Robust Client–Server Watermarking for Split Federated Learning

Abstract

Split federated learning (SFL) is renowned for its low computational overhead, extremely suitable for resource-constrained edge computing scenarios while inheriting privacy-preserving characteristics from federated learning (FL). In this framework, clients employ lightweight models to process private data locally and transmit intermediate outputs to a powerful server for further computation. However, SFL is a double-edged sword: while it enables edge computing and enhances privacy, it also introduces intellectual property ambiguity as both clients and the server jointly contribute to training. Existing watermarking techniques fail to protect both sides since no single participant possesses the complete model. To address this, we propose a robust model intellectual property protection scheme using client–server watermark embedding (RISE) for SFL. Specifically, RISE adopts an asymmetric client–server watermarking design: the server embeds feature-based watermarks through a loss regularization term, while clients embed backdoor-based watermarks by injecting predefined trigger samples into private datasets. This co-embedding strategy enables both clients and the server to verify model ownership. Experimental results on standard datasets and multiple network architectures show that RISE achieves over 95% watermark detection rate ( $p$ -value $\lt {\,}0.03$ ) across most settings. It exhibits no mutual interference between client- and server-side watermarks and remains robust against common removal attacks. Our source code is available at GitHub