{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,8]],"date-time":"2026-09-08T21:12:32Z","timestamp":1788901952957,"version":"build-2803163510"},"reference-count":38,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Information Sciences"],"published-print":{"date-parts":[[2026,11]]},"DOI":"10.1016\/j.ins.2026.123869","type":"journal-article","created":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T22:15:46Z","timestamp":1783203346000},"page":"123869","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["SensMark: Robust and interpretable model watermarking via contextual sensitivity estimation and adaptive trigger insertion"],"prefix":"10.1016","volume":"756","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-5289-9264","authenticated-orcid":false,"given":"Gejian","family":"Zhao","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1599-7232","authenticated-orcid":false,"given":"Hanzhou","family":"Wu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bin","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xinpeng","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Athanasios V.","family":"Vasilakos","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"issue":"7","key":"10.1016\/j.ins.2026.123869_bib0010","doi-asserted-by":"crossref","first-page":"3362","DOI":"10.1109\/TAI.2024.3351116","article-title":"Deep model intellectual property protection with compression-resistant model watermarking","volume":"5","author":"Nie","year":"2024","journal-title":"IEEE Trans. Artif. Intell."},{"issue":"3","key":"10.1016\/j.ins.2026.123869_bib0015","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1007\/s10462-023-10684-0","article-title":"Machine learning methods for service placement: a systematic review","volume":"57","author":"Keshavarz Haddadha","year":"2024","journal-title":"Artif. Intell. Rev."},{"issue":"6","key":"10.1016\/j.ins.2026.123869_bib0020","doi-asserted-by":"crossref","first-page":"5766","DOI":"10.1109\/TDSC.2024.3384416","article-title":"Robust and imperceptible black-box DNN watermarking based on Fourier perturbation analysis and frequency sensitivity clustering","volume":"21","author":"Liu","year":"2024","journal-title":"IEEE Trans. Dependable Secure Comput."},{"issue":"3","key":"10.1016\/j.ins.2026.123869_bib0025","first-page":"1334","article-title":"Deepsigns: a generic watermarking framework for IP protection of deep learning models","volume":"18","author":"Rouhani","year":"2021","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"10.1016\/j.ins.2026.123869_bib0030","series-title":"Advances in Neural Information Processing Systems, 33","first-page":"22619","article-title":"Passport-aware normalization for deep model protection","author":"Zhang","year":"2020"},{"key":"10.1016\/j.ins.2026.123869_bib0035","series-title":"Proceedings 27th USENIX Security Symposium (USENIX Security)","first-page":"1615","article-title":"Turning your weakness into a strength: watermarking deep neural networks by backdooring","author":"Adi","year":"2018"},{"issue":"2","key":"10.1016\/j.ins.2026.123869_bib0040","doi-asserted-by":"crossref","first-page":"1082","DOI":"10.1109\/TDSC.2024.3426957","article-title":"Robust and large-payload DNN watermarking via fixed, distribution-optimized, weights","volume":"22","author":"Tondi","year":"2025","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"10.1016\/j.ins.2026.123869_bib0045","series-title":"Proceedings of the 37th Annual Computer Security Applications Conference","first-page":"554","article-title":"BadNL: backdoor attacks against NLP models with semantic-preserving improvements","author":"Chen","year":"2021"},{"key":"10.1016\/j.ins.2026.123869_bib0050","series-title":"Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing","first-page":"443","article-title":"Hidden killer: invisible textual backdoor attacks with syntactic trigger","author":"Qi","year":"2021"},{"key":"10.1016\/j.ins.2026.123869_bib0055","series-title":"Proceedings of the 40th International Conference on Machine Learning (ICML)","first-page":"17005","article-title":"A watermark for large language models","author":"Kirchenbauer","year":"2023"},{"issue":"9","key":"10.1016\/j.ins.2026.123869_bib0060","doi-asserted-by":"crossref","first-page":"1420","DOI":"10.3390\/math13091420","article-title":"Watermarking for large language models: a survey","volume":"13","author":"Yang","year":"2025","journal-title":"Mathematics"},{"key":"10.1016\/j.ins.2026.123869_bib0065","doi-asserted-by":"crossref","first-page":"228","DOI":"10.1016\/j.ins.2021.06.073","article-title":"NeuNAC: a novel fragile watermarking algorithm for integrity protection of neural networks","volume":"576","author":"Botta","year":"2021","journal-title":"Inf. Sci."},{"key":"10.1016\/j.ins.2026.123869_bib0070","series-title":"Proceedings of the 16th European Conference on Computer Vision (ECCV)","first-page":"182","article-title":"Reflection backdoor: a natural backdoor attack on deep neural networks","author":"Liu","year":"2020"},{"key":"10.1016\/j.ins.2026.123869_bib0075","series-title":"Advances in Neural Information Processing Systems (NeurIPS)","article-title":"A unified approach to interpreting model predictions","author":"Lundberg","year":"2017"},{"key":"10.1016\/j.ins.2026.123869_bib0080","series-title":"Proceedings of the 34th International Conference on Machine Learning (ICML)","first-page":"3319","article-title":"Axiomatic attribution for deep networks","author":"Sundararajan","year":"2017"},{"key":"10.1016\/j.ins.2026.123869_bib0085","doi-asserted-by":"crossref","first-page":"2977","DOI":"10.1109\/TIFS.2022.3198267","article-title":"A DNN fingerprint for non-repudiable model ownership identification and piracy detection","volume":"17","author":"Zheng","year":"2022","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.ins.2026.123869_bib0090","series-title":"Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), 38","first-page":"14115","article-title":"Backdoor attacks via machine unlearning","author":"Liu","year":"2024"},{"key":"10.1016\/j.ins.2026.123869_bib0095","series-title":"Proceedings of 2021 Great Lakes Symposium on VLSI","first-page":"455","article-title":"DNN intellectual property protection: taxonomy, attacks and evaluations","author":"Xue","year":"2021"},{"key":"10.1016\/j.ins.2026.123869_bib0100","series-title":"Proceedings 30th USENIX Security Symposium (USENIX Security)","first-page":"1937","article-title":"Entangled watermarks as a defense against model extraction","author":"Jia","year":"2021"},{"key":"10.1016\/j.ins.2026.123869_bib0105","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2022.102730","article-title":"The triggers that open the NLP model backdoors are hidden in the adversarial samples","volume":"118","author":"Shao","year":"2022","journal-title":"Comput. Secur."