A proposed watermark for spiking neural networks passed a fixed verification check for all 20 tested keys, while none of 30,000 fresh random keys passed. The largest experiment used a 215.4-million-parameter SpikeGPT checkpoint and 64-bit keys. Genuine responses matched between 55 and 62 bits, averaging 59.4. The reported false-positive rate was 0.000%, with a one-sided 95% upper bound of 0.010%.
The method, called MeMark, places a multi-bit identifier in selected neurons’ internal membrane states. These are the values used in the neurons’ firing decisions. The system recovers each bit by comparing the state with that neuron’s firing threshold, without using a learned decoder.
The pass line was fixed before the remaining genuine-key and random-key tests. Calibration found a strongest negative response of 50 matching bits out of 64, so the threshold was set at 51 matching bits. That made the test a preset pass-or-fail check rather than a score chosen after seeing the final comparisons.
Results across altered checkpoints
The identifier remained verifiable in the tested models after 200 fine-tuning steps, 90% pruning, int8 quantization and replacement of the output head. All 20 keys still met the fixed rule. Fine-tuned models lost 1.1 matching bits on average, and the weakest response was 53 bits.
The wider evaluation covered eight SNN testbeds spanning different model sizes, architectures and tasks.
Across six vision testbeds, five produced a membrane bit-error rate, or BER, of 0.00. BER is the share of recovered bits that were wrong. QKFormer had a BER of 0.0625, equivalent to one wrong bit in a 16-bit payload, while the optional output BER stayed below 0.15.
The embedding process also showed little separation from its comparison in the reported loss measure. After 2,000 embedding steps, mean validation loss was 5.0506 for 20 watermarked checkpoints and 5.0551 for equal-budget anchored controls, a difference of -0.0046.
Direct spike supervision produced a BER around 0.5, while training with a margin around the membrane threshold produced a BER of 0.00. Hard membrane reads and actual LIF spikes recovered identical bits on the 20 SpikeGPT checkpoints and 630,055 negative claims.
The signal is not proof of ownership by itself
Selecting coordinates and bits after inspecting the recurrent model produced 32/32 membrane agreement, and fitting output token pairs produced 32/32 output agreement. A matching response alone cannot establish prior ownership.
In the challenge-response test, MeMark recovered all 32 bits with the correct challenge. Mean off-trigger agreement was 0.516 across 10 keys, compared with 0.575 for a matched DICTION-style watermark.
A 128-channel structural permutation made direct membrane-index reading produce a BER of 0.438, while behavioral realignment restored the keyed coordinates. After combined modifications, recovered BER was at or below 0.031, compared with 0.531 for an unrelated model.
Attacks reveal the boundary
After 250 steps of an all-state margin attack, mean membrane BER rose from 0 to 0.0625 and output BER was 0.031. All four tested models still met the fixed 22/32 joint rule.
Rollback access produced a sharper distinction. With a 0.1% rollback budget, approximate reference checkpoints left membrane and output BER at or below 0.169 and 0.019. An exact checkpoint from immediately before embedding produced BER of 0.250 and 0.275, respectively, despite almost no change in task loss.
A coordinate-ranking attack found none of the first 64 candidates and only one of the first 512 was genuine. Synthetic triggers recovered 16 of 32 and 19 of 32 bits, and 400 removal steps left both owner responses at a BER of 0.00.
Output-only extraction marked another limit. After 1,500 distillation steps, the student’s task loss was 2.447 versus 2.442 for the teacher, while the student’s membrane and output BERs were 0.531 and 0.438. In that reported setting, the student copied the task measure closely but did not inherit the watermark.
A test of checkpoint lineage, not a universal guarantee
Taken together, the results support a narrower conclusion than a universal ownership guarantee. MeMark provided an internal verification check across the tested checkpoint modifications and architectures, but its signal could be weakened by exact rollback access or adaptive attacks and did not survive output-only transfer in the reported distillation test.
The manuscript is an arXiv preprint, version 1, dated 26 Aug 2026. The authors state that all code and results are available at their repository.
Paper data and sources
Original title: MeMark: Membrane-Space Watermarking for Spiking Neural Networks
Authors: Roberto Riaño, Gorka Abad, Stjepan Picek, Aitor Urbieta
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-26
DOI: Not available
Original paper · Full text