Watermarking Kolmogorov-Arnold Networks for Emerging Networked Applications via Activation Perturbation

Chia-Hsun Lu; Chih-Ya Shen; Guan-Jhih Wu; Ya-Chi Ho

REVIEW 4 major objections 4 minor 21 references

Watermarking Kolmogorov-Arnold Networks for Emerging Networked Applications via Activation Perturbation

T0 review · 4 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read KAN models can be watermarked by perturbing layer-0 activations with a DCT signal, and the mark survives pruning and retraining.

desk verdict A plausible first KAN-specific watermarking method, but the central robustness claim is undercut by chance-level results on Fashion MNIST after pruning/retraining, and the method is not reproducible as written. read the letter →

arxiv 2508.06676 v1 pith:VGE3XSPI submitted 2025-08-08 cs.LG

Chia-Hsun Lu , Guan-Jhih Wu , Ya-Chi Ho , Chih-Ya Shen This is my paper

classification cs.LG

keywords modelwatermarkingKolmogorov-ArnoldNetworksactivationperturbationdiscretecosinetransformintellectualpropertyprotectionfine-tuningattackpruningretrainingafter

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a Kolmogorov-Arnold Network (KAN) can be watermarked by perturbing the outputs of its first learnable activation layer in the frequency domain, using the Discrete Cosine Transform. The proposed method, DCT-AW, is intended to be task-independent: it works for classification and regression because it does not rely on task-specific trigger samples or output labels. The paper further claims that this activation-level mark survives common removal attacks, including fine-tuning, pruning, and retraining after pruning, better than existing DNN watermarking methods transplanted onto KAN. If true, KAN model owners could verify ownership after an attacker has modified the model, with only a small measured change in the model's main-task performance.

What carries the argument

The load-bearing object is the perturbation rule $y' = \mathrm{IDCT}(\mathrm{DCT}(y) + P)$ applied to layer-0 activation outputs, where DCT is the Discrete Cosine Transform and $P$ is a fixed watermark signal in the frequency domain; this is what lets the mark be injected into learnable activation functions without task data. The second component is a three-layer MLP detector, trained on layer-0 activation outputs from watermarked and clean models with shuffling as augmentation, that classifies any suspect model's activations as watermarked or not. Layer 0 is chosen as the embedding site because earlier layers have weaker influence on the final output, so the perturbation preserves main-task

What would settle it

Train a KAN with DCT-AW, apply retrain-after-pruning, then run the trained detector on layer-0 activations from an unrelated KAN that was never watermarked and measure the false-positive rate; if the detector labels unrelated models as watermarked at rates near the reported attack-detection rates, the verification does not distinguish ownership. A second check is to replace the fixed perturbation $P$ with random frequency values and see whether the detection transfer remains, which would indicate the detector is keying on a generic artifact rather than the owner's specific signal.

Watch

Extended reading notes

Core claim

The paper's central claim is that embedding a fixed frequency-domain perturbation into the layer-0 activation outputs of a KAN, via $y' = \mathrm{IDCT}(\mathrm{DCT}(y) + P)$, creates a detectable watermark that is independent of the downstream task and resistant to pruning-based removal. During training, the model first trains normally on its task and then updates the layer-0 activation parameters toward the perturbed outputs, so the signal becomes part of the learned activations rather than a separate trigger set. Verification is done with a small binary MLP detector trained only on activation outputs of the watermarked model versus a clean model, with shuffled variants as data augmentation

Load-bearing premise

The load-bearing premise is that a fixed perturbation $P$, which the paper never specifies, can be imposed on layer-0 activation outputs and then detected by a detector trained only on pristine clean versus watermarked activations, even after the suspect model has been pruned, fine-tuned, or retrained.

