Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SLIM: Stealthy Low-Coverage Black-Box Watermarking via Latent-Space Confusion Zones

Hengyu Wu, Yang Cao

TL;DR

SLIM tackles the challenge of protecting training-data provenance for LLMs under ultra-low coverage and strict black-box access. It creates Latent-Space Confusion Zones by paraphrasing prefixes and pairing them with divergent continuations, forcing nearby latent representations to map to multiple plausible outputs. Verification relies on hypothesis testing on continuation instability, using both reference-model-based and reference-model-free approaches to accommodate realistic access constraints. Empirical results show SLIM achieves reliable traceability, negligible harm to utility, strong stealthiness, and scalable performance across architectures and data volumes. Overall, SLIM offers a practical, verifiable, and scalable solution for data ownership in modern LLM training pipelines.

Abstract

Training data is a critical and often proprietary asset in Large Language Model (LLM) development, motivating the use of data watermarking to embed model-transferable signals for usage verification. We identify low coverage as a vital yet largely overlooked requirement for practicality, as individual data owners typically contribute only a minute fraction of massive training corpora. Prior methods fail to maintain stealthiness, verification feasibility, or robustness when only one or a few sequences can be modified. To address these limitations, we introduce SLIM, a framework enabling per-user data provenance verification under strict black-box access. SLIM leverages intrinsic LLM properties to induce a Latent-Space Confusion Zone by training the model to map semantically similar prefixes to divergent continuations. This manifests as localized generation instability, which can be reliably detected via hypothesis testing. Experiments demonstrate that SLIM achieves ultra-low coverage capability, strong black-box verification performance, and great scalability while preserving both stealthiness and model utility, offering a robust solution for protecting training data in modern LLM pipelines.

SLIM: Stealthy Low-Coverage Black-Box Watermarking via Latent-Space Confusion Zones

TL;DR

SLIM tackles the challenge of protecting training-data provenance for LLMs under ultra-low coverage and strict black-box access. It creates Latent-Space Confusion Zones by paraphrasing prefixes and pairing them with divergent continuations, forcing nearby latent representations to map to multiple plausible outputs. Verification relies on hypothesis testing on continuation instability, using both reference-model-based and reference-model-free approaches to accommodate realistic access constraints. Empirical results show SLIM achieves reliable traceability, negligible harm to utility, strong stealthiness, and scalable performance across architectures and data volumes. Overall, SLIM offers a practical, verifiable, and scalable solution for data ownership in modern LLM training pipelines.

Abstract

Training data is a critical and often proprietary asset in Large Language Model (LLM) development, motivating the use of data watermarking to embed model-transferable signals for usage verification. We identify low coverage as a vital yet largely overlooked requirement for practicality, as individual data owners typically contribute only a minute fraction of massive training corpora. Prior methods fail to maintain stealthiness, verification feasibility, or robustness when only one or a few sequences can be modified. To address these limitations, we introduce SLIM, a framework enabling per-user data provenance verification under strict black-box access. SLIM leverages intrinsic LLM properties to induce a Latent-Space Confusion Zone by training the model to map semantically similar prefixes to divergent continuations. This manifests as localized generation instability, which can be reliably detected via hypothesis testing. Experiments demonstrate that SLIM achieves ultra-low coverage capability, strong black-box verification performance, and great scalability while preserving both stealthiness and model utility, offering a robust solution for protecting training data in modern LLM pipelines.
Paper Structure (27 sections, 7 equations, 10 figures, 3 tables)

This paper contains 27 sections, 7 equations, 10 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Membership Inference
  4. Data Watermarking
  5. Latent Space of LLMs
  6. SLIM: Stealthy Low-coverage Instability Watermarking
  7. Watermarking Phase
  8. Latent-Space Confusion Zone
  9. Verification Phase
  10. Experiments
  11. Traceability
  12. Reference Model-Based Verification
  13. Reference Model-Free Verification
  14. Harmlessness
  15. Stealthiness
  16. ...and 12 more sections

Figures (10)

  • Figure 1: Overview of the watermarking and verification process of SLIM
  • Figure 2: The formation of the Latent-Space Confusion Zone
  • Figure 3: Shift of the verification $t$-statistic with increasing number of watermarked sequences ($K$).
  • Figure 4: Distribution of t-value under $H_0$ and the positions of Watermarked Samples (K=64)
  • Figure 5: $\Delta t$ as a function of training dataset size
  • ...and 5 more figures