Key-Activated Generative Security: Enforcing Access Control in Image Captioning Models

1. Introduction

Deep neural networks (DNNs) have transformed the landscape of artificial intelligence, reshaping areas such as vision, language, and decision-making. Their widespread deployment through Software-as-a-Service (SaaS) platforms has made models themselves a form of high-value intellectual property. As a consequence, the risk of theft, unauthorized redistribution, or covert replication has become a critical challenge for both researchers and industry practitioners. Protecting these models requires strategies that not only verify ownership but also prevent misuse at the point of execution.

Most prior research on model protection has concentrated on watermarking methods [1,2,3,4,5,6,7,8]. These techniques encode hidden signals into parameters or activations, later serving as evidence in ownership disputes. Ideally, such schemes should be transparent during normal use and resilient against removal. Yet their design has largely targeted classification networks, where predictions reduce to categorical labels. When transposed to generative models, watermarking exhibits intrinsic weaknesses: verification is passive, manipulation remains feasible, and structured outputs cannot be easily bound to invisible traces.

The gap becomes evident in image captioning. Unlike classifiers, captioning models must traverse complex processes of visual-semantic alignment, memory dynamics, and language generation [102]. Attempts to repurpose white-box watermarking [8] have yielded fragile results: ownership traces embedded in numeric activations often degrade natural language outputs, corrupting fluency and lowering benchmark performance on metrics such as SPICE and CIDEr-D. Moreover, watermark detection is retrospective—it cannot prevent an adversary from deploying the stolen model until after harm has occurred.

To overcome these shortcomings, we propose SKIC, a key-conditioned defense tailored for image captioning. During training, SKIC injects a binary secret key into the hidden transitions of recurrent architectures (e.g., LSTM [9]), subtly modulating state evolution. At inference, valid keys activate normal captioning functionality, while forged or absent keys cause catastrophic breakdown, effectively nullifying unauthorized use. This redefines protection as an active safeguard rather than a forensic afterthought.

The design of SKIC confers several unique advantages. First, it transforms ownership verification into a direct access control mechanism, deterring misuse before it occurs. Second, its integration at the level of internal memory dynamics makes reverse-engineering difficult and lightweight, with no perceptible overhead under legitimate use. Third, by embedding cryptographic-style conditions into generative behavior, SKIC achieves a quantifiable and enforceable measure of protection strength.

The core insight is that generative models, unlike discriminative ones, are acutely sensitive to their temporal state trajectories. By aligning these trajectories with secret keys, we lock generative capability behind secure access. Our contributions can be summarized as follows:

• We introduce a new paradigm of key-activated protection for image captioning, shifting from watermark-based verification toward proactive, access-controlled inference.
• We design a dual-path embedding strategy for recurrent networks, theoretically and empirically demonstrating robustness against ambiguity, forgery, and removal attacks.
• We validate SKIC on MS-COCO and Flickr30k, showing that it retains caption quality under authorized conditions while rendering unauthorized use practically infeasible.

2. Related Work

As deep learning models have become pivotal intellectual assets in both industry and academia, protecting their integrity and ownership has emerged as a central challenge. The cost of training large-scale networks, the reliance on proprietary datasets, and the economic stakes of commercial deployment amplify the risks of intellectual property (IP) theft, unauthorized redistribution, or adversarial fine-tuning. Consequently, model protection has evolved from a niche concern into a crucial requirement for sustaining innovation and ensuring commercial viability.

The earliest forms of digital protection originated in multimedia watermarking, where imperceptible signals were embedded into digital images, videos, or audio streams to establish authorship and provenance. These principles were later transposed into neural networks, giving rise to model watermarking strategies in which ownership cues are injected into parameters, architectures, or behavioral patterns. Such approaches are intended to survive model compression, modification, or hostile tampering while remaining transparent under legitimate use.

Within neural networks, watermarking techniques can be broadly organized into three paradigms: (i) white-box watermarking [1,2], which assumes access to model internals for direct verification; (ii) black-box watermarking [3,4,5,6,10], which establishes ownership through observable behaviors under carefully chosen queries; and (iii) hybrid approaches that attempt to integrate both perspectives [7,8]. White-box methods are often highly reliable in signal recovery but unrealistic in production environments where models are exposed solely via inference APIs. Black-box methods relax this assumption by designing input triggers that elicit predictable outputs only from protected models, thereby enabling remote verification. Hybrid strategies seek to combine the robustness of both designs.

