Intellectual Property Protection of Hyperdimensional Computing Classifiers: Black-Box Ownership Verification via Model Watermarking
Authors: Hamed Poursiami, Farshad Soleiman, Ahmad Tahmasivand, Guojing Cong, Thomas Potok, Khaled N. Khasawneh, Kai Zeng, Maryam Parsa
Organizations: 1Electrical and Computer Engineering Department, George Mason University, Fairfax, VA, USA · 2Oak Ridge National Laboratory, Oak Ridge, TN, USA
Hyperdimensional computing (HDC) offers efficient learning and inference for resource-constrained systems, yet ownership verification of its models remains underexplored. We present the first systematic investigation of model watermarking in HDC by adapting backdoor-based embedding to three classifiers with different prototype-learning mechanisms. Across four benchmarks, with conventional neural networks as references, we examine whether watermarks can be learned without compromising task accuracy and whether they survive subsequent model modification and replication. The error-driven classifiers, AdaptHD and OnlineHD, support verification at a nominal trigger exposure of 1% with at most 0.58 percentage points of mean accuracy loss, whereas single-pass Vanilla HDC requires greater exposure and can incur substantial accuracy costs. The error-driven models retain verification under native continued training, but extraction produces surrogates that reproduce much of the task behavior without verifiable watermarks. Watermark overwriting readily embeds attacker watermarks into HDC prototypes and erodes the owner's watermark more strongly than in the neural network references, although the strongest erosion coincides with large accuracy losses. We further deploy watermarked AdaptHD on an FPGA and stress its execution through undervolting and overclocking. Verification survives substantial computation errors, whereas more severe stress either causes verification failure together with accuracy collapse or results in inference timeouts. These findings establish the feasibility of watermarking in HDC while identifying limitations in retention under extraction and sensitivity to overwriting.
Figures & tables
Dataset
α
mmin
ExactFPR (%)
Emp.FPR (%)
MNIST ( C=10 )
10−2
11
0.935
0.925
10−3
14
0.029
0.014
Fashion-MNIST ( C=10 )
10−2
11
0.935
0.966
10−3
14
0.029
0.042
ISOLET ( C=26 )
10−2
7
0.291
0.281
10−3
8
0.061
0.067
Table 1: Verification thresholds (minimum matches mmin out of K=50 ) and null-hypothesis calibration.
Dataset
Model
Clean Acc. (%)
WM Acc. (%)
Δ Acc. (pp)
Matches
Ver. p<10−2
Ver. p<10−3
MNIST
ANN
99.18
99.14
0.03
50.0
True
True
AdaptHD
94.80
94.76
0.03
50.0
True
True
OnlineHD
96.28
96.31
-0.03
49.3
True
True
Vanilla
82.96
82.98
-0.01
3.7
False
False
FashionMNIST
ANN
91.98
91.90
0.08
49.7
True
True
AdaptHD
83.96
84.18
-0.22
47.7
True
True
Table 2: Watermark embedding at exposure ρ=1% with K=50 triggers. Matches are out of 50 ; Δ Acc. denotes clean minus watermarked accuracy in percentage points; True/False indicates verification success/failure.
Figure 1: Effect of watermark exposure on Vanilla HDC ( K=50 ). (a) Mean verification evidence, expressed as −log10(p) , and capped at 12 ; dashed lines mark the verification thresholds. (b) Mean test-accuracy loss relative to the unwatermarked model. Stars mark exposures used in subsequent attacks: ρ=15% for MNIST, 50% for Fashion-MNIST, 7.5% for ISOLET, and 25% for UCI-HAR.
Native continued Fine-Tuning
Centroid Grafting
Dataset
Model
Δ Acc. (pp)
Matches
p<10−2
p<10−3
Angle ( ∘ )
Δ Acc. (pp)
Matches
p<10−2
p<10−3
MNIST
ANN
-0.05
50.0
3/3
3/3
—
—
—
—
—
AdaptHD
-0.07
44.0
3/3
3/3
17.24
-0.01
49.0
3/3
3/3
OnlineHD
-0.43
46.7
3/3
3/3
8.93
0.62
41.7
3/3
3/3
Vanilla
-0.27
10.7
1/3
1/3
0.61
-0.32
9.7
1/3
1/3
FashionMNIST
ANN
-0.48
49.7
3/3
3/3
—
—
—
—
—
Table 3: Model adaptation using the full auxiliary split. Metrics are means over three seeds; matches are out of 50 , and verification entries count passing seeds. Δ Acc. is pre-attack minus post-attack accuracy (pp). Angle denotes mean class-prototype rotation. ANN adaptation uses weight fine-tuning; centroid grafting applies only to HDC.
