{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,17]],"date-time":"2026-05-17T10:07:45Z","timestamp":1779012465996,"version":"3.51.4"},"reference-count":57,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/100018910","name":"National Computer Network Emergency Response Technical Team Coordination Center of China","doi-asserted-by":"publisher","award":["2020A065"],"award-info":[{"award-number":["2020A065"]}],"id":[{"id":"10.13039\/100018910","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Neurocomputing"],"published-print":{"date-parts":[[2026,7]]},"DOI":"10.1016\/j.neucom.2026.133646","type":"journal-article","created":{"date-parts":[[2026,4,15]],"date-time":"2026-04-15T23:13:47Z","timestamp":1776294827000},"page":"133646","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["High-fidelity backdoor watermark embedding framework for classification models in heterogeneous tabular data"],"prefix":"10.1016","volume":"687","author":[{"given":"Jixun","family":"Wei","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jinjie","family":"Zhou","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yuanhao","family":"Men","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7729-5439","authenticated-orcid":false,"given":"Senlin","family":"Luo","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Limin","family":"Pan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"78","reference":[{"issue":"14s","key":"10.1016\/j.neucom.2026.133646_bib1","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3595292","article-title":"I know what you trained last summer: a survey on stealing machine learning models and defences","volume":"55","author":"Oliynyk","year":"2023","journal-title":"ACM Comput. Surv."},{"issue":"11","key":"10.1016\/j.neucom.2026.133646_bib2","doi-asserted-by":"crossref","first-page":"31829","DOI":"10.1007\/s11042-023-16843-3","article-title":"A review of image watermarking for identity protection and verification","volume":"83","author":"Sharma","year":"2024","journal-title":"Multimed. Tools Appl."},{"key":"10.1016\/j.neucom.2026.133646_bib3","first-page":"1615","article-title":"Turning your weakness into a strength: watermarking deep neural networks by backdooring","author":"Adi","year":"2018","journal-title":"27th USENIX Secur. Symp (USENIX Secur. 18)"},{"key":"10.1016\/j.neucom.2026.133646_bib4","doi-asserted-by":"crossref","DOI":"10.1109\/TNNLS.2025.3565170","article-title":"Persistence of backdoor-based watermarks for neural networks: a comprehensive evaluation","author":"Ngo","year":"2025","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"issue":"7","key":"10.1016\/j.neucom.2026.133646_bib5","doi-asserted-by":"crossref","first-page":"4339","DOI":"10.1007\/s00034-024-02651-z","article-title":"Deep learning-based watermarking techniques challenges: a review of current and future trends","volume":"43","author":"Ben Jabra","year":"2024","journal-title":"Circuits Syst. Signal Process."},{"key":"10.1016\/j.neucom.2026.133646_bib6","doi-asserted-by":"crossref","DOI":"10.1016\/j.sigpro.2025.110088","article-title":"A survey of fragile model watermarking","volume":"238","author":"Gao","year":"2026","journal-title":"Signal Process."},{"issue":"2","key":"10.1016\/j.neucom.2026.133646_bib7","first-page":"89","article-title":"Robust image watermarking based on hybrid IWT-DCT-SVD","volume":"1","author":"Wahyudi","year":"2025","journal-title":"IJACI Int. J. Adv. Comput. Inform."},{"issue":"2","key":"10.1016\/j.neucom.2026.133646_bib8","first-page":"1","article-title":"A survey of text watermarking in the era of large language models","volume":"57","author":"Liu","year":"2024","journal-title":"ACM Comput. Surv."},{"key":"10.1016\/j.neucom.2026.133646_bib9","first-page":"159","article-title":"Protecting intellectual property of deep neural networks with watermarking","author":"Zhang","year":"2018","journal-title":"Proc. 2018 Asia Conf. Comput. Commun. Secur."},{"issue":"6","key":"10.1016\/j.neucom.2026.133646_bib10","first-page":"593","article-title":"Information extraction from semi and unstructured data sources: a systematic literature review","volume":"14","author":"Zaman","year":"2020","journal-title":"ICIC Exp. Lett."},{"issue":"27","key":"10.1016\/j.neucom.2026.133646_bib11","doi-asserted-by":"crossref","first-page":"20149","DOI":"10.1007\/s11042-020-08881-y","article-title":"A recent survey on multimedia and database watermarking","volume":"79","author":"Kumar","year":"2020","journal-title":"Multimed. Tools Appl."