Dual-Locking Learned AI Models: A PIN-Based Sparse QIM Watermarking and Adaptive Index Permutation Approach

Iva Vasic; Jesús Muñoz-Cádiz; Bata Vasic

cs.CRSep 19, 2026

Dual-Locking Learned AI Models: A PIN-Based Sparse QIM Watermarking and Adaptive Index Permutation Approach

Authors: Iva Vasic, Jesús Muñoz-Cádiz, Bata Vasic

Organizations: Faculty of Science and Medicine, University of Fribourg, 1700 Fribourg, Switzerland · Faculty of Electronic Engineering, University of Nis, 18000 Nis, Serbia · Information Technology Department, University MB, 11040 Belgrade, Serbia

Abstract

We present a dual-locking method for securing trained neural networks that combines key-driven index permutation with PIN-based watermarking based on Sparse Quantization Index Modulation (QIM). Cryptographic randomness is introduced by independently applying a uniform random permutation to each row of adaptively selected index vectors. A robust blind binary watermark is then embedded into the bias coefficients by modulating their quantized values, binding the network to a user-defined Personal Identification Number (PIN). Without the correct key, the network retains its architecture but becomes functionally impaired due to disrupted internal representations. Inverse permutation fully restores the original model accuracy, while the embedded watermark remains imperceptible and enables blind verification of key association and model authorship. To improve both locking effectiveness and recoverability, an adaptive key selection strategy redistributes high-magnitude weights to low-sensitivity positions and vice versa, increasing degradation in the locked state while preserving full recovery. Experiments on MNIST, CIFAR-10/100, and ImageNet-1K using fully connected networks, ResNet CNNs, and transformer architectures show that locking reduces accuracy below 10%, and even below 0.5% for CNNs, while the correct key fully restores performance. The watermark introduces no measurable accuracy degradation and reliably authenticates ownership. Analysis of embedding distributions across CNNs and transformers further indicates potential diagnostic value for identifying undertrained or suboptimally designed models. The proposed approach therefore provides simultaneous model protection, recovery, and ownership verification.

Figures & tables

Fig. 1: Illustration of the proposed locking and unlocking mechanism, where the function $\aleph(\mathbf{W},\mathbf{b})$ maps the weight vector $\mathbf{W}$ and bias vector $\mathbf{b}$ , while the permutation operator $\bm{\pi}_{\mathbf{K}}$ and its inverse $\bm{\pi}_{\mathbf{K}}^{-1}$ are defined in ( 5 ) and ( 8 ), respectively. The central part of the illustration depicts Stage 1, representing the key-based adaptive permutation, and Stage 2, corresponding to the PIN QIM watermarking process.

Fig. 2: Accuracy degradation curves for all neural networks (NN1–NN6) as a function of key length $r$ under random reshuffling of bias indices ( 7 ).

NN Name	Accuracy as a function of key length
	Original	4	10	100	1000	10000
NNetwork1	96.48%	74.29%	50.65%	9.89%	8.95%	8.14%
NNetwork2	95.04%	94.92%	94.61%	84.99%	16.16%	9.53%
NNetwork3	96.21%	95.80%	94.96%	38.64%	11.45%	10.79%
ResNet18	70.59%	0.93%	0.45%	0.03%	0.19%	0.00%
ResNet20	92.12%	53.03%	30.80%	9.80%	9.88%	10.00%

TABLE I: Accuracy of adaptive locked Neural Networks

Fig. 3: Accuracy degradation curves for all neural networks (NN1–NN6) as a function of key length $r$ ( 9 ) under adaptive permutation of weight indices in descending-order index vector $\mathbf{L}$ defined in ( 8 ).

NN Name	Accuracy as a function of PIN Length
	Original	4	6	8
NNetwork1	96.48%	96.46%	96.47%	96.47%
NNetwork2	95.04%	95.03%	95.07%	95.03%
NNetwork3	96.21%	96.20%	96.23%	96.21%
ResNet18	70.59%	68.83%	68.93%	68.74%
ResNet20	92.12%	91.31%	90.82%	90.52%

TABLE II: Accuracy of watermarked Neural Networks

LLM	Watermarked Accuracy for different key lengths
	Original	1000	10000	15000
ALBERT	92.66	88.88	56.77	50.11
BERT-Tiny	70.59	59.06	63.65	48.97
DistilBERT	91.06	85.89	60.21	49.08
MiniLM	90.14	86.70	59.63	50.23

TABLE III: Accuracy of watermarked LLMs

Attacks	Level 1	Level 2	Model usability	Dual-Locking robustness
Post-lock fine-tuning	Yes	Yes	No	Yes
Model distillation	No	No	No	No
Pruning and compression	No	Yes	No	Yes
Weight reinitialization	Yes	No	No	Yes
Overwriting or forging	Yes	No	Yes	Yes
Key-search or brute-force	Yes	Yes	Yes	Yes

TABLE IV: Dual-locking robustness of each protection level

Fig. 4: Histogram of absolute bias variations $|\Delta_{b}|$ across all Sparse QIM $T$ -blocks for the intensive fine-tuning configuration ( $p2\_approx4x$ ).