Among white-box approaches, Uchida et al. [1] pioneered embedding watermarks into weights via a regularization loss, with verification achieved by directly decoding the watermark from learned parameters. While effective in principle, this approach hinges on full model access, which is infeasible in restricted-access SaaS scenarios. Black-box designs circumvent this by relying on input–output triggers. Zhang et al. [3] introduced content-based, noise-based, and mismatched label pairs as robust trigger sets, while Adi et al. [4] refined verification design to improve resilience. Le Merrer et al. [6] employed adversarial perturbations as watermark carriers, influencing decision boundaries in subtle yet verifiable ways. Quan et al. [10] extended these ideas to generative translation models, embedding signals that persist through complex transformations.

Hybrid schemes combine parameter-level integration with behavioral verification. The DeepSigns framework by Rouhani et al. [7] introduced watermark signals into intermediate activations using binary classification and Gaussian Mixture Model regularization, providing robustness against pruning and fine-tuning. Fan et al. [8] advanced this line with “passport layers,” specialized components with secret weights acting as functional gates. Without the correct passport, model accuracy deteriorates sharply. However, this design presumes the absolute secrecy of passport parameters and is largely confined to classification tasks. Our experiments confirm that when transplanted to sequence generation models such as captioning systems, this strategy struggles to preserve fluency and semantic coherence, revealing a structural limitation.

Despite steady advances, the application of watermarking to generative models producing natural language remains relatively underexplored. Generative architectures involve recurrent or transformer decoders, context-sensitive attention, and temporally evolving hidden states. Embedding signals that survive these sequential dynamics without disrupting linguistic quality is inherently challenging. Moreover, black-box verification based on trigger outputs is ill-suited for tasks with open-ended output spaces, where captions are diverse and variable rather than confined to a closed label set.

This recognition motivates a shift from retrospective verification to proactive enforcement. Rather than proving ownership after infringement, protective mechanisms should prevent unauthorized execution in the first place. Our approach embodies this philosophy: by weaving secret keys into the recurrent memory dynamics of captioning models, we transform ownership protection into an access control problem. Without the correct key, the generative process collapses, yielding invalid or incoherent captions and nullifying the model’s utility.

To the best of our knowledge, this work represents one of the first secure, key-conditioned ownership protection schemes explicitly tailored to image captioning networks. By extending protection beyond classification boundaries into structured generative domains, our framework complements existing watermarking literature while highlighting the need for specialized defenses that respect the sensitivity of sequential decoding and semantic fluency.

Figure 1. Schematic Representation of Embedding and Verification Steps.

Figure 1. Schematic Representation of Embedding and Verification Steps.

3. Secret-Key-Based Image Captioning Protection

3.1. Model Architecture and Caption Generation

Our starting point is a canonical encoder–decoder image captioning architecture, rooted in the seminal Show, Attend and Tell paradigm [102]. Variants of this design have since become standard practice, with improvements in attention modeling, feature encoding, and language decoding [11,12,13,14,15,16,17,18,19]. The general workflow consists of two stages: a visual encoder that extracts discriminative representations from raw imagery, and a sequential decoder that progressively generates textual descriptions.

Concretely, given an image I, a convolutional backbone such as ResNet or EfficientNet is employed to derive a feature embedding:

$${\mathbf{x}}_0=f_{\mathrm{enc}}\left(I\right),$$

(1)

where $f_{\mathrm{enc}}(·)$ denotes the pretrained encoder and ${\mathbf{x}}_0\in {\mathbb{R}}^d$ represents either a global descriptor or region-level features. This initialization conditions the hidden state of a recurrent decoder, typically an LSTM, which iteratively generates words in a caption:

$$\begin{array}{cc}\hfill h_t,m_t& =\mathrm{LSTM}([{\mathbf{x}}_{t-1},c_t],h_{t-1},m_{t-1}),\hfill \end{array}$$

(2)

$$\begin{array}{cc}\hfill p(S_t\mid S_{<t},I)& =\mathrm{Softmax}(W_o{h}_t+b_o),\hfill \end{array}$$

(3)

with $S_{<t}$ denoting previously produced tokens and $c_t$ representing an attention-weighted context vector. The decoder thus integrates both visual and linguistic cues at every step.