},{"key":"10.1016\/j.neucom.2026.133646_bib12","unstructured":"Goodfellow, I.J., Shlens, J., & Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. https:\/\/doi.org\/10.48550\/arXiv.1412.6572."},{"key":"10.1016\/j.neucom.2026.133646_bib13","article-title":"Spread-transform dither modulation watermarking of deep neural network","volume":"63","author":"Li","year":"2021","journal-title":"J. Inf. Secur. Appl."},{"key":"10.1016\/j.neucom.2026.133646_bib14","doi-asserted-by":"crossref","first-page":"84","DOI":"10.1016\/j.inffus.2021.11.011","article-title":"Tabular data: deep learning is not all you need","volume":"81","author":"Shwartz-Ziv","year":"2022","journal-title":"Inf. Fusion"},{"key":"10.1016\/j.neucom.2026.133646_bib15","doi-asserted-by":"crossref","DOI":"10.1016\/j.patcog.2023.109844","article-title":"Deep fidelity in DNN watermarking: a study of backdoor watermarking for classification models","volume":"144","author":"Hua","year":"2023","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.neucom.2026.133646_bib16","first-page":"20373","article-title":"Excess capacity and backdoor poisoning","volume":"34","author":"Manoj","year":"2021","journal-title":"Adv. Neural Inf. Process. Syst."},{"issue":"14","key":"10.1016\/j.neucom.2026.133646_bib17","doi-asserted-by":"crossref","first-page":"16497","DOI":"10.1007\/s10489-022-03339-0","article-title":"Active intellectual property protection for deep neural networks through stealthy backdoor and users\u2019 identities authentication","volume":"52","author":"Xue","year":"2022","journal-title":"Appl. Intell."},{"key":"10.1016\/j.neucom.2026.133646_bib18","series-title":"International Conference on Machine Learning for Cyber Security","first-page":"90","article-title":"A client-side watermarking with private-class in federated learning","author":"Chen","year":"2023"},{"key":"10.1016\/j.neucom.2026.133646_bib19","first-page":"1937","article-title":"Entangled watermarks as a defense against model extraction","author":"Jia","year":"2021","journal-title":"30th USENIX Secur. Symp (USENIX Secur. 21)"},{"key":"10.1016\/j.neucom.2026.133646_bib20","doi-asserted-by":"crossref","first-page":"39","DOI":"10.1145\/3531536.3532950","article-title":"Blindspot: watermarking through fairness","author":"Lounici","year":"2022","journal-title":"Proc. 2022 ACM Workshop Inf. Hiding Multimed. Secur."},{"key":"10.1016\/j.neucom.2026.133646_bib21","series-title":"ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)","first-page":"2700","article-title":"Spy-watermark: robust invisible watermarking for backdoor attack","author":"Wang","year":"2024"},{"key":"10.1016\/j.neucom.2026.133646_bib22","unstructured":"Liu, A., Pan, L., Hu, X., Meng, S., & Wen, L. (2023). A Semantic Invariant Robust Watermark for Large Language Models. ArXiv, abs\/2310.06356. https:\/\/doi.org\/10.48550\/arXiv.2310.06356."},{"key":"10.1016\/j.neucom.2026.133646_bib23","first-page":"48971","article-title":"Fedgmark: certifiably robust watermarking for federated graph learning","author":"Yang","year":"2024","journal-title":"Adv. Neural Inf. Process. Syst. 37"},{"key":"10.1016\/j.neucom.2026.133646_bib24","doi-asserted-by":"crossref","first-page":"314","DOI":"10.65109\/SEBO3603","article-title":"Temporal watermarks for deep reinforcement learning models","author":"Chen","year":"2021","journal-title":"Proc. 20th Int. Conf. Auton. Agents MultiAgent Syst."},{"key":"10.1016\/j.neucom.2026.133646_bib25","first-page":"487","article-title":"DeepAttest: an end-to-end attestation framework for deep neural networks","author":"Chen","year":"2019","journal-title":"Int. Symp Comput. Archit."},{"key":"10.1016\/j.neucom.2026.133646_bib26","doi-asserted-by":"crossref","first-page":"269","DOI":"10.1145\/3078971.3078974","article-title":"Embedding watermarks into deep neural networks","author":"Uchida","year":"2017","journal-title":"Proc. 2017 ACM Int. Conf. Multimed. Retr."