Do You Steal My Model? Signature Diffusion Embedded Dual-Verification Watermarking for Protecting Intellectual Property of Hyperspectral Image Classification Models

1 Introduction

Deep learning (DL) techniques have tremendously developed and achieved great success in various hyperspectral image (HSI) processing tasks, e.g. classification [Yang et al., 2024a], change detection [Luo et al., 2024; Qu et al., 2025a], super-resolution [Qu et al., 2025b] and so on. HSI classification models, which accurately identify objects on the Earth surface, play a crucial role in environmental monitoring and military [Li et al., 2019a]. To fully mine the capability of HSI classification models, network architectures need to be delicately designed, and substantial computational resources is required. Additionally, considering the specialized equipment for HSI acquisition and expert knowledge for data notation, it is hard to obtain sufficient training data. Therefore, a well-performed HSI classification model is of great values. The illegal use of HSI classification model may result in the leakage of sensitive information, thereby threatening to the national security. The intellectual property (IP) protection of HSI classification models has emerged as a pressing demand.

∗Corresponding author

Inspired by the idea of digital watermarking [Fang et al., 2021], model watermarking methods are developed to protect the IP of deep models (shown in Figure 1). Generally, according to the information accessible to the verifier, the model watermarking methods are divided into white-box watermarking and black-box watermarking. White-box watermarking methods embed the watermark information into the weights or the activations of the model [Rouhani et al., 2019; Li et al., 2021]. However, the adversaries may not willing to provide the internal parameters and structure of model to verifiers, which limits the practicability in real-world scenarios. Black-box watermarking can be verified easier, which only requires API access to the suspicious model. Black-box watermarking methods train the model with a set of carefully crafted trigger samples and the designated labels to embed a secret watermark [Li et al., 2023; Kim et al., 2023]. The ownership of the model is verified by comparing the outputs of the model with the pre-defined labels of the trigger samples.

However, mainstream black-box methods construct trigger set by embedding a noticeable pattern to clean samples, which is easily detected by human inspection. Although some researches try to generate imperceptible trigger samples, they ignore the data characteristic of HSIs, which may result in spectral distortion of trigger samples. Moreover, the existing model watermarking methods fail to verify ownership when trigger sets generated by different parties provide the same mapping relationship, leading to a successful forgery attack.

To address these problems, we propose a signature diffusion embedded dual-verification watermarking for IP protection of HSI classification models, which constructs imperceptible trigger set with owner signature to verify the ownership of the model against forgery attack. Specifically, the seeds near decision boundary are selected to capture the information of the protected model while avoiding significant impact to the classification task. The owner signature is incorporated to the abundance matrix of the selected seeds via diffusion model in subpixel space, thus ensuring the imperceptibility of trigger samples. To resist the forgery attack, a dual-stamp ownership verification strategy is proposed to make the watermark traceable. The contributions of this paper are:

• We propose a signature diffusion embedded dualverification watermarking method, which is the first to introduce the IP protection problem into HSI classification tasks.
• We propose a subpixel-space owner signature diffusion incorporated imperceptible trigger set generation method to hide the owner signature into the abundance of the seeds in subpixel space via diffusion model, thus ensuring the imperceptibility of trigger samples with explicit owner information.
• We design a dual-stamp ownership verification strategy to verify both the ownership of the model and the legality of trigger set, effectively resisting forgery attack.

2 RelatedWork

Model Watermarking

Various model watermarking methods have been proposed for the IP protection of deep models, which can be divided into white-box watermarking and black-box watermarking.

White-box watermarking methods embed the watermark into the parameters of the target model. [Uchida et al., 2017] first proposed watermarking deep models by embedding a bit string into a middle layer. [Rouhani et al., 2019] embedded the watermark information in the probability density function of activation map. [Liu et al., 2021] greedily selected a few and important model parameters for watermarking embedding to improve the robustness. [Fan et al., 2022] added a special passport layer to the model, which performs unsatisfactory when the weights of passport are incorrect. [Zhao et al., 2021] pruned the internal channels of the model with pruning rates controlled by watermark. The verification process of white-box watermarking methods requires the internal details of suspicious model, severely limiting its applicability.

