MeMark: Membrane-Space Watermarking for Spiking Neural Networks

Roberto Riaño; Gorka Abad; Stjepan Picek; Aitor Urbieta

cs.CRAug 26, 2026

MeMark: Membrane-Space Watermarking for Spiking Neural Networks

Authors: Roberto Riaño, Gorka Abad, Stjepan Picek, Aitor Urbieta

Organizations: Radboud University, The Netherlands · IKERLAN Technology Research Centre, Spain · University of Bergen, Norway · University of Zagreb, Croatia

Abstract

Spiking Neural Networks (SNNs) are increasingly distributed as pretrained checkpoints and reused as backbones for new tasks. However, current SNN watermarks are mainly verified against the model output. Thus, a user who replaces the output head can keep most of the original network while removing the evidence used for verification. We present MeMark, a watermark designed for the checkpoint-reuse setting. Instead of storing the watermark in the output head, MeMark embeds a multi-bit identifier in the internal membrane state of selected Leaky Integrate-and-Fire (LIF) neurons. A secret input drives each selected neuron to the chosen side of its own firing threshold, and the same threshold is later used to recover the secret bit, so the verifier does not need a learned decoder. We evaluate MeMark across recurrent, convolutional, residual, and transformer SNNs. On a 215.4M-parameter SpikeGPT checkpoint, all 20 independent 64-bit keys pass the fixed 51/64 verification rule, while none of the $30\,000$ fresh random keys pass when tested against all 20 protected checkpoints and the clean model. All 20 genuine keys also remain above the threshold after fine-tuning, 90% pruning, int8 quantization, and output-head replacement. Under our stated threat model, adaptive attacks can weaken the watermark but do not remove the ownership evidence in the settings we test. Additionally, we study false ownership claims, key-aware and key-agnostic removal, partial key disclosure, rollback, and extraction into a student. The results show that MeMark can provide evidence of checkpoint derivatives, while being resistant to the adversary's attacks and complete head replacement.

Figures & tables

Figure 1: MeMark stores each watermark bit in the pre-fire state of a selected LIF neuron. A one-bit is moved above the neuron’s firing threshold and a zero-bit below it at the selected time step. The same threshold is used again during verification.

Fixed rule	FP keys	Key FPR	95% upper	Genuine
Hard/spike, $\geq 51/64$	0/30 000	0.000%	0.010%	20/20

Table 1: SpikeGPT ownership decisions. The fixed 51/64 rule accepts all 5 calibration and 15 held-out genuine keys, giving 20/20 overall, while none of the 30000 fresh random keys pass across all 20 protected checkpoints and the clean model.

Accuser’s strategy	Mem.	Aux. out.	Joint
Honest random key	13/32	20/32	13/32
Coordinates and bits fitted	32/32	16/32	16/32
Trigger optimized only	18/32	20/32	18/32
Coordinates fitted $+$ trigger optimized	32/32	17/32	17/32
$+$ output token pairs fitted	32/32	32/32	32/32

Table 2: False claims fitted to an unwatermarked model and evaluated at the calibrated joint threshold of

\geq 22/32

(Accepted claims are shown in bold). A claimant who chooses the key after inspecting the model can make the model-level test accept even though no watermark was embedded.

Panel of Figure 2 — Figure 2: Challenge-response selectivity. Both panels use off-trigger payload agreement: the mean agreement on the key’s one-bits and zero-bits. A value of $0.5$ indicates no payload information.

Carrier	Decoder reference	On-trig. BER	Off-trig. agreement
membrane	firing threshold	0.000	0.516
membrane	trained projection	0.000	0.715
activation	zero	0.000	0.580
activation	calibration mean	0.000	0.680
activation	calibration median	0.000	0.677

Table 3: Carrier and decoder controls over ten keys. Off-trigger agreement is measured on 300 probes per key;

0.5

is the chance level.

Scheme	Payload	White-box read on the challenge	Read without the challenge	Output channel	Fidelity
MeMark (ours)	32 bits	BER $0.000$	agreement $0.516$	BER $0.000$	loss $2.413$
DICTION-style [ 1 ]	32 bits	BER $0.000$	agreement $0.575$	BER $0.000$	loss $2.428$
DeepSigns-style [ 23 ]	32 bits	BER $0.000$	BER $0.125$	n/a	loss $2.447$
Uchida et al. [ 28 ]	32 bits	BER $0.094$	no challenge to withhold	n/a	loss $2.413$
Poursiami et al. [ 22 ]	1 continuation	n/a	n/a	16/16 tokens	loss $2.284$

Table 4: Baselines on the 4-layer recurrent SNN, reimplemented from the same checkpoint and training budget where the method allows it. Trigger-conditioned methods are also read on off-trigger probes; DeepSigns is evaluated on held-out data and Uchida directly from weights. Fidelity is the resulting loss after the defense is applied.