},{"key":"10.1016\/j.neucom.2026.133646_bib27","series-title":"CCF International Conference on Natural Language Processing and Chinese Computing","first-page":"708","article-title":"COSYWA: enhancing semantic integrity in watermarking natural language generation","author":"Fang","year":"2023"},{"key":"10.1016\/j.neucom.2026.133646_bib28","doi-asserted-by":"crossref","DOI":"10.3389\/fdata.2021.729663","article-title":"A systematic review on model watermarking for neural networks","volume":"4","author":"Boenisch","year":"2021","journal-title":"Front. big Data"},{"key":"10.1016\/j.neucom.2026.133646_bib29","series-title":"International Conference on Knowledge Science, Engineering and Management","first-page":"363","article-title":"Watermarking neural network with compensation mechanism","author":"Feng","year":"2020"},{"key":"10.1016\/j.neucom.2026.133646_bib30","first-page":"485","article-title":"Deepsigns: an end-to-end watermarking framework for ownership protection of deep neural networks","author":"Darvish Rouhani","year":"2019","journal-title":"Proc. Twenty-Fourth Int. Conf. Archit. Support Program. Lang. Oper. Syst."},{"key":"10.1016\/j.neucom.2026.133646_bib31","first-page":"2574","article-title":"Deepfool: a simple and accurate method to fool deep neural networks","author":"Moosavi-Dezfooli","year":"2016","journal-title":"Proc. IEEE Conf. Comput. Vis. Pattern Recognit."},{"issue":"13","key":"10.1016\/j.neucom.2026.133646_bib32","doi-asserted-by":"crossref","first-page":"9233","DOI":"10.1007\/s00521-019-04434-z","article-title":"Adversarial frontier stitching for remote neural network watermarking","volume":"32","author":"Le Merrer","year":"2020","journal-title":"Neural Comput. Appl."},{"key":"10.1016\/j.neucom.2026.133646_bib33","unstructured":"Ballet, V., Renard, X., Aigrain, J., Laugel, T., Frossard, P., & Detyniecki, M. (2019). Imperceptible adversarial attacks on tabular data. arXiv preprint arXiv:1911.03274. https:\/\/doi.org\/10.48550\/arXiv.1911.03274."},{"key":"10.1016\/j.neucom.2026.133646_bib34","unstructured":"Cartella, F., Anunciacao, O., Funabiki, Y., Yamaguchi, D., Akishita, T., & Elshocht, O. (2021). Adversarial attacks for tabular data: Application to fraud detection and imbalanced data. arXiv preprint arXiv:2101.08030. https:\/\/doi.org\/10.48550\/arXiv.2101.08030."},{"key":"10.1016\/j.neucom.2026.133646_bib35","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2022.108377","article-title":"Not all datasets are born equal: on heterogeneous tabular data and adversarial examples","volume":"242","author":"Mathov","year":"2022","journal-title":"Knowl. -Based Syst."},{"key":"10.1016\/j.neucom.2026.133646_bib36","first-page":"18932","article-title":"Revisiting deep learning models for tabular data","volume":"34","author":"Gorishniy","year":"2021","journal-title":"Adv. Neural Inf. Process. Syst."},{"issue":"8","key":"10.1016\/j.neucom.2026.133646_bib37","first-page":"6679","article-title":"Tabnet: attentive interpretable tabular learning","volume":"35","author":"Arik","year":"2021","journal-title":"Proc. AAAI Conf. Artif. Intell."},{"key":"10.1016\/j.neucom.2026.133646_bib38","first-page":"442","article-title":"A weight-wise watermarking technique for DNN models and its robustness against overwriting attack","volume":"11766","author":"He","year":"2021"},{"issue":"14","key":"10.1016\/j.neucom.2026.133646_bib39","doi-asserted-by":"crossref","first-page":"6184","DOI":"10.3390\/app14146184","article-title":"IW-NeRF: using implicit watermarks to protect the copyright of neural radiation fields","volume":"14","author":"Chen","year":"2024","journal-title":"Appl. Sci."},{"key":"10.1016\/j.neucom.2026.133646_bib40","series-title":"2021 IEEE Symposium on Security and Privacy (SP)","first-page":"121","article-title":"Adversarial watermarking transformer: Towards tracing text provenance with data hiding","author":"Abdelnabi","year":"2021"},{"issue":"8","key":"10.1016\/j.neucom.2026.133646_bib41","doi-asserted-by":"crossref","first-page":"733","DOI":"10.1007\/s10489-025-06608-w","article-title":"DMC-watermark: a backdoor richer watermark for dual identity verification by dynamic mask covering","volume":"55","author":"Zhu","year":"2025","journal-title":"Appl. Intell."},{"key":"10.1016\/j.neucom.2026.133646_bib42","doi-asserted-by":"crossref","first-page":"4417","DOI":"10.1145\/3474085.3475591","article-title":"Dawn: dynamic adversarial watermarking of neural networks","author":"Szyller","year":"2021","journal-title":"Proc. 29th ACM Int. Conf. Multimed."},{"key":"10.1016\/j.neucom.2026.133646_bib43","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s13640-020-00527-1","article-title":"Secure neural network watermarking protocol against forging attack","volume":"2020","author":"Zhu","year":"2020","journal-title":"EURASIP J. Image Video Process."