Practical Black-box Watermark Removal via Knowledge Distillation into Compact Models

Practical Black-box Watermark Removal via Knowledge Distillation into Compact Models | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Practical Black-box Watermark Removal via Knowledge Distillation into Compact Models Chengcheng Wei, Aoting Hu, Deiqing Yang This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8190886/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted 7 You are reading this latest preprint version Abstract As deep neural networks continue to grow in scale and deployment scope, protecting model intellectual property has become increasingly important. Black-box watermarking techniques embed hidden ownership signals via trigger inputs, enabling verification without access to model internals. However, existing works typically evaluate extraction attacks under a rather optimistic assumption: the attacker’s surrogate model is at least as large as, or even larger than, the victim model, and watermarks that survive in this setting are deemed secure. Our study shows that the surrogate model’s capacity has a strong impact on watermark retention. When the surrogate model is smaller than the victim model, its limited capacity often fails to preserve the embedded watermark, even if main-task performance remains high. Motivated by this observation, we propose the \emph{Capacity Exploited Watermark Removal Attack} (CEWRA), a black-box watermark removal framework that leverages knowledge distillation into deliberately low-capacity neural architectures. By reducing model depth and parameter count, CEWRA disrupts the representation subspace used to encode watermark signals while preserving essential features for the primary task. We evaluate CEWRA on three benchmark datasets and three state-of-the-art black-box watermarking schemes—EWE (USENIX 2021), MEA (S&P 2024), and SSW (ACM MM 2023). On CIFAR-100, CEWRA reduces the Watermark Success Rate to $0%$ for EWE and the robust SSW-S variant, and to $21.8%$ for SSW-P, while keeping the accuracy drop on the primary task within $2.5%$. Compared to existing removal techniques, CEWRA shows superior robustness and generalizability across architectures such as ResNet and VGG, revealing a capacity-related vulnerability in current black-box watermarking strategies and underscoring the need for capacity-aware IP protection under realistic extraction scenarios. Model watermarking Black-box watermark removal Knowledge distillation Model extraction attacks Capacity-constrained models Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Review Version 1 posted Reviewers agreed at journal 15 Apr, 2026 Reviews received at journal 09 Jan, 2026 Reviewers agreed at journal 25 Dec, 2025 Reviewers invited by journal 25 Dec, 2025 Editor assigned by journal 25 Dec, 2025 Submission checks completed at journal 25 Nov, 2025 First submitted to journal 24 Nov, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8190886","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":565525821,"identity":"8b15a56d-c71f-4456-8212-fb612cf65168","order_by":0,"name":"Chengcheng Wei","email":"","orcid":"","institution":"Anhui University of Technology","correspondingAuthor":false,"prefix":"","firstName":"Chengcheng","middleName":"","lastName":"Wei","suffix":""},{"id":565525822,"identity":"82b1b743-2716-4039-a5d3-67cd3292f40b","order_by":1,"name":"Aoting Hu","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA3UlEQVRIiWNgGAWjYJCCAyDEz8AD5jA2ENbADNEi2cAD1kycFrBFBgeI1cLf3n/wcMGvO4mbj589Jv2BwUZ2wwHmZw/waZE4c5jh8My+Z4nbzuSlSRxgSDPecIDN3ACvNTeSGQ7z9hxO3HYgxwyo5XDihgM8bBL4dMjDtGzufwPS8p+wFgOQFp4fQMMlwLYcIKzF8Mxhg8O8DYeNZ9x4Y2xxxiDZeOZhNjO8WuSONz7+zPPnsGx/f47hjYoKO9m+483P8GoBA8Y2uDsZoBFFEPwhStUoGAWjYBSMVAAA/jVUlc93+g4AAAAASUVORK5CYII=","orcid":"","institution":"Anhui University of Technology","correspondingAuthor":true,"prefix":"","firstName":"Aoting","middleName":"","lastName":"Hu","suffix":""},{"id":565525823,"identity":"3d7fc423-92f7-4263-a547-176ce75c07f7","order_by":2,"name":"Deiqing Yang","email":"","orcid":"","institution":"Anhui University of Technology","correspondingAuthor":false,"prefix":"","firstName":"Deiqing","middleName":"","lastName":"Yang","suffix":""}],"badges":[],"createdAt":"2025-11-24 