sum_{i=1}^{N} \omega_i = 1.$9, a random matrix $W_0$0 is injected so that

$W_0$1

This entangles the watermark weights with the base model weights. The stated purpose is to ensure that the watermark is not a clean detachable add-on: if an attacker removes the LoRA branches, the remaining base model becomes $W_0$2, which performs poorly; if the attacker attempts to bypass the LoRA component, the altered base parameters remain a barrier (Zhang et al., 28 Jul 2025).

The paper’s security intuition is that because $W_0$3 is unique per user, random, and linearly independent, an attacker cannot simply strip out the watermark, reuse one user’s base model with another user’s branches, or collude across multiple models to isolate a clean base model. The framework also reports that gradient-based unlearning or removal methods such as I-BAU and RNP fail because obfuscation distorts the optimization landscape and entangles watermark and task parameters. This suggests that the main defense is not secrecy of the trigger alone, but structural dependence between task utility and watermark retention.

Verification is entirely black-box. For each bit $W_0$4, the owner prepares a trigger test set $W_0$5 and queries the suspect model. If the watermark trigger success rate exceeds a threshold $W_0$6,

$W_0$7

otherwise $W_0$8. The extracted signature $W_0$9 is then compared against the signature registry using a bit-match score $B_i \in \mathbb{R}^{d \times r}$0; a leak is flagged if $B_i \in \mathbb{R}^{d \times r}$1, and attribution is determined by

$B_i \in \mathbb{R}^{d \times r}$2

No access to internal weights is required (Zhang et al., 28 Jul 2025).

5. Evaluation protocol and reported results

The framework is evaluated on three task families—image classification, image generation, and text generation—using six backbone models: ResNet-50, MobileNet, DeiT, Latent Diffusion Model (LDM), LLaMA-2-7B, and MobileLLM-1.5B. The datasets include CIFAR-100 and ImageNet for classification, MS COCO 2014 for image generation, and MMLU and ARC-Easy for text-generation evaluation, with VGGFace, MetFace, CIFAR-100, ImageNet, and Finance-Alpaca used as watermark datasets depending on the task. The main experiments embed 10-bit signatures with watermark sample ratio $B_i \in \mathbb{R}^{d \times r}$3 (Zhang et al., 28 Jul 2025).

Category	Items
Tasks	Image classification; image generation; text generation
Backbones	ResNet-50; MobileNet; DeiT; LDM; LLaMA-2-7B; MobileLLM-1.5B
Metrics	CDP; Bit-Acc; Id-Acc; Time Cost; PR

The reported metrics are CDP (Clean Data Performance), Bit-Acc, Id-Acc, Time Cost, and Parameter Ratio (PR). CDP is task-specific: classification accuracy for classification, PSNR/SSIM/FID for image generation, and MMLU/ARC-Easy for LLMs (Zhang et al., 28 Jul 2025).

The central empirical claims are strong. The paper reports minimal impact on main-task performance, with classification drops under $B_i \in \mathbb{R}^{d \times r}$4, diffusion quality remaining high, and large-language-model reasoning performance nearly unchanged or slightly improved. Verification performance reaches $B_i \in \mathbb{R}^{d \times r}$5 Bit-Acc and $B_i \in \mathbb{R}^{d \times r}$6 Id-Acc across all tested models and tasks. Efficiency is likewise emphasized: additional parameters stay below about $B_i \in \mathbb{R}^{d \times r}$7; customization requires about $B_i \in \mathbb{R}^{d \times r}$8 ms per model; and generating $B_i \in \mathbb{R}^{d \times r}$9 models takes under $A \in \mathbb{R}^{r \times k}$0 days, compared with $A \in \mathbb{R}^{r \times k}$1–$A \in \mathbb{R}^{r \times k}$2 days for baselines that require per-user fine-tuning. The paper characterizes the per-user distribution cost as $A \in \mathbb{R}^{r \times k}$3 (Zhang et al., 28 Jul 2025).

Capacity scaling experiments evaluate 10-, 16-, 24-, and 28-bit signatures. All settings achieve $A \in \mathbb{R}^{r \times k}$4 Id-Acc, while the implied number of uniquely identifiable models scales to about $A \in \mathbb{R}^{r \times k}$5, $A \in \mathbb{R}^{r \times k}$6, $A \in \mathbb{R}^{r \times k}$7, and $A \in \mathbb{R}^{r \times k}$8, respectively. A plausible implication is that the branch-per-bit design preserves attribution fidelity even as the signature space expands, at least within the reported experimental regime.

6. Robustness, limitations, and terminological context

The paper studies six attack vectors: Neural Cleanse, escape attack, model collusion, pruning, fine-tuning, and gradient-based removal or unlearning. Neural Cleanse reportedly fails to reconstruct the true triggers. Escape attack—removing LoRA at inference—severely damages utility because of parameter obfuscation. Model collusion by swapping LoRA branches between different users causes performance collapse. Pruning preserves the watermark until pruning becomes so strong that the model becomes unusable. Under fine-tuning, watermark stability remains high and bit accuracy stays above $A \in \mathbb{R}^{r \times k}$9 (Zhang et al., 28 Jul 2025).

Ablation results attribute this behavior to three design choices. Removing $$\omega = \begin{cases} \mathbf{e}^{(i)}, & \text{if } x=\tilde{x}_i \in D_{\text{wm}}^{(i)},\ \hat{\omega}(x), & \text{if } x \in D_{\text{clean}}. \end{cases}$$0 causes branch entanglement, so deleting one bit tends to break all bit verifications; with the routing loss present, only targeted bits fail under partial removal. Removing $$\omega = \begin{cases} \mathbf{e}^{(i)}, & \text{if } x=\tilde{x}_i \in D_{\text{wm}}^{(i)},\ \hat{\omega}(x), & \text{if } x \in D_{\text{clean}}. \end{cases}$$1 harms utility: classification accuracy drops sharply, image generation quality degrades strongly, and LLMs are somewhat more tolerant but still benefit from alignment. The paper therefore treats routing supervision as necessary for independent bit editability and alignment as necessary for safe branch swapping (Zhang et al., 28 Jul 2025).

The method also has explicit assumptions and limits. It relies on LoRA-style modular adaptation, so it is most natural in models where such adapters can be inserted. Verification depends on owner-controlled trigger inputs and on a registry of assigned user signatures. Strong obfuscation improves security, but if the model is heavily pruned or otherwise damaged, utility may collapse before watermark removal succeeds. These are not presented as formal impossibility results, but as practical operating conditions for the framework.

The term “hot swap” in the method’s name can be misleading unless placed in context. In other arXiv usage, hot swap denotes board replacement in ATCA without powering off the shelf (Correia et al., 2018), a conceptual autonomous healing architecture for mission-critical systems in lethal autonomous weapons (Nyagudi, 2014), speculative biometric revocation and replacement through biotechnology (Crowcroft et al., 22 Sep 2025), and rapid swap or controlled-swap gate synthesis in neutral-atom systems (Sun et al., 2024). Hot-Swap MarkBoard uses the term in a narrower sense: post-training branch swapping in a multi-branch LoRA watermark carrier. That narrower usage is central to the framework’s contribution, because it turns watermarking from a fixed embedding procedure into a configurable distribution pipeline.