ATPP-KAN: robust black-box watermarking for Kolmogorov-Arnold Networks via alternating training and parameter perturbation

In the context of growing concern over intellectual property protection in deep neural networks (DNNs), Kolmogorov-Arnold Networks (KANs), which are emerging neural network architectures that have potential for replacing multi-layer perceptrons (MLPs), cannot ignore their own intellectual property protection issues. Unlike MLPs, KANs have unique architectures that position learnable activation functions at the “edges” of the networks, rather than fixed activation functions at the “nodes.” This innovative design significantly enhances the capacity of models to fit complex functions and provides a more effective tool for various tasks. However, it also means that KANs have distinct characteristics compared with conventional networks. Existing black-box watermarking methods, which are mostly designed for general DNNs, do not fully explore the collaboration between the training set and the trigger set in training KANs. When these methods are applied directly to KANs, they achieve unsatisfactory results in the embedding of watermarks and robustness against watermark removal attacks. Therefore, there is an urgent need to design a specialized watermarking method tailored for KANs. Motivated by this, we propose a robust black-box KAN watermarking method based on alternating training and parameter perturbation (ATPP-KAN). We employ an alternating training strategy, using the original training set and the trigger set alternately for model training, and introduce a model parameter perturbation loss during the training process to simulate watermark removal attacks, thereby effectively enhancing the robustness of the watermark. Experimental results demonstrate that the proposed work can achieve a classification accuracy of 100% for the watermarking task even with a pruning rate of 50%, and the average performance of KANs on the watermarking task remains above 98.67% after fine-tuning attacks.