Watermark Removal in Neural PDE Operators: Limits of Passive Ownership Evidence

We evaluate an active tangent-space watermark and a passive tangent-distance ranking in ten Fourier neural operators on one discrete Darcy-flow benchmark. Utility requires forward, two derivative and inverse-task errors to increase by no more than 25% relative to each clean owner. Ordinary fine-tuning on 256 forward-labeled controls for 1,920 updates, wrapped with a 256-iteration Jacobi correction using known PDE coefficients in every forward call, yields seven useful models that defeat both evaluated tests. The unwrapped copies all fail derivative utility; whether copied weights are necessary for the wrapped utility is unmeasured. Other procedures separate the signals. At a retained descriptive checkpoint of 320 ordinary updates, 8/10 owners qualify as active removals while every useful copy retains positive passive evidence. Two attacks using 16,384 derivative-labeled controls, four times the owners' labeled-control count, yield 9/10 qualified removals with passive retention at 20,480 updates; their benefit over matched-access scratch training is unmeasured. One intact final mark is undetected and remains in the denominator. The frozen scratch comparison applies only to the unwrapped 1,920-update ordinary copies: geometric replacement-to-copy error ratios are 7.16 for random-direction derivatives and 2.53 for the inverse task, despite failed full utility. Ownership verdicts depend on access, checkpoint and utility definition. Failed physical qualification limits this bounded robustness study to declared numerical references; saved-result reproducibility does not establish universal protection or population error rates. Status: Research preprint. Pinned method and campaign source and saved-result analysis: https://github.com/Hc1012/OperatorMark/releases/tag/v1.0.0-rc5 The manuscript reproduction supplement accompanying this record supplies the Figure 1 and selected-endpoint table scripts and per-owner outputs derived from the same saved-analysis object. It does not regenerate experimental measurements. AI-assisted tools supported software implementation, analysis and visualization code, and manuscript preparation. The author takes responsibility for the reported work. The manuscript and its LaTeX source are licensed under CC BY 4.0. Code in the reproduction supplement retains the MIT licence included in that archive.