Black-box watermarking methods facilitate ownership verification without detailed information of the parameters or structures of the model [Li et al., 2024]. [Adi et al., 2018] embedded abstract images as backdoor watermark into the model to verify the ownership. A blind watermark framework [Li et al., 2019b] guaranteed the key samples with similar distribution of the original samples. [Li et al., 2022] verified the ownership of suspicious model with the knowledge of defender-specified external features. CosWM [Charette et al., 2022] embedded a cosine signal into the output of teacher model to defend against model distillation. [Lin et al., 2024] utilized logistic chaos mapping to chunk and dislocate trigger samples with original labels. An unambiguous backdoor watermarking method [Hua et al., 2023a] increased the cost of ambiguity attacks to exponential complexity. [Liu et al., 2024] modified clean samples in frequency domain to generate trigger sample without noticeable artifacts. However, IP protection for HSI classification models is unexplored. How to generate imperceptible trigger set to protect HSI classification models remains an important open question.

Diffusion Model

Diffusion models [Sohl-Dickstein et al., 2015] are proposed as generative model with high flexibility, which destroy the structure in a data distribution, and recover the data via a gradually denoising process.[Ho et al., 2020] proposed denoising diffusion probabilistic models (DDPMs) to simplify this process. DDPMs use a Markov chain to convert the input image into Gaussian noise in the forward process, and adopt a denoising network to predict the added noise in the reverse process. Denoising diffusion implicit models (DDIMs) [Song et al., 2020] provide an alternative noising process without Markov chain constraints, enabling faster sampling than DDPMs. Diffusion models have shown remarkable results in various computer vision tasks including image translation [Zhao et al., 2022], steganography [Yu et al., 2024; Yang et al., 2024b], etc. In this paper, the potential of diffusion model is explored to embed the owner signature into HSI to generate imperceptible trigger samples.

3 ProposedMethod

3.1 Threat Model

In the threat model, we consider a attack-defense setting with two parties: model owner O and adversary A. The model owner aims to train a well-performed HSI classification model FO and provide API for clients. The adversary may illegally construct a stolen model FA that has similar performance (Acc(FA) ≈ Acc(FO)). Therefore, the model owner intends to design an effective model IP protection method to verify the ownership of suspicious model.

Adversary's Capability. The adversary steals a model and removes its watermark without affecting its functionality, but has limited computational resources and data. Moreover, aware of the input-output relationships of trigger set, the adversary may forge a trigger set and claim ownership.

Defender's Capability. The defender, who is the legitimate developer and owner of the model, embeds a watermark to assert ownership for unauthorized use. The defender has full access to the inner details of the model, while only API of the suspicious model is available for ownership verification.

3.2 Overview

We assume the HSI classification model FO is trained with N labeled samples, and learns a function FO : X → Y to classify each pixel in HSI Xi ∈ X into corresponding class yi ∈ Y = {1, 2, ..., c}. The problem of HSI classification model IP protection is defined as: given the model FO, the watermark is embedded into FO to obtain watermarked model F WM O , and the owner can extract thewatermark to verify whether the suspicious model FSP is stolen from F WM O .

In this paper, the subpixel-space signature diffusion embedded dual-verification watermarking method is proposed for HSI classification model protection. The core idea is to generate imperceptible trigger samples that encode owner signature in the subpixel space for model watermarking, thus enabling ownership verification with both model stamp and trigger stamp to resist the forgery attack. As shown in Figure 2, the proposed method can be formalized into two steps:

1) Signature Incorporated Trigger Set Generation and Watermark Embedding: The model owner selects seeds S = {(Xs, ys)}Ss=1 near decision boundary and incorporates owner signature Sig into the abundance of seeds in the subpixel space (shown in Figure 3) to obtain trigger set, which harnesses the diffusion model to ensure stealthiness. The generated trigger set with pre-defined labels R = {( ̂Xr, yr)}Rr=1 are embedded into model FO as model watermark:

where θ∗ and θ0 are the parameters of the watermarked model F WM O and the model without watermark FO.

