Dual-Locking Learned AI Models: A PIN-Based Sparse QIM Watermarking and Adaptive Index Permutation Approach

Abstract

We present a dual-locking method for securing trained neural networks, combining key-driven index permutation with personal identification number (PIN)-based watermarking via sparse quantization index modulation (QIM). To incorporate cryptographic randomness into the locking mechanism, we independently apply a uniform random permutation to every row of the adaptively selected index vectors. The second stage embeds a robust, blind binary watermark into the bias coefficients, modulating its quantized values, and binding the network to a user-defined PIN. Without the correct key, the network retains its architecture, but becomes functionally impaired due to disrupted internal representations. Unlocking is achieved through inverse permutation, fully restoring model accuracy. Simultaneously, the embedded watermark remains imperceptible, concealed within the host bias structure without affecting functionality. Upon extraction, it verifies the key association and confirms model authorship. To enhance both robustness and recoverability, we apply an adaptive key selection strategy that redistributes high-magnitude weights to low-sensitivity positions and vice versa. This maximizes degradation when locked, while ensuring full recovery when unlocked. Experiments on MNIST, CIFAR-10/100, and ImageNet-1K using fully connected networks, ResNet convolutional neural networks (CNNs), and transformer architectures demonstrate that our method sharply reduces accuracy when locked to below 10% and even 0.5% for CNNs, while fully restoring it with the correct key. The embedded watermark does not degrade performance and reliably authenticates ownership. Embedding analysis across transformers and CNNs reveals the method’s diagnostic potential, where characteristic shifts in embedding distributions may indicate undertraining or suboptimal design. Overall, this approach offers strong protection and traceability for neural network models.