Watermarking the weights is trivial.
Watermarking the output is also possible, but more complex and with a statistical success rate Vs performance tradeoff.
Watermarking the output is also possible, but more complex and with a statistical success rate Vs performance tradeoff.