Imagine you hide your house key under the doormat. It works fine — until someone realizes that every house on the block uses the same hiding spot. That's the core mechanism here: BN-layer watermarking in Federated Learning relies on a predictable, structurally exposed embedding location, and the authors demonstrate you can remove the key without ever entering the house. The committed claim: BN-based watermarking schemes in Federated Learning have fundamental, exploitable vulnerabilities, and a practical data-free attack can consistently strip them. This is not a theoretical objection — the authors built the attack, ran it against two representative FL watermarking schemes, and showed watermark removal with minimal model performance degradation. The kicker: no access to representative training data is needed. The attacker doesn't need your dataset. They just need to know where to look. Why BN layers? In Federated Learning, participants train locally and share model updates. BN layers carry per-channel statistics (running mean and variance) that are convenient places to embed watermarks because they're small, model-specific, and don't require large modifications. But this convenience is the vulnerability. BN statistics are structurally isolated from the learned feature representations — they can be reset, recalculated, or replaced without touching the weights that actually encode task performance. The authors exploit exactly this structural separation. The attack works by regenerating BN statistics using synthetic or surrogate data that approximates the batch statistics the model expects, effectively overwriting the watermark while preserving the model's functional behavior. Because BN layers normalize activations in a well-understood way, the attacker can reconstruct plausible statistics without ever seeing real training samples. This is what makes the attack data-free and practically dangerous: the barrier to execution is knowledge of the architecture, not access to proprietary data. The broader point lands harder than the specific attack. The authors invoke Kerckhoffs's principle — the standard that a cryptographic system should be secure even if everything about the system except the key is public knowledge. Most DNN watermarking papers evaluate robustness against fine-tuning, pruning, or distillation. Those are generic modifications. This paper argues the field has been testing locks against weather, not against lockpicks. If your watermark's security depends on the attacker not knowing it's in the BN layers, that's security through obscurity, and it fails the moment the scheme is published. Two representative FL watermarking schemes were tested. In both cases, watermark removal was consistent. The paper doesn't name exact accuracy deltas in the abstract, but the claim of 'minimal impact on model performance' is the load-bearing result. If removal cost 10% accuracy, defenders could argue the cure is worse than the disease. But if the model stays functional post-attack, the watermark was never providing real security — just a false sense of it. This is a necessary correction paper. It doesn't propose a new watermarking scheme; it demolishes the assumptions underlying a popular class of existing ones. For anyone building FL systems that depend on BN-layer watermarks for ownership verification or participant attribution, this is a direct threat model update. The field now needs watermarking approaches that survive Kerckhoffs-style adversaries, not just accidental model modifications.
