MeMark: Membrane-Space Watermarking for Spiking Neural Networks

As Spiking Neural Networks (SNNs) become more common as pretrained backbones, they are increasingly vulnerable to unauthorized reuse. Traditional watermarking methods for SNNs often rely on verifying model outputs, which is ineffective if an attacker replaces the final task-specific layers (the output head). This paper asks: can we embed a watermark directly into the internal spiking dynamics of an SNN so that it survives even if the output head is discarded?

The authors introduce MeMark, a white-box watermarking scheme that embeds a multi-bit identifier into the internal membrane potentials of Leaky Integrate-and-Fire (LIF) neurons. By selecting specific neurons and time steps, the owner trains the model so that, given a secret input, the membrane potential of these neurons is pushed to a specific side of their firing threshold. Verification is straightforward: the owner provides the secret input and checks if the membrane potentials are above or below the threshold. Because the firing threshold is a fundamental property of the LIF neuron, no learned decoder or external projection is needed to recover the watermark.

MeMark demonstrates high robustness across various architectures, including recurrent, convolutional, residual, and transformer-based SNNs. In experiments with a 215.4M-parameter SpikeGPT model, the authors successfully embedded 20 independent 64-bit keys. All protected checkpoints passed the verification rule, while 30,000 random keys failed. The watermark remained intact after significant modifications, including 90% weight pruning, int8 quantization, fine-tuning, and complete replacement of the output head. The authors also provide a timestamped commitment mechanism to prevent false ownership claims, where an attacker might otherwise attempt to fit a key to an existing, unwatermarked model.