Neural network obfuscation
No.  What you want is probably not achievable in practice, because the approach you are considering obfuscates only the weights but does not obfuscate the inputs and outputs to the network.  In any reasonable ischeme I can imagine, the input $x$ to the obfuscated network will be known and under the attacker's control, and the output $y$ from the obfuscated network will be known to the attacker.  In particular, the attacker can pick any $x$ of his choice, and observe the output $y$.

If that is true, your goose is cooked.  The attacker can use the ability to invoke your neural network to learn his own neural network that is just as good as yours.  In particular, the attacker can assemble an arbitrarily large training set by picking many potential inputs $x$ and for each one computing the corresponding $y$ by running your obfuscated network on $x$, then putting the pair $(x,y)$ in the training set.  This doesn't require labelled examples; it only requires the adversary to be able to put together a large set of unlabelled instances (and then use your obfuscated network to label those instances).  Typically, it's not too hard for someone to create a large set of unlabelled instances.

Finally, once the adversary has assembled this training set, the adversary can train their own neural network using standard techniques.  It's likely that the resulting neural network will be approximately as good as yours -- i.e., have approximately the same accuracy.  (This is what seems to happen in practice.)

As a result, no obfuscation scheme for obfuscating the weights is likely to be terribly effective, because that doesn't hide the inputs and outputs to the network.  The most you can hope for is a scheme that acts as a "speed bump" that slightly increases the cost of de-obfuscation or that raises the bar a little bit, but nothing you do will provide strong security against a knowledgeable adversary.  So, don't spend too much time or energy or money on trying to make this work.  Instead, you might be better off looking for other ways to deal with this issue.



P.S. Even if you could hide the outputs and reveal only the ultimate classification (i.e., hide the continuous probability values from the softmax and just reveal the highest-probability class), that's probably still not enough.  Revealing the class is still enough for an adversary to label a bunch of instances, create a training set, and then train their own network.