Unnoticeable Hybrid Watermarking for Deep Neural Network Authentication Using Auxiliary Hidden Layers

Abstract

The authentication and protection of deep neural network models have become challenging due to their widespread distribution and reuse, making them vulnerable to unauthorized access. This paper addresses the need for ownership verification by proposing a hybrid neural network watermarking method for secure model authentication. The approach combines a steganographic watermark embedded into stable model weights with a user code for watermark recovery encoded in auxiliary hidden layers. Stable parameters are identified through a reduced training to estimate gradient variations for the watermark insertion with minimal impact on model performance. Additionally, two auxiliary layers are introduced, to store in the first layer the metadata indices from the selected weights where the watermark was embedded and in the second layer the user code, supporting secure identification and verification. Experimental evaluations demonstrate that the proposed method remains robust under different model optimization attacks, including pruning, fine-tuning, additive noise injection, and parameter overwriting, while preserving model performance. The proposed framework achieves a BER = 0 under several moderate attack scenarios across different neural network models, whereas more aggressive optimizations degrade the watermark recovery performance. These results indicate that the proposed framework provides an effective solution for neural network ownership protection while maintaining the model performance.

1. Introduction

The development of artificial intelligence models based on neural networks has expanded across most research areas, facilitating their distribution and reuse. However, this situation has increased the risk of unauthorized use. Therefore, it is necessary to develop effective protection and authentication mechanisms for trained neural network models [1,2,3].

In this context, neural network protection techniques are commonly classified into white-box and black-box approaches. White-box techniques have full access to the model architecture and parameters, which are used to embed or extract ownership information [4,5,6]. In contrast, black-box approaches operate with restricted access, limiting the interaction to input–output information for model authentication [7,8,9].

Despite their effectiveness, both methods may present limited robustness and imperceptibility. Several existing methods show a performance degradation due to the embedding of ownership information. Furthermore, these techniques face some challenges during model optimizations such as fine-tuning, pruning, or quantization [10,11,12,13].

For this reason, it is necessary to develop unnoticeable watermarking methods for neural network authentication that preserve model performance while ensuring robustness. To address this challenge, this paper presents a hybrid white-box approach that combines two complementary mechanisms. First, a watermark is embedded into selected stable weights, intentionally designed to enable manipulation detection. Second, an authentication mechanism based on auxiliary hidden layers is introduced to ensure reliable ownership verification under model optimization attacks. The weight watermarking process relies on the identification of the most stable layers and weights through gradient analysis under a simulated reduced fine-tuning procedure, which allows for selecting parameters with minimal variation.

Unlike our previous work [14], which embedded ownership information by directly replacing a single bit within the IEEE 754 floating-point representation of selected weights, the proposed method adopts a structured binary decomposition of the weights and integrates auxiliary hidden layers to strengthen authentication reliability and robustness.

Specifically, two auxiliary layers are incorporated into the trained architecture. The first auxiliary layer encodes the indices of the selected stable layers and weights, for localization during the verification process without requiring gradient computation. The second auxiliary layer stores a user code generated through a modular addition (mod 2) between the binary representation of the selected weights and the watermark sequence. This hybrid design enhances robustness against neural network optimizations while preserving model performance. The main contributions of this paper consist of:

• A hybrid watermarking scheme that integrates an unnoticeable watermark embedded into stable model weights for manipulation detection, combined with a robust authentication based on auxiliary hidden layers, for ownership verification under model optimization attacks.
• An unnoticeable watermarking scheme is presented to embed ownership information into selected stable weights of the neural network, preserving the performance of the model.
• A criterion for the selection of stable layers and weights is established through a gradient-based analysis conducted under a simulated reduced training process. This approach identifies the weights and layers with minimal variation, reducing randomness in the selection process.
• Auxiliary hidden layers are incorporated into the trained architecture to encode and store the indices of the selected stable layers and weights. This design facilitates the watermark extraction during the authentication stage, contributing to improved efficiency and robustness against fine-tuning optimizations.
• A user code for authentication is embedded by means of a modular addition operation between the binary representation of the selected stable weights and the watermark. This modular encoding strategy enhances the robustness against common optimizations, including fine-tuning, pruning, noise injection, and bit overwriting.

To contextualize these contributions, the following section provides a comprehensive review of existing neural network watermarking and protection methods.

