用目标遗忘技术隐藏版权指纹，隐蔽性强且不易被检测。
ForgetMark: Stealthy Fingerprint Embedding via Targeted Unlearning in Language Models
- 通过目标遗忘构建可读的密钥-值对，实现隐蔽指纹嵌入。
- 在多种模型上实现100%版权验证成功率，性能不受影响。
- 适合需要隐蔽版权保护的AI模型部署场景。
现有入侵式指纹技术存在高困惑度触发词易被过滤、固定响应模式易被启发式检测器发现、良性输入上产生误激活等问题。本文提出\textsc{ForgetMark}，一种基于目标遗忘的隐蔽指纹框架，通过编码来源信息来实现版权保护。该框架利用辅助模型和预测熵排序构建紧凑、人类可读的密钥-值集合，再训练轻量级LoRA适配器，在抑制原始值的同时保持通用能力。所有权验证在黑盒/灰盒环境下通过聚合似然与语义证据实现，指纹成功率达100%。由于依赖概率遗忘痕迹而非固定触发-响应模式，\textsc{ForgetMark}避免了高困惑度触发词，降低可检测性，并减少误触发。在多种架构与设置下，其在保持标准性能的同时，优于后门基线在隐蔽性和对模型合并的鲁棒性方面表现，且在适度增量微调下仍有效。代码与数据见https://github.com/Xuzhenhua55/ForgetMark。
原文摘要 · Abstract (English)
Existing invasive (backdoor) fingerprints suffer from high-perplexity triggers that are easily filtered, fixed response patterns exposed by heuristic detectors, and spurious activations on benign inputs. We introduce \textsc{ForgetMark}, a stealthy fingerprinting framework that encodes provenance via targeted unlearning. It builds a compact, human-readable key--value set with an assistant model and predictive-entropy ranking, then trains lightweight LoRA adapters to suppress the original values on their keys while preserving general capabilities. Ownership is verified under black/gray-box access by aggregating likelihood and semantic evidence into a fingerprint success rate. By relying on probabilistic forgetting traces rather than fixed trigger--response patterns, \textsc{ForgetMark} avoids high-perplexity triggers, reduces detectability, and lowers false triggers. Across diverse architectures and settings, it achieves 100\% ownership verification on fingerprinted models while maintaining standard performance, surpasses backdoor baselines in stealthiness and robustness to model merging, and remains effective under moderate incremental fine-tuning. Our code and data are available at \href{https://github.com/Xuzhenhua55/ForgetMark}{https://github.com/Xuzhenhua55/ForgetMark}.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。