提出可抵抗模型合并的指纹技术,实现黑盒验证大模型版权。
MergePrint: Merge-Resistant Fingerprints for Robust Black-box Ownership Verification of Large Language Models
- 通过模拟合并过程优化指纹,确保融合后仍可检测
- 仅需验证特定输入输出即可完成所有权检查
- 适合防范模型合并盗用,兼顾性能损失最小化
由于训练成本高昂,大型语言模型(LLMs)的知识产权保护日益重要。模型合并技术虽高效,却带来了未经授权使用的新型风险。现有指纹技术对合并攻击的鲁棒性尚未研究。为此,我们提出新方法 MergePrint,嵌入可抵御合并的鲁棒指纹,支持黑盒所有权验证:所有者只需检查模型在特定指纹输入下是否产生目标输出,无需访问权重或中间结果。通过针对伪合并模型进行优化,确保指纹在合并后仍可检测;同时预优化指纹输入以最小化性能下降。MergePrint 首次提供实用的黑盒验证方案,有效防范通过合并窃取模型的行为,并对更广泛的模型盗用威胁具备强抵抗力。
原文摘要 · Abstract (English)
Protecting the intellectual property of Large Language Models (LLMs) has become increasingly critical due to the high cost of training. Model merging, which integrates multiple expert models into a single multi-task model, introduces a novel risk of unauthorized use of LLMs due to its efficient merging process. While fingerprinting techniques have been proposed for verifying model ownership, their resistance to model merging remains unexplored. To address this gap, we propose a novel fingerprinting method, MergePrint, which embeds robust fingerprints capable of surviving model merging. MergePrint enables black-box ownership verification, where owners only need to check if a model produces target outputs for specific fingerprint inputs, without accessing model weights or intermediate outputs. By optimizing against a pseudo-merged model that simulates merged behavior, MergePrint ensures fingerprints that remain detectable after merging. Additionally, to minimize performance degradation, we pre-optimize the fingerprint inputs. MergePrint pioneers a practical solution for black-box ownership verification, protecting LLMs from misappropriation via merging, while also excelling in resistance to broader model theft threats.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。