2) Dual-Stamp Ownership Verification: The owner first verifies the ownership of the suspicious model FSP remotely with the generated trigger set R. To avoid forgery attack, the owner further verifies if the signature extracted from trigger set ̂ Sig matches the embedded signature Sig. The dual-stamp ownership verification can be formulated as:

3.3 Subpixel-Space Owner Signature Diffusion Incorporated Imperceptible Trigger Set Generation

Seeds Selection

To avoid significant changes of decision boundaries of model FO in watermark embedding process, the samples that be easily misclassified to the target class are selected as seeds S = {(Xs, ys)}Ss=1 . This ensures the generated trigger samples with imperceptible perturbation R = {( ̂Xs, yr)}Rr=1 are still near the decision boundaries. Since the samples with small difference between the top two predicted probability values are regarded to be near decision boundaries, we select seeds Xs according to the following rule shown in Figure 4:

where Minitop (·) selects the top i samples belong to class ci with the smallest difference, Proa denotes the probability of class a, and ysec is the label of second-highest class.

Subpixel Information Diffusion Based Signature Hiding

A subpixel information diffusion based signature hiding method is proposed to embed signature Sig into selected seeds Xs in subpixel space, which adopts diffusion model to make trigger samples indistinguishable from seeds. The foundation lies in changing abundance of HSIs only involves partial spectral information, making perturbation in subpixel space subtler than in pixel space.

Specifically, the spectral signature of each pixel is decomposed into endmember signatures U and corresponding abundance in subpixel space. The endmember matrix is estimated by vertex component analysis (VCA), and under the extended linear mixture model assumption, the abundant matrix A of HSI X is obtained by solving the following problem:

where Ψ is the scaling factor, and E is the additive noise.

Given the abundant matrix of seeds As,0 ∼ q(A), the diffusion model is adopted to embed the signature to the abundant of the seeds in the subpixel space. The forward process gradually adds Gaussian noise to a real data distribution through T steps to obtain a noisy representation As,T :

where As,t is the noisy representation of the t-th step, ¯αt is a noise scheduler, and ϵ is Gaussian noise.

In the reverse process, the proposed method maps the Gaussian representation As,T to an abundance matrix ̂As,0 ∼ q(A) through DDIM, while injecting the signature to the estimated As,t via signature encoders. In this way, the signature is embedded to the generated abundance ̂As,0, and can be extracted by the signature decoders to confirm the legality of the trigger sets. The signature encoder of the t-th step Enct is designed to learn the embedding signature Zt:

For each step t, the input is obtained by concatenating the embedding signature with the estimated As,t, denoted as (As,t ⊙ Zt), and the embedding signature is replaced with a null signature N when t > τ to minimize the influence on visual quality of the generated abundance ̂As,0. The noise predictor ϵθ is adopted to estimate the noise added to As,0, and the estimation of As,0 is formulated as:

The estimated noise is reintroduced to the approximated ̂Ats,0 to obtain As,t-1:

The signature decoder Dect is trained to extract the signature ̂ Sigt concealed in As,t-1:

The trigger sample ̂Xs is obtained by adjusting the generated abundance of seeds ̂As,0 with the scaling factors Ψ and multiplying with the endmember U:

Loss Function

Two key aspects warrant attention in the training process, i.e., visual quality of trigger samples and extraction accuracy of signature. Specifically, the trigger reconstruction loss Ltrig minimizes the mean absolute error between trigger samples ̂As,0 and seeds As,0. The signature extraction loss constrains the cross entropy between the extracted signature ̂ Sigt and original signature Sig. The total loss Ltotal is defined as:

where α and β (set as 1 and 0.1) are loss weights.

