  Embedding watermarks into models has been widely used to protect model
ownership in federated learning (FL). However, existing methods are inadequate
for protecting the ownership of personalized models acquired by clients in
personalized FL (PFL). This is due to the aggregation of the global model in
PFL, resulting in conflicts over clients' private watermarks. Moreover,
malicious clients may tamper with embedded watermarks to facilitate model
leakage and evade accountability. This paper presents a robust watermark
embedding scheme, named RobWE, to protect the ownership of personalized models
in PFL. We first decouple the watermark embedding of personalized models into
two parts: head layer embedding and representation layer embedding. The head
layer belongs to clients' private part without participating in model
aggregation, while the representation layer is the shared part for aggregation.
For representation layer embedding, we employ a watermark slice embedding
operation, which avoids watermark embedding conflicts. Furthermore, we design a
malicious watermark detection scheme enabling the server to verify the
correctness of watermarks before aggregating local models. We conduct an
exhaustive experimental evaluation of RobWE. The results demonstrate that RobWE
significantly outperforms the state-of-the-art watermark embedding schemes in
FL in terms of fidelity, reliability, and robustness.
