🤖 machine learning

MeMark: Membrane-Space Watermarking for Spiking Neural Networks

MeMark introduces a robust watermarking technique for Spiking Neural Networks that embeds multi-bit identifiers directly into the internal membrane states of neurons, enabling reliable ownership verification even after output head replacement, fine-tuning, pruning, and quantization.

Original authors: Roberto Riaño, Gorka Abad, Stjepan Picek, Aitor Urbieta

Published 2026-08-27

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Roberto Riaño, Gorka Abad, Stjepan Picek, Aitor Urbieta

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the rapidly evolving world of artificial intelligence, a significant shift is occurring toward a type of computer brain that mimics the human nervous system more closely than traditional models. These systems, known as spiking neural networks, do not process information in a constant stream of numbers. Instead, they communicate through brief, discrete bursts of activity, much like neurons firing in the brain. They remain silent until a specific signal triggers them, making them incredibly efficient at using energy. Because training these advanced systems requires vast amounts of data, powerful computers, and significant time, the final trained models are valuable assets. Companies and researchers often release these models as pre-trained starting points, allowing others to build upon them for new tasks. However, this practice creates a vulnerability: if someone takes a released model, tweaks it slightly, and replaces the part that produces the final answer, they can effectively erase any proof that the original creator built the core of the system.

To solve this problem, a team of researchers has developed a new method called MeMark, which acts as a hidden signature embedded deep within the internal workings of these spiking networks. Unlike previous attempts to protect artificial intelligence models, which relied on checking the final output or the visible results, MeMark hides its evidence inside the neurons themselves. The researchers focused on a specific type of neuron that maintains an internal electrical charge, known as a membrane potential. This charge builds up over time until it reaches a critical limit, causing the neuron to fire a signal and then reset. The team realized they could use this natural firing threshold as a secret lock. By carefully adjusting the training process, they can force specific neurons to hold their charge just above or just below this firing limit when a secret, hidden input is presented. This creates a pattern of "fired" and "not fired" states that corresponds to a secret code, effectively writing a multi-digit password into the electrical state of the network.

The brilliance of this approach lies in how it is read and how it survives changes. To verify the ownership of a model, the owner does not need to train a separate decoder or learn a new way to interpret the data. They simply present the secret input and check the internal charge of the selected neurons. If the charge is above the limit, it counts as a one; if it is below, it counts as a zero. Because the threshold is a built-in part of the neuron's design, the verification process is immediate and requires no extra learning. This method proved remarkably resilient. In tests involving a massive language model with over 200 million parameters, the researchers embedded twenty different secret keys. Even when the model was heavily modified—such as by removing ninety percent of its connections, compressing its data, or completely replacing the final layers that generate text—the hidden signature remained intact. The internal evidence survived these drastic changes, while the visible output markers used in older methods were easily erased.

The researchers also addressed a clever trick that a dishonest claimant might try: inspecting a model and then crafting a fake key that happens to match the model's existing internal states. To prevent this, the system requires a timestamped record created before the model is ever released. This record binds the secret key to the specific version of the model at that moment. If someone tries to claim ownership later by reverse-engineering a key, they cannot produce this prior record, proving their claim is false. The study showed that while an attacker could indeed create a key that matched the model if they were allowed to look inside first, they could not bypass the requirement for the original timestamped commitment. Furthermore, the system was tested against thousands of random keys, and none of them accidentally matched the protected models, ensuring that the evidence is specific and reliable.

This work demonstrates that ownership of complex artificial intelligence can be protected even when the model is repurposed or altered. By embedding the proof directly into the fundamental electrical behavior of the neurons, rather than in the final output, the researchers have created a signature that is difficult to remove without destroying the model's ability to function. The method works across different types of network architectures, from simple repeating structures to complex transformer-based systems used for language. While the system is robust, the researchers noted that if an attacker knows the exact secret input and the specific locations of the hidden neurons, they could potentially target and remove them. However, without that secret knowledge, the watermark remains a persistent and reliable form of evidence, ensuring that the original creators can prove their work even after the model has been passed through many hands and modified for new uses.

Technical Summary: MeMark – Membrane-Space Watermarking for Spiking Neural Networks

1. Problem Statement

Spiking Neural Networks (SNNs) are increasingly distributed as pretrained checkpoints and reused as backbones for new tasks. While model watermarking is a standard technique for protecting Deep Neural Networks (DNNs), existing SNN watermarking methods face a critical vulnerability in the checkpoint-reuse setting. Current SNN watermarks are primarily verified against the model's output (e.g., via temporal responses or trigger-dependent outputs). Consequently, an adversary who replaces the output head (the final task-specific layers) can remove the watermark evidence while retaining the vast majority of the original network's weights and internal structure. Furthermore, existing methods often rely on learned decoders or output-based verification, which are insufficient when the output interface is altered or when white-box access allows an attacker to craft keys that match the model's internal states post-hoc.

2. Methodology: MeMark

MeMark is a challenge-response watermarking scheme designed to embed multi-bit identifiers directly into the internal membrane states of Leaky Integrate-and-Fire (LIF) neurons, ensuring persistence even after output head replacement.

2.1 Core Mechanism

Instead of storing watermarks in weights or output activations, MeMark embeds bits into the pre-fire membrane potential ( $v_i(t)$ ) of selected LIF neurons at specific timesteps.

