FedDW: Leveraging Dataset Distillation for Black-Box Watermarking in Federated Learning Models

Federated Learning (FL) is a distributed machine learning paradigm wherein multiple parties collaboratively train a shared model while maintaining the privacy of their respective data. However, this collaborative process grants client’s full access to the global model, thereby exacerbating the risk of model leakage. To mitigate this risk, it is crucial to develop methods for verifying model ownership and tracing malicious clients responsible for model leakage. Existing methods often utilize white-box watermarking techniques, wherein the watermark verification process requires direct access to the model’s internal parameters and structure. This approach is not feasible in many real scenarios, as numerous potentially suspicious models are reluctant to reveal their internal parameters. In this paper, we propose a fully black-box approach that addresses these challenges. Our method involves distilling the original data to establish the foundation of our watermark trigger set. We also propose a feature fusion method to enhance the diversity of the trigger sets, assigning a distinct trigger set to each client. Additionally, we introduce a regularization term to constrain the model parameters before and after watermarking. Experimental results demonstrate that our approach preserves the accuracy of the original task while ensuring ownership verification and tracing leakers. Furthermore, our method shows strong robustness against various watermark removal and detection attacks.