We formalize and analyze the trade-off between backdoor-based watermarks and adversarial defenses, framing it as an interactive protocol between a verifier and a prover. While previous works have primarily focused on this trade-off, our analysis extends it by identifying transferable attacks as a third, counterintuitive, but necessary option. Our main result shows that for all learning tasks, at least one of the three exists: a watermark, an adversarial defense, or a transferable attack. By transferable attack, we refer to an efficient algorithm that generates queries indistinguishable from the data distribution and capable of fooling all efficient defenders. Using cryptographic techniques, specifically fully homomorphic encryption, we construct a transferable attack and prove its necessity in this trade-off. Finally, we show that tasks of bounded VC-dimension allow adversarial defenses against all attackers, while a subclass allows watermarks secure against fast adversaries.

翻译：我们形式化并分析了基于后门的水印与对抗防御之间的权衡，将其构建为验证者与证明者之间的交互协议。虽然先前研究主要聚焦于此权衡关系，但我们的分析通过将可迁移攻击识别为第三种反直觉但必要的选项，从而扩展了该框架。我们的主要结果表明：对于所有学习任务，以下三者至少存在其一：水印、对抗防御或可迁移攻击。所谓可迁移攻击，我们指能够生成与数据分布不可区分且能欺骗所有高效防御者的查询的高效算法。通过密码学技术（特别是全同态加密），我们构建了可迁移攻击并证明了其在此权衡关系中的必要性。最后，我们证明有界VC维度的任务允许针对所有攻击者的对抗防御，而其中一个子类允许能抵御快速对手的安全水印。