Editorial extensions

If this is right

If DCT-AW works as claimed, KAN-based models in networked applications can carry an ownership mark without needing task-specific trigger samples or label modifications.
A watermarked KAN would remain verifiable after an attacker fine-tunes it with a large learning rate, prunes 60% of parameters, or prunes and retrains, the three attacks in the paper's evaluation.
The same embedding procedure applies to regression tasks, where trigger-set and decision-boundary methods are hard to use, because the mark lives in activations rather than in output labels.
Because the watermark is embedded in layer-0 activation functions, it can be verified even when the model's downstream task head or output distribution changes, as long as the KAN layers are preserved.
The method's task independence would allow a single watermarking pipeline to protect KAN models across classification, regression, and future task types.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper does not report false-positive rates on unattacked or unrelated KANs, so an immediate follow-up is to measure whether the detector's transfer after attacks also flags models that were never watermarked.
Because the watermark signal $P$ is added to frequency components before the inverse transform, an attacker who knows the embedding rule could try to estimate or overwrite $P$ by re-training layer-0 activations toward clean-model behavior; testing this adversarial re-training would be a direct follow-up.
The same activation-perturbation idea could be tried on other architectures with learnable or differentiable activations, such as spline-based or piecewise-linear networks, to see whether task independence and pruning resistance carry over.
The paper leaves the choice and properties of $P$ unspecified; one testable design question is whether different owners can use different $P$ values to obtain unique, non-interchangeable watermarks while keeping the detector transfer.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is a plausible first stab at KAN-specific watermarking, but the robustness claim doesn't survive its own Fashion MNIST numbers, and the method isn't reproducible as written.

The DCT activation-perturbation idea is genuinely new for KAN, and unlike trigger-set methods it's task-agnostic in principle. Embedding in layer 0 is a sensible choice, and the MNIST results look strong: 100% wm acc after fine-tuning and pruning, 93.69% after retrain-after-pruning, with no accuracy loss. The regression experiments cover many Feynman equations, which is a nice range.

But the core claim of "superior robustness against pruning and retraining after pruning" is undercut by Table V: on Fashion MNIST, DCT-AW gets 50.01% and 50.15% wm acc after pruning and retrain—chance level for a binary detector. The abstract and conclusion say otherwise, and Section VI-B4 even claims the method "effectively preserves the watermark information." That's not what the table shows.

The deeper issue is detector calibration. The detector is trained only on activations from a clean KAN and a watermarked KAN, both before any attack. There are no false-positive measurements on attacked clean models or independently trained KANs. Without that, high post-attack wm acc could just mean the detector labels any out-of-distribution activation as watermarked. The Fashion MNIST numbers actually support this interpretation.

Reproducibility is also weak: the perturbation signal P in Eq. (5) is never specified—the reader can't even know what signal is being embedded. No seeds, no error bars, no detector hyperparameters, and the code link is an unverifiable short URL.

Who gets value: researchers working on model watermarking or IP protection for KAN. The idea is worth taking seriously, but this version isn't the place to learn the method.

My recommendation: send it to peer review, but the authors need to specify P, add false-positive calibration on attacked and unrelated models, report variance, and correct the Fashion MNIST claim. As is, it's a conditionally acceptable paper that needs major revision.

Referee Report

4 major / 4 minor

Summary. The paper proposes DCT-AW, a watermarking scheme for Kolmogorov-Arnold Networks (KANs). The method embeds a watermark by perturbing layer-0 activation outputs in the discrete-cosine-transform (DCT) domain during training, and verifies ownership using a three-layer MLP detector trained to distinguish activation outputs of a watermarked KAN from those of an unwatermarked KAN. Experiments on MNIST, Fashion MNIST, and the Feynman regression benchmark compare DCT-AW against four DNN watermarking baselines, reporting watermark detection accuracy after fine-tuning, pruning, and retraining-after-pruning attacks. The central claims are that DCT-AW is task-independent, has small impact on model performance, and is robust to common watermark removal attacks.

