arXiv:2508.02092cs.CRcs.AI2025-08中稿 · COLM被引 2

通过局部参数修改,在不损伤模型性能前提下植入难以察觉的指纹。

FPEdit: Robust LLM Fingerprinting through Localized Parameter Editing

  • 用知识编辑技术在少量权重上注入语义连贯的自然语言指纹。
  • 在全参数微调和高效适配下保持94%-100%指纹保留率。
  • 适合需要防盗版、防滥用的LLM部署场景,尤其资源受限时。

大型语言模型是计算、数据与工程投入的巨大资产,但易遭未经授权的微调或黑箱部署。现有指纹方法存在根本矛盾:内在方法需完整参数访问,基于后门的技术则使用统计异常触发,易被检测过滤。本文提出FPEdit框架,利用知识编辑通过稀疏、定向权重修改,注入语义一致的自然语言指纹。引入促抑值向量优化,同时提升目标词概率并抑制竞争词,确保指纹嵌入稳定且不损害模型功能。实验表明,FPEdit在全参数微调与参数高效适配下均实现94%-100%指纹保留,且在量化、剪枝与随机解码下仍具鲁棒性。可在2分钟内将10组指纹嵌入LLaMA2-7B,GPU内存消耗低于30 GB,显著降低资源开销。FPEdit首次实现对适应性攻击的鲁棒性、抗检测性与模型可用性的统一,为对抗环境下的大模型溯源提供轻量可靠方案。

原文摘要 · Abstract (English)

Large language models represent significant investments in computation, data, and engineering expertise, making them extraordinarily valuable intellectual assets. Nevertheless, these AI assets remain vulnerable to unauthorized redistribution and commercial exploitation through fine-tuning or black-box deployment. Current fingerprinting approaches face a fundamental trade-off: intrinsic methods require full parameter access, while backdoor-based techniques employ statistically anomalous triggers easily detected and filtered by adversaries. To address these limitations, we introduce FPEdit, a novel framework that leverages knowledge editing to inject semantically coherent natural language fingerprints through sparse, targeted modifications to model weights. Our approach introduces Promote-Suppress Value Vector Optimization, which simultaneously enhances target token likelihood while suppressing competing tokens, ensuring robust fingerprint integration without degrading core model functionality. Extensive experiments show that FPEdit achieves 94-100% fingerprint retention under both full-parameter fine-tuning and parameter-efficient adaptation, while preserving performance on downstream benchmarks. Moreover, FPEdit remains robust under quantization, pruning, and stochastic decoding, and can embed 10 fingerprint pairs into LLaMA2-7B in under 2 minutes using less than 30 GB of GPU memory, which represents a substantial reduction in resource requirements. These advances establish FPEdit as the first fingerprinting approach to simultaneously achieve robustness against adaptation, resistance to detection, and preservation of model utility, thereby providing a minimally invasive solution for reliable provenance verification of large language models in adversarial deployment scenarios.

模型指纹大模型安全知识编辑

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。