3.4 Watermark Embedding

Once the trigger samples ̂Xs with the signature information Sig is generated, the model owner can obtain the watermarked model F WM O by training the model with clean samples and trigger samples. Based on the over-parameterization property of the owner model FO, the training process is able to force the model to learn the mapping between the trigger samples and the pre-defined labels. The watermark embedding process can be formulated as:

3.5 Dual-Stamp Ownership Verification

Assuming the watermarked model F WM O is leaked, the owner can verify the ownership by extracting the watermarking from the suspicious model FSP and comparing with the original watermarking. In this paper, a dual-stamp ownership verification strategy is proposed to confirm the owner of the suspicious model and further verify the generator of trigger set, which can be seen as a dual-stamp process to resist ownership confusion caused by forgery attack.

Definition 1. Given the suspicious model FSP , the model owner queries the predicted results of FSP with the trigger samples. The model owner claims that the ownership of the suspicious model if the accuracy of FSP on the trigger set R = {( ̂Xs, yr)}Rr=1 is lager than the threshold ε:

where Num(·) denotes the function calculating the number

of trigger samples classified into the pre-defined class. Definition 2. Given the trigger samples to be verified as ̂X′s , the model owner claims the legality of the trigger samples if the distance between the extracted signature Sig′ and the original signature Sig is smaller than the threshold η:

4 Experiment

4.1 Implementation Details

We evaluate the performance of the proposed method on three datasets. Pavia University dataset contains 9 classes and has 610×340 pixels with 103 spectral bands. Indian Pines dataset is composed of 224 bands and the spatial dimension is 145×145, which includes 16 land-cover types. Salinas dataset is of size 512×217×224 and contains 16 classes. We conduct experiments on three models, i.e., MCNN [Zheng et al., 2021], DBDA [Li et al., 2020], and SSFTT [Sun et al., 2022] to comprehensively evaluate the performance across different backbones (2D-CNN, 3D-CNN, and Transformer).

In the experiments, HSI is divided into 27×27 and owner signature is fixed as the same spatial size. The DDIM sampler with 200 sampling steps is adopted. The batch size is 128 and learning rate of 1e-3. The number of epochs is set as 500.

OA and Kappa coefficient (KC) indicate the classification accuracy. Watermark success rate (WSR) is used to calculate the probability that the trigger samples are correctly classified into pre-defined label yt. Bit error rate (BER) evaluates quality of extracted signature. PSNR, SSIM, and SAM evaluate visual quality as well as spectral distortion of trigger samples.

4.2 Results

Fidelity

Fidelity measures the impact of watermark embedding on the performance of the original model. OA and KC of clean model and watermarked model are compared on different datasets to evaluate the performance degradation in Table 1. The proposed method achievesan OA drop of less than 0.1% on Salinas dataset and even improves the classification accuracy of MCNN on Indian Pines dataset. The results show that the watermarked models achieve similar performance to clean model, indicating the good fidelity of the proposed method.

Effectiveness

Effectiveness measures whether the ownership of model can be verified successfully by the watermarking method. As shown in Table 1, WSR of watermarked model are higher than 95% on three datasets and three different models, while the clean models without watermarking have WSR lower than 10% for trigger samples. The results can verify the ownership without falsely claiming the ownership of clean models.

To verify the effectiveness for avoiding forgery attack, we evaluate both visual results and objective metrics of extracted owner signature (shown in Figure 5). The signature extracted from trigger samples generated by the owner exhibits high quality with low mean BER. The proposed method proves the unique relationship between the trigger samples and the owner, avoiding the confusion of model's ownership.

Robustness

We evaluate the robustness of the propose method against model fine-tuning, model pruning, and weight quantization.

Model Fine-Tuning: Model fine-tuning retrains the watermarked model to remove watermark by modifying the weights. We randomly select 1% samples in the test set to fine-tune the watermarked model, and the numbers of epochs are set from 10 to 50. As shown in Figure 6, WSR of finetuned model is still 100% for all models, and OA and KC of the watermarked model show minimal decline after finetuning. Therefore, the proposed method is robust to model fine-tuning attack.

