arXiv:2507.20650cs.CRcs.AI2025-07被引 2

无需重训练即可为每个用户定制水印,有效防止大模型被盗用。

Hot-Swap MarkBoard: An Efficient Black-box Watermarking Approach for Large-scale Model Distribution

  • 通过多分支低秩适配模块独立嵌入水印,支持快速更换
  • 在六种模型上实现100%验证准确率,且不需重新训练
  • 适合大规模分发场景,兼容分类、生成等各类任务

深度学习模型正越来越多地部署在终端设备上,作为本地AI运行,提升效率与隐私保护。然而,这种分布式部署也带来更严重的知识产权风险,因模型被分发到大量本地设备,易遭窃取和重分发。现有大多数所有权保护方案(如基于后门的水印)针对云服务设计,无法直接用于大规模分发场景——每个用户实例需携带唯一水印。这些方法通常嵌入固定水印,修改水印需重新训练模型。为此,我们提出Hot-Swap MarkBoard,一种高效水印方法:通过在多分支低秩适配(LoRA)模块中独立嵌入多个水印,实现无需重训练的用户专属水印定制。参数混淆机制将水印权重与基础模型权重纠缠,防止移除而不损害性能。该方法支持黑盒验证,兼容多种模型架构与任务,包括分类、图像生成和文本生成。在三种任务类型和六种主干模型上的实验表明,该方法在效率与适应性方面优于现有方案,达到100%验证准确率。

原文摘要 · Abstract (English)

Recently, Deep Learning (DL) models have been increasingly deployed on end-user devices as On-Device AI, offering improved efficiency and privacy. However, this deployment trend poses more serious Intellectual Property (IP) risks, as models are distributed on numerous local devices, making them vulnerable to theft and redistribution. Most existing ownership protection solutions (e.g., backdoor-based watermarking) are designed for cloud-based AI-as-a-Service (AIaaS) and are not directly applicable to large-scale distribution scenarios, where each user-specific model instance must carry a unique watermark. These methods typically embed a fixed watermark, and modifying the embedded watermark requires retraining the model. To address these challenges, we propose Hot-Swap MarkBoard, an efficient watermarking method. It encodes user-specific $n$-bit binary signatures by independently embedding multiple watermarks into a multi-branch Low-Rank Adaptation (LoRA) module, enabling efficient watermark customization without retraining through branch swapping. A parameter obfuscation mechanism further entangles the watermark weights with those of the base model, preventing removal without degrading model performance. The method supports black-box verification and is compatible with various model architectures and DL tasks, including classification, image generation, and text generation. Extensive experiments across three types of tasks and six backbone models demonstrate our method's superior efficiency and adaptability compared to existing approaches, achieving 100\% verification accuracy.

模型水印隐私保护LoRA黑盒验证

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。