2. Literature Review

Existing approaches for neural network watermarking and protection depend on the level of model access, watermark embedding strategies, and authentication mechanisms, with a focus on robustness against different model optimizations.

Early studies have demonstrated that neural network models can be effectively manipulated for its protection even under black-box access, as presented by Leroux et al. [15], who generated embedding keys by clustering internal activations and optimizing input samples near the decision boundary. Yadollahi et al. [16] embed the watermark by introducing a trigger composed by modified input samples associated with incorrect labels. Luo et al. [17] embedded the watermark into input images using a generative adversarial network (GAN) trained with the classification model. The model is designed to recognize only the watermark embedded images. Liu et al. [18] generate unnoticeable perturbations in the Discrete Fourier Transform, combined with trigger patterns, to create dedicated watermark classes. The watermark is verified through the model response to the perturbed inputs. Li et al. [19] modify the training of the neural network to embed a watermark into the activation functions. A Power Function Mapping is applied to smooth the activations. Zhang et al. [20] embed a watermark into neural networks using a set of triggers, where each trigger encodes a single bit.

Moreover, other studies have explored watermarking schemes under white-box access using internal parameters. Bellafqira and G. Coatrieux [21] proposed DICTION to embed the watermark into the activation maps from the hidden layers. Furukawa et al. [22] proposed a weight regularization during training. Then, the watermark is embedded into the convolutional layer weights with a predefined binary pattern generated using a secret key. Zheng and Ren [23] embed the watermark information into feature maps during training using convolutional kernels. Fei et al. [24] introduce a watermarking approach for generative models that embeds ownership information during training by enforcing convergence toward a wide flat minimum through an additional watermarking loss.

Table 1. Deep learning watermarking methods summarized.

Method	Year	Model Access	Embedding Domain	Auxiliary Components	Limitations
[15]	2024	Black-box	Triggers/ Boundaries decision	Triggers	Activation functions dependency and decision boundary stability
[16]	2021	Black-box	Trigger-based behavior (implicit in weights)	Triggers	Watermark depends on trigger set design
[17]	2024	Black-box	Input data	GAN	Depends on the input data
[18]	2024	Black-box	Input data/Triggers		Limited robustness against fine-tuning, pruning, or image distortions watermark
[19]	2023	Black-box	Activation functions		Depends on PF-Mapping design
[20]	2025	Black-box	Triggers		Requires loss functions to avoid degrading the performance
[21]	2025	White-box	Activation functions and triggers	Projection network	Requires joint training and an additional network
[22]	2023	White-box	Convolutional layers		Limited watermark payload
[23]	2024	White-box	Feature maps via convolutional kernels		Requires access to activation functions and convolutional layers
[24]	2024	White-box	Wide flat minimum-based watermarking		Requires retraining of the generative model and is limited to generative architectures

Has auxiliary components Does not have auxiliary components. Most of the methods employ specific activation functions and trigger mechanisms as auxiliary elements for network protection. The incorporation of additional components such as new layers and the embedding of information within the model generates an effective model authentication.

summarizes representative neural network watermarking methods, highlighting their model access, embedding domains, use of auxiliary components, and main limitations.

3. Materials and Methods

3.1. Materials

The method was implemented on a system equipped with an Intel Core i7 processor (Intel Corporation, Santa Clara, CA, USA) and an NVIDIA GeForce RTX 4060 GPU (NVIDIA Corporation, Santa Clara, CA, USA). For the experimental setup, two approaches were considered. First, an inpainting-based segmentation model was utilized using the IMD2020 dataset [25]. Second, a classification model was trained and evaluated on the MNIST dataset to assess its performance on an image classification task. All experiments were implemented in Python v3.10 using PyTorch v2.1 and CUDA v12.1.

3.2. Proposed Deep Neural Network Authentication

The proposed method focuses on the authentication of neural networks using a hybrid watermarking scheme. An unnoticeable watermark is embedded into the most stable weights for forgery detection while auxiliary layers are employed to store user information for the authentication. Figure 1 illustrates the architecture of the proposed method. The proposed method is divided into five stages:

• Stable layers and weights extraction;
• Watermark embedding;
• User code generation;
• Auxiliary storage;
• Neural network authentication.

3.2.1. Stable Layers and Weights Extraction

To minimize the impact of watermark embedding on model performance and to ensure reliable recovery, it is crucial to select the most stable layers and weights. Weight stability is measured during training with the gradient, to identify the parameters with minimal changes. These stable weights are used for an unnoticeable watermark embedding.

