Satellite models get a middle tier: perturbing a few thousandths of weights yields a ~50% accuracy service level

One trained model can serve inference at different accuracy levels according to authorization tier, instead of only fully usable or fully unusable. Most prior active model protection follows a binary authorization paradigm, where the model is either fully recovered with the correct key or unusable without it, and cannot offer controllable intermediate-accuracy service without retraining. On CIFAR-10, GTSRB, Fashion-MNIST and UC Merced Land Use, accuracy drops by roughly 42% to 47% from the original model to the partially recovered model, with the intermediate level landing near 50%: 51.98% on CIFAR-10, 51.69% on Fashion-MNIST, 51.87% on GTSRB and 51.67% on UC Merced Land Use.

In the fully encrypted state the model loses practical inference capability, and this is achieved by modifying only a very small number of parameters. Unlike protection schemes that require network restructuring, extra training or dedicated hardware, this operates directly on already-trained parameters without changing the architecture or the inference pipeline. Accuracy reduction from the original model to the fully encrypted model exceeds 80% on all datasets, falling to around 10% on Fashion-MNIST, CIFAR-10 and UC Merced Land Use and to 13.97% on GTSRB; on UC Merced Land Use only 99 parameters are modified across both stages, 0.000419% of the 23,604,234 total parameters, and even GTSRB stays below 0.003%.

A watermark embedded after model restoration leaves normal inference unchanged and produces a verifiable response on a trigger set only when the watermark activation key is applied. Conventional backdoor-triggered watermarks can be exposed by detectors such as Neural Cleanse, and some methods alter model behavior even without activation. Without activation, trigger-set accuracy stays near random guessing; with activation, trigger accuracy exceeds 99% on the original model while activated clean accuracy stays close to the original; under Neural Cleanse reverse engineering the anomaly-score distribution matches clean models, whereas BadNet exceeds 6.0 to 7.0 on GTSRB.

The report covers model protection in satellite-based onboard inference: the model owner deploys a trained model onboard, distributes recovery keys to ground users by authorization tier, and claims ownership via the watermark after a leak. Experiments use four public datasets, CIFAR-10, GTSRB, Fashion-MNIST and UC Merced Land Use, with modified ResNet-18 and ResNet-50 models. The authors state that future work will focus on scalable key management and more general watermark verification strategies for large-scale multi-model, multi-mission satellite AI systems.

Intermediate accuracy is explicitly controlled by a target accuracy and tolerance as the stopping criterion, but the paper demonstrates only a two-stage, three-state setting and notes that more authorization levels are possible in principle. Under knowledge-distillation extraction the watermark's trigger accuracy drops substantially; the authors note that the current watermark mainly protects ownership verification of the original deployed model, and that robustness against powerful surrogate-model extraction remains a challenging problem, as with other parameter-level watermarking schemes. Under extreme pruning beyond 90% sparsity, watermark and model functionality degrade together.