Significance. If the claims hold, DCT-AW would be a useful first architecture-specific watermarking method for KANs, exploiting their learnable activation functions rather than transferring DNN weight-embedding or trigger-set methods. The paper also identifies a real gap: existing DNN watermarking techniques are not designed for KAN's pruning-sensitive architecture. However, the current evidence is insufficient to support the headline robustness claim. The watermark signal is never specified, detector transfer is not validated with false-positive controls, and one of the paper's own tables shows chance-level watermark accuracy after pruning attacks. These are fixable with additional specification and experiments, so the core idea is worth a major revision rather than rejection.

major comments (4)

[§V-A, Eq. (5), Algorithm 1] The core perturbation signal P is never defined. Eq. (5) writes y' = IDCT(DCT(y) + P), but the paper does not state how P is generated, its length, its magnitude, its frequency support, or how it is derived from the watermark key w. Algorithm 1 line 9 is also notationally inconsistent: it writes Os = DCT(O, w), which does not match Eq. (5). Without a precise definition of P (or w), the method is not reproducible and the experiments cannot be independently reconstructed or assessed.
[§V-B, Eqs. (6)-(7), Tables IV-VI] The detector is trained only on activation outputs from one clean KAN and one watermarked KAN before any attack. Robustness is then measured by applying this detector to attacked watermarked models. The paper reports no false-positive rates on attacked clean models, nor on independently trained unrelated KANs. Without such controls, high wm acc after pruning or retraining could simply reflect the detector labeling any out-of-distribution activation distribution as 'watermarked.' The authors should report FPR/ROC on attacked clean models and on independently trained KANs; this is essential for the verification claim.
[Table V (Fashion MNIST), Pruning and Retrain after Pruning columns] The paper's abstract claims 'superior robustness against various watermark removal attacks, including pruning and retraining after pruning.' However, Table V shows DCT-AW wm acc = 50.01 after pruning and 50.15 after retraining after pruning on Fashion MNIST, i.e., chance level for binary classification. This directly contradicts the abstract and undermines the central robustness claim. The authors must either explain these results (e.g., different threshold, detector miscalibration) or qualify the claim. Single numbers without error bars or seed repetitions further weaken the comparison.
[§VI-A, Tables IV-VI] The experimental protocol is under-specified. There are no details on detector architecture hyperparameters, training/validation split, number of runs, random seeds, or how the layer-0 activation outputs are pooled across samples. All tables report single point estimates, so statistical significance and run-to-run variability cannot be assessed. This is particularly important because robustness numbers in Tables IV-VI vary widely across datasets and attacks, and the baseline comparisons depend on exact percentages.

minor comments (4)

[§III-B and §I] The phrase 'protecting in protecting deep neural networks' in the Introduction appears to be a typo; it should read 'protecting deep neural networks.'
[§V-A, Table III] The choice of layer 0 as the embedding location is based on a single comparison per task using one classification and one regression dataset. This is a free parameter of the method, and the paper gives no sensitivity analysis across tasks, model sizes, or depths. A short ablation would strengthen the claim that layer 0 is generally preferable.
[Title, Abstract, §VI] The title and abstract mention 'Emerging Networked Applications,' but the experiments include only standard image classification (MNIST, Fashion MNIST) and textbook equation regression (Feynman). No network-structured data or social-network-type task is evaluated, so the 'networked applications' framing is not supported by the reported evidence.
[Algorithm 1] Algorithm 1 does not define the 'signal loss' weight relative to the main-task loss, nor how the two training phases are balanced. The paper should specify the exact objective optimized in Step 2 and the learning rates/epoch counts used for embedding.

Circularity Check

1 steps flagged · score 4.0 of 10

Initial wm acc is a supervised-fit metric; robustness is uncalibrated and partly fails, but functionality/task-independence results remain independent.

fitted input called prediction [Section V-B, Eqs. (6)-(7); Section VI-A 'watermark accuracy' definition]
"Label(od_n) = {1 if n = wm or n = wm′, 0 if n = m or n = m′. (6) ... LDetect = CrossEntropy(Md(Xd), Yd). (7) ... We calculate the watermark detection rate as the number of testing instances successfully detected by the detector to the total number of testing instances."