For this purpose, a simulated training is performed to estimate the expected changes in the weights. A reduced dataset $X_s$ and a limited number of epochs are used in this simulation. The reduced training setup uses the same dataset as the main experiment and employs the Adam optimizer with a learning rate of 1 × 10⁻⁴, batch size of 64, and a limited training range of 1–5 epochs. During this process, the weight $w_{i,j}$ of layer $i$ is updated $w_{i,j}^{\prime }$ as in (1):

$$w_{ij}^{\prime }=w_{ij}-\eta {\displaystyle \frac{\partial L_s}{\partial w_{ij}}}$$

(1)

where η is the learning rate and L_s is the loss function that evaluates $X_s$. The stability of each weight is evaluated using its gradient g, calculated in (2), as it indicates how sensitive the weight is to changes during training. Weights with smaller gradient magnitudes have minimal changes and are considered more stable [26,27,28,29].

$$g={\displaystyle \frac{w_{ij}}{\eta }}\approx \left|{\displaystyle \frac{\partial L}{\partial w_{ij}}}\right|$$

(2)

The gradients are computed for the original trained weights and the weights for the simulated training process. To analyze parameter stability, the variation $\mathsf{\Delta }$ between the original gradient g_t and the simulated gradient g_s is calculated in (3).

$$△g=|g_s-g_t|$$

(3)

Then, the layer stability is calculated with the average gradient from the weights in (4).

$$S_i={\displaystyle \frac{1}{n_i}}{\displaystyle \sum _{j=1}^{n_i}{g}_{ij}}$$

(4)

The 74 most stable weights from the most stable layers are selected for watermark embedding. These weights are subsequently transformed into a binary representation.

3.2.2. Watermark Embedding

After selecting the stable weights, a binary representation is constructed. Unlike the IEEE-754 floating-point representation, the proposed encoding strategy does not employ exponent normalization or floating-point scaling operations. Instead, the original parameter value is represented using a structured binary encoding specifically designed for watermark embedding. This representation enables watermark insertion at predefined bit positions while preserving the numerical consistency of the original weight during the embedding and extraction processes.

Each weight is decomposed into three components: the sign bit, the integer component integer, and the binary representation of the fractional part f in (5) and (6).

$$w\to Integer.float$$

(5)

$$w\to (sign,Integer,binar{y}_{float})$$

(6)

where the sign bit $\in \{0,1\}$, and the binary vector has a length of 32 bits. The sign bit is defined in (7).

$$sign=\left\{\begin{array}{c}\begin{array}{ccc}0& if& w<0\end{array}\\ \begin{array}{ccc}1& if& w\ge 0\end{array}\end{array}\right.$$

(7)

The fractional f is quantized using 32 bits in (8):

$$d=|f\cdot 2^{32}|$$

(8)

The binary vector $b=\{b_1,b_2,\dots ,b_{32}\}$ is obtained by expressing $d$ as its binary representation. Therefore, the watermark $wm$ is embedded into the selected bit position $k\in \{1,\dots ,32\}$, defining the watermarked binary weight as b′ in (9).

$$b^{\prime }=\left\{\begin{array}{c}\begin{array}{ccc}1& if& wm=0\end{array}\\ \begin{array}{ccc}b& if& wm=1\end{array}\end{array}\right.$$

(9)

Therefore, the inverse process is applied to reconstruct the weights in their decimal form, to use them on the neural network, in (10).

$$d_r={\displaystyle \sum _{k=1}^{32}{b}_k^{\prime }}\cdot 2^{32-k}$$

(10)

Then, the float part is recovered in (11).

$$f_r={\displaystyle \frac{d}{2^{32}}}$$

(11)

Finally, the watermarked weight is obtained as

$$w_r={(-1)}^{sign}(Integer+f_r)$$

(12)

The watermark embedding process does not alter the weight distribution and preserves the original performance of the neural network.

3.2.3. User Code Generation

The user code is generated from the interaction between the watermark and the model weight parameters and is used as a model-dependent authentication element. The stable weights act as a pseudo-random sequence that is difficult to reproduce, even under identical training conditions.