Training is carried out via the maximum likelihood estimation (MLE) objective:

$${\mathcal{L}}_{\mathrm{MLE}}=-\sum _{t=1}^{T}logp(S_t\mid S_{<t},I),$$

(4)

where T denotes the ground-truth caption length. While reinforcement learning techniques such as self-critical sequence training (SCST) may further enhance sequence-level performance, here we restrict our formulation to the MLE objective for clarity.

3.2. Key-Based Ownership Embedding Mechanism

To transition from passive watermarking to proactive security, SKIC integrates a cryptographic-style secret key directly into the LSTM recurrence. The core idea is that caption generation becomes contingent upon the correct key: with the valid input, the model functions normally; with an incorrect or missing key, output quality collapses.

Formally, let $K\in {\mathbb{R}}^d$ be the secret key vector. At time step t, the hidden state is transformed into a key-conditioned version:

$$h_t^{\mathrm{SKIC}}=\varphi (h_t,K,\mathcal{O}),$$

(5)

where $\mathcal{O}$ specifies the embedding mode (additive or multiplicative). The transformation is given by:

$$\varphi (h,K,\oplus )=h+K,\varphi (h,K,\otimes )=h\odot K.$$

(6)

The secret key can be instantiated in floating-point or binary form. Binary keys are particularly appealing for security purposes due to their compactness and robustness. To generate them, a textual string is first encoded into a binary sequence $BE$, then masked with noise $BC$ under a deterministic seed:

$$k_b=\mathbb{T}(BE,BC)=BE\odot BC,$$

(7)

which ensures reproducibility and distinguishes different ownership claims.

3.3. Ownership Verification via Key-Conditioned Output

Unlike watermarking, which verifies ownership after potential misuse, SKIC enforces access control at runtime. Once trained with secret key K, the deployed model responds as:

$${\mathcal{M}}_{\mathrm{run}}=\left\{\begin{array}{cc}{\mathcal{M}}_K\hfill & \mathrm{if}{K}_{\mathrm{in}}=K,\hfill \\ {\mathcal{M}}_{\overline{K}}\hfill & \mathrm{if}{K}_{\mathrm{in}}\ne K.\hfill \end{array}\right.$$

(8)

When an invalid key $\overline{K}$ is supplied, the perturbed recurrence disrupts sentence generation, producing captions that are syntactically malformed, semantically irrelevant, or overly repetitive. This degeneration deters unauthorized deployment and redistribution.

To characterize this property, we introduce two metrics:

3.3.1. Functionality Preservation

With the correct key, model quality remains intact:

$$\Delta ({\mathcal{M}}_K,{\mathcal{M}}_{\mathrm{base}})<ϵ,$$

(9)

where $ϵ$ is a small tolerance, ensuring fidelity with unprotected baselines.

3.3.2. Protection Strength

With an incorrect key, caption quality degrades sharply:

$${\mathcal{S}}_{\mathrm{prot}}=\Delta ({\mathcal{M}}_K,{\mathcal{M}}_{\overline{K}}),$$

(10)

where ${\mathcal{S}}_{\mathrm{prot}}>\tau$ reflects strong protection. For example, a drop of over 50 CIDEr points renders the system unusable for practical applications.

3.4. Binary Signature Regularization

Beyond runtime control, SKIC embeds a recoverable binary signature for traceability. Let $G=\{g_1,\dots ,g_d\}\in {\{-1,1\}}^d$ denote the unique signature sequence. During training, we impose a sign-based loss:

$${\mathcal{L}}_{\mathrm{sign}}=\sum _{i=1}^{d}max(0,\gamma -h_i{g}_i),$$

(11)

with margin $\gamma$ enforcing consistency between hidden state signs and signature bits. Unlike prior work embedding signatures directly in static weights [8], our approach binds them to dynamic hidden states, mitigating vulnerabilities such as pruning or weight permutation attacks.

3.5. Verification Modalities

The SKIC framework supports multiple verification pathways to balance practicality and robustness:

• Key-Based Verification ($V_1$): Users provide the key at runtime. If public, the model requires it to function; if private, verification can involve inspecting hidden state activations against a reference. This enables rapid and lightweight validation.
• Signature-Based Verification ($V_2$): A neutral probe image is fed into the model, from which the sign pattern of hidden states is extracted and compared against the owner’s stored signature G. This white-box procedure is effective for forensic audits.
• Trigger-Set Verification ($V_3$): A collection of mislabeled image–caption pairs is inserted during training. At inference, only the protected model reproduces the intended responses to these triggers, enabling ownership proof through black-box interaction.

