Aaryan Ajay Sharma supervised by Dr. Ankit Gangwal received his Master of Science – Dual Degree in Computer Science and Engineering (LCD). Here’s a summary of his research work on – On the Security of Machine Learning Models: IP Protection and Adversarial Robustness

The rapid adoption of Machine Learning (ML) models in safety-critical and commercial applications has raised fundamental questions about their security. We investigate two complementary facets of ML model security: Intellectual Property (IP) protection of Graph Neural Networks (GNNs) and adversarial robustness of merged models.

In the first part, we present GENIE, the first watermarking scheme designed specifically for GNNs trained on the Link Prediction (LP) task. Existing GNN watermarking techniques address only node or graph classification, leaving LP—a task central to recommendation systems, social network analysis, and knowledge graph completion—entirely unprotected. GENIE introduces a novel backdoor-based watermark that supports both node-representation-based (GCN, GraphSAGE, NeoGNN) and subgraphbased (SEAL) LP methods. It constructs a secret trigger set and watermark vector to embed an ownership signature during training. We further propose Dynamic Watermark Thresholding (DWT), a statistically principled verification procedure that bounds the misclassification probability with high confidence under minimal distributional assumptions. Extensive experiments across 4 model architectures, 7 real-world datasets, and 21 watermark removal attacks demonstrate that GENIE preserves model utility (less than 2% AUC degradation), achieves near-perfect watermark accuracy, and remains robust against black-box, white-box, combination, and adaptive attacks.

In the second part, we study the adversarial robustness implications of Model Merging (MM), a popular technique that combines multiple fine-tuned models into a single multi-task model without requiring access to training data. While recent work suggests that MM confers “free” adversarial robustness by mitigating backdoor attacks, we challenge this notion by demonstrating that MM significantly increases vulnerability to adversarial transfer attacks. Through comprehensive evaluations spanning 8 MM methods, 7 image classification datasets, 6 attack methods, and 336 distinct attack settings, we establish three statistically validated findings: (1) stronger MM methods lead to higher adversarial transfer rates (exceeding 80% on average); (2) mitigating representation bias through post-hoc surgery increases vulnerability to transfer attacks from fine-tuned surrogates; and (3) weight averaging, despite being the weakest MM method, is paradoxically the most vulnerable to transfer attacks. We provide theoretical justification via gradient alignment analysis and the Cross-Task Linearity property.

Together, these contributions advance our understanding of ML model security from both defensive (IP protection) and offensive (adversarial vulnerability) perspectives, highlighting the complex interplay between model utility, robustness, and security in modern ML systems.

July 2026