Could already have happened in these weights. Reminds me of when the movie studios started projecting random dot patterns during movies to try to catch which theaters were leading to bootlegs. Their approach was essentially defeated by pirates sourcing multiple versions and combining them. In this case, I suspect you could add a small normally distributed random number to some random subset of the weights and it would have very little impact on performance but would corrupt any watermark beyond recognition.