Stealthy watermarking for medical AI models via spatial patch trigger and two-stage training

Deep learning models for medical image analysis require substantial computational resources, domain expertise, and curated datasets, making them valuable intellectual property. Protecting the ownership of such models is critical, yet existing watermarking techniques often compromise diagnostic accuracy or introduce visible artifacts that are unacceptable in clinical settings. In this paper, we propose a stealthy watermarking framework specifically designed for medical AI models. Our approach utilizes a spatial patch trigger mechanism that mimics natural imaging phenomena commonly observed in dermoscopic images, combined with a two-stage training strategy that decouples feature learning from watermark embedding. The first stage trains the model on clean data to establish robust feature representations, while the second stage jointly optimizes for the primary classification task and watermark embedding with partial network freezing and weight regularization. We evaluate the proposed method on the ISIC 2018 Skin Lesion Analysis dataset using a ResNet-50 backbone. Across five random seeds, the proposed margin-masked two-stage method attains a watermark success rate of 94.08% while maintaining a classification fidelity of 76.16%, reducing the accuracy gap to the clean baseline from about 22 to about 12 percentage points relative to an unmasked single-stage embedding and lowering the run-to-run variance. The trigger remains within the perceptually indistinguishable range, with an SSIM of 0.984 and an LPIPS of 0.060. We additionally evaluate robustness to model-modification attacks, the false positive rate of ownership verification, and generalization across four network architectures. The framework offers a practical mechanism for protecting the intellectual property of medical AI models at a quantified and honestly reported cost in classification accuracy.