Robust White-Box Watermarking Against Model Pruning: An Encoder-Decoder Approach for Medical Image Analysis

Abstract

Medical image classification models often require large amounts of annotated data and considerable training costs, making intellectual property protection particularly important. However, existing white-box watermarking methods are mainly designed for natural image classification tasks and have rarely been validated on medical image models. To address this issue, this paper proposes a white-box watermarking method for medical image classification models. A lightweight autoencoder is first pretrained on the MNIST dataset, and its encoder parameters are used to construct the watermark. The watermark is embedded into the convolutional layer parameters of the target model using a binary parameter mask and parameter overwriting, while an adaptive regularization term is introduced to improve watermark stability. Model ownership is verified by reconstructing the encoder from the extracted watermark parameters and evaluating image reconstruction performance. Experiments on three MedMNIST2D datasets demonstrate that the proposed method achieves effective watermark embedding while preserving classification performance. Moreover, it maintains reliable copyright verification capability against common model attacks, including pruning and fine-tuning.