Embedding: For a secret input (challenge) $x_{wm}$ $x_{w m}$ , the system selects a set of coordinates $C = \{(l_k, n_k, t_k)\}$ $C = {(l_{k}, n_{k}, t_{k})}$ corresponding to layer, neuron, and timestep. The training objective pushes the membrane potential of a selected neuron to one side of its intrinsic firing threshold ( $v_{th}$ $v_{t h}$ ) based on the payload bit $W_k$ $W_{k}$ :
- If $W_k = 1$ , the potential is trained to be $> v_{th}$ .
- If $W_k = 0$ , the potential is trained to be $< v_{th}$ .
Loss Function: The method utilizes a signed distance metric $m_k = (v_k - v_{th,k}) / \tau_{wm}$ and optimizes a Binary Cross-Entropy (BCE) loss. This allows the optimizer to receive gradient signals regarding the distance to the threshold even before the binary spike decision changes, avoiding the non-differentiability of the spike operation.
Fidelity: To preserve task performance, the training objective includes a fidelity term (KL divergence) between the watermarked model and a frozen copy of the original checkpoint, alongside the task loss.

2.2 Verification

Verification requires white-box access to the suspect model to inspect internal states.

Hard Read: The verifier presents the secret challenge and checks if the membrane potential at the specific coordinates is above or below the neuron's firing threshold. This recovers the bit without requiring a learned decoder, as the threshold is an intrinsic part of the neuron.
Continuous Score: An optional continuous score ( $S_{mem}$ ) measures the distance of the membrane potential from the threshold, providing a confidence metric.
Output Carrier: MeMark includes an optional output-based response for scenarios where internal states are inaccessible, though this is acknowledged as removable via head replacement.

2.3 Anti-Counterfeiting and Commitment

To prevent "fitted claims" (where a dishonest actor inspects a model and generates a key that matches its current internal states), MeMark requires the owner to publish a timestamped cryptographic commitment before releasing the checkpoint. This commitment binds the specific key, owner, and checkpoint hash. A valid ownership claim must demonstrate that the key was committed prior to the suspect model's release.

3. Key Contributions

Membrane-Space Embedding: Introduction of MeMark, which embeds watermarks in the internal membrane potentials of LIF neurons, making the evidence resilient to output head replacement.
Decoder-Free Verification: The method utilizes the neuron's intrinsic firing threshold for decoding, eliminating the need for a learned projection layer (unlike DNN activation-based watermarks) and reducing storage overhead.
Robustness Evaluation: Comprehensive evaluation across recurrent, convolutional, residual, and transformer SNN architectures, including a 215.4M-parameter SpikeGPT checkpoint.
Commitment Protocol: Integration of a timestamped commitment mechanism to mitigate false ownership claims derived from white-box model inspection.

4. Experimental Results

The authors evaluated MeMark on eight SNN testbeds, including a 215.4M-parameter SpikeGPT model and various vision models (SEW-ResNet, Spikformer, QKFormer).

Verification Accuracy: On the SpikeGPT checkpoint, 20 independent 64-bit keys were embedded. All 20 genuine keys passed a fixed verification rule of 51/64 matching bits. Conversely, 30,000 fresh random keys failed to pass this rule across all protected checkpoints and the clean model, resulting in a False Positive Rate (FPR) of 0.000% (95% upper bound 0.010%).
Robustness to Modifications:
- Head Replacement: The membrane watermark remained verifiable (BER $\approx$ 0.00) after the output head was reset and retrained, whereas the output carrier was removed.
- Fine-tuning: After 200 steps of fine-tuning, all 20 keys still satisfied the 51/64 threshold (average matching bits dropped slightly from 59.4 to 58.3).
- Pruning & Quantization: 90% pruning and int8 quantization did not alter the membrane bits for any of the 20 keys.
- Structural Changes: The watermark survived channel permutations and layer splitting, provided a channel-matching recovery step was performed to realign the coordinates.
Selectivity: The watermark is highly selective to the secret challenge. Off-trigger agreement (using random inputs) was 0.516 (near random chance), significantly lower than learned projection decoders (0.715), indicating the payload is not leaked during normal operation.
Fitted Claims: Experiments confirmed that without the pre-release commitment, an attacker with white-box access could fit a key to match the model's internal states (achieving 32/32 bits). The commitment protocol effectively mitigates this by requiring proof of prior registration.

5. Significance and Claims

The paper claims that MeMark provides a robust solution for proving ownership of SNN checkpoints in a reuse scenario where the output interface is no longer trusted. By moving the watermark from the output layer to the internal membrane dynamics, MeMark ensures that ownership evidence persists even when the model is repurposed or its final layers are stripped.

The authors emphasize that MeMark offers a practical alternative to DNN watermarking techniques that rely on learned decoders, as it leverages the existing physical properties of spiking neurons (the firing threshold) for verification. The results suggest that MeMark can provide evidence of checkpoint derivatives while resisting adaptive attacks, model modifications (pruning, quantization, fine-tuning), and complete head replacement. The paper concludes that while adaptive attacks can weaken the watermark, they do not completely remove ownership evidence in the tested settings, and the method maintains high fidelity to the original task performance.