{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,17]],"date-time":"2026-06-17T16:29:25Z","timestamp":1781713765619,"version":"3.54.5"},"reference-count":100,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U2336206"],"award-info":[{"award-number":["U2336206"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62472398"],"award-info":[{"award-number":["62472398"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U2436601"],"award-info":[{"award-number":["U2436601"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62402469"],"award-info":[{"award-number":["62402469"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Fundamental Research Funds of a State Key Laboratory","award":["CBCT2024KF01"],"award-info":[{"award-number":["CBCT2024KF01"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2026,3]]},"DOI":"10.1109\/tdsc.2025.3622253","type":"journal-article","created":{"date-parts":[[2025,10,16]],"date-time":"2025-10-16T17:41:25Z","timestamp":1760636485000},"page":"1955-1970","source":"Crossref","is-referenced-by-count":2,"title":["Performance-Lossless Black-Box Model Watermarking"],"prefix":"10.1109","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-0588-1674","authenticated-orcid":false,"given":"Na","family":"Zhao","sequence":"first","affiliation":[{"name":"CAS Key Laboratory of Electro-Magnetic Space Information, University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9868-3414","authenticated-orcid":false,"given":"Kejiang","family":"Chen","sequence":"additional","affiliation":[{"name":"CAS Key Laboratory of Electro-Magnetic Space Information, University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5576-6108","authenticated-orcid":false,"given":"Weiming","family":"Zhang","sequence":"additional","affiliation":[{"name":"CAS Key Laboratory of Electro-Magnetic Space Information, University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4417-9316","authenticated-orcid":false,"given":"Nenghai","family":"Yu","sequence":"additional","affiliation":[{"name":"CAS Key Laboratory of Electro-Magnetic Space Information, University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Improving language understanding by generative pre-training","author":"Radford","year":"2018"},{"key":"ref2","article-title":"Language models are unsupervised multitask learners","author":"Radford"},{"key":"ref3","first-page":"1877","article-title":"Language models are few-shot learners","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Brown"},{"key":"ref4","article-title":"GPT-4 technical report","year":"2023"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1017\/9781108891530.013"},{"key":"ref6","article-title":"Large scale GAN training for high fidelity natural image synthesis","author":"Brock","year":"2019"},{"key":"ref7","article-title":"Alias-free generative adversarial networks","author":"Karras","year":"2021"},{"key":"ref8","article-title":"Diffusion models beat gans on image synthesis","author":"Dhariwal","year":"2021"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.52202\/068431-0628"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01042"},{"key":"ref14","first-page":"269","volume-title":"Proc. ACM Int. Conf. Multimedia Retrieval","author":"Uchida"},{"key":"ref15","first-page":"4714","article-title":"Rethinking deep neural network ownership verification: Embedding passports to defeat ambiguity attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Fan"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3242737"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3259881"},{"key":"ref18","first-page":"1615","article-title":"Turning your weakness into a strength: Watermarking deep neural networks by backdooring","volume-title":"Proc. 27th USENIX Secur. Symp.","author":"Adi"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196550"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3474085.3475591"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00099"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2025.3546223"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00083"},{"key":"ref24","first-page":"17061","article-title":"A watermark for large language models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Kirchenbauer"},{"key":"ref25","first-page":"4031","volume-title":"Proc. 2024 Conf. North Amer. Chapter Assoc. Comput. Linguistics: Hum. Lang. Technol.","author":"Yoo"},{"key":"ref26","first-page":"13423","article-title":"Aqualora: Toward white-box protection for customized stable diffusion models via watermark lora","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Feng"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-019-04434-z"},{"key":"ref28","article-title":"Blackmarks: Blackbox multibit watermarking for deep neural networks","author":"Chen","year":"2019"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2022.3194704"},{"key":"ref30","first-page":"1","volume-title":"Proc. IEEE 34th Comput. Secur. Foundations Symp.","author":"Lounici"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE53745.2022.00104"},{"key":"ref32","first-page":"1937","article-title":"Entangled watermarks as a defense against model extraction","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Jia"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3240765.3240862"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1186\/s13640-020-00527-1"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3437880.3460398"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359801"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i9.21193"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01457"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i9.21184"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3321705.3329808"},{"key":"ref41","first-page":"1450","article-title":"Certified neural network watermarks with randomized smoothing","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Bansal"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-47436-2_35"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.23919\/DATE54114.2022.9774656"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW63382.2024.00217"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/WIFS58808.2023.10374879"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i12.26750"},{"key":"ref47","article-title":"Functionmarker: Watermarking language datasets via knowledge injection","author":"Li","year":"2023"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/focs54457.2022.00092"},{"key":"ref49","article-title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain","author":"Gu","year":"2017"},{"key":"ref50","article-title":"Label-consistent backdoor attacks","author":"Turner","year":"2019"},{"key":"ref51","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"ref53","article-title":"Clean-label backdoor attacks","author":"Turner","year":"2018"},{"key":"ref54","first-page":"1505","article-title":"Blind backdoors in deep learning models","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Bagdasaryan"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3323873.3325042"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8682202"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-55393-7_33"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.2352\/ISSN.2470-1173.2020.4.MWSF-022"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3450000"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/3437880.3460402"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2020-2787"},{"key":"ref62","first-page":"6978","article-title":"Watermarking deep neural networks with greedy residuals","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Liu"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2021.3088846"},{"key":"ref64","first-page":"22619","article-title":"Passport-aware normalization for deep model protection","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhang"},{"key":"ref65","first-page":"22177","article-title":"Trapdoor normalization with irreversible ownership verification","volume-title":"Proc. Int. Conf. Mach. Learni.","author":"Liu"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00785"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01169"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/3297858.3304051"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2021.108285"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP43922.2022.9747416"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/WIFS55849.2022.9975300"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP49357.2023.10095332"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom50675.2020.00062"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.52202\/068431-0392"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i10.21321"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.117"},{"key":"ref77","article-title":"Watermarking text generated by black-box language models","author":"Yang","year":"2023"},{"key":"ref78","article-title":"Provable robust watermarking for ai-generated text","author":"Zhao","year":"2023"},{"key":"ref79","article-title":"On the reliability of watermarks for large language models","author":"Kirchenbauer","year":"2023"},{"key":"ref80","first-page":"1","article-title":"Watermax: Breaking the LLM watermark detectability-robustness-quality trade-off","volume-title":"Proc. 38th Conf. Neural Inf. Process. Syst.","author":"Giboulot"},{"key":"ref81","article-title":"Unbiased watermark for large language models","author":"Hu","year":"2023"},{"key":"ref82","article-title":"A resilient and accessible distribution-preserving watermark for large language models","author":"Wu","year":"2023"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.268"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i16.29756"},{"key":"ref85","article-title":"An unforgeable publicly verifiable watermark for large language models","author":"Liu","year":"2023"},{"key":"ref86","article-title":"A semantic invariant robust watermark for large language models","author":"Liu","year":"2024"},{"key":"ref87","article-title":"Token-specific watermarking with enhanced detectability and semantic coherence for large language models","author":"Huo","year":"2024"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01267-0_40"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW59228.2023.00100"},{"key":"ref90","article-title":"Watermark anything with localized messages","author":"Sander","year":"2024"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2020.3030671"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2021.3064850"},{"key":"ref93","article-title":"A recipe for watermarking diffusion models","author":"Zhao","year":"2023"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.02053"},{"key":"ref95","article-title":"An efficient watermarking method for latent diffusion models via low-rank adaptation","author":"Lin","year":"2024"},{"key":"ref96","article-title":"Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust","author":"Wen","year":"2023"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01156"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1201\/9781351133036"},{"key":"ref99","article-title":"OPT: Open pre-trained transformer language models","author":"Zhang","year":"2022"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01042"},{"key":"ref101","article-title":"Project gutenberg ebook metadata, complete catalog metadata 1971\u20132023)","author":"Gutenberg"},{"key":"ref102","first-page":"8748","article-title":"Learning transferable visual models from natural language supervision","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Radford"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP49660.2025.10889741"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8858\/11434575\/11205307.pdf?arnumber=11205307","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,16]],"date-time":"2026-03-16T22:50:48Z","timestamp":1773701448000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11205307\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3]]},"references-count":100,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2025.3622253","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3]]}}}