NeuralMark: Multifaceted Marking in Neural Systems

• NeuralMark is a family of methods that embed secret or learned marks into neural and stochastic representations to enable ownership verification and network analysis.
• It spans diverse applications including weight-based DNN watermarking, NeRF copyright protection, audio watermarking, connectomics hub detection, and cosmological statistics.
• The framework balances security, robustness, and interpretability by tailoring marks to specific neural representations and threat models.

Searching arXiv for papers on "NeuralMark" and closely related usages to ground the article in current literature. NeuralMark is a polysemous term in recent arXiv literature. In its most specific use, it denotes a white-box, weight-based neural network watermarking method built around a hashed watermark filter for ownership verification (Yao et al., 15 Jul 2025). In broader usage, closely related “NeuralMark” or “NeuralMark-style” constructions appear in connectomics as a Markov-based framework for defining brain-network hubs (Murty et al., 2024), in NeRF copyright protection through secret-view watermark extraction (Chen et al., 2023), in audio watermarking through codec-latent directional shifts robust to neural resynthesis (Chen et al., 5 Mar 2026), in cosmology as a learnable marked statistic for extracting non-Gaussian information (Semenzato et al., 9 Jun 2026), and in marked Hawkes modeling via explicit neural kernels over elapsed time and marks (Joseph et al., 2024). This suggests that NeuralMark is best understood not as a single canonical algorithm but as a family of methods in which a learned, secret, or physically motivated “mark” is coupled to a neural or stochastic representation.

1. Terminological scope and shared idea

Across these literatures, a “mark” is not a uniform object. It can be a binary watermark tied to a secret key, a scalar field reweighting a cosmological density, a stationary probability used to rank neural hubs, a latent-space directional bias, or an event attribute entering a marked point-process kernel. The common structure is the use of an additional signal that changes how a system is represented, queried, or interpreted.

Domain	Meaning of the mark	Representative paper
Weight-based NNW	Hashed binary watermark filtering model parameters	(Yao et al., 15 Jul 2025)
NeRF protection	Secret-perspective watermark decoded from a rendered view	(Chen et al., 2023)
Audio watermarking	Detectable latent directional shift in neural codecs	(Chen et al., 5 Mar 2026)
Connectomics	Stationary distribution score defining hubs	(Murty et al., 2024)
Cosmology	Learnable scalar field $M(\mathbf{x})$ reweighting density	(Semenzato et al., 9 Jun 2026)
Marked Hawkes	Event mark $m$ entering $\phi_{dj}(t,m)$	(Joseph et al., 2024)

A common misconception is that NeuralMark necessarily refers to copyright watermarking. Current usage does not support that restriction. In some papers the mark is explicitly cryptographic or forensic, while in others it is a statistical weighting, a spectral centrality score, or a continuous event attribute. Another misconception is that a mark must be opaque. Several of these works are explicitly designed to preserve interpretability rather than replace it with a black-box latent representation.

2. NeuralMark as hashed-filter watermarking for neural networks

In the most direct sense, NeuralMark is a weight-based white-box watermarking method for deep neural networks that addresses forging and overwriting attacks by using a hashed watermark as a private filter over parameters (Yao et al., 15 Jul 2025). The owner chooses a secret key matrix $\mathbf{K} \in \mathbb{R}^{k \times n}$ and derives a binary watermark

$$\mathbf{b} = \mathcal{H}(\mathbf{K}) \in \{0,1\}^n,$$

with SHAKE-256 used in the experiments. Instead of embedding across all selected parameters, NeuralMark repeatedly filters a flattened weight vector $\mathbf{w}$ using the bits of $\mathbf{b}$. After $R$ filtering rounds, the surviving vector $\mathbf{w}^{(R)}$ is average-pooled to $\widetilde{\mathbf{w}}$, and watermark extraction is performed as

$m$0

where $m$1 is the sigmoid. Training minimizes

$m$2

so the watermark is embedded jointly with the main task.

The key innovation is that the watermark determines its own embedding domain. Because different keys generate independent hashed filters, an attacker’s counterfeit watermark tends to act on a largely disjoint subset of parameters. This directly targets the two principal weaknesses of earlier weight-based schemes: forging, in which an attacker fabricates an alternative valid key-watermark pair without changing weights, and overwriting, in which the attacker retrains the stolen model to erase the original watermark while preserving utility. NeuralMark’s verification rule uses the watermark detection rate

$m$3

with threshold $m$4 for $m$5. Under the paper’s random-oracle analysis, the probability that a forged watermark reaches this threshold is bounded by

$m$6

and for $m$7, $m$8, this yields a forging probability below $m$9 (Yao et al., 15 Jul 2025).