Model Pruning: Model pruning removes redundant parameters of the model while maintaining the performance of primary task. We prune the watermarked model with prune rate from 10% to 90% to evaluate the performance and robustness. As can be observed in Table 2, until the pruning rate reaches a threshold that significantly degrades the classification performance, the proposed method can effectively extract the watermark, showing robustness to model pruning attack.

Weight Quantization: Weight quantization compresses the weights to lower bit representation to reduce the storage requirements. Table 3 shows that the values of WSR are still 100%, and the accuracy of classification can be maintained after quantization on all datasets, which shows that the proposed method is resistant to weight quantization attack.

Stealthiness

To evaluate the stealthiness of the proposed method, we compare the trigger samples generated by the proposed method with four representative methods, i.e., Content, Noise, Patches [Wang et al., 2022], and Crop [Lv et al., 2024]. As shown in Figure 7, the trigger patterns of Content and Crop is easily distinguished, which exposes the construction way of trigger set. The noticeable artifacts can be observed on trigger samples generated by Noise and Patches. As shown in Table 4, the proposed method can minimize the visual difference between clean samples and trigger samples, and achieve the best results in terms of mean PSNR, SSIM, and SAM, indicating good stealthiness.

4.3 Comparison to Other Methods

To verify the superiority of the proposed method, we conduct the experiments to compare it to the state-of-the-art methods [Hua et al., 2023b; Lv et al., 2024; Tan et al., 2023]. The results of different methods on various datasets are shown in Table 5. MEA yields a 4.91% accuracy loss in terms of OA on India Pines dataset, while the dropout of OA and KC of the proposed method are less than 0.34% on all datasets, achieving better fidelity than UHFB, MEA, and SSW. This is because the proposed method selects the seeds near decision boundaries and injects imperceptible information to the seeds, ensuring small impact to the performance of the model.

As for the effectiveness, the WSR of all methods are larger than 98%, and the proposed method achieves the highest WSR. However, the main drawback of the competing methods is that they cannot resist forgery attack. The proposed method enables the signature information extracted from the trigger samples to claim the legality of the trigger set, improving the effectiveness for ownership verification.

4.4 Ablation Study

To evaluate the impact of number of trigger samples, we conduct experiments on the proposed method with 50, 100, 200 trigger samples. As shown in Table 6, a larger trigger set leads to a slight decline in OA and KC, indicating a reduction in fidelity. Although WSR remains 100% for different numbers of trigger sets, smaller trigger sets lead to higher miss detection rates. In this paper, 100 trigger samples are adopted to balance fidelity and effectiveness.

We discuss the effect of time step that begins to inject the owner signature (threshold τ). The experiments on models with τ=200, 100, and 20 demonstrate that injecting the signature only in the final steps (τ=20) of diffusion model can minimize the visual influence of signature embedding to trigger sample as well as the impact to classification accuracy.

5 Conclusion

In this paper, we propose a signature diffusion embedded dual-verification watermarking to protect IP of HSI classification models for the first time, which verifies the ownership of model with imperceptible trigger set. The subpixel-space owner signature diffusion incorporated imperceptible trigger set generation method is designed to encode owner signature to the seeds in subpixel space via diffusion model. To ensure adversary cannot forge trigger samples to confuse ownership, dual-stamp ownership verification strategy is proposed to verify both model ownership and legality of trigger set. Experiments demonstrate the effectiveness of the proposed watermarking method in IP protection of HSI classification model.

Acknowledgments

This work was supported in part by the National Natural Science Foundation of China under Grant 62201423, 62471359, and 62476013, the Key Research and Development Program of Shaanxi under Grant 2025SF-YBXM-513, the Young Talent Fund of Association for Science and Technology in Shaanxi under Grant 20230117 and 20250133, the Young Talent Fund of Xi'an Association for Science and Technology under Grant 959202313052, and in part by the Fundamental Research Funds for the Central Universities under Grant QTZX25084.