WAPITI: A Watermark for Finetuned Open-Source LLMs
Keywords: Watermark, Large Language Models, Model Interventions
TL;DR: We propose the first watermarking method for open-source fine-tuned models using parameter editing, and it preserves the model capabilities while ensuring high detectability across diverse models in real settings.
Abstract: Watermarking of large language models (LLMs) generation embeds an imperceptible statistical pattern within texts, making it algorithmically detectable.
Watermarking is a promising method for addressing potential harm and biases from LLMs, as it enables traceability, accountability, and detection of manipulated content, helping to mitigate unintended consequences.
However, for open-source models, watermarking faces two major challenges:
(1) incompatibility with fine-tuned models
(2) vulnerability to fine-tuning attacks.
In this work, we propose WAPITI, a new method that transfers watermarking from base models to fine-tuned models through parameter integration.
To the best of our knowledge, we are the first to embed watermarks into fine-tuned model parameters and preserve their fine-tuned capabilities.
Furthermore, our approach offers an effective defense against fine-tuning attacks.
We test our method on various model architectures and watermarking strategies.
Results demonstrate that our method can successfully inject watermarks and is highly compatible with fine-tuned models.
Additionally, we offer an in-depth analysis of how the strength of
parameter editing influences the watermark strength and overall capabilities of the resulting models.
Primary Area: other topics in machine learning (i.e., none of the above)
Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.
Submission Guidelines: I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.
Reciprocal Reviewing: I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.
Anonymous Url: I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
No Acknowledgement Section: I certify that there is no acknowledgement section in this submission for double blind review.
Submission Number: 8399
Loading