Empirically, the method is evaluated across 13 distinct Convolutional and Transformer architectures, five image classification tasks, and one text generation task. Utility degradation is small: for example, on CIFAR-100 with ResNet-18, clean accuracy is $\phi_{dj}(t,m)$0 and NeuralMark reaches $\phi_{dj}(t,m)$1; on E2E with GPT-2-S, BLEU changes from $\phi_{dj}(t,m)$2 to $\phi_{dj}(t,m)$3. Watermark detection is $\phi_{dj}(t,m)$4 before attacks. Under forging attacks on ResNet-18 for CIFAR-10 and CIFAR-100, NeuralMark yields detection rates around $\phi_{dj}(t,m)$5 to $\phi_{dj}(t,m)$6, close to random guessing and well below the security boundary, whereas VanillaMark and VoteMark reach $\phi_{dj}(t,m)$7, indicating complete forging success in those baselines. Under overwriting with attacker embedding strength $\phi_{dj}(t,m)$8, NeuralMark retains $\phi_{dj}(t,m)$9 owner detection where competing methods fall to $\mathbf{K} \in \mathbb{R}^{k \times n}$0, $\mathbf{K} \in \mathbb{R}^{k \times n}$1, and $\mathbf{K} \in \mathbb{R}^{k \times n}$2 in a CIFAR-100$\mathbf{K} \in \mathbb{R}^{k \times n}$3CIFAR-10 setting. Fine-tuning and pruning experiments show that realistic attacks fail to remove the watermark without unacceptable utility loss, and average pooling materially improves robustness under these transformations (Yao et al., 15 Jul 2025).

The principal practical characteristics of this version of NeuralMark are therefore white-box verification, cryptographic binding between key and watermark, attack resistance through parameter-subset isolation, and low overhead. On CIFAR-100 with ResNet-18, average epoch time is $\mathbf{K} \in \mathbb{R}^{k \times n}$4 s for NeuralMark versus $\mathbf{K} \in \mathbb{R}^{k \times n}$5 s for clean training, substantially below GreedyMark and VoteMark (Yao et al., 15 Jul 2025).

3. NeuralMark-style watermarking in generative and media models

The watermarking literature uses NeuralMark-like ideas beyond weight space. "MarkNeRF:Watermarking for Neural Radiance Field" implements copyright verification for implicit 3D models by embedding watermarks into training images, training a NeRF on those watermarked images, and later extracting the watermark from a secret viewpoint in a black-box setting (Chen et al., 2023). The pipeline consists of an embedding network $\mathbf{K} \in \mathbb{R}^{k \times n}$6, noise-layer simulation using Gaussian, salt-and-pepper, speckle, and Poisson noise, NeRF training on watermarked images, a secret camera parameter $\mathbf{K} \in \mathbb{R}^{k \times n}$7, and an extraction network $\mathbf{K} \in \mathbb{R}^{k \times n}$8 that reconstructs the watermark only from the secret-view image $\mathbf{K} \in \mathbb{R}^{k \times n}$9. The embedding network uses a shallow ConvNet with dense-like concatenations, and the extractor uses a similarly shallow over-parameterized ConvNet. The method treats camera parameters as the trigger and the rendered secret view as a backdoor image. In NeRFSynthetic experiments, embedded-image imperceptibility ranges from $$\mathbf{b} = \mathcal{H}(\mathbf{K}) \in \{0,1\}^n,$$0 to $$\mathbf{b} = \mathcal{H}(\mathbf{K}) \in \{0,1\}^n,$$1 dB in PSNR and from $$\mathbf{b} = \mathcal{H}(\mathbf{K}) \in \{0,1\}^n,$$2 to $$\mathbf{b} = \mathcal{H}(\mathbf{K}) \in \{0,1\}^n,$$3 in SSIM across scenes; extracted watermarks from the secret viewpoint reach PSNR $$\mathbf{b} = \mathcal{H}(\mathbf{K}) \in \{0,1\}^n,$$4 to $$\mathbf{b} = \mathcal{H}(\mathbf{K}) \in \{0,1\}^n,$$5 dB and SSIM $$\mathbf{b} = \mathcal{H}(\mathbf{K}) \in \{0,1\}^n,$$6 to $$\mathbf{b} = \mathcal{H}(\mathbf{K}) \in \{0,1\}^n,$$7. Secret-view selectivity is sharp: at angular deviation $$\mathbf{b} = \mathcal{H}(\mathbf{K}) \in \{0,1\}^n,$$8, extraction reaches PSNR $$\mathbf{b} = \mathcal{H}(\mathbf{K}) \in \{0,1\}^n,$$9 dB and SSIM $\mathbf{w}$0, while at larger deviations PSNR drops toward $\mathbf{w}$1–$\mathbf{w}$2 dB and SSIM toward $\mathbf{w}$3–$\mathbf{w}$4, so adjacent views do not reliably reveal the watermark (Chen et al., 2023).