08:23:15","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8190886/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8190886/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":99131083,"identity":"32fa81d1-ed16-41da-98c6-573a80ec7ec0","added_by":"auto","created_at":"2025-12-29 04:35:53","extension":"json","order_by":0,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":6040,"visible":true,"origin":"","legend":"","description":"","filename":"5fc8765693cd46409600945753fd00e2.json","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/e56c91afee8622fc91265436.json"},{"id":99131080,"identity":"d80eb17b-a9d5-4b88-b4d3-223d04303774","added_by":"auto","created_at":"2025-12-29 04:35:53","extension":"xml","order_by":1,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":126417,"visible":true,"origin":"","legend":"","description":"","filename":"5fc8765693cd46409600945753fd00e21enriched.xml","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/3417394a9f2b2be24bad046d.xml"},{"id":99315249,"identity":"f09c6509-4fa5-42f3-921e-7818232c45af","added_by":"auto","created_at":"2025-12-31 16:26:41","extension":"pdf","order_by":2,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":25868,"visible":true,"origin":"","legend":"","description":"","filename":"CapacityvsTestAccPaperReady.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/d07658f7fca54a12424dfba8.pdf"},{"id":99316206,"identity":"1de28239-85a4-4625-abc7-69316680d60f","added_by":"auto","created_at":"2025-12-31 16:27:53","extension":"pdf","order_by":3,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":16579,"visible":true,"origin":"","legend":"","description":"","filename":"CapacityvsTestaccfinalgroup.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/314cf858695236013165f3bc.pdf"},{"id":99131089,"identity":"bf46b754-77fa-4ff5-8258-a975c009f032","added_by":"auto","created_at":"2025-12-29 04:35:54","extension":"pdf","order_by":4,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":26512,"visible":true,"origin":"","legend":"","description":"","filename":"CapacityvsWatermarkAccuracyREALDATA.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/ca0b3f5d20918e91a8af3679.pdf"},{"id":99131079,"identity":"7706f8c0-abb3-4ba2-929e-7d6e8fc881bc","added_by":"auto","created_at":"2025-12-29 04:35:53","extension":"pdf","order_by":5,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":18200,"visible":true,"origin":"","legend":"","description":"","filename":"CapacityvsWtaccfinalgroup.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/3fe60c5f830eb0aa0f9b0135.pdf"},{"id":99314974,"identity":"d35979f9-3411-48da-8869-d4790539dbe5","added_by":"auto","created_at":"2025-12-31 16:25:16","extension":"pdf","order_by":6,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":18054,"visible":true,"origin":"","legend":"","description":"","filename":"CapacityvsWtaccfinalgroup1.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/82bdbd681637ec2e583b8e1a.pdf"},{"id":99315441,"identity":"6b41912e-591c-4e53-a26b-ae9f5fc9629a","added_by":"auto","created_at":"2025-12-31 16:26:56","extension":"doc","order_by":7,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":20992,"visible":true,"origin":"","legend":"","description":"","filename":"CoverLetterClusterComputingAotingHu.doc","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/472aff144adfbdb54ec50eb7.doc"},{"id":99315030,"identity":"c35fa86d-31cf-43f3-9728-c199805e699b","added_by":"auto","created_at":"2025-12-31 16:26:04","extension":"pdf","order_by":8,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":542365,"visible":true,"origin":"","legend":"","description":"","filename":"PracticalBlackboxWatermarkRemoval.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/50deb1bddc250188fe3664c0.pdf"},{"id":99315403,"identity":"26699816-719c-46bb-b071-44c16b1920a8","added_by":"auto","created_at":"2025-12-31 16:26:53","extension":"png","order_by":9,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":220922,"visible":true,"origin":"","legend":"","description":"","filename":"cifar10top10channelsbest.png","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/5c0ca96d3b60ad0095c46db9.png"},{"id":99316236,"identity":"9ff218e9-dd05-45f0-a94e-56fbf4e56f3d","added_by":"auto","created_at":"2025-12-31 