AWA: Activation-Based Weight Alignment for Robust Static Watermarking of Neural Networks

AWA: Activation-Based Weight Alignment for Robust Static Watermarking of Neural Networks

Akimenkov A.A. (ISP RAS, Moscow, Russia)
Obydenkov D.O. (ISP RAS, Moscow, Russia)
Yakushev A.Yu. (ISP RAS, Moscow, Russia)
Abud K.N. (IAI MSU, Moscow, Russia)
Ustinova A.A. (ISP RAS, Moscow, Russia)
Markin Yu.V. (ISP RAS, Moscow, Russia)

Abstract

This paper addresses the problem of improving the robustness of static neural network watermarking methods in the white-box extraction scenario, where a digital watermark is extracted directly from model parameters. The main focus is on the coordinated weight permutation attack, which preserves the predictive performance of a neural network but changes the order of parameters used during watermark extraction. To counter this attack, we propose an activation-based weight alignment algorithm, AWA (Activation-based Weight Alignment), which matches structural elements of the original and attacked models using activation maps and restores the weight order before watermark extraction. In this work, AWA is integrated into the extraction procedure of NeuralMark, since this method is robust to several model modification attacks but remains sensitive to parameter permutations. The experimental evaluation is conducted on several datasets, neural network architectures, and model modification attacks, including pruning, fine-tuning, watermark overwriting, weight shifting, and coordinated weight permutation. The results show that applying AWA improves the robustness of NeuralMark against permutation attacks while preserving high robustness against the other considered model modification attacks. In particular, under the weight permutation attack, NeuralMark-AWA reduces BER from 0.48 to 0.00 on CIFAR-10 and from 0.44 to 0.00 on Caltech-101, while TPR@FPR increases from 0.04 and 0.06 to 1.00, respectively.

Keywords

digital watermarks; neural networks; static watermarking; intellectual property protection; watermarking attacks; weight permutation; activation-based weight alignment.

Edition

Proceedings of the Institute for System Programming, vol. 38, issue 4, part 2, 2026, pp. 225-244

ISSN 2220-6426 (Online), ISSN 2079-8156 (Print).

DOI: 10.15514/ISPRAS-2026-38(4)-28

For citation

Akimenkov A.A., Obydenkov D.O., Yakushev A.Yu., Abud K.N., Markin Yu.V. AWA: Activation-Based Weight Alignment for Robust Static Watermarking of Neural Networks. Proceedings of the Institute for System Programming, vol. 38, issue 4, part 2, 2026, pp. 225-244 DOI: 10.15514/ISPRAS-2026-38(4)-28.

Full text of the paper in pdf (in Russian) Back to the contents of the volume