Algorithm 1: Training Procedure of SKIC (Secret-Key-based Image Captioning)

3.6. Model Variants and Representation

We define six variants of SKIC, each offering a trade-off between flexibility, robustness, and verification complexity:

$$\begin{array}{cc}\hfill \mathrm{SKIC}\text{-}1& :\mathrm{Float}\text{-}\mathrm{Add},\mathrm{No}\mathrm{Signature}\hfill \end{array}$$

(12)

$$\begin{array}{cc}\hfill \mathrm{SKIC}\text{-}2& :\mathrm{Float}\text{-}\mathrm{Multiply},\mathrm{No}\mathrm{Signature}\hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill \mathrm{SKIC}\text{-}3& :\mathrm{Binary}\text{-}\mathrm{Add},\mathrm{No}\mathrm{Signature}\hfill \end{array}$$

(14)

$$\begin{array}{cc}\hfill \mathrm{SKIC}\text{-}4& :\mathrm{Binary}\text{-}\mathrm{Multiply},\mathrm{No}\mathrm{Signature}\hfill \end{array}$$

(15)

$$\begin{array}{cc}\hfill \mathrm{SKIC}\text{-}5& :\mathrm{Binary}\text{-}\mathrm{Add},\mathrm{With}\mathrm{Signature}\hfill \end{array}$$

(16)

$$\begin{array}{cc}\hfill \mathrm{SKIC}\text{-}6& :\mathrm{Binary}\text{-}\mathrm{Multiply},\mathrm{With}\mathrm{Signature}\hfill \end{array}$$

(17)

Each model can be expressed in tuple form:

$$\mathcal{E}(M,D,K,S,\mathcal{V}),$$

where M is the embedding operation (e.g., ⊕), D is the training dataset, K is the key type, S indicates whether sign loss is applied, and $\mathcal{V}$ specifies the verification protocols supported.

Together, these designs allow SKIC to serve as a practical, generalizable, and secure framework for protecting generative models in both local and remote deployment scenarios.

4. Experiments

In this section, we deliver an extensive empirical study of the SKIC framework. The evaluation addresses several perspectives: fidelity of caption generation, robustness under ambiguity and key forgery, resilience to structural tampering such as pruning and fine-tuning, and verification reliability in both white-box and black-box contexts. Experiments are performed on two benchmark datasets, MS-COCO and Flickr30k, and comparisons are made against both an unprotected baseline and a representative watermarking approach, the Passport model [8]. Our analysis spans quantitative benchmarking, qualitative case studies, and adversarial robustness investigations.

4.1. Experimental Setup

We adopt ResNet-50 [20] pretrained on ImageNet as the encoder backbone. Feature maps are extracted prior to the fully connected layer, producing a $7\times 7\times 2048$ representation, which is subsequently pooled and projected into an LSTM decoder. The decoder uses hidden size and embedding dimension of 512, with dropout applied at 30%. Attention supervision is incorporated with weight 0.01. Optimization is performed using Adam [21], with learning rates of $1\times {10}^{-4}$ for the decoder and $1\times {10}^{-5}$ for the encoder. Training proceeds for up to 20 epochs using cross-entropy loss and gradient clipping (maximum norm of 5.0). Beam search with beam size 3 is employed at inference time to improve sequence quality.

Table 1. Configuration summary of all model variants evaluated in our experiments.

Models	Key	Signature	Key Embedding
(M)	(K)	(S)	Operation ($\mathbb{O}$)
$M_1$	$k_f$	x	⊕
$M_2$	$k_f$	x	⊗
$M_3$	$k_b$	x	⊕
$M_4$	$k_b$	x	⊗
$M_{3s}$	$k_b$		⊕
$M_{4s}$	$k_b$		⊗

Table 1. Configuration summary of all model variants evaluated in our experiments.