16:27:55","extension":"eps","order_by":10,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":91593,"visible":true,"origin":"","legend":"","description":"","filename":"fig.eps","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/64aee37f7a066b0240fdf0ad.eps"},{"id":99314938,"identity":"7be7afd8-f8ae-4cc9-9489-4a6a109da85c","added_by":"auto","created_at":"2025-12-31 16:24:56","extension":"jpg","order_by":11,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":79635,"visible":true,"origin":"","legend":"","description":"","filename":"huitu.jpg","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/9017f021974c647e97569f45.jpg"},{"id":99131098,"identity":"f97657e1-5cc4-4a14-a828-2de4c2e54a50","added_by":"auto","created_at":"2025-12-29 04:35:54","extension":"pdf","order_by":12,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":21407,"visible":true,"origin":"","legend":"","description":"","filename":"modelwatermarkcomparison.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/bb64b592445bce7aa34f32d9.pdf"},{"id":99316287,"identity":"cccb1314-7500-4897-9c2c-5e121d22b7f3","added_by":"auto","created_at":"2025-12-31 16:28:06","extension":"png","order_by":13,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":62272,"visible":true,"origin":"","legend":"","description":"","filename":"modelwatermarkcomparison.png","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/04507929db049840d970b65d.png"},{"id":99316567,"identity":"7caafc33-c717-4b5e-9d87-1b98a230a8b1","added_by":"auto","created_at":"2025-12-31 16:28:36","extension":"png","order_by":14,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":46174,"visible":true,"origin":"","legend":"","description":"","filename":"modelwatermarkcomparison1.png","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/c97a775335dab7070408c029.png"},{"id":99131094,"identity":"d0c8aadc-8317-46b9-a2ab-658a6dcba6fd","added_by":"auto","created_at":"2025-12-29 04:35:54","extension":"bst","order_by":15,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":146013,"visible":true,"origin":"","legend":"","description":"","filename":"snapacite.bst","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/6b562ee78ec63039e22286f1.bst"},{"id":99131095,"identity":"3ffebce3-3261-4492-8e00-3df2f6c9e104","added_by":"auto","created_at":"2025-12-29 04:35:54","extension":"bst","order_by":16,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":29828,"visible":true,"origin":"","legend":"","description":"","filename":"snaps.bst","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/10af649f339c36e1ded22f4f.bst"},{"id":99131097,"identity":"34cdf997-e036-4c6f-8968-75c111344bf3","added_by":"auto","created_at":"2025-12-29 04:35:54","extension":"pdf","order_by":17,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":421391,"visible":true,"origin":"","legend":"","description":"","filename":"snarticle.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/3ba17f8e82123883ef11d0f4.pdf"},{"id":99315218,"identity":"b8398a63-ee0c-499d-a1ad-21d51eda618f","added_by":"auto","created_at":"2025-12-31 16:26:38","extension":"bst","order_by":18,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":35515,"visible":true,"origin":"","legend":"","description":"","filename":"snbasic.bst","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/f7b2a1413983d78fa1cc191d.bst"},{"id":99315229,"identity":"c637faa6-b9c0-4454-b298-254515c9f930","added_by":"auto","created_at":"2025-12-31 16:26:40","extension":"bst","order_by":19,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":33968,"visible":true,"origin":"","legend":"","description":"","filename":"snchicago.bst","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/12ce949fc2066bf810220130.bst"},{"id":99131107,"identity":"25ba66b6-177f-478f-86de-1d9f0e0966d0","added_by":"auto","created_at":"2025-12-29 04:35:54","extension":"cls","order_by":20,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":55857,"visible":true,"origin":"","legend":"","description":"","filename":"snjnl.cls","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/7a0069f10563fa9312b8406a.cls"},{"id":99315020,"identity":"86404181-df8e-4cee-9eb2-9744a5874d16","added_by":"auto","created_at":"2025-12-31 16:25:58","extension":"bst","order_by":21,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":64023,"visible":true,"origin":"","legend":"","description":"","filename":"snmathphysay.bst","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/939f5ad2a319a2850792d091.bst"},{"id":99315603,"identity":"d1c560e9-e4a8-4083-953a-1d7ffe7bff7d","added_by":"auto","created_at":"2025-12-31 