The detector Md is trained specifically to separate layer-0 activations of the watermarked model Mwm from those of the clean model Mm (Eqs. 6-7). The paper's only watermark metric, wm acc, is this detector's classification accuracy on held-out activations from those same two models. Thus the reported 100% initial wm acc measures supervised separability of the two training distributions, not the presence of an independently specified perturbation P (which is never defined in the paper). The only independent transfer test is robustness after attacks, but that test is uncalibrated: no false-positive rate on attacked clean models is reported, and Table V shows chance-level wm acc (50.01/50.15) after pruning/retraining on Fashion MNIST, contradicting the claimed robustness. The verification cla

full rationale

The paper's core embedding procedure (Eq. 5 and Algorithm 1) is an explicit activation-perturbation scheme, and the functionality-preservation and task-independence results are evaluated on standard external benchmarks (MNIST, Fashion MNIST, Feynman) against independent baselines, so those parts are not circular. The preliminary weakness analysis is original experimentation, not a citation-dependent premise. The only self-citation of note is USP [3], a prior work by co-author Chih-Ya Shen, used as a baseline; it is not load-bearing for the proposed method's validity. However, the watermark-verification metric is partially circular: the detector is fit to exactly the two classes it later 'detects,' so high initial wm acc is a supervised-fit result rather than an independent watermark-key verification. The robustness claim depends on detector transfer to attacked models, which is neither calibrated by false-positive checks on attacked clean models nor consistently achieved, as the Fashion MNIST results show. These are genuine circularity/validation concerns, but they do not make the whole derivation equivalent to its inputs, hence a moderate score of 4.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on unspecified practical components, mainly the perturbation signal P, the layer choice, and detector training. No new physical or mathematical entities are introduced.

free parameters (3)

Perturbation signal P = not specified
The core embedded signal in Equation (5); no generation rule, amplitude, frequency band, or random seed is given.
Embedding layer index = 0
Layer 0 is chosen from Table III comparing layer 0 versus layer 1 on one classification and one regression task, with no detection accuracy or variance reported for the choice.
Detector hyperparameters = not specified
A three-layer MLP detector is described, but hidden sizes, epochs, learning rate, batch size, and train/test split are absent.

assumptions (4)

standard math The Kolmogorov-Arnold representation theorem justifies the KAN architecture with learnable univariate activations.
Invoked in Section III-A as the theoretical basis for KAN.
standard math The DCT and IDCT pair is invertible and preserves the representable signal shape.
Used in Section V-A to define the perturbation operation in the frequency domain.
domain assumption Layer-0 activation outputs are observable and stable enough to carry an embedded signal across training and attacks.
The entire embedding and verification pipeline in Sections V-A and V-B depends on this assumption, but no analysis supports it.
domain assumption An attacker does not know the perturbation signal or the detector, so verification remains meaningful.
The threat model in Sections II and V-B implicitly assumes the watermark secret is not available to the attacker.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Watermarking Kolmogorov-Arnold Networks for Emerging Networked Applications via Activation Perturbation." pith.science (2026). https://pith.science/paper/VGE3XSPI

@misc{pith2026250806676,
  author       = {Pith},
  title        = {Pith review of: Watermarking Kolmogorov-Arnold Networks for Emerging Networked Applications via Activation Perturbation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VGE3XSPI}},
  note         = {Machine review of arXiv:2508.06676}
}

read the original abstract

With the increasing importance of protecting intellectual property in machine learning, watermarking techniques have gained significant attention. As advanced models are increasingly deployed in domains such as social network analysis, the need for robust model protection becomes even more critical. While existing watermarking methods have demonstrated effectiveness for conventional deep neural networks, they often fail to adapt to the novel architecture, Kolmogorov-Arnold Networks (KAN), which feature learnable activation functions. KAN holds strong potential for modeling complex relationships in network-structured data. However, their unique design also introduces new challenges for watermarking. Therefore, we propose a novel watermarking method, Discrete Cosine Transform-based Activation Watermarking (DCT-AW), tailored for KAN. Leveraging the learnable activation functions of KAN, our method embeds watermarks by perturbing activation outputs using discrete cosine transform, ensuring compatibility with diverse tasks and achieving task independence. Experimental results demonstrate that DCT-AW has a small impact on model performance and provides superior robustness against various watermark removal attacks, including fine-tuning, pruning, and retraining after pruning.

Figures

Figures reproduced from arXiv: 2508.06676 by the authors.

