Double-I Watermark: Protecting Model Copyright for LLM Fine-tuning

TL;DR

This work tackles watermarking of customized LLMs during black-box fine-tuning to protect copyright, introducing Double-I, a backdoor-based approach that embeds watermark knowledge via two data paradigms (trigger in Input or Instruction) and a Trigger/Reference framework for reliable verification. By coupling Backdoor Data Paradigms with Fisher exact test-based verification, Double-I achieves high uniqueness, negligible harm to downstream task performance, and robustness against common attacks, including LoRA-based fine-tuning, quantization, and pruning. The paper provides extensive experiments on LLaMA-family models with both Full and LoRA fine-tuning, demonstrating strong watermark validity, minimal performance impact, and resilience to filters, while also examining the necessity of Reference sets and the potential benefits of mixing multiple watermarks. Overall, Double-I offers a practical, scalable solution for business owners to verify ownership of fine-tuned LLMs in real-world, black-box deployments, though it also highlights risks and areas for further refinement in watermark design and detection.

Abstract

To support various applications, a prevalent and efficient approach for business owners is leveraging their valuable datasets to fine-tune a pre-trained LLM through the API provided by LLM owners or cloud servers. However, this process carries a substantial risk of model misuse, potentially resulting in severe economic consequences for business owners. Thus, safeguarding the copyright of these customized models during LLM fine-tuning has become an urgent practical requirement, but there are limited existing solutions to provide such protection. To tackle this pressing issue, we propose a novel watermarking approach named ``Double-I watermark''. Specifically, based on the instruct-tuning data, two types of backdoor data paradigms are introduced with trigger in the instruction and the input, respectively. By leveraging LLM's learning capability to incorporate customized backdoor samples into the dataset, the proposed approach effectively injects specific watermarking information into the customized model during fine-tuning, which makes it easy to inject and verify watermarks in commercial scenarios. We evaluate the proposed "Double-I watermark" under various fine-tuning methods, demonstrating its harmlessness, robustness, uniqueness, imperceptibility, and validity through both quantitative and qualitative analyses.

Figures (6)

• Figure 1: The framework of Double-I watermarking.
• Figure 2: The attention scores of models $M_1$ and $N_1$ over input sentences.
• Figure 3: The attention scores of models $M_1$ and $N_1$ under different prefixes for input sentences from trigger set and reference set with the same <input subject>: Katie Liu Leung has only acted in films.
• Figure 4: The attention scores of models $M_1$ and $N_1$ under different prefixes for input sentences from trigger set and reference set with the same <input subject>: The May field Brewery shut down due to bank ruptcy.
• Figure 5: The attention scores of models $M_1$ and $N_1$ under different prefixes for input sentences from trigger set and reference set with the same <input subject>: The Tito Puente Amphitheatre is very famous.