The combination of the watermark $wm=\left({wm}_1,{wm}_2,\dots ,{wm}_L\right)$ and the binary stable weights $b{w}^{\prime }=({bw}_1,{bw}_2,\dots ,{bw}_L)$ creates the user code, which introduces an additional randomness. This strategy increases the robustness against model modifications while preserving network performance. In this stage, each stable weight is binarized according to its sign, as in (13).

$$b{w}^{\prime }=\left\{\begin{array}{c}\begin{array}{ccc}0& if& w<0\end{array}\\ \begin{array}{ccc}1& if& w\ge 0\end{array}\end{array}\right.$$

(13)

Thus, the user code $uc$ is generated using the addition module 2 [30,31,32], ensuring a reversible encoding, in (13) and (14):

$$uc=(b{w}_k^{\prime }+w{m}_k)\mathrm{mod}(2)\hspace{1em}k=1,\dots ,L$$

(14)

where L is the length sequence. This encoding links the watermark to the neural network model, generating an efficient authentication.

3.2.4. Auxiliary Storage

Auxiliary layers are incorporated into the trained neural network to store auxiliary authentication data. These layers are hidden in the architecture and do not interact with the inference, ensuring that the original task and performance of the network remain unaffected.

The first auxiliary layer Aux₁ encodes the indices of the stable layers $l_{i}i$ = 1, …, 4 and weights $w_{i,j}$ j = 1, …, 75 used during the watermark embedding in (15).

$$Au{x}_1=\{(l_1,w_{1,1},w_{1,2},\dots ,w_{1,75}),(l_2,w_{2,1},w_{2,2},\dots ,w_{2,75}),\dots ,(l_4,w_{4,1},w_{4,2},\dots ,w_{4,75})\}$$

(15)

The index embedding improves the robustness of the method and facilitates the localization of the watermarked weights, thereby increasing the effectiveness of the watermark extraction process. The second auxiliary layer Aux₂ is used to store the user code, eliminating the need for storage on an external device, as in (16).

$$Au{x}_2=\{u{c}_1,\dots ,u{c}_L\}$$

(16)

The introduction of auxiliary storage layers provides an efficient mechanism for preserving authentication information. Moreover, embedding information on the neural network eliminates the need for external metadata or secret files, reducing the risk of information loss or tampering. This method does not assume perfect invisibility of the auxiliary layers under unrestricted white-box access. Its security relies on the absence of explicit architectural exposure, unless there is prior knowledge of the embedding locations and retrieval procedure.

3.2.5. Neural Network Authentication

The architecture authentication process is illustrated in Figure 2 and in Algorithm 1, where the extraction of both watermarks is represented.

During the watermark extraction, the indices from the stable layers $l_i$, $i=1,\dots ,4$, and their corresponding weights $w_{(i,j)}$, $j=1,\dots ,74$ used for watermark embedding, are retrieved from the auxiliary layer, as in (17).

$$Au{x}_1=\{(l_1,w_{1,1},w_{1,2},\dots ,w_{1,75}),(l_2,w_{2,1},w_{2,2},\dots ,w_{2,75}),\dots ,(l_4,w_{4,1},w_{4,2},\dots ,w_{4,75})\}$$

(17)

For each selected stable weight, the same decomposition process used during embedding is applied to obtain its fractional component f, which is quantized using 32 bits, as shown in (5)–(8). Therefore, the watermark is obtained from the embedded bit position m, as in (18).

$$w{m}^{\prime }=b_m,\hspace{1em}m\in \{1,\dots ,32\}$$

(18)

Then, the neural network is authenticated using the user code stored in the second auxiliary layer ${\mathit{Aux}}_2$. The embedded watermark associated with the user code is retrieved by applying the inverse modulo-2 addition operation defined in (19), combining the binarized weights $b{w}^{\prime }=({bw}_1,{bw}_2,\dots ,{bw}_L)$ represented in (13) and the user code uc.

$$w{m}^{\prime }=(b{w}_k^{\prime }+u{c}_k)\mathrm{mod}(2)$$

(19)

Algorithm 1. Watermark retrieval process.

Input:   Neural network N,   stable layer indices li,   embedded bit position m,   user code uc

Output:   Recovered ownership watermark W,   recovered authentication watermark A

1: Retrieve stable layers li from Aux2 2: for each selected weight w(i,j) in li do 3:   Compute the fractional component f 4:   Quantize f using 32-bit representation 5:   Extract the embedded bit from position m 6:   Store the extracted bit into W 7: end for 8: Retrieve the binarized weights bw’ 9: Recover authentication watermark:           A = bw’ ⊕ uc 10: Return W and A

The proposed extraction procedure recovers both watermarks by reproducing the transformation steps used during embedding. Together, these mechanisms enable an accurate ownership authentication, even under common neural network optimization operations.

