We introduce new methods of staining and locking computer vision models, to protect their owners' intellectual property. Staining, also known as watermarking, embeds secret behaviour into a model which can later be used to identify it, while locking aims to make a model unusable unless a secret trigger is inserted into input images. Unlike existing methods, our algorithms can be used to stain and lock pre-trained models without requiring fine-tuning or retraining, and come with provable, computable guarantees bounding their worst-case false positive rates. The stain and lock are implemented by directly modifying a small number of the model's weights and have minimal impact on the (unlocked) model's performance. Locked models are unlocked by inserting a small `trigger patch' into the corner of the input image. We present experimental results showing the efficacy of our methods and demonstrating their practical performance on a variety of computer vision models.
@article{arxiv.2507.22000,
title = {Staining and locking computer vision models without retraining},
author = {Oliver J. Sutton and Qinghua Zhou and George Leete and Alexander N. Gorban and Ivan Y. Tyukin},
journal= {arXiv preprint arXiv:2507.22000},
year = {2025}
}