Attack	Matching bits	Pass
None (baseline)	59.4 [55, 62]	20/20
Fine-tune, 200 steps	58.3 [53, 61]	20/20
Prune $90\%$	59.4 [55, 62]	20/20
int8 quantization	59.4 [55, 62]	20/20
Head reset $+$ retrain	59.4 [55, 62]	20/20
Channel permutation	32.6 [28, 38]	0/20

Table 5: Attacks on all 20 SpikeGPT checkpoints after

2\,000

embedding steps. Matching bits are the mean over keys, with the observed range. “Pass” uses the fixed 51/64 rule.

Figure 3: Model accuracy and BER with function-preserving channel permutations before and after recovering the coordinates by matching on non-secret signatures against a previous protected checkpoint.

Transformation	Max logit $\Delta$	Naive BER	Recovered BER
Layer split ( $W_{2}W_{1}$ )	$0$	0.000	0.000
Replicate $+$ permute	$7{\times}10^{-6}$	0.562	0.000
$+$ layer split	$7{\times}10^{-6}$	0.562	0.000

Table 6: Function-preserving structural transformations. “Recovered” uses the retained protected checkpoint to align channels before applying the secret key.

Panel of Figure 4 — Figure 4: Vision feasibility across six testbeds: three different SNN architectures on CIFAR-10 and three additional datasets evaluated with a shared spiking CNN.

Reference	Revert	Mem. BER	Out. BER	Clean loss
Public initializer	$0.1\%$	0.156	0.019	4.496
	$1\%$	0.169	0.094	4.593
	$5\%$	0.206	0.256	4.914
Similar, same corpus	$0.1\%$	0.169	0.019	4.427
Similar, same corpus	$1\%$	0.244	0.119	4.425
Similar, disjoint corpus	$0.1\%$	0.163	0.019	4.425

Table 7: Differencing attack on private proprietary pre-embedding checkpoint, mean over five keys. Before attack, the released models read

0.119/0.000

at clean loss

4.428

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset or task	Architecture	LIF timesteps or context	Parameters	Embed steps	Payload
enwik8 language modeling	4-layer recurrent SNN	context 128	0.97M	250	32
OpenWebText checkpoint, enwik8 embed	SpikeGPT-216M	context 1 024	215.4M	2,000	64
MNIST	3-stage spiking CNN	4	0.21M	200	24
CIFAR-10	SEW-ResNet-18	4	11.18M	300	16
CIFAR-10	Spikformer	4	0.65M	3 000	16
CIFAR-10	QKFormer	4	0.14M	3 000	16

Appendix

Table 8: Evaluation testbeds and watermark settings.

Steps	Genuine min.	Negative max.	Difference
$1\,200$	53	49	4
$2\,000$	59	48	11
$3\,000$	59	50	9

Appendix

Table 9: Calibration results for the first five SpikeGPT keys.

Training	Genuine range	Fresh FP	FT pass
400/ $1\,200$	48–57	8/30 000	19/20
all at $1\,200$	53–60	0/30 000	19/20
all at $2\,000$	55–62	0/30 000	20/20

Appendix

Table 10: Effect of the SpikeGPT embedding budget. “FT pass” reports the number of keys that still pass after 200 fine-tuning steps.

Payload	Membrane	Output
8	8/8	8/8
16	16/16	16/16
32	32/32	32/32
64	64/64	64/64
128	128/128	127/128

Appendix

Table 11: Payload-size ablation on the recurrent SNN. Entries report correctly recovered bits.

Panel of Figure 5 — Figure 5: LIF parameter changes. The methods react differently to large changes in $v_{th}$ and $\tau$ .

Scale	MeMark	DICTION	$\Delta$ loss M	$\Delta$ loss D
Firing threshold $v_{th}$
$0.125\times$	0.075	0.256	+0.603	+0.606
$0.25\times$	0.034	0.178	+0.510	+0.513
$0.5\times$	0.003	0.022	+0.256	+0.258
$0.707\times$	0.000	0.000	+0.088	+0.088
$1\times$	0.000	0.000	+0.000	+0.000

Appendix

Table 12: BER and validation loss under LIF parameter changes, mean over ten matched keys.