Fig. 5: Accuracy degradation curves for all neural networks (NN1–NN6) as a function of key length $r$ under random reshuffling of weight indices ( 6 ). The X-axis is represented using a base- $10$ logarithmic scale of $r$ , where the value $r=0$ effectively corresponds to the performance of the original networks.

NN Name	Locked NN Accuracy for different key lengths
	Original	10	100	$>100$
B_NNetwork1	96.48%	96.26%	95.98%	95.47%
B_NNetwork2	95.04%	95.02%	95.06%	93.44%
B_NNetwork3	96.21%	96.24%	95.84%	94.86%
ResNet18	70.59%	52.96%	0.42%	0.38%
ResNet20	92.12%	75.31%	10.04%	10.00%

I.TABLE: Accuracy of Neural Networks

NN Name	Locked NN Accuracy for different key lengths
	Original	10	100	$>100$
B_NNetwork1	96.48%	94.38%	95.10%	96.48%
B_NNetwork2	95.04%	94.49%	90.82%	95.04%
B_NNetwork3	96.21%	95.68%	93.58%	96.21%
ResNet18	70.59%	0.16%	0.06%	0.22%
ResNet20	92.12%	9.63%	10.15%	10.00%

II.TABLE: Accuracy of Neural Networks: adaptive locked biases

LLMs	Watermarked Accuracy for different key lengths
	Original	1000	10000	15000
ALBERT	92.66	82.68	50.46	50.69
BERT-Tiny	70.59	79.93	59.29	49.43
MiniLM	91.06	89.45	49.77	48.97
MiniLM	90.14	87.96	57.80	57.80

III.TABLE: Accuracy of watermarked LLMs

Robust Watermarking

Robust watermarking embeds or verifies ownership and provenance signals that survive editing, compression, model changes, and deliberate removal.

See all 207 papers

Locking Pretrained Weights via Deep Low-Rank Residual Distillation
May 11, 2026Keitaro Sakamoto, Pierre Ablin, Federico Danieli +1Open-Weight Language Models LLM Security
Apple
Intellectual Property Protection of Hyperdimensional Computing Classifiers: Black-Box Ownership Verification via Model Watermarking
Oct 26, 2026Hamed Poursiami, Farshad Soleiman, Ahmad Tahmasivand +5Robust Watermarking Hyperdimensional Computing
1Electrical and Computer Engineering Department, George Mason University, Fairfax, VA, USA · 2Oak Ridge National Laboratory, Oak Ridge, TN, USA
Language Model Fingerprinting Requires Rethinking Watermark Teachers
Oct 3, 2026Jeongyeon Hwang, Anshul Nasery, Sewoong Oh +1Language Model Fingerprinting Fingerprint Identification
Pohang University of Science and Technology · University of Washington

May 11, 2026J/K move · Enter open · S save

Locking Pretrained Weights via Deep Low-Rank Residual Distillation

Keitaro Sakamoto, Pierre Ablin, Federico Danieli, Marco Cuturi

Apple

Open-Weight Language Models LLM Security Fine-Tuning Language Models

Open paper AskPDF arXiv

The quality of open-weight language models has dramatically improved in recent years. Sharing weights greatly facilitates model adoption by enabling their use across diverse hardware and software platforms. They also allow for more open research and testing, to the extent that users can use them as checkpoints, fine-tune them according to their needs, and potentially redistribute them. In some cases, however, concerns on modifying these weights towards unauthorized uses may outweigh the pros of giving users such freedom. Defending against such adaptation is non-trivial: since an adaptive attacker can observe all weights and architectures by definition, they can reverse simple structural defenses, and use optimization to defeat the simplest locking mechanisms. In this work, we exploit the inference-training asymmetry of automatic differentiation as a novel defense axis. We propose DLR-Lock, a method where the purveyor of the model purposely replaces each pretrained MLP in their model with a deep low-rank residual network (DLR-Net) of comparable parameter count, forcing activation memory that grows linearly with depth during backpropagation. DLR-Nets are efficiently trained via module-wise regression. We show that, beyond this memory overhead, DLR-Lock results in architectural mismatches that complicate the optimization landscape of standard fine-tuning, and a backward pass that incurs disproportionately more overhead than the forward pass. Our defense succeeds in withstanding adaptive attackers with full knowledge of the defense strategy while preserving the original model's capabilities. Experiments on LLMs validate these claims.

Abstract

Robust Watermarking

Explore similar work

Locking Pretrained Weights via Deep Low-Rank Residual Distillation

Intellectual Property Protection of Hyperdimensional Computing Classifiers: Black-Box Ownership Verification via Model Watermarking

Language Model Fingerprinting Requires Rethinking Watermark Teachers