Satellite models get three access tiers, not one: under 0.0005% of weights changed
Synopsis
Model protection for on-orbit inference no longer has to be all-or-nothing. STAR-OV applies a two-stage reversible perturbation in parameter space, degrading a model from original accuracy to a medium-accuracy state and then to near-random guessing, while the recorded perturbations form hierarchical keys that restore different performance levels by authorization tier. A latent watermark embedded after recovery stays inactive during normal inference and produces verifiable trigger responses once activated. Across four public datasets, the fully encrypted state drops to roughly 10% to 13.97% accuracy while only 10⁻³% to 10⁻²% of parameters are modified.
Interpretation
An on-orbit model can serve inference at different accuracy levels by authorization tier instead of being wholly usable or wholly unusable. Earlier active protection schemes mostly follow a binary authorization paradigm, where the correct key restores full capability and no key leaves the model unusable, so they cannot offer intermediate-accuracy service without retraining. On CIFAR-10, GTSRB, Fashion-MNIST and UC Merced Land Use, accuracy falls by roughly 42% to 47% from the original model to the partially recovered model, and by more than 80% from the original model to the fully encrypted model.
Encryption touches very few weights, leaving the network structure, inference pipeline and parameter statistics largely unchanged. Existing methods often require network restructuring, extra training or dedicated hardware, whereas this approach operates directly on trained parameters. On UC Merced Land Use, only 66 parameters change from the original model to the partially recovered model, 0.00028% of 23,604,234 total parameters, with 99 parameters changed across both stages, or 0.000419%; overall perturbation ratios across datasets stay between 10⁻³% and 10⁻²%.
Ownership can still be verified after a model leaks, through a latent watermark that does not appear during normal inference. Conventional backdoor-triggered watermarks alter model behavior and may be exposed by detectors such as Neural Cleanse. Without activation, trigger-set accuracy stays near random guessing; after activation, trigger accuracy exceeds 99% on the original model and clean-data accuracy stays close to the original; under Neural Cleanse reverse engineering, anomaly-score distributions resemble those of clean models, while BadNet scores are markedly higher.
Hierarchical keys are bound to individual deployment instances, so reusing a key across satellites fails to restore the target model. When the same model is distributed to multiple satellite platforms, a reusable key would let one leak compromise every deployment. Two protected versions of the same model were generated with different random seeds; correctly paired keys restore original accuracy, while cross-applying the other deployment's key leaves accuracy at the protected level.
Perspective
The reported evidence covers classification models on four public datasets, including the remote sensing land-use dataset UC Merced Land Use along with CIFAR-10, GTSRB and Fashion-MNIST. The method targets model owners who provide tiered-accuracy services in on-orbit inference settings, and encryption and decryption involve only parameter-level operations without modifying network structure or inference flow. The source states that future work will focus on scalable key management and more general watermark verification strategies for large-scale multi-model, multi-mission satellite AI systems.
Watermark resistance to knowledge-distillation extraction is limited: a student distilled from the partially recovered model retains considerable classification capability while trigger activation accuracy drops substantially, so the current watermark mainly protects ownership verification of the original deployed model. The source also notes that maintaining watermark robustness against powerful surrogate-model extraction remains an open problem. In addition, watermark verification cannot be reliably performed on the fully encrypted model and is only effective on recovered models.