16:27:06","extension":"bst","order_by":22,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":64166,"visible":true,"origin":"","legend":"","description":"","filename":"snmathphysnum.bst","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/7f1a418658f7067231816f33.bst"},{"id":99131099,"identity":"972e1b75-2a50-4567-b9ce-d498f84aeb80","added_by":"auto","created_at":"2025-12-29 04:35:54","extension":"bst","order_by":23,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":37333,"visible":true,"origin":"","legend":"","description":"","filename":"snnature.bst","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/9352685a44522211d2205709.bst"},{"id":99131096,"identity":"889e852e-2f48-4419-a91c-dce2481fc423","added_by":"auto","created_at":"2025-12-29 04:35:54","extension":"bst","order_by":24,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":39951,"visible":true,"origin":"","legend":"","description":"","filename":"snvancouveray.bst","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/2c99056eebd66c39ac8a410a.bst"},{"id":99131102,"identity":"3a56d65b-da72-4166-a572-b82d6292165b","added_by":"auto","created_at":"2025-12-29 04:35:54","extension":"bst","order_by":25,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":40758,"visible":true,"origin":"","legend":"","description":"","filename":"snvancouvernum.bst","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/4139acf167a23a22f809a28d.bst"},{"id":99314925,"identity":"f58f908e-e373-45ae-b1a2-929bd36ee823","added_by":"auto","created_at":"2025-12-31 16:24:41","extension":"png","order_by":26,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":185643,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinecifar10top10channelsbest.png","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/97f895a21bd24aa778e1c338.png"},{"id":99131101,"identity":"41ba874e-ecce-4636-bac3-283da36a8376","added_by":"auto","created_at":"2025-12-29 04:35:54","extension":"png","order_by":27,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":340092,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinehuitu.png","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/309504b9fb7e71577aee3b19.png"},{"id":99315049,"identity":"39aaa671-453d-4189-be3e-b39c8c4ceeac","added_by":"auto","created_at":"2025-12-31 16:26:14","extension":"png","order_by":28,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":52320,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinemodelwatermarkcomparison.png","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/4f1e426065a4020d19fb5e16.png"},{"id":99314890,"identity":"6aa853be-aba1-428f-8b65-63493c175fcb","added_by":"auto","created_at":"2025-12-31 16:24:21","extension":"png","order_by":29,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":39165,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinemodelwatermarkcomparison1.png","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/803d04111cac0636a11d27b7.png"},{"id":99131104,"identity":"84a2116d-7353-4951-a457-b7220dcdd4bc","added_by":"auto","created_at":"2025-12-29 04:35:54","extension":"xml","order_by":30,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":130782,"visible":true,"origin":"","legend":"","description":"","filename":"5fc8765693cd46409600945753fd00e21structuring.xml","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/d37fb258589525bd40a16874.xml"},{"id":99314731,"identity":"c23d05a0-e99e-47bf-bef9-b1c412df5e99","added_by":"auto","created_at":"2025-12-31 16:22:46","extension":"html","order_by":31,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":148138,"visible":true,"origin":"","legend":"","description":"","filename":"earlyproof.html","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1/37ce32ff67f5f3b90612475e.html"},{"id":99787910,"identity":"87ae76c4-fa5c-4c4b-b9f2-ccf7b4473e4f","added_by":"auto","created_at":"2026-01-08 12:41:14","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":486764,"visible":true,"origin":"","legend":"","description":"","filename":"PracticalBlackboxWatermarkRemoval.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8190886/v1_covered_3483fa02-9e56-471c-aada-e20e13c5d3d6.