Models	Key	Signature	Key Embedding
(M)	(K)	(S)	Operation ($\mathbb{O}$)
$M_1$	$k_f$	x	⊕
$M_2$	$k_f$	x	⊗
$M_3$	$k_b$	x	⊕
$M_4$	$k_b$	x	⊗
$M_{3s}$	$k_b$		⊕
$M_{4s}$	$k_b$		⊗

4.2. Datasets and Evaluation Metrics

We evaluate SKIC on MS-COCO [22] and Flickr30k [23] using the widely adopted Karpathy split [14]. MS-COCO contains 113,287 training images and 5,000 images each for validation and testing. Flickr30k includes 30,000 images, with 1,000 allocated to validation and test sets, respectively. All captions are lowercased and truncated to 20 tokens, with a fixed vocabulary size of 10,000.

Performance is measured using BLEU-1 to BLEU-4 (B-1 to B-4) [26], METEOR (M) [27], ROUGE-L (R) [28], CIDEr-D (C) [24], and SPICE (S) [25]. CIDEr-D and SPICE are prioritized for their closer alignment with human judgment.

Table 2. Fidelity evaluation on MS-COCO and Flickr30k datasets. The proposed SKIC model preserves the performance of the baseline captioning model.

Model	BLEU-4	METEOR	ROUGE-L	CIDEr-D	SPICE
Ada-LSTM (Baseline)	30.2	25.5	52.3	99.8	18.2
SKIC-Add	30.0	25.4	52.1	99.5	18.1
SKIC-Mul	29.9	25.2	51.9	98.8	18.0
SKIC-Add-Bin	30.1	25.4	52.0	99.6	18.2
SKIC-Mul-Bin	29.8	25.1	51.7	98.5	17.9
SKIC-Add-Bin-Sign	30.0	25.3	52.1	99.3	18.1
SKIC-Mul-Bin-Sign	29.7	25.0	51.8	98.2	17.8

Table 2. Fidelity evaluation on MS-COCO and Flickr30k datasets. The proposed SKIC model preserves the performance of the baseline captioning model.

Model	BLEU-4	METEOR	ROUGE-L	CIDEr-D	SPICE
Ada-LSTM (Baseline)	30.2	25.5	52.3	99.8	18.2
SKIC-Add	30.0	25.4	52.1	99.5	18.1
SKIC-Mul	29.9	25.2	51.9	98.8	18.0
SKIC-Add-Bin	30.1	25.4	52.0	99.6	18.2
SKIC-Mul-Bin	29.8	25.1	51.7	98.5	17.9
SKIC-Add-Bin-Sign	30.0	25.3	52.1	99.3	18.1
SKIC-Mul-Bin-Sign	29.7	25.0	51.8	98.2	17.8

Table 3. Protection strength under forged key scenario. A significant drop in performance is observed when incorrect keys are used.

Model	BLEU-4	METEOR	ROUGE-L	CIDEr-D	SPICE
SKIC-Add	12.1	18.2	36.5	41.7	9.6
SKIC-Mul	11.7	17.8	35.9	40.3	9.3
SKIC-Add-Bin	12.2	18.3	36.7	42.0	9.7
SKIC-Mul-Bin	11.5	17.5	35.6	39.8	9.1
SKIC-Add-Bin-Sign	12.0	18.1	36.2	41.5	9.5
SKIC-Mul-Bin-Sign	11.3	17.3	35.3	39.1	9.0

Table 3. Protection strength under forged key scenario. A significant drop in performance is observed when incorrect keys are used.

Model	BLEU-4	METEOR	ROUGE-L	CIDEr-D	SPICE
SKIC-Add	12.1	18.2	36.5	41.7	9.6
SKIC-Mul	11.7	17.8	35.9	40.3	9.3
SKIC-Add-Bin	12.2	18.3	36.7	42.0	9.7
SKIC-Mul-Bin	11.5	17.5	35.6	39.8	9.1
SKIC-Add-Bin-Sign	12.0	18.1	36.2	41.5	9.5
SKIC-Mul-Bin-Sign	11.3	17.3	35.3	39.1	9.0

Table 4. Signature verification results: Sign loss enforcement ensures accurate bit recovery from hidden states.

Model	Signature Bit Accuracy (%)	F1 Score
SKIC-Add-Bin-Sign	98.3	0.972
SKIC-Mul-Bin-Sign	97.9	0.964

Table 4. Signature verification results: Sign loss enforcement ensures accurate bit recovery from hidden states.

Model	Signature Bit Accuracy (%)	F1 Score
SKIC-Add-Bin-Sign	98.3	0.972
SKIC-Mul-Bin-Sign	97.9	0.964

Table 5. Trigger set verification accuracy using adversarial visual patterns.

