AID-H-013: Proactive Content & Model Watermarking & Fingerprinting
Embed governed provenance, watermark, or ownership signals into generated content and model assets so authorized investigators can trace origin, detect bounded reuse, or test a model-ownership hypothesis. Content-level controls cover supported image, video, text-generation, and signed-provenance paths; model-level controls use canonical artifact fingerprints or preregistered behavioral challenge populations.
Scope boundary
Owns bounded technical provenance and ownership signals through content watermarking, signed provenance, exact white-box artifact or tensor comparison, and calibrated black-box behavioral challenges. It does not prevent copying, guarantee confidentiality, prove factual truth, or establish legal ownership.
AID-H-003.011: AID-H-013 embeds or evaluates bounded provenance and ownership signals after model artifacts or generated content may be copied; AID-H-003.011 decides whether an entitled, freshly attested client may receive the decryption key for an exact protected model release. Attribution evidence is not an entitlement decision, and attested delivery does not provide later ownership proof.
Sub-techniques
Threat mappings
MITRE ATLAS
- AML.T0024.002 Exfiltration via AI Inference API: Extract AI Model
- AML.T0048.004 External Harms: AI Intellectual Property Theft
MAESTRO
- Model Stealing (L1)
OWASP LLM Top 10 2026
- LLM06:2026 Unbounded Consumption
- LLM07:2026 Misinformation
OWASP ML Top 10 2023
- ML05:2023 Model Theft
- ML09:2023 Output Integrity Attack
OWASP Top 10 for Agentic Applications 2026
- N/A
NIST Adversarial Machine Learning 2025
- NISTAML.031 Model Extraction
Cisco Integrated AI Security and Safety Framework
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-10.1 Model Extraction
Google Secure AI Framework 2.0 - Risks
- MXF: Model Exfiltration
- MRE: Model Reverse Engineering
Databricks AI Security Framework 3.0
- Model 7.2: Model assets leak
- Model Management 8.2: Model theft
- Model Serving - Inference response 10.2: Output manipulation