},{"key":"10.1016\/j.neucom.2026.133646_bib44","doi-asserted-by":"crossref","first-page":"171","DOI":"10.1016\/j.neucom.2021.07.051","article-title":"A survey of deep neural network watermarking techniques","volume":"461","author":"Li","year":"2021","journal-title":"Neurocomputing"},{"issue":"6","key":"10.1016\/j.neucom.2026.133646_bib45","doi-asserted-by":"crossref","first-page":"4403","DOI":"10.1007\/s10462-021-10125-w","article-title":"Adversarial example detection for DNN models: a review and experimental comparison","volume":"55","author":"Aldahdooh","year":"2022","journal-title":"Artif. Intell. Rev."},{"key":"10.1016\/j.neucom.2026.133646_bib46","series-title":"ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)","first-page":"8057","article-title":"A quantitative analysis of the robustness of neural networks for tabular data","author":"Gupta","year":"2021"},{"key":"10.1016\/j.neucom.2026.133646_bib47","series-title":"International Conference on Machine Learning","first-page":"10355","article-title":"Deltagrad: rapid retraining of machine learning models","author":"Wu","year":"2020"},{"issue":"1","key":"10.1016\/j.neucom.2026.133646_bib48","first-page":"62","article-title":"Tamper localization and content restoration in fragile image watermarking: a review","volume":"2","author":"Amrullah","year":"2026","journal-title":"IJACI Int. J. Adv. Comput. Inform."},{"issue":"1","key":"10.1016\/j.neucom.2026.133646_bib49","first-page":"41","article-title":"Robust digital image watermarking using DWT, hessenberg, and SVD for copyright protection","volume":"2","author":"Kusuma","year":"2026","journal-title":"IJACI Int. J. Adv. Comput. Inform."},{"key":"10.1016\/j.neucom.2026.133646_bib50","first-page":"321","article-title":"Refit: a unified watermark removal framework for deep learning systems with limited data","author":"Chen","year":"2021","journal-title":"Proc. 2021 ACM Asia Conf. Comput. Commun. Secur."},{"key":"10.1016\/j.neucom.2026.133646_bib51","author":"Kohavi","year":"1996","journal-title":"Adult Data Set."},{"key":"10.1016\/j.neucom.2026.133646_bib52","author":"Schlimmer","year":"1987","journal-title":"Mushroom Data Set."},{"key":"10.1016\/j.neucom.2026.133646_bib53","author":"Jock","year":"1998","journal-title":"Cover. Data Set."},{"key":"10.1016\/j.neucom.2026.133646_bib54","author":"LeCun","year":"1998","journal-title":"MNIST DATABASE Handwrit. Digits"},{"issue":"11","key":"10.1016\/j.neucom.2026.133646_bib55","doi-asserted-by":"crossref","first-page":"1494","DOI":"10.3390\/sym16111494","article-title":"Clean-label backdoor watermarking for dataset copyright protection via trigger optimization","volume":"16","author":"Chen","year":"2024","journal-title":"Symmetry"},{"key":"10.1016\/j.neucom.2026.133646_bib56","first-page":"2579","article-title":"Visualizing data using t-SNE","volume":"9","author":"Maaten","year":"2008","journal-title":"J. Mach. Learn. Res."},{"issue":"8045","key":"10.1016\/j.neucom.2026.133646_bib57","doi-asserted-by":"crossref","first-page":"319","DOI":"10.1038\/s41586-024-08328-6","article-title":"Accurate predictions on small data with a tabular foundation model","volume":"637","author":"Hollmann","year":"2025","journal-title":"Nature"}],"container-title":["Neurocomputing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S092523122601043X?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S092523122601043X?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,5,17]],"date-time":"2026-05-17T09:33:08Z","timestamp":1779010388000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S092523122601043X"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7]]},"references-count":57,"alternative-id":["S092523122601043X"],"URL":"https:\/\/doi.org\/10.1016\/j.neucom.2026.133646","relation":{},"ISSN":["0925-2312"],"issn-type":[{"value":"0925-2312","type":"print"}],"subject":[],"published":{"date-parts":[[2026,7]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"High-fidelity backdoor watermark embedding framework for classification models in heterogeneous tabular data","name":"articletitle","label":"Article Title"},{"value":"Neurocomputing","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.neucom.2026.133646","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"133646"}}