\Delta

loss is measured from the unmodified model.

Exposed fraction	Exposed BER	Hidden BER
0.00	–	0.000
0.25	1.000	0.000
0.50	1.000	0.000
0.75	1.000	0.000
1.00	1.000	–

Appendix

Table 13: Partial-key attack on the recurrent SNN.

Condition	Val. loss $\Delta$	Match acc.	Recovered BER
Task $+$ signature flattening	$-0.008$	0.984	0.000
Plain fine-tuning	$-0.385$	0.828	0.031

Appendix

Table 14: Recovery after modifying the channel signatures used for alignment.

Figure 6: Minimum-norm reconstruction for watermark detection. The keyed positions largely overlap with the random controls, and only one keyed position is flagged.

Quantity	Measured
Checkpoint / secret key size	861.7 MB / $1\,600$ bytes
Membrane state on the challenge	$1\,769\,472$ scalars
Scalars the verifier reads	64 ( $0.0036\%$ )
LIF modules that must be observable	30 of 36
with the keyed modules tapped	788 ms ( $+1.9\%$ )
with all LIF modules tapped	791 ms ( $+2.3\%$ )

Appendix

Table 15: Verification cost on the 215.4M-parameter SpikeGPT checkpoint, measured with 256-token sequences and the median of 30 runs on an RTX 4090.

Robust Watermarking

Robust watermarking embeds or verifies ownership and provenance signals that survive editing, compression, model changes, and deliberate removal.

See all 208 papers

Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks
Jul 30, 2026Spyridon Raptis, Haralampos-G. StratigopoulosAdversarial Attacks Spiking Neural Networks
Sorbonne Universit´e, CNRS, LIP6, Paris, France
Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs
Jul 30, 2026Roberto Riaño, Gorka Abad, Stjepan Picek +1Backdoor Attacks Backdoor Detection
Radboud University, The Netherlands · Ikerlan Research Centre, Spain · University of Bergen, Norway +1
Hardware-Aware Model Inversion in Memristive Spiking Neural Networks
Oct 29, 2026Pablo Sorrentino, Fernando M. Quintana, Erika Covi +1Model Inversion Attacks Spiking Neural Networks
University of Groningen Groningen, The Netherlands · Technical University of Munich Munich, Germany

Jul 30, 2026J/K move · Enter open · S save

Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks

Spyridon Raptis, Haralampos-G. Stratigopoulos

Sorbonne Universit´e, CNRS, LIP6, Paris, France

Adversarial Attacks Spiking Neural Networks Neuromorphic Computing Adversarial Perturbations

Open paper AskPDF arXiv

Spiking Neural Networks (SNNs) communicate through sparse binary spike events rather than dense activations, enabling energy-efficient inference on neuromorphic hardware and motivating their use in always-on, battery-powered edge systems. We show that this same efficiency advantage creates a distinct security risk: sponge attacks can increase inference-time spike activity and synaptic workload, inflating energy consumption while remaining difficult to detect through correctness-based monitoring alone. Prior input-space efficiency attacks on SNNs have focused on per-sample optimization, primarily in rate-coded settings. We extend this threat to native event-based binary inputs and study two attack models. First, we develop a per-sample sponge attack that crafts a custom adversarial spike train for each input via gradient-based optimization. This attack increases per-inference SynOps by 1.5-2.6x on three SNN models for the NMNIST, SHD, and IBM DVS Gesture datasets, while preserving the predicted class on at least 98% of evaluated samples. Second, to the best of our knowledge, we introduce the first universal sponge attack for native event-based SNN inputs: a fixed binary perturbation computed offline and applied via XOR to all subsequent inputs. Although weaker, it still inflates SynOps by 1.09-1.24x across all three datasets and represents a more realistic deployment threat because it requires no per-input optimization. Mapping SynOp inflation to estimated Loihi-1 energy yields per-inference overheads from 14

μ

J to 13.24 mJ. These results show that native event-based SNNs are vulnerable to practical input-space efficiency attacks, and that reusable universal perturbations can accumulate into meaningful battery drain in continuously deployed edge systems.

Abstract

Robust Watermarking

Explore similar work

Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks

Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs

Hardware-Aware Model Inversion in Memristive Spiking Neural Networks