用语义水印实现更隐蔽、抗干扰的LLM版权保护
LLM Fingerprinting via Semantically Conditioned Watermarks
- 以语义域替代固定关键词，让水印融入响应整体
- 在微调和量化后仍能稳定识别，误检率低于1%
- 适合需要长期追踪模型版权的开发者与平台
现有LLM指纹技术依赖模型对固定查询返回异常响应（密钥），但此类方法易受微调、量化影响，且密钥可被轻易检测过滤。本文提出基于语义条件水印的指纹方案：将固定查询集替换为广泛语义领域（如法语），并将水印信号以统计方式分散至每条响应中。训练模型仅在特定领域提示下生成水印响应，模型所有者可通过该领域内任意查询可靠检测指纹并验证所有权。实验表明，该方法在各类部署场景下均具备强鲁棒性与隐蔽性。
原文摘要 · Abstract (English)
Most LLM fingerprinting methods teach the model to respond to a few fixed queries with predefined atypical responses (keys). This memorization often does not survive common deployment steps such as finetuning or quantization, and such keys can be easily detected and filtered from LLM responses, ultimately breaking the fingerprint. To overcome these limitations we introduce LLM fingerprinting via semantically conditioned watermarks, replacing fixed query sets with a broad semantic domain, and replacing brittle atypical keys with a statistical watermarking signal diffused throughout each response. After teaching the model to watermark its responses only to prompts from a predetermined domain e.g., French language, the model owner can use queries from that domain to reliably detect the fingerprint and verify ownership. As we confirm in our thorough experimental evaluation, our fingerprint is both stealthy and robust to all common deployment scenarios.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。