Research map / Architectures and efficiency / Pruning and efficient tuning

Find the Lady: Permutation and Re-synchronization of Deep Neural Networks

AAAI 2024 · Architectures and efficiency › Pruning and efficient tuning · approach: Low-rank compression and merging · 2 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes a cosine-similarity-based method to re-synchronize (undo) neuron permutations in deep networks, robust to noise, fine-tuning, quantization and pruning, and shows an integrity threat to white-box watermarking.

Problem

Neuron order in a layer can be arbitrarily permuted without changing model output, which breaks white-box watermark extraction and integrity checks; the question is whether the original order can be recovered when the permutation is unknown and the weights are further perturbed.

Approach

Match each permuted neuron to its original position by the cosine similarity of its weight vector with the original layer's weights; because neurons with similar outputs have de-correlated weights, the argmax similarity recovers the permutation, and it stays robust under perturbations. The authors also show that scaling-type perturbations keep cosine similarity at one while changing the function,

Key results

• Re-synchronization success rate Psi reaches 100% for most architectures under fine-tuning up to 10% of original epochs, and under 16-to-4-bit quantization for most models.
• Under Gaussian noise with Omega up to 10, Psi stays high (e.g. 100% for VGG16 and ResNet18) while error more than doubles at Omega=6 for many models.
• The method recovers the watermark of Uchida et al.'s white-box scheme under permutation, where the Pearson correlation was otherwise destroyed.

Measured effects reported in the paper

Surprising findings

• Neurons with identical outputs under the same input can have de-correlated weights (cosine similarity about -0.02), so output matching alone is insufficient.
• Preserving cosine similarity at one does not preserve function: a scalar rescaling of weights keeps cosine similarity at one while changing model behavior, causing a misdetection of pedestrians.

Limitations

• Robustness degrades for some models under heavy pruning or noise (e.g. YOLO-v5n and ResNet50 at high Omega and T), with Psi dropping well below 100%.
• Results are reported for a single penultimate-layer or chosen-layer permutation setup per experiment, and the theoretical analysis is limited to Gaussian inputs and ReLU.

Experimental setup

Datasets: CIFAR-10 ImageNet-1k Cityscapes COCO UVG

Benchmarks: CIFAR-10 ImageNet-1k Cityscapes COCO UVG

Metrics: re-synchronization success rate (Psi) top-1 classification error mean IoU complement mAP50 complement bpp at MS-SSIM 0.97

Baselines: L1-norm ranking trigger set neuron identification Uchida et al. white-box watermarking

Builds on: Uchida et al. white-box watermarking

Closest papers by meaning

• Boosting the Uniqueness of Neural Networks Fingerprints with Informative Triggers (NeurIPS 2025 · similarity 0.82)
• DeepPermNet: Visual Permutation Learning (CVPR 2017 · similarity 0.82)
• The Cost of Symmetry: Universality and Hardness for Permutation-Invariant Neural Networks (NeurIPS 2026 · similarity 0.82)
• Beyond the Permutation Symmetry of Transformers: The Role of Rotation for Model Fusion (ICML 2025 · similarity 0.82)
• $C^2M^3$: Cycle-Consistent Multi-Model Merging (NeurIPS 2024 · similarity 0.82)
• REPAIR: REnormalizing Permuted Activations for Interpolation Repair (ICLR 2023 · similarity 0.82)