# Why Neural Structural Obfuscation Can't Kill White-Box Watermarks for Good!

arXiv: https://arxiv.org/abs/2603.12679 · HTML: https://mlsanity.com/paper/2603.12679/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Mar 2026.

## Built on by (most cited first, 1 of 1)

- [PlanTwin: Privacy-Preserving Planning Abstractions for Cloud-Assisted LLM Agents](https://mlsanity.com/paper/2603.18377/) (2026)

## Abstract (arXiv)

Neural Structural Obfuscation (NSO) (USENIX Security'23) is a family of ``zero cost'' structure-editing transforms (textttnsozero, textttnsoclique, textttnsosplit) that inject dummy neurons. By combining neuron permutation and parameter scaling, NSO makes a radical modification to the network structure and parameters while strictly preserving functional equivalence, thereby disrupting white-box watermark verification. This capability has been a fundamental challenge to the reliability of existing white-box watermarking schemes. We rethink NSO and, for the first time, fully recover from the damage it has caused. We redefine NSO as a graph-consistent threat model within a textitproducer--consumer paradigm. This formulation posits that any obfuscation of a producer node necessitates a compatible layout update in all downstream consumers to maintain structural integrity. Building on these consistency constraints on signal propagation, we present textscCanon, a recovery framework that probes the attacked model to identify redundancy/dummy channels and then textitglobally canonicalizes the network by rewriting textitall downstream consumers by construction, synchronizing layouts across textttfan-out, textttadd, and textttcat. Extensive experiments demonstrate that, even under strong composed and extended NSO attacks, textscCanon achieves 100% recovery success, restoring watermark verifiability while preserving task utility. Our code is available at https://anonymous.4open.science/r/anti-NSO-9874.