**Figure 2.** Concept of the proposed approach DCT-AW [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

21 extracted references · 16 canonical work pages

[1]

How to prove your model belongs to you: A blind-watermark based framework to protect intellectual property of dnn,

Z. Li, C. Hu, Y . Zhang, and S. Guo, “How to prove your model belongs to you: A blind-watermark based framework to protect intellectual property of dnn,” in Proceedings of the 35th annual computer security applications conference, 2019, pp. 126–137

work page 2019
[2]

Margin-based neural network watermarking,

B. Kim, S. Lee, S. Lee, S. Son, and S. J. Hwang, “Margin-based neural network watermarking,” in International Conference on Machine Learning. PMLR, 2023, pp. 16 696–16 711

work page 2023
[3]

Customized and robust deep neural network watermarking,

T.-Y . Chien and C.-Y . Shen, “Customized and robust deep neural network watermarking,” in Proceedings of the 17th ACM International Conference on Web Search and Data Mining , 2024, pp. 134–142

work page 2024
[4]

KAN: Kolmogorov–arnold networks,

Z. Liu, Y . Wang, S. Vaidya, F. Ruehle, J. Halverson, M. Soljacic, T. Y . Hou, and M. Tegmark, “KAN: Kolmogorov–arnold networks,” in The Thirteenth International Conference on Learning Representations , 2025

work page 2025
[5]

On the representation of continuous functions of many variables by superposition of continuous functions of one variable and addition,

A. N. Kolmogorov, “On the representation of continuous functions of many variables by superposition of continuous functions of one variable and addition,” in Doklady Akademii Nauk , vol. 114, no. 5. Russian Academy of Sciences, 1957, pp. 953–956

work page 1957
[6]

Tkan: Temporal kolmogorov-arnold net- works,

R. Genet and H. Inzirillo, “Tkan: Temporal kolmogorov-arnold net- works,” arXiv preprint arXiv:2405.07344 , 2024

arXiv 2024
[7]

Kolmogorov-arnold network for satellite image classification in remote sensing,

M. Cheon, “Kolmogorov-arnold network for satellite image classification in remote sensing,” arXiv preprint arXiv:2406.00600 , 2024

arXiv 2024
[8]

Embedding watermarks into deep neural networks,

Y . Uchida, Y . Nagai, S. Sakazawa, and S. Satoh, “Embedding watermarks into deep neural networks,” in Proceedings of the 2017 ACM on international conference on multimedia retrieval , 2017, pp. 269–277

work page 2017

Show all 21 references

[9]

Turning your weakness into a strength: Watermarking deep neural networks by back- dooring,

Y . Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by back- dooring,” in 27th USENIX security symposium (USENIX Security 18) , 2018, pp. 1615–1631

2018
[10]

Protecting intellectual property of deep neural networks with watermarking,

J. Zhang, Z. Gu, J. Jang, H. Wu, M. P. Stoecklin, H. Huang, and I. Molloy, “Protecting intellectual property of deep neural networks with watermarking,” in Proceedings of the 2018 on Asia Conference on Computer and Communications Security , 2018, pp. 159–172

2018
[11]

Deepipr: Deep neural network ownership verification with passports,

L. Fan, K. W. Ng, C. S. Chan, and Q. Yang, “Deepipr: Deep neural network ownership verification with passports,” IEEE Transactions on Pattern Analysis and Machine Intelligence , vol. 44, no. 10, pp. 6122– 6139, 2021

2021
[12]

Multilayer feedforward networks are universal approximators,

K. Hornik, M. Stinchcombe, and H. White, “Multilayer feedforward networks are universal approximators,” Neural networks , vol. 2, no. 5, pp. 359–366, 1989

1989
[13]

On the representation of continuous functions of three variables by superpositions of continuous functions of two variables,

V . I. Arnol’d, “On the representation of continuous functions of three variables by superpositions of continuous functions of two variables,” Matematicheskii Sbornik, vol. 90, no. 1, pp. 3–74, 1959

1959
[14]

Kolmogorov, On the representation of continuous functions of several variables by superpositions of continuous functions of a smaller number of variables

N. Kolmogorov, On the representation of continuous functions of several variables by superpositions of continuous functions of a smaller number of variables. American Mathematical Society, 1961

1961
[15]

Deepokan: Deep operator network based on kolmogorov arnold networks for mechanics problems,