4. Results

This section evaluates the proposed hybrid watermarking method under different experimental scenarios to assess its effectiveness, robustness, and impact on model performance. To evaluate its applicability across different neural network models, two architectures were employed (Figure 3 and Figure 4).

The MNIST dataset was used to assess performance in an image classification task.

Additionally, the embedded watermark consists of four pseudo-random binary sequences, where each sequence contains 74 bits and is inserted into four distinct stable layers previously selected through the gradient-based stability analysis.

The auxiliary layers are intentionally disconnected from the computational graph of the neural network. They are excluded from both forward and backward propagation processes and do not participate in the inference, loss computation, or gradient-based optimization. Consequently, their presence does not interfere with the learning, convergence, or predictive performance of the model.

These layers were employed as storage structures, and their dimensionality can be flexibly defined according to the required payload size, without imposing architectural modifications or additional computational overhead on the primary network.

The accuracy was used as for the MNIST classification evaluation. In the case of the inpainting segmentation model, accuracy and mean squared error (MSE) were employed to assess forged pixel prediction. These metrics illustrate the impact of the watermark embedding and auxiliary layers on the inference performance from each neural network. Moreover, the bit error rate (BER) was used to evaluate watermark recovery from the network parameters by measuring the portion of different bits between the original and the retrieved sequences. The retrieved watermark is considered successfully recovered when the extracted sequence remains structurally identifiable with respect to the original watermark. Lower BER values indicate higher recovery fidelity and improved robustness against distortions. In the proposed framework, the recovered watermark patterns preserve recognizable structural information and remain distinguishable from unrelated watermark sequences, even under different image distortions and manipulations.

4.1. Impact of Watermark Embedding on Model Performance

To evaluate watermark imperceptibility and neural network performance, the models were analyzed before and after watermark embedding. The watermark embedding was performed using the 13-bit position to ensure a stable encoding without affecting model performance. The evaluation focuses on verifying that the proposed method does not degrade predictive accuracy while maintaining watermark integrity.

Table 2. Impact of watermark embedding on neural network performance.

Architecture	Metric	Original Performance	Watermarked Performance	$\mathbf{Difference}∆$
Classification	Accuracy	98.5%	98.5%	<0.1%
Inpainting	Accuracy	99.12%	99.10%	0.02%
	MSE	0.0087	0.0090	0.0003

summarizes the quantitative results for each architecture.

Table 2 and Figure 5 demonstrate minimal changes between the original and watermarked models. Table 2 shows that the impact of the watermark on the neural network performance is less than 0.1%. On the other hand, Figure 5 illustrates the weight distributions of the original and watermarked models. These results demonstrate the imperceptibility of the proposed watermarking method. The quantitative evaluation of the weight distribution for the original and watermarked models is presented in

Table 3. Quantitative distribution analysis.

Model	Mean (After)	Mean (Before)	Standard Deviation (After)	Standard Deviation (Before)	Wasserstein Distance
Classification	−0.0041	−0.0041	0.0399	0.0399	3.2019 × 10−7
Inpainting	−0.010	0.010	0.3599	0.3599	5.4955 × 10−9

.

Table 3 shows the preservation of the statistics from the weights of the neural networks, demonstrating that the embedding process does not perturb the parameters. The Wasserstein distance validates the comparison of the statistical distributions.

4.2. Robustness and Authentication Analysis

To assess robustness, the proposed method was evaluated under different optimization attacks.

Table 4. Robustness of proposed method.