(a) Model extraction
(b) Watermark overwriting
Original owner
Attacker
Dataset
Model
Fidelity (%)
Δ Acc. (pp)
Matches
Δ Acc. (pp)
Matches
p<10−2
p<10−3
Matches
p<10−2
p<10−3
MNIST
ANN
98.51
0.89
5.0
0.02
50.0
3/3
3/3
18.7
3/3
3/3
AdaptHD
93.76
2.07
4.0
3.87
35.7
3/3
3/3
48.0
3/3
3/3
OnlineHD
94.99
2.15
4.3
1.43
35.7
3/3
3/3
49.7
3/3
3/3
Vanilla
89.86
5.00
4.3
-0.03
12.7
2/3
1/3
11.7
2/3
1/3
Table 4: Post-deployment (a) model extraction and (b) watermark overwriting. Fidelity is surrogate–victim prediction agreement; Δ Acc. is pre-attack minus post-attack accuracy (pp). Metrics average three seeds; matches are out of 50 , and verification entries count passing seeds. All extracted surrogates fail both verification thresholds in every seed.
Setting
MNIST
FashionMNIST
ISOLET
UCI-HAR
V
f
E ( μ J)
Acc.
WM
Acc.
WM
Acc.
WM
Acc.
WM
0.852 V
187.5 MHz
204.4
95.00
50.0 ✓
84.15
48.0 ✓
93.26
50.0 ✓
93.52
50.0 ✓
0.652 V
187.5 MHz
112.0
95.00
50.0 ✓
84.15
48.0 ✓
93.26
50.0 ✓
93.52
50.0 ✓
0.645 V
230.0 MHz
108.2
95.00
50.0 ✓
84.15
48.0 ✓
93.26
50.0 ✓
93.52
50.0 ✓
0.652 V
250.0 MHz
117.8
83.00
36.7 ✓
74.58
31.0 ✓
90.49
44.0 ✓
89.38
40.3 ✓
0.645 V
250.0 MHz
116.2
73.00
31.0 ✓
66.40
25.3 ✓
88.75
41.3 ✓
87.47
33.0 ✓
Table 5: Watermarked AdaptHD under FPGA undervolting and overclocking (ZCU104). Accuracies (%) and trigger matches (WM, out of 50 ) average three hardware runs per setting. E denotes mean core-supply energy per query.
Overparameterized machine learning (ML) methods such as neural networks may be prohibitively resource intensive for devices with limited computational capabilities. Hyperdimensional computing (HDC) is an emerging resource efficient and low-complexity ML method that allows hardware efficient implementations of (re-)training and inference procedures. In this paper, we propose a maximum-margin HDC classifier, which significantly outperforms baseline HDC methods on several benchmark datasets. Our method leverages a formal relation between HDC and support vector machines (SVMs) that we established for the first time. Our findings may inspire novel HDC methods with potentially more hardware-oriented implementations compared to SVMs, thus enabling more efficient learning solutions for various intelligent resource-constrained applications.
Nikita Zeulin, Olga Galinina, Ravikumar Balakrishnan +2
Tampere University, Tampere, Finland · Tampere Institute for Advanced Study, Tampere University, Finland · Intel Corporation, Santa Clara, CA, United States
Being trained on large and diverse datasets, visual foundation models (VFMs) can be fine-tuned to achieve remarkable performance and efficiency in various downstream computer vision tasks. The high computational cost of data collection and training makes these models valuable assets, which motivates some VFM owners to distribute them alongside a license to protect their intellectual property rights. In this paper, we propose an approach to ownership verification of visual foundation models that leverages a small encoder-decoder network to embed digital watermarks into an internal representation of a hold-out set of input images. The method is based on random watermark embedding, which makes the watermark statistics detectable in functional copies of the watermarked model. Both theoretically and experimentally, we demonstrate that the proposed method yields a low probability of false detection for non-watermarked models and a low probability of false misdetection for watermarked models.
Hyperdimensional computing (HDC) is attractive for efficient and robust learning, but conventional inference still encodes every query independently, repeatedly paying the cost of high-dimensional projection. We introduce SupHDC, a new inference paradigm that processes multiple queries through a shared encoding computation. SupHDC assigns lightweight random slot keys, superposes the keyed queries before encoding, and uses slot-specific classifiers to recover their individual predictions. A random-feature kernel view explains why exact recovery of each hypervector is unnecessary: inference only needs to preserve the class evidence that determines the prediction. Across ten datasets, SupHDC achieves 1.39x analytical speedup with no average accuracy loss, and up to 2.08x speedup with only a 2.67 percentage-point mean accuracy loss. On a Raspberry Pi~5, it delivers 2.01x measured wall-clock speedup with a 2.26 percentage-point loss in mean prediction accuracy. SupHDC shows that high-dimensional redundancy can be used not only for robustness, but also as capacity for shared inference.