"Latent-Mark: An Audio Watermark Robust to Neural Resynthesis" frames audio watermarking in an explicitly NeuralMark-style zero-bit setting, but relocates the mark from waveform perturbations to codec-invariant latent space (Chen et al., 5 Mar 2026). The core statistic is the mean latent projection

$\mathbf{w}$5

where $\mathbf{w}$6 is the codec latent and $\mathbf{w}$7 is a secret watermark direction. Embedding optimizes a waveform perturbation $\mathbf{w}$8 so that $\mathbf{w}$9 exceeds a target margin, using a hinge loss with $\mathbf{b}$0, $\mathbf{b}$1, 150 Adam steps, and dynamic perturbation budgets derived from target SDR. The multi-codec extension performs cross-codec optimization over surrogate codecs, using $\mathbf{b}$2 kHz, padding to multiples of 4096 samples, $\mathbf{b}$3, $\mathbf{b}$4, and $\mathbf{b}$5, then aggregates detector outputs by the median normalized margin. The main empirical result is a shift from near-total failure of prior methods under neural resynthesis to strong survivability: after a single SNAC pass, WavMark and SilentCipher fall to $\mathbf{b}$6, AudioSeal is at most $\mathbf{b}$7 on the reported datasets, Latent-Cluster typically attains $\mathbf{b}$8–$\mathbf{b}$9 survivability, and Latent-Joint $R$0–$R$1. The method remains competitive under standard DSP attacks and is nearly indistinguishable from original audio in UTMOS, while SI-SNR degradation is modest (Chen et al., 5 Mar 2026).

Taken together, these systems extend NeuralMark-like watermarking along three orthogonal axes: parameter-space embedding in white-box DNN verification, output-conditioned secret-trigger verification in NeRFs, and zero-bit latent-statistic detection robust to neural codecs in audio. The shared strategy is to move the mark into whichever representation the threat model is least able to erase cheaply: hashed parameter subsets, secret viewpoints, or codec latents.

4. NeuralMark as a Markov framework for neural hubs

In connectomics, NeuralMark denotes a Markov-based framework for defining hubs in directed brain networks rather than a watermark (Murty et al., 2024). The brain or connectome is modeled as a finite directed graph $R$2, with a row-stochastic Markov matrix $R$3 attached to edges. In the simplest discrete-time construction,

$R$4

when $R$5, and $R$6 otherwise, though the formulation also allows weighted transition probabilities tied to synaptic strengths. For continuous time, a differentiable transition matrix $R$7 satisfies

$R$8

with stationary distribution $R$9 defined by $\mathbf{w}^{(R)}$0. The central postulate is that brain-network hubs are the nodes with largest stationary probabilities $\mathbf{w}^{(R)}$1, so hub detection reduces to solving

$\mathbf{w}^{(R)}$2

This construction is explicitly linked to eigenvector centrality and PageRank-type reasoning, but it is formulated for directed graphs and extended to continuous time. In the paper’s C. elegans example, the $\mathbf{w}^{(R)}$3 connectivity matrix is converted to a Markov matrix, and only two neurons, PVCL and PVCR, receive non-zero stationary probabilities, each approximately $\mathbf{w}^{(R)}$4. These neurons are interneurons involved in forward locomotion and harsh tail touch response, and both belong to a set of 12 critical neurons identified independently by vulnerability-based analysis. The same framework also yields a new spectral bound for global graph geometry. If $\mathbf{w}^{(R)}$5 is the maximal absolute value of the nontrivial eigenvalues of $\mathbf{w}^{(R)}$6, and $\mathbf{w}^{(R)}$7 is an eigenvector matrix with condition number $\mathbf{w}^{(R)}$8, then for every node the eccentricity is bounded by

$\mathbf{w}^{(R)}$9

and the same expression bounds both graph diameter and radius. The interpretation given is that rapid Markov mixing and strong hubs imply short effective path lengths, connecting hubness, communication efficiency, and small-world or expander-like structure in neural systems (Murty et al., 2024).

This usage differs sharply from the watermarking sense of NeuralMark. Here the “mark” is not an ownership token but a Markovian weighting of neural states, with the stationary distribution serving as a functional measure of hubness.