	Inpainting Model		Classification Model
Attacks	BER (Watermark Embedded in Stable Weights)	BER (Watermark Recover from the User Code)	BER (Watermark Embedded in Stable Weights)	BER (Watermark Recover from the User Code)
No attack	0	0	0	0
Fine-tuning 5 epochs	0.24	0	0.11	0
Fine-tuning 40 epochs	0.23	0	0.18	0
Gaussian noise addition σ = 0.02	0	0	0	0
Gaussian noise addition σ = 0.09	0.11	0.47	0.53	0.51
Pruning 20%	0	0	0	0
Pruning 25%	0	0	0	0
Pruning 30%	0.11	0.47	0	0
Pruning 40%	0.38	0.55	0.52	0.53
LSB bit overwriting	0	0	0	0
Quantization int 16	0	0	0	0
Quantization int 8	0.44	0.56	0.37	0.49

presents the watermark recovery and authentication performance, evaluated in terms of the BER defined as in (20):

$$BER={\displaystyle \frac{1}{N}}{\displaystyle \sum _{i=1}^N(w_i\oplus w_i^{\prime })}$$

(20)

where w and w’ are the original watermark and the retrieved watermark, respectively. Additionally, $\oplus$ represents an XOR operation. The authentication is determined by the watermark retrieval error, where lower BER values indicate a successful recovery and values approaching 0.5 correspond to random reconstruction and failed authentication. The verification is performed directly at the bit-reconstruction level.

Table 4 evaluates the robustness of the two proposed authentication mechanisms independently. The watermark embedded into the selected stable weights is employed for ownership verification, while the user code stored in the auxiliary layers is designed for user authentication and traceability.

The results present the recovery performance of both watermarks under different optimization attacks, evaluated on two different neural network architectures. As expected, the watermark embedded into the selected stable weights is sensitive to parameter modifications, which increase the BER under fine-tuning, pruning, and Gaussian noise injection.

In contrast, the watermark from the user code is recoverable across most optimization attacks, exhibiting a low BER and reliable authentication. However, for pruning rates above 25%, the recovery of the robust watermark may degrade, since the removal of weights involved in the user code generation can compromise the watermark reconstruction. Finally, LSB bit overwriting does not significantly affect watermark recovery, as this manipulation introduces minimal variations in the weight parameters and does not interfere with watermark retrieval.

For a more explicit interpretation of watermark reconstruction performance,

Table 5. Detailed bit-level evaluation of watermark extraction performance.

	No Attack	Pruning 20%	Pruning 35%	Quantization Int 16	Quantization Int 8
TP	74	74	41	74	46
TN	0	0	0	0	0
FP	0	0	0	0	0
FN	0	0	33	0	28

additionally reports the number of correctly and incorrectly recovered bits under different attack scenarios.

Figure 6 illustrates the impact of the learning rate during fine-tuning on watermark recovery in both models. In the classification network, the watermark shows a high initial BER of 0.44 for a learning rate of 0.001 and the watermark recovery BER decreases when the learning rate is lower. The robust watermark, however, achieves complete recovery (BER = 0) under moderate learning rates. In the inpainting model, the watermark remains stable with a BER recovery of 0.23–0.24 across all learning rates. Overall, these results highlight the proposed hybrid scheme.

4.3. Payload Capacity

The payload capacity of the proposed watermarking technique is evaluated by changing the amount of embedded information and the number of layers used for insertion. The assessment considers both the impact on model accuracy and the robustness of watermark recovery under different insertion configurations.

Table 6. Payload capacity analysis and watermark recovery performance.

Watermarked Layers	Watermarked Weights per Layer	Performance	BER (Watermark Embedded in Stable Weights)	BER (Watermark Recover from the User Code)
5 layers	74	Accuracy = 99.10% MSE = 0.0090	0	0
6 layers	74	Accuracy = 99.10% MSE = 0.0090	0	0
10 layers	74	Accuracy = 99.10% MSE = 0.0090	0	0

illustrates the impact of increasing the watermark payload on model performance maintaining a stable performance accuracy, indicating that the information embedding does not affect the learned representations. Furthermore, both watermarks remain detectable and recoverable, achieving a BER of 0 across all evaluated configurations. These results demonstrate that the proposed method supports higher embedding capacities without compromising performance or recoverability.

The number of selected stable weights is determined by the payload size required for watermark embedding. Consequently, the proposed framework can be adapted to different embedding capacities; the only condition is that the selected layers contain a sufficient number of stable parameters for reliable information storage.

4.4. Method Comparison

The effectiveness of the proposed hybrid watermarking scheme is evaluated through a comparative analysis with representative methods reported in the literature. The comparison considers the watermark embedding strategy, payload capacity, robustness against common optimization attacks, and watermark recovery performance. This analysis highlights the advantages of the proposed method in terms of watermark detection and ownership authentication.

Table 7. Comparative analysis of the proposed and existing methods.

