Summary
It can be hard to prove who owns a model built using hyperdimensional computing (HDC), a method useful for small devices. The authors studied a way to add hidden marks, called watermarks, to these models without making them worse at their job. They found some types of HDC models keep their watermarks even after being changed or copied, while others lose them more easily. They also tested these watermarked models on hardware under stressful conditions and showed watermarks mostly survive unless the system breaks down. This work shows it is possible to protect HDC models with watermarks but also points to challenges.
What this means in practice
- •For embedded system developers: Protect ownership of hyperdimensional computing models on resource-constrained devices by embedding verifiable watermarks that survive typical retraining and hardware stress.
- •For hardware security engineers: Verify authenticity of deployed HDC models under non-ideal conditions such as undervolting and overclocking, ensuring model integrity despite hardware-induced errors.
Authors
Hamed Poursiami, Farshad Soleiman, Ahmad Tahmasivand, Guojing Cong, Thomas Potok, Khaled N. Khasawneh, Kai Zeng, Maryam Parsa
Abstract
Hyperdimensional computing (HDC) offers efficient learning and inference for resource-constrained systems, yet ownership verification of its models remains underexplored. We present the first systematic investigation of model watermarking in HDC by adapting backdoor-based embedding to three classifiers with different prototype-learning mechanisms. Across four benchmarks, with conventional neural networks as references, we examine whether watermarks can be learned without compromising task accuracy and whether they survive subsequent model modification and replication. The error-driven classifiers, AdaptHD and OnlineHD, support verification at a nominal trigger exposure of 1% with at most 0.58 percentage points of mean accuracy loss, whereas single-pass Vanilla HDC requires greater exposure and can incur substantial accuracy costs. The error-driven models retain verification under native continued training, but extraction produces surrogates that reproduce much of the task behavior without verifiable watermarks. Watermark overwriting readily embeds attacker watermarks into HDC prototypes and erodes the owner's watermark more strongly than in the neural network references, although the strongest erosion coincides with large accuracy losses. We further deploy watermarked AdaptHD on an FPGA and stress its execution through undervolting and overclocking. Verification survives substantial computation errors, whereas more severe stress either causes verification failure together with accuracy collapse or results in inference timeouts. These findings establish the feasibility of watermarking in HDC while identifying limitations in retention under extraction and sensitivity to overwriting.