Dual-locking method secures AI models with PIN and permutation keys
Dual-Locking Learned AI Models: A PIN-Based Sparse QIM Watermarking and Adaptive Index Permutation Approach
Cryptography and SecurityArtificial Intelligence
Summary
AI models can be copied or misused, so protecting them is important. The authors developed a locking system that scrambles parts of the model with secret keys and embeds a secret PIN-based watermark inside it. Without the right keys, the model doesn’t work well, but applying the correct keys fully restores its abilities. The hidden watermark also proves who owns the model without harming its accuracy. This method was tested on various image recognition AI models and datasets.
What this means in practice
- •For ai model developers: Protect pretrained AI models from unauthorized use by locking them with secret PINs and scrambled indices while enabling full recovery with correct keys.
- •For enterprise ai security teams: Authenticate AI model ownership and integrity using embedded PIN-based watermarks that can be verified without altering model behavior.
Authors
Iva Vasic, Jesús Muñoz-Cádiz, Bata Vasic
Abstract
We present a dual-locking method for securing trained neural networks that combines key-driven index permutation with PIN-based watermarking based on Sparse Quantization Index Modulation (QIM). Cryptographic randomness is introduced by independently applying a uniform random permutation to each row of adaptively selected index vectors. A robust blind binary watermark is then embedded into the bias coefficients by modulating their quantized values, binding the network to a user-defined Personal Identification Number (PIN). Without the correct key, the network retains its architecture but becomes functionally impaired due to disrupted internal representations. Inverse permutation fully restores the original model accuracy, while the embedded watermark remains imperceptible and enables blind verification of key association and model authorship. To improve both locking effectiveness and recoverability, an adaptive key selection strategy redistributes high-magnitude weights to low-sensitivity positions and vice versa, increasing degradation in the locked state while preserving full recovery. Experiments on MNIST, CIFAR-10/100, and ImageNet-1K using fully connected networks, ResNet CNNs, and transformer architectures show that locking reduces accuracy below 10\%, and even below 0.5\% for CNNs, while the correct key fully restores performance. The watermark introduces no measurable accuracy degradation and reliably authenticates ownership. Analysis of embedding distributions across CNNs and transformers further indicates potential diagnostic value for identifying undertrained or suboptimally designed models. The proposed approach therefore provides simultaneous model protection, recovery, and ownership verification.