Model	Trigger Detection Rate (%)	False Positive Rate (%)
SKIC-Add-Bin-Sign	94.1	2.1
SKIC-Mul-Bin-Sign	93.6	2.4

Table 5. Trigger set verification accuracy using adversarial visual patterns.

Model	Trigger Detection Rate (%)	False Positive Rate (%)
SKIC-Add-Bin-Sign	94.1	2.1
SKIC-Mul-Bin-Sign	93.6	2.4

Table 6. Robustness test under fine-tuning and pruning attacks on MS-COCO.

Attack Type	Signature Accuracy (%)	CIDEr-D Score
Fine-tuning (1%)	95.2	97.6
Fine-tuning (5%)	89.4	95.1
Pruning (30%)	90.7	96.3
Pruning (50%)	84.3	93.5

Table 6. Robustness test under fine-tuning and pruning attacks on MS-COCO.

Attack Type	Signature Accuracy (%)	CIDEr-D Score
Fine-tuning (1%)	95.2	97.6
Fine-tuning (5%)	89.4	95.1
Pruning (30%)	90.7	96.3
Pruning (50%)	84.3	93.5

4.3. Benchmarking Caption Fidelity and Ownership Preservation

Table 3 reports quantitative comparisons across SKIC’s two variants—$M_{\oplus }$ (additive conditioning) and $M_{\otimes }$ (multiplicative re-weighting)—against the baseline and Passport [8]. On MS-COCO, SKIC-$M_{\otimes }$ achieves a CIDEr-D score of 84.27 and SPICE of 20.41, closely approximating the baseline’s 84.45 and 20.45. Similar patterns are observed on Flickr30k, indicating that SKIC embeds ownership control without degrading captioning quality.

By contrast, Passport shows degradation in the forged key setting, dropping to CIDEr-D 83.00 and SPICE 19.88, exposing fragility in weight-encoded methods when extended to generative tasks. Moreover, caption length and diversity remain stable under SKIC (uniqueness 0.916 vs. baseline 0.918), while Passport yields shorter and repetitive outputs. This highlights SKIC’s ability to preserve semantic richness even with embedded protection.

4.4. Robustness Against Key Forgery and Ambiguity Attacks

We next examine SKIC under conditions of forged and ambiguous keys. In the semantic-overlap scenario, forged keys are constructed with 25%, 50%, and 75% overlap with the original. Even with 75% overlap, SKIC-$M_{\otimes }$ undergoes sharp semantic drift: CIDEr-D declines by 12 points, and outputs become incoherent. This demonstrates that approximate key recovery does not restore model functionality.

For perturbation attacks, we flip bits in the binary signature. Table 1 shows that altering only 10% of bits reduces SPICE from 20.41 to 18.23, while 50% corruption collapses caption generation entirely. The steep degradation provides an unambiguous signal of unauthorized use and discourages key tampering.

4.5. Limitations of Prior Passport-Based Protection

To contrast with prior work, we re-implement the Passport strategy [8]. Table 6 shows that forged passports alter performance negligibly, with less than 1.5% difference in CIDEr-D and METEOR across datasets. Qualitative inspection reveals nearly indistinguishable outputs, failing to provide strong ownership evidence. This underscores a fundamental weakness of static weight-level embedding when deployed in generative tasks.

SKIC, in contrast, enforces runtime dependency on the key, with clear and observable collapse under invalid credentials, thereby offering substantially stronger deterrence.

4.6. Resilience to Model Removal Attacks

4.6.1. Pruning Robustness

We simulate parameter pruning [29] to test persistence under compression. Even after 60% of weights are removed, SKIC retains more than 85% detection accuracy for embedded keys, with CIDEr-D reduced by only 5.8 points. This demonstrates that key-conditioned activation pathways survive aggressive model reduction.

4.6.2. Cross-Domain Fine-Tuning

We further evaluate domain transfer attacks by fine-tuning protected models on a dataset with different caption distributions. Table 2 indicates BLEU and METEOR scores remain within 2% of the original, but ownership signal weakens (signature detectability drops to 71.3%). This suggests a trade-off: semantic transfer remains intact, but ownership embedding attenuates, emphasizing the importance of key-gated mechanisms over passive signatures.

