PaperlayerView exact revision on arXiv

Source-linked AI summary

MeMark: Membrane-Space Watermarking for Spiking Neural Networks

Roberto Riaño, Gorka Abad, Stjepan Picek, Aitor Urbieta

arXiv:2608.25738v1cs.CRcs.AIcs.LG

TL;DR

Output-based SNN watermarks can be removed by replacing a reused checkpoint’s output head, motivating watermark evidence that remains in the backbone. MeMark embeds multi-bit identifiers in selected LIF membrane states and recovers them with existing firing thresholds. Across architectures and attacks, the method preserves ownership evidence in the tested checkpoint-reuse settings.

  • Problem

    Output-based SNN watermarks become unsuitable for backbone reuse because replacing task-specific output layers can remove the watermark while leaving most of the model unchanged.

  • Method

    MeMark embeds a multi-bit payload in selected LIF membrane states and uses their firing thresholds for verification without a learned internal decoder.

  • Results

    All 20 64-bit keys pass the fixed 51/64 verification rule on the 215.4M-parameter SpikeGPT checkpoint, while none of 30 000 fresh random keys pass; all 20 remain verifiable after tested modifications.

  • Takeaways & Limitations

    MeMark provides evidence of checkpoint derivatives that survives output-head replacement and remains effective against the tested adaptive and model-modification attacks.

  • Takeaways & Limitations

    The claims assume white-box verification and privacy of the secret key and exact pre-watermark checkpoint; rollback is stronger when that reference is available.

Abstract

from arXiv · show

Spiking Neural Networks (SNNs) are increasingly distributed as pretrained checkpoints and reused as backbones for new tasks. However, current SNN watermarks are mainly verified against the model output. Thus, a user who replaces the output head can keep most of the original network while removing the evidence used for verification. We present MeMark, a watermark designed for the checkpoint-reuse setting. Instead of storing the watermark in the output head, MeMark embeds a multi-bit identifier in the internal membrane state of selected Leaky Integrate-and-Fire (LIF) neurons. A secret input drives each selected neuron to the chosen side of its own firing threshold, and the same threshold is later used to recover the secret bit, so the verifier does not need a learned decoder. We evaluate MeMark across recurrent, convolutional, residual, and transformer SNNs. On a 215.4M-parameter SpikeGPT checkpoint, all 20 independent 64-bit keys pass the fixed 51/64 verification rule, while none of the $30\,000$ fresh random keys pass when tested against all 20 protected checkpoints and the clean model. All 20 genuine keys also remain above the threshold after fine-tuning, 90\% pruning, int8 quantization, and output-head replacement. Under our stated threat model, adaptive attacks can weaken the watermark but do not remove the ownership evidence in the settings we test. Additionally, we study false ownership claims, key-aware and key-agnostic removal, partial key disclosure, rollback, and extraction into a student. The results show that MeMark can provide evidence of checkpoint derivatives, while being resistant to the adversary's attacks and complete head replacement.

1 Introduction

MeMark addresses the weakness of output-based SNN watermarks under checkpoint reuse by embedding multi-bit ownership evidence in internal LIF membrane states. The paper evaluates this design across architectures, attacks, and model modifications, including output-head replacement.

  • Motivation: SNN output watermarks can disappear when users replace task-specific final layers while retaining most of the original backbone.This motivates watermarking evidence that remains inside the reused spiking computation.
  • Verification: The primary membrane response remains in the backbone after output-head replacement, while an optional output carrier supports query-only verification but can be removed with the head.The membrane-distance score provides a continuous confidence signal in addition to the hard threshold read.
  • Method: MeMark embeds a multi-bit identifier in secret LIF states and verifies bits using each selected neuron’s firing threshold without a learned decoder.A secret input drives selected membrane potentials to specified sides of their thresholds; verification reads those states.
  • Ownership Evidence: A timestamped commitment binds the key and owner to the released checkpoint, addressing false ownership claims based on keys fitted after inspecting a model.The commitment must precede the ownership claim and identify the specific checkpoint hash.
  • Evaluation: MeMark is evaluated across recurrent, convolutional, residual, and transformer SNNs, including eight testbeds and a 215.4M-parameter SpikeGPT checkpoint.The evaluation covers fine-tuning, pruning, quantization, structural changes, adaptive removal, rollback, partial key disclosure, and extraction.

2 Background

SNNs process discrete spikes over time, with neuron outputs depending on current input and accumulated temporal state. LIF neurons implement this through leaky membrane potentials, while surrogate gradients enable training despite nondifferentiable spikes.