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Practical Black-box Watermark Removal via Knowledge Distillation into Compact Models","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"cluster-computing","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"","sideBox":"Learn more about [Cluster Computing](https://www.springer.com/journal/10586)","snPcode":"10586","submissionUrl":"https://submission.nature.com/new-submission/10586/3","title":"Cluster Computing","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"Model watermarking, Black-box watermark removal, Knowledge distillation, Model extraction attacks, Capacity-constrained models","lastPublishedDoi":"10.21203/rs.3.rs-8190886/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8190886/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"As deep neural networks continue to grow in scale and deployment scope, protecting model intellectual property has become increasingly important. Black-box watermarking techniques embed hidden ownership signals via trigger inputs, enabling verification without access to model internals. However, existing works typically evaluate extraction attacks under a rather optimistic assumption: the attacker’s surrogate model is at least as large as, or even larger than, the victim model, and watermarks that survive in this setting are deemed secure. Our study shows that the surrogate model’s capacity has a strong impact on watermark retention. When the surrogate model is smaller than the victim model, its limited capacity often fails to preserve the embedded watermark, even if main-task performance remains high. Motivated by this observation, we propose the \\emph{Capacity Exploited Watermark Removal Attack} (CEWRA), a black-box watermark removal framework that leverages knowledge distillation into deliberately low-capacity neural architectures. By reducing model depth and parameter count, CEWRA disrupts the representation subspace used to encode watermark signals while preserving essential features for the primary task. We evaluate CEWRA on three benchmark datasets and three state-of-the-art black-box watermarking schemes—EWE (USENIX 2021), MEA (S\\\u0026P 2024), and SSW (ACM MM 2023). On CIFAR-100, CEWRA reduces the Watermark Success Rate to $0\\%$ for EWE and the robust SSW-S variant, and to $21.8\\%$ for SSW-P, while keeping the accuracy drop on the primary task within $2.5\\%$. Compared to existing removal techniques, CEWRA shows superior robustness and generalizability across architectures such as ResNet and VGG, revealing a capacity-related vulnerability in current black-box watermarking strategies and underscoring the need for capacity-aware IP protection under realistic extraction scenarios.","manuscriptTitle":"Practical Black-box Watermark Removal via Knowledge Distillation into Compact Models","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-12-29 04:35:49","doi":"10.21203/rs.3.rs-8190886/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"reviewerAgreed","content":"276694272610828484572183069185921028157","date":"2026-04-15T06:45:18+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-01-10T00:53:21+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"278093021982513217591877098630817280440","date":"2025-12-25T14:46:03+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-12-25T14:43:53+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-12-25T14:43:11+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-11-25T14:41:09+00:00","index":"","fulltext":""},{"type":"submitted","content":"Cluster Computing","date":"2025-11-24T08:09:57+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"cluster-computing","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"","sideBox":"Learn more about [Cluster Computing](https://www.springer.com/journal/10586)","snPcode":"10586","submissionUrl":"https://submission.nature.com/new-submission/10586/3","title":"Cluster Computing","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"0fc9a365-8ee4-4cb9-9f8c-b68b097f5225","owner":[],"postedDate":"December 29th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[],"tags":[],"updatedAt":"2025-12-29T04:35:49+00:00","versionOfRecord":[],"versionCreatedAt":"2025-12-29 04:35:49","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8190886","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8190886","identity":"rs-8190886","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}