D. W. Abueidda, P. Pantidis, and M. E. Mobasher, “Deepokan: Deep operator network based on kolmogorov arnold networks for mechanics problems,” arXiv preprint arXiv:2405.19143 , 2024

2024 arXiv
[16]

Discrete cosine transform,

N. Ahmed, T. Natarajan, and K. R. Rao, “Discrete cosine transform,” IEEE transactions on Computers , vol. 100, no. 1, pp. 90–93, 1974

1974
[17]

The mnist database of handwritten digit images for machine learning research,

L. Deng, “The mnist database of handwritten digit images for machine learning research,” IEEE Signal Processing Magazine, vol. 29, no. 6, pp. 141–142, 2012

2012
[18]

Ai feynman: A physics-inspired method for symbolic regression,

S.-M. Udrescu and M. Tegmark, “Ai feynman: A physics-inspired method for symbolic regression,” Science Advances , vol. 6, no. 16, p. eaay2631, 2020

2020
[19]

Ai feynman 2.0: Pareto-optimal symbolic regression exploiting graph mod- ularity,

S.-M. Udrescu, A. Tan, J. Feng, O. Neto, T. Wu, and M. Tegmark, “Ai feynman 2.0: Pareto-optimal symbolic regression exploiting graph mod- ularity,” Advances in Neural Information Processing Systems , vol. 33, pp. 4860–4871, 2020

2020
[20]

Reproducibility materials (codes, models, and documents),

G.-J. Wu, C.-H. Lu, and C.-Y . Shen, “Reproducibility materials (codes, models, and documents),” in https://reurl.cc/zqKLja , 2025

2025
[21]

Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” arXiv preprint arXiv:1708.07747, 2017

2017 arXiv

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [1]

How to prove your model belongs to you: A blind-watermark based framework to protect intellectual property of dnn,

Z. Li, C. Hu, Y . Zhang, and S. Guo, “How to prove your model belongs to you: A blind-watermark based framework to protect intellectual property of dnn,” in Proceedings of the 35th annual computer security applications conference, 2019, pp. 126–137

work page 2019

[2] [2]

Margin-based neural network watermarking,

B. Kim, S. Lee, S. Lee, S. Son, and S. J. Hwang, “Margin-based neural network watermarking,” in International Conference on Machine Learning. PMLR, 2023, pp. 16 696–16 711

work page 2023

[3] [3]

Customized and robust deep neural network watermarking,

T.-Y . Chien and C.-Y . Shen, “Customized and robust deep neural network watermarking,” in Proceedings of the 17th ACM International Conference on Web Search and Data Mining , 2024, pp. 134–142

work page 2024

[4] [4]

KAN: Kolmogorov–arnold networks,

Z. Liu, Y . Wang, S. Vaidya, F. Ruehle, J. Halverson, M. Soljacic, T. Y . Hou, and M. Tegmark, “KAN: Kolmogorov–arnold networks,” in The Thirteenth International Conference on Learning Representations , 2025

work page 2025

[5] [5]

On the representation of continuous functions of many variables by superposition of continuous functions of one variable and addition,

A. N. Kolmogorov, “On the representation of continuous functions of many variables by superposition of continuous functions of one variable and addition,” in Doklady Akademii Nauk , vol. 114, no. 5. Russian Academy of Sciences, 1957, pp. 953–956

work page 1957

[6] [6]

Tkan: Temporal kolmogorov-arnold net- works,

R. Genet and H. Inzirillo, “Tkan: Temporal kolmogorov-arnold net- works,” arXiv preprint arXiv:2405.07344 , 2024

arXiv 2024

[7] [7]

Kolmogorov-arnold network for satellite image classification in remote sensing,

M. Cheon, “Kolmogorov-arnold network for satellite image classification in remote sensing,” arXiv preprint arXiv:2406.00600 , 2024

arXiv 2024

[8] [8]

Embedding watermarks into deep neural networks,

Y . Uchida, Y . Nagai, S. Sakazawa, and S. Satoh, “Embedding watermarks into deep neural networks,” in Proceedings of the 2017 ACM on international conference on multimedia retrieval , 2017, pp. 269–277

work page 2017