5. NeuralMark in cosmological marked statistics

In cosmology, NeuralMark refers to a learnable, interpretable mark $\widetilde{\mathbf{w}}$0 applied to the matter density field to fold non-Gaussian information back into two-point statistics (Semenzato et al., 9 Jun 2026). Starting from density contrast $\widetilde{\mathbf{w}}$1, the mean-centered marked field is

$\widetilde{\mathbf{w}}$2

The resulting summaries are the auto- and cross-power spectra

$\widetilde{\mathbf{w}}$3

which depend on higher-order moments because $\widetilde{\mathbf{w}}$4 is nonlinear in the field. Classical baselines use

$\widetilde{\mathbf{w}}$5

but NeuralMark generalizes this with learnable, physically structured local features.

The architecture is explicitly interpretable. The density field is filtered with learned radial spherical-harmonic filters $\widetilde{\mathbf{w}}$6 for $\widetilde{\mathbf{w}}$7, producing $\widetilde{\mathbf{w}}$8, and then reduced to rotation-invariant scalar channels $\widetilde{\mathbf{w}}$9, $m$00, $m$01, and $m$02. The mark is assembled as

$m$03

with independent MLPs $m$04 and a cross-term $m$05. Training uses a contrastive objective that aligns marked summaries with cosmological parameters while orthogonalizing the marked embedding against the unmarked power-spectrum embedding, so the learned mark is rewarded only for complementary information. The paper uses 5,000 Quijote BSQ simulations spanning broad priors in $m$06, $m$07, $m$08, $m$09, and $m$10, and reports a full training run of about 3 hours on a single NVIDIA GH200 GPU.

At $m$11, NeuralMark tightens marginalized Fisher constraints on $m$12 by $m$13 and on $m$14 by $m$15 relative to the best classical mark, and reduces parameter MSE by up to $m$16 over that baseline. The first two principal components of the learned latent space align with $m$17 and $m$18, and retrieval performance reaches $m$19 and $m$20, far above random baselines. Morphologically, the learned mark is dominated by the isotropic $m$21 channel, while anisotropic channels $m$22, $m$23, and $m$24 contribute refinements at boundaries and in elongated structures. This makes NeuralMark a physically interpretable extension of classical marked statistics rather than a generic field-level black box (Semenzato et al., 9 Jun 2026).

6. Related marked-process formulations and unifying themes

A further related usage appears in "Non-Parametric Estimation of Multi-dimensional Marked Hawkes Processes" (Joseph et al., 2024). There the central object is a marked conditional intensity

$m$25

and the paper introduces two neural parameterizations of $m$26: Shallow Neural Hawkes with marks for excitatory kernels and Neural Network for Non-Linear Hawkes with Marks for signed kernels. Each kernel is represented by a two-layer feed-forward network over elapsed time and mark, preserving the Hawkes decomposition while remaining fully non-parametric in functional form. The paper emphasizes that this preserves interpretability, because one can inspect how a past event of dimension $m$27 and mark $m$28 changes the future intensity of dimension $m$29. Synthetic experiments recover known ground-truth kernels, and a 4D cryptocurrency order-book analysis on Binance BTC-USD and ETH-USD market orders reveals mark-dependent self- and cross-excitation patterns, such as increasing self-excitation with volume for both ETH dimensions and strong cross-excitation from buy ETH-USD to sell BTC-USD (Joseph et al., 2024).

Taken together, these papers support a broad but coherent interpretation of NeuralMark. A mark may be a cryptographically generated selector, a secret trigger, a latent directional statistic, a Markov stationary weight, a cosmological reweighting field, or an event attribute. The recurring design pattern is to augment a neural, spectral, or stochastic system with an auxiliary structured signal that changes what is detectable, inferable, or controllable. This suggests a useful editor’s term: “marked representation learning”—the use of learned or secret marks to expose otherwise inaccessible structure. In watermarking, the inaccessible quantity is ownership under adversarial manipulation; in connectomics, it is hubness in directed flow; in cosmology, it is non-Gaussian information beyond the power spectrum; in marked Hawkes models, it is the dependence of excitation on event magnitude.

The literature also divides cleanly along verification and interpretability lines. NeuralMark in weight-based DNN watermarking is white-box and cryptographic (Yao et al., 15 Jul 2025); MarkNeRF is black-box and trigger-based (Chen et al., 2023); Latent-Mark is zero-bit and codec-latent (Chen et al., 5 Mar 2026). By contrast, the connectomics, cosmology, and Hawkes usages are not ownership mechanisms at all, but methods for defining, learning, or estimating marked structures that remain explicitly interpretable (Murty et al., 2024). The principal unresolved issue across these domains is therefore not a single technical bottleneck, but the absence of a standardized definition. “NeuralMark” currently denotes a family resemblance rather than a settled formal class.