},{"key":"10.1016\/j.ins.2026.123869_bib0110","series-title":"Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing (EMNLP)","first-page":"4569","article-title":"Mind the style of text! Adversarial and backdoor attacks based on text style transfer","author":"Qi","year":"2021"},{"key":"10.1016\/j.ins.2026.123869_bib0115","series-title":"Findings of the Association for Computational Linguistics: EMNLP","first-page":"7518","article-title":"GuardEmb: dynamic watermark for safeguarding large language model embedding service against model stealing attack","author":"Wang","year":"2024"},{"key":"10.1016\/j.ins.2026.123869_bib0120","doi-asserted-by":"crossref","DOI":"10.1016\/j.neucom.2023.126700","article-title":"A novel watermarking framework for intellectual property protection of NLG APIs","volume":"558","author":"Li","year":"2023","journal-title":"Neurocomputing"},{"key":"10.1016\/j.ins.2026.123869_bib0125","series-title":"Proceedings of the IEEE Symposium on Security and Privacy (SP)","first-page":"707","article-title":"Neural cleanse: identifying and mitigating backdoor attacks in neural networks","author":"Wang","year":"2019"},{"key":"10.1016\/j.ins.2026.123869_bib0130","author":"Krishna"},{"key":"10.1016\/j.ins.2026.123869_bib0135","series-title":"Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), 35","first-page":"12963","article-title":"Self-attention attribution: interpreting information interactions inside transformer","author":"Hao","year":"2021"},{"key":"10.1016\/j.ins.2026.123869_bib0140","series-title":"Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), 36","first-page":"561","article-title":"Backdoor attacks on the DNN interpretation system","author":"Fang","year":"2022"},{"key":"10.1016\/j.ins.2026.123869_bib0145","author":"Li"},{"key":"10.1016\/j.ins.2026.123869_bib0150","series-title":"Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing (EMNLP)","first-page":"1631","article-title":"Recursive deep models for semantic compositionality over a sentiment treebank","author":"Socher","year":"2013"},{"key":"10.1016\/j.ins.2026.123869_bib0155","series-title":"Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long Papers)","first-page":"1112","article-title":"A broad-coverage challenge corpus for sentence understanding through inference","author":"Williams","year":"2018"},{"key":"10.1016\/j.ins.2026.123869_bib0160","series-title":"Proceedings of the 28th International Conference on Neural Information Processing Systems (NeurIPS)","first-page":"649","article-title":"Character-level convolutional networks for text classification","author":"Zhang","year":"2015"},{"key":"10.1016\/j.ins.2026.123869_bib0165","series-title":"Proceedings of the Third International Workshop on Paraphrasing (IWP)","article-title":"Automatically constructing a corpus of sentential paraphrases","author":"Dolan","year":"2005"},{"key":"10.1016\/j.ins.2026.123869_bib0170","series-title":"Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies","first-page":"4171","article-title":"BERT: pre-training of deep bidirectional transformers for language understanding","author":"Devlin","year":"2019"},{"key":"10.1016\/j.ins.2026.123869_bib0175","author":"Liu"},{"issue":"8","key":"10.1016\/j.ins.2026.123869_bib0180","first-page":"9","article-title":"Language models are unsupervised multitask learners","volume":"1","author":"Radford","year":"2019","journal-title":"OpenAI Blog"},{"issue":"140","key":"10.1016\/j.ins.2026.123869_bib0185","first-page":"1","article-title":"Exploring the limits of transfer learning with a unified text-to-text transformer","volume":"21","author":"Raffel","year":"2020","journal-title":"J. Mach. Learn. Res."},{"key":"10.1016\/j.ins.2026.123869_bib0190","author":"Zhang"},{"key":"10.1016\/j.ins.2026.123869_bib0195","series-title":"Proceedings of the IEEE European Symposium on Security and Privacy (EuroS&P)","first-page":"179","article-title":"Trojaning language models for fun and profit","author":"Zhang","year":"2021"}],"container-title":["Information Sciences"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0020025526008005?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0020025526008005?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,9,8]],"date-time":"2026-09-08T20:50:04Z","timestamp":1788900604000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0020025526008005"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,11]]},"references-count":38,"alternative-id":["S0020025526008005"],"URL":"https:\/\/doi.org\/10.1016\/j.ins.2026.123869","relation":{},"ISSN":["0020-0255"],"issn-type":[{"value":"0020-0255","type":"print"}],"subject":[],"published":{"date-parts":[[2026,11]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"SensMark: Robust and interpretable model watermarking via contextual sensitivity estimation and adaptive trigger insertion","name":"articletitle","label":"Article Title"},{"value":"Information Sciences","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.ins.2026.123869","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Published by Elsevier Inc.","name":"copyright","label":"Copyright"}],"article-number":"123869"}}