Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Watermark Robustness and Radioactivity May Be at Odds in Federated Learning

Leixu Huang, Zedian Shao, Teodora Baluta

TL;DR

This work studies federated data provenance for large language models by embedding watermarks into locally trained synthetic data and evaluating detectability after FL fine-tuning. It demonstrates that standard watermarks (e.g., KGW+) are radioactive in vanilla FL, with highly significant $p$-values, but introduces an active-adversary threat where a Byzantine-robust aggregator (RandEigen) can suppress the watermark while preserving utility. The study reveals a fundamental trade-off among radioactivity, robustness, and utility in FL, showing that robust aggregation can erase provenance signals and that watermark design must account for this. The results motivate future watermarking schemes tailored to FL that balance detectability with robustness under active server manipulation, enabling reliable data provenance in distributed NLP deployments.

Abstract

Federated learning (FL) enables fine-tuning large language models (LLMs) across distributed data sources. As these sources increasingly include LLM-generated text, provenance tracking becomes essential for accountability and transparency. We adapt LLM watermarking for data provenance in FL where a subset of clients compute local updates on watermarked data, and the server averages all updates into the global LLM. In this setup, watermarks are radioactive: the watermark signal remains detectable after fine-tuning with high confidence. The $p$-value can reach $10^{-24}$ even when as little as $6.6\%$ of data is watermarked. However, the server can act as an active adversary that wants to preserve model utility while evading provenance tracking. Our observation is that updates induced by watermarked synthetic data appear as outliers relative to non-watermark updates. Our adversary thus applies strong robust aggregation that can filter these outliers, together with the watermark signal. All evaluated radioactive watermarks are not robust against such an active filtering server. Our work suggests fundamental trade-offs between radioactivity, robustness, and utility.

Watermark Robustness and Radioactivity May Be at Odds in Federated Learning

TL;DR

This work studies federated data provenance for large language models by embedding watermarks into locally trained synthetic data and evaluating detectability after FL fine-tuning. It demonstrates that standard watermarks (e.g., KGW+) are radioactive in vanilla FL, with highly significant -values, but introduces an active-adversary threat where a Byzantine-robust aggregator (RandEigen) can suppress the watermark while preserving utility. The study reveals a fundamental trade-off among radioactivity, robustness, and utility in FL, showing that robust aggregation can erase provenance signals and that watermark design must account for this. The results motivate future watermarking schemes tailored to FL that balance detectability with robustness under active server manipulation, enabling reliable data provenance in distributed NLP deployments.

Abstract

Federated learning (FL) enables fine-tuning large language models (LLMs) across distributed data sources. As these sources increasingly include LLM-generated text, provenance tracking becomes essential for accountability and transparency. We adapt LLM watermarking for data provenance in FL where a subset of clients compute local updates on watermarked data, and the server averages all updates into the global LLM. In this setup, watermarks are radioactive: the watermark signal remains detectable after fine-tuning with high confidence. The -value can reach even when as little as of data is watermarked. However, the server can act as an active adversary that wants to preserve model utility while evading provenance tracking. Our observation is that updates induced by watermarked synthetic data appear as outliers relative to non-watermark updates. Our adversary thus applies strong robust aggregation that can filter these outliers, together with the watermark signal. All evaluated radioactive watermarks are not robust against such an active filtering server. Our work suggests fundamental trade-offs between radioactivity, robustness, and utility.
Paper Structure (49 sections, 7 equations, 6 figures, 5 tables, 2 algorithms)

This paper contains 49 sections, 7 equations, 6 figures, 5 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Federated Setup
  4. LLM Watermarking
  5. Federated Data Provenance
  6. Problem Statement
  7. Approach
  8. Evaluation
  9. Setup
  10. LLM Watermark Radioactivity in FL
  11. LLM Watermark Robustness in FL
  12. Watermark Hyperparameters Analysis
  13. Utility Results
  14. Related Work
  15. Conclusion
  16. ...and 34 more sections

Figures (6)

  • Figure 1: t-SNE visualization of model updates shows the clear differences in updates from clean clients (blue) and watermark clients (red).
  • Figure 2: Overview of federated data provenance in ActiveFL for LLMs.
  • Figure 3: $\textnormal{KGW+}$ radioactivity improves with larger $\epsilon$, while $\textnormal{KTH+}$ remains not radioactive.
  • Figure 4: $\textnormal{KGW+}$ radioactivity improves with larger $\delta$.
  • Figure 5: t-SNE visualizations of local updates from clean clients (blue) and watermarking clients (red) for KGW+ and KTH+ in the first round. The mean gradient for each group is marked with an 'X'. All clean clients use synthetic data.
  • ...and 1 more figures

Theorems & Definitions (3)

  • Definition 1: Radioactivity
  • Definition 2: FL Robustness
  • Definition 3: Utility