Dual-Locking Learned AI Models: A PIN-Based Sparse QIM Watermarking and Adaptive Index Permutation Approach

Summary

The authors propose a dual-locking method for trained neural networks, combining key-driven random index permutation with PIN-bound blind watermarking via sparse QIM in the bias coefficients. Without the correct key, accuracy drops below 10% on tested models, and 0.5% for CNNs, while the correct key restores full accuracy. Experiments on MNIST, CIFAR-10/100, and ImageNet-1K with fully connected networks, ResNet CNNs, and transformers show the watermark does not degrade performance and reliably authenticates ownership.