Federated Learning has been popularized in recent years for applications involving personal or sensitive data, as it allows the collaborative training of machine learning models through local updates at the data-owners' premises, which does not require the sharing of the data itself. Considering the risk of leakage or misuse by any of the data-owners, many works attempt to protect their copyright, or even trace the origin of a potential leak through unique watermarks identifying each participant's model copy. Realistic accusation scenarios impose a black-box setting, where watermarks are typically embedded as a set of sample-label pairs. The threat of collusion, however, where multiple bad actors conspire together to produce an untraceable model, has been rarely addressed, and previous works have been limited to shallow networks and near-linearly separable main tasks. To the best of our knowledge, this work is the first to present a general collusion-resistant embedding method for black-box traitor tracing in Federated Learning: BlackCATT, which introduces a novel collusion-aware embedding loss term and, instead of using a fixed trigger set, iteratively optimizes the triggers to aid convergence and traitor tracing performance. Experimental results confirm the efficacy of the proposed scheme across different architectures and datasets. Furthermore, for models that would otherwise suffer from update incompatibility on the main task after learning different watermarks (e.g., architectures including batch normalization layers), our proposed BlackCATT+FR incorporates functional regularization through a set of auxiliary examples at the aggregator, promoting a shared feature space among model copies without compromising traitor tracing performance.

翻译：近年来，联邦学习在处理涉及个人或敏感数据的应用中日益普及，因为它允许通过在数据所有者本地进行模型更新的方式实现机器学习模型的协同训练，而无需共享数据本身。考虑到数据所有者可能存在的泄露或滥用风险，许多研究工作试图保护模型版权，甚至通过识别每个参与者模型副本的唯一水印来追踪潜在泄露的源头。现实的指控场景要求黑盒设置，其中水印通常以一组样本-标签对的形式嵌入。然而，针对多个恶意行为者合谋产生不可追踪模型的合谋威胁，现有研究鲜有涉及，且先前工作仅限于浅层网络和接近线性可分的主任务。据我们所知，本文首次提出了一种适用于联邦学习中黑盒叛徒追踪的通用抗合谋嵌入方法：BlackCATT。该方法引入了一种新颖的合谋感知嵌入损失项，并采用迭代优化触发样本的方式替代固定触发集，以促进收敛并提升叛徒追踪性能。实验结果证实了所提方案在不同架构和数据集上的有效性。此外，对于在学习不同水印后可能因主任务更新不兼容而受损的模型（例如包含批量归一化层的架构），我们提出的BlackCATT+FR通过在聚合器端引入一组辅助样本进行功能正则化，在保持叛徒追踪性能的同时，促进了模型副本间共享特征空间的形成。