Embedding watermarks into models has been widely used to protect model ownership in federated learning (FL). However, existing methods are inadequate for protecting the ownership of personalized models acquired by clients in personalized FL (PFL). This is due to the aggregation of the global model in PFL, resulting in conflicts over clients' private watermarks. Moreover, malicious clients may tamper with embedded watermarks to facilitate model leakage and evade accountability. This paper presents a robust watermark embedding scheme, named RobWE, to protect the ownership of personalized models in PFL. We first decouple the watermark embedding of personalized models into two parts: head layer embedding and representation layer embedding. The head layer belongs to clients' private part without participating in model aggregation, while the representation layer is the shared part for aggregation. For representation layer embedding, we employ a watermark slice embedding operation, which avoids watermark embedding conflicts. Furthermore, we design a malicious watermark detection scheme enabling the server to verify the correctness of watermarks before aggregating local models. We conduct an exhaustive experimental evaluation of RobWE. The results demonstrate that RobWE significantly outperforms the state-of-the-art watermark embedding schemes in FL in terms of fidelity, reliability, and robustness.

该研究提出了一种名为RobWE的鲁棒性水印嵌入方案，用于保护个性化联邦学习（PFL）中个性化模型的所有权，其通过将水印嵌入分为头层和表示层，采用水印切片嵌入操作来避免嵌入冲突，并设计了一种恶意水印检测方案以确保水印的正确性，实验证明RobWE在忠实度、可靠性和鲁棒性方面明显优于现有的水印嵌入方案。

RobWE：个性化联邦学习模型所有权保护的鲁棒性水印嵌入