  • Spiking Neural Networks: SNNs aggregate discrete spikes over time, so a neuron’s output depends on current input and information accumulated from previous timesteps.This temporal state distinguishes spiking computation from conventional continuous-valued activations.
  • LIF Neurons: A LIF neuron integrates incoming spikes into a membrane potential that decays over time, fires at threshold vth, and then resets.The firing decision is binary: the neuron emits a spike when vi(t) reaches or exceeds vth.
  • Watermark Carrier: MeMark reads the LIF membrane potential immediately before spike reset, using this internal value as watermark evidence.The membrane potential vi(t) is the state associated with neuron i at timestep t.
  • Training: Surrogate-gradient training replaces nondifferentiable binary spikes with a differentiable approximation during backpropagation.This permits standard gradient-based optimization for SNNs.
  • Verification Access: MeMark primarily uses white-box internal-state verification, whereas black-box output verification remains available through an optional output carrier.Output verification becomes unsuitable when reused SNN backbones have their output layers replaced.

3 Threat Model

The threat model assumes a released proprietary SNN may be extensively modified or reused by an attacker who knows MeMark but not its secret key. Robustness claims depend on keeping both the key and exact pre-watermark checkpoint private.

  • Attacker Capabilities: The attacker receives the protected checkpoint and may fine-tune, prune, quantize, replace the output head, alter LIF parameters, reorder channels, or reuse part of the network.The attacker is assumed to understand MeMark and have full access to the released architecture and weights.
  • Secret Information: The secret key remains private, including the challenge input, selected LIF coordinates, payload bits, and optional output carrier information.Disclosing the key gives the attacker substantially more information for targeting the watermark.
  • Verification Setting: MeMark’s primary verification requires white-box access to inspect selected LIF states, while its optional output response can be checked with query access.Replacing the output head can remove the optional response, making it weaker than the internal watermark.
  • Reference Checkpoint: The exact checkpoint immediately before watermarking must remain private because comparing it with the protected release helps isolate embedding updates.Rollback is stronger when the attacker has this precise pre-watermark reference than when using a public initializer or related checkpoint.
  • False Claims: A claimant can inspect a model and choose a matching key, so ownership requires a timestamped commitment linking the key to the specific released checkpoint.The commitment distinguishes prior ownership evidence from a key fitted after model inspection.
  • Scope Boundary: A fresh student trained only from normal outputs is outside MeMark’s checkpoint-lineage setting because it may not inherit the original internal response.The paper separately explores extraction into a student.

4 Method

MeMark embeds a multi-bit watermark in selected pre-fire membrane states and verifies it with the neurons’ own firing thresholds. Training uses threshold-distance signals while preserving the original model’s behavior, and verification can use hard, continuous, or optional output reads.

  • 4.2 Membrane Watermark Embedding: MeMark assigns each watermark bit to a secret LIF layer, neuron, and timestep, then trains its pre-fire membrane potential to the required side of that neuron’s threshold.A one-bit is placed above the threshold and a zero-bit below it when the secret input is present.
  • 4.1 Watermark Key: The key contains a secret input, selected carrier states, and a binary payload, so the challenge controls when the response appears and the carriers control where it is read.The owner binds the key to the protected checkpoint through a timestamped commitment before release.
  • 4.2 Membrane Watermark Embedding: Training uses signed membrane-to-threshold distance because direct spike supervision is non-differentiable and does not indicate how far the state is from the desired side.The watermark loss supplies a training signal even before the binary spike changes.
  • 4.2 Membrane Watermark Embedding: The embedding objective combines the original task loss, behavioral preservation relative to a frozen clean model, and the watermark loss.The frozen copy M0 constrains changes to the protected checkpoint.
  • 4.3 Watermark Verification: Verification reads selected states from the suspect checkpoint using either a hard threshold decision or a continuous membrane-distance score.The hard read recovers 1 above threshold and 0 below it without a learned decoder; an optional output carrier supports query-only verification.
  • 4.3 Watermark Verification: MeMark can separately embed an output response for query-only verification, but replacing the output head can remove that response while leaving the internal membrane watermark unchanged.The membrane watermark is intended for checkpoint reuse, whereas the output variant depends on the output interface.

5 Evaluation Setup

The evaluation spans eight SNN testbeds, multiple architectures, model sizes, and tasks, with repeated attacks on a small recurrent model and a larger SpikeGPT checkpoint for realistic reuse testing.