Author	Method	Dataset	Payload	Baseline Performance	Resistance to Optimization Attacks
Li et al. [17]	Black box	CIFAR10 and Fashion MNIST	1–10 bits	BER = 0.08	Fine-tuning Quantization
Bellafqira and G. Coatrieux [20]	White box	Caltech 101, CIFAR 10 and CIFAR 100	256 bits	BER = 0	Fine-tuning Overwriting
Furukawa and Sakazawa [21]	White box	CIFAR10 and MNIST	64 bits	Error = 4 bits	---
Fei et al. [23]	White box	Not mention	100 bits	Accuracy = 96.8%	Fine-tuning
Proposed Method	White box	MNIST and IMD2020 dataset	296–740 bits	BER = 0	Fine-tuning Gaussian noise injection Pruning Overwriting

presents a comparison between existing neural network watermarking methods and the proposed approach in terms of payload capacity, baseline performance, and robustness against optimization attacks. Most existing methods are evaluated exclusively on classification models, particularly using the MNIST dataset, which limits the assessment of their generalization across different tasks and architectures. In contrast, this work was evaluated on two distinct models: one for image classification and another for segmentation. This experimental validation demonstrates adaptability and applicability across different architectures and objectives.

The compared methods are evaluated on different datasets, including, which vary in complexity, resolution, and domain characteristics. However, in the proposed approach, the watermark is embedded directly into model parameters. Therefore, dataset differences do not significantly affect the embedding or extraction performance in our method.

The proposed method achieves a higher payload capacity (296–740 bits) while preserving stable inference performance. In addition, a BER of 0 is obtained for watermark recovery under baseline conditions. Moreover, it shows robustness against fine-tuning, Gaussian noise injection, pruning, and bit overwriting attacks.

Nevertheless, the method is sensitive to quantization. Since the watermark is embedded at the bit level of floating-point weights, quantization may remove or alter the modified bits by changing the numerical precision and binary representation of the parameters, which can make the watermark recovery difficult.

5. Discussion

The experimental results highlight the effectiveness of the proposed hybrid watermarking method for neural networks. The watermark embedded in stable weights exhibits high sensitivity to optimizations, such as fine-tuning, pruning, and noise injection. In contrast, the watermark from the user code embedded into the auxiliary layer demonstrates a consistent retrieval process across different optimizations, ensuring an efficient ownership verification. This design preserves accuracy and the model performance. Furthermore, the payload can be increased without performance degradation.

However, the sensitivity to quantization exposes a limitation of bit-level watermarking in floating-point representations. Since quantization modifies the precision and binary structure of weights, it may disrupt the embedded information. Overall, the results demonstrate that the proposed method provides a balanced and effective solution for neural network ownership authentication, although further improvements are required. Future work will focus on the design of adaptive and structure embedding strategies to enhance robustness against quantization, as well as extend the evaluation to large architectures and adversarial optimized environments. Embedding information in numerically stable regions of the floating-point format, it may be possible to increase robustness over conventional direct bit-level modification.

6. Conclusions

This work proposes a neural network protection method based on a hybrid watermarking strategy. The watermark is embedded directly into selected model weights, while the indices of the modified layers and parameters are stored in an auxiliary layer in parallel. On the other hand, the second watermark is implemented by storing a user code in a second auxiliary layer. This user code is generated by combining the watermark sequence with the binarized weights according to their sign, enabling consistent and model-dependent ownership verification.

Experimental results demonstrate that the proposed method achieves a BER of 0 for the user code watermark recovery under common optimization procedures, including fine-tuning, pruning, Gaussian noise injection, and LSB bit overwriting. Furthermore, increasing the payload does not degrade the inference performance of the model, confirming that the embedded information does not interfere with learned representations or training dynamics.

The approach also demonstrates generality by being validated on two different neural network architectures designed for distinct tasks, showing consistent behavior in terms of imperceptibility, robustness, manipulation detection, and watermark recovery. However, sensitivity to quantization is observed, since modifications in the binary representation of floating-point weights may compromise watermark reconstruction. Since quantization modifies the precision and binary structure of weights by modifying the embedded information. Future work will focus on the design of adaptive and structure embedding strategies to enhance robustness against quantization. Embedding information in numerically stable regions of the floating-point format, it may be possible to increase the robustness over conventional direct bit-level modification.