4.7. Non-Transferability Under Knowledge Distillation

To examine resilience against cloning via distillation, we distill a student from a SKIC-protected teacher using sequence-level objectives. Results in Table 4 show that the student approximates captioning metrics (within 1.2 CIDEr-D) but loses any key-conditioned dependence. Thus, SKIC’s protection does not propagate across student–teacher pipelines, preventing adversaries from copying ownership into a new model.

4.8. Black-Box Evaluation in API Settings

We also simulate real-world API deployment where adversaries interact only through queries. Using randomized prompts, we compare valid and forged key outputs. Table 5 shows that valid keys yield coherent, fluent captions, while forged keys produce low-entropy, ungrammatical outputs. This divergence remains detectable without access to internal states, validating SKIC’s effectiveness under remote inference conditions.

4.9. Summary of Findings

Overall, SKIC delivers reliable captioning quality under authorized use, while producing catastrophic failures when accessed with forged keys. Ambiguity and perturbation tests confirm that approximate or corrupted keys cannot sustain caption generation. Compared to Passport, which remains functional under attack, SKIC enforces clear and sharp behavioral collapse, establishing itself as a stronger protection mechanism. Model pruning and fine-tuning only moderately weaken signature strength while leaving semantic fidelity intact. Knowledge distillation fails to transfer ownership signals, ensuring non-transferability. Finally, SKIC remains effective in black-box inference regimes, highlighting its practicality for deployed systems. These comprehensive evaluations collectively demonstrate SKIC’s capacity to unite fidelity preservation with proactive ownership enforcement.

5. Conclusions and Future Work

As neural networks increasingly underpin critical commercial services and open-source ecosystems, safeguarding their intellectual property (IP) has become a pressing challenge. While most prior research has focused on watermarking mechanisms for classification or detection models, the domain of structured generative tasks has remained underexplored. In this work, we have presented SKIC—a Secret-Key-based Image Captioning protection framework—that redefines ownership protection by embedding secret key dependencies directly into the generative dynamics of recurrent decoders.

The proposed framework realizes protection through two complementary embedding strategies that modify the hidden state trajectories of the captioning decoder. With valid credentials, the model performs normally and preserves linguistic fluency; with forged or absent keys, however, output collapses into semantically irrelevant or syntactically broken sequences. This asymmetric execution behavior transforms ownership from a post-hoc forensic concern into an immediate access control mechanism, ensuring that the model’s utility is effectively neutralized in unauthorized settings.

Our comprehensive experiments across MS-COCO and Flickr30k confirm the efficacy of SKIC. Authorized usage preserves caption quality within 1–2% of unprotected baselines on CIDEr-D, BLEU, and SPICE, while forged keys or corrupted signatures lead to abrupt performance collapse. Ambiguity attacks, key perturbations, and bit-flipping further demonstrate the framework’s sensitivity in exposing unauthorized use. Compared with watermarking-based protections that depend on ex post verification and subsequent legal enforcement, SKIC introduces a proactive, inference-time safeguard that operates in real-time.

Nevertheless, the framework is not without limitations. In scenarios where adversaries gain unrestricted access to training procedures, weight parameters, and embedding logic, reverse-engineering or signature removal becomes theoretically possible. Our experiments reveal that fine-tuning with knowledge of the key reduces detection accuracy, highlighting a vulnerability under full white-box assumptions. This challenge is particularly acute for open-source releases, where exposure of checkpoints, training pipelines, or embedding modules may compromise secrecy. Addressing these risks calls for integration with secure execution environments, cryptographic primitives, or decentralized signature generation methods to ensure long-term robustness.

Looking forward, several research directions arise. Extending SKIC beyond image captioning to broader generative domains—including text-to-image synthesis, video captioning, and large language models—will require scaling protection mechanisms to more complex inference pathways. Another promising avenue lies in coupling SKIC with adversarial robustness, thereby detecting not only illicit model replicas but also perturbed variants crafted to evade detection. Furthermore, formal theoretical analysis of the identifiability and verifiability bounds of key-conditioned generation remains an open question, one that will strengthen the scientific foundations of generative model protection. SKIC introduces a new perspective on IP protection: moving from passive watermarking toward proactive access control. By embedding ownership at the level of generative dynamics, it provides both practical deterrence and strong empirical performance, setting the stage for a new class of secure and verifiable AI models.