  • Architectures and Tasks: The eight testbeds include recurrent, convolutional, residual, and transformer SNNs across language, traditional vision, and neuromorphic vision tasks.Vision models include spiking CNNs, SEW-ResNet-18, Spikformer, and QKFormer on MNIST, CIFAR-10, CIFAR10-DVS, and N-Caltech101.
  • Model Sizes: The recurrent SNN has 0.97M parameters, while SpikeGPT-216M has 215.4M parameters and is used as the substantially larger pretrained-checkpoint testbed.The recurrent model is trained on enwik8; SpikeGPT is pretrained on OpenWebText and uses enwik8 for watermark embedding.
  • Payload Configuration: The recurrent model uses a 32-bit payload for most ablations, while Appendix B.4 reports recovery from 8 to 128 bits using the same number of training steps.The payload-length choice has little effect on original task performance in that experiment.
  • SpikeGPT Configuration: SpikeGPT uses 20 independent 64-bit keys trained for 3,000 steps, with evaluations at 1,200, 2,000, and 3,000 steps.The genuine responses stop improving after 2,000 embedding steps for all tested SpikeGPT keys.
  • Threshold and False-Positive Testing: Threshold calibration uses separate random and genuine key sets before testing 30,000 fresh random keys across the protected and clean checkpoints.A false positive is counted when any tested checkpoint accepts a key.

6 Metrics

MeMark evaluation reports bit recovery, membrane confidence, challenge specificity, task behavior, and ownership decisions from the SpikeGPT experiment.

  • Watermark Recovery: BER measures the fraction of incorrectly recovered watermark bits, while membrane score Smem increases as selected potentials move farther onto their expected threshold sides.BER is defined in Eq. (9), and Smem is an additional verification measure.
  • Specificity and Task Behavior: Off-trigger agreement near 0.5 indicates that non-challenge inputs do not reveal the payload and are not related to the model.The evaluation also measures original task performance before and after watermarking using validation loss or clean accuracy.
  • Ownership Decisions: The fixed 51/64 rule accepts all 5 calibration and 15 held-out genuine keys, yielding 20/20 overall, while 30,000 fresh random keys produce no accepted ownership decision.The random-key test covers all 20 protected checkpoints and the clean checkpoint.
  • Joint Verification: When both channels are evaluated in recurrent two-channel experiments, the joint score is min(mmem, mout) with a threshold of ≥22/32.The hard membrane read remains the primary rule.

7 Experimental Results

MeMark reliably separates genuine internal watermark keys from random or unrelated inputs, while preserving verification after common model modifications and output-head replacement. Its challenge-conditioned membrane read reveals less payload off-trigger than learned projection decoders, though adaptive attacks can weaken the signal without removing ownership evidence in the tested settings.

  • Verification: 59.4/64 average matching bits, with all 20 independent keys passing the fixed 51/64 threshold after 2 000 embedding steps.The observed range was 55–62 bits.
  • Verification: 0 of 30 000 fresh random keys passed the 51/64 rule, yielding a 0.000% false-positive rate and a one-sided 95% upper bound of 0.010%.The random keys were tested across all protected checkpoints and the clean checkpoint.
  • Challenge-response selectivity: 0.516 off-trigger agreement versus 0.575 for the matched DICTION-style watermark shows that MeMark reveals less payload without the secret challenge.Both methods recover all bits with the correct challenge.
  • Challenge-response selectivity: 0.715 off-trigger agreement with a learned projection decoder exceeds MeMark’s 0.516, while activation-reference decoders also reveal more payload on unrelated inputs.The comparison keeps the same membrane vector and changes only the decoder.
  • Robustness to model modifications: 200 fine-tuning steps restore BER to 0.00 after initial changes, and all 20 SpikeGPT keys remain above threshold after pruning, quantization, and head replacement.Neither 90% pruning nor int8 quantization changes any membrane bit; the weakest fine-tuned response is 53 bits.
  • Robustness to model modifications: 90% pruning preserves all 20 membrane watermarks while validation loss rises from about 5.05 to 46.2, damaging the language model more than the ownership signal.This demonstrates a trade-off between removing the watermark and preserving model behavior.

8 Discussion and Limitations

MeMark targets checkpoint derivatives, including reused or modified models, but its scope excludes models produced solely through extraction. Its threat model depends on keeping the secret key and exact pre-watermark checkpoint private.

  • Model extraction can reproduce the protected task without preserving the watermark, because extraction does not directly reuse the original internal states.
  • The exact pre-watermark checkpoint substantially weakens MeMark by letting an attacker isolate embedding changes more accurately than with related references.
  • Primary membrane verification requires white-box access to selected LIF states, while the optional output response supports query-only verification but is removable through head replacement.
  • The threat model assumes that the secret key and exact pre-watermark checkpoint remain private; full disclosure gives the attacker substantially more targeting information.

9 Related Work

Prior SNN watermarks mainly verify ownership through model outputs, which is unsuitable when task-specific heads are replaced. MeMark instead places ownership evidence in the internal spiking computation and addresses false claims through prior key commitment.

  • Output-based SNN watermarks support black-box verification but can be completely removed by replacing final task-specific layers while retaining most of the model.
  • White-box watermarking has embedded payloads in weights, normalization parameters, activation distributions, and internal states, sometimes using learned projections.
  • Structural attacks reorganize models while preserving behavior, motivating experiments that examine coordinate movement and recovery through behavioral alignment.
  • False-ownership attacks let malicious claimants construct counterfeit evidence, so MeMark requires the key to be committed before checkpoint release.

10 Conclusions

MeMark uses selected LIF membrane states and existing firing thresholds to provide lightweight watermark verification inside SNN backbones. Experiments report reliable recovery across architectures and robustness to several checkpoint modifications, while identifying stronger attacks and scope boundaries.

  • MeMark recovers payload bits from selected LIF membrane states using the neurons’ existing firing thresholds, without an additional learned projection.
  • On SpikeGPT, all 20 independently embedded keys pass the fixed 51/64 rule, while none of 30 000 fresh random keys pass it.
  • All 20 keys remain verifiable after 200 fine-tuning steps, 90% pruning, int8 quantization, and output-head replacement.
  • Structural changes can move watermark coordinates without removing the watermark, and alignment with the protected release can recover those coordinates.
  • The membrane-space mechanism applies to recurrent, convolutional, residual, and transformer SNNs, with architecture-specific embedding adjustments.
  • The watermark response alone cannot establish ownership because a white-box claimant can select a key matching existing internal states; prior commitment is therefore required.
  • Future work includes preserving ownership signals through distillation or extraction and incorporating registration history directly into the watermark.

B.4 Additional Watermark Ablations

Additional ablations examine task impact, coordinate selection, payload capacity, threshold crossing, and sensitivity to LIF dynamics. They show broad recovery capacity and identify dependencies between nearby states and altered neuron dynamics.

  • 0.2005 versus 0.1966 firing rate shows watermarking did not generally increase recurrent-network spike activity.
  • 0.0033 same-bit watermark loss versus 0.0186 opposite-bit loss shows that nearby states from one neuron should be selected carefully.
  • Every tested membrane payload from 8 to 128 bits is recovered, while the optional output response is exact through 64 bits and recovers 127 of 128 bits at maximum size.
  • BER 0.000 with both targets below firing threshold shows that membrane states can carry payloads without selected neurons firing, although an additional decoding boundary is then required.
  • Increasing the membrane time constant to 8× raises membrane BER to 0.419 and validation loss by 0.970, indicating degradation after substantial LIF-dynamics changes.

B.6 Partial Key Exposure

Partial key exposure leaves undisclosed membrane coordinates intact, while stronger timing and structural attacks can weaken or challenge recovery without removing the registered response in the tested settings.

  • Partial key exposure: BER remains 0.000 on all undisclosed coordinates across every tested partial-key exposure rate.The attacker flips each disclosed coordinate toward the opposite bit, while the separately keyed output response remains at or near zero BER.
  • Timing attack: 200 000 timing-search queries raise membrane BER to 0.250, but output BER remains 0.000.With 50 000 queries, membrane BER is unchanged; the stronger score-aware search is more damaging at the larger budget.
  • Structural attack: 98.4% of channel signatures remain correctly aligned under an objective that explicitly modifies matching responses, recovering the watermark at BER 0.000.Normal fine-tuning instead yields 82.8% matching accuracy and BER 0.031 in the reported comparison.

B.9 Watermark Detection

Detection tests examine reconstruction ambiguity, coexistence of multiple watermark keys, output-interface dependence, and extraction into a fresh student model.

  • Minimum-norm detection: Keyed reconstruction norms largely overlap random controls, with only one of ten keyed positions flagged.Across five seeds, the same flagged position recurs in four runs, while three representative unflagged keyed positions remain unflagged every time.
  • Multiple watermarks: Two independently generated watermark responses can coexist in the same checkpoint without automatically erasing the original.On both the recurrent SNN and the 215.4M-parameter model, the original responses remain at their pre-embedding values.
  • Claim precedence: Ownership priority cannot be determined from model responses alone when multiple keys verify; pre-release commitments provide registration timing evidence.The model-level response identifies a checkpoint derivative, while commitments establish when a key was registered.
  • Output verification: Output watermark verification uses either score comparisons or selected labels and tokens, but remains dependent on the available output interface.Membrane and output payloads are decoded separately and need not contain the same bits.
  • Extraction boundary: Output-based extraction does not transfer the watermark: the student reaches membrane BER 0.531 and output BER 0.438.The student is trained only on normal inputs and output behavior, without secret challenges or protected membrane states.
Loading 2608.25738v1…