Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

KinGuard: Hierarchical Kinship-Aware Fingerprinting to Defend Against Large Language Model Stealing

Zhenhua Xu, Xiaoning Tian, Wenjun Zeng, Wenpeng Xing, Tianliang Lu, Gaolei Li, Chaochao Chen, Meng Han

TL;DR

KinGuard addresses the IP protection challenge for large language models by resolving the stealth-robustness paradox of backdoor fingerprints through knowledge-based embedding. It constructs a kinship-aware private corpus, injects it via incremental pre-training to internalize structured knowledge, and verifies ownership by probing conceptual understanding with a $ROUGE$-based similarity and $AUC$-based fingerprint metric. Experiments show KinGuard achieves $FSR$ near 1.0 across models while maintaining harmlessness and robustness under fine-tuning, input perturbations, and model merging, outperforming baseline methods. This approach offers a practical, stealthy, black-box ownership verification mechanism with strong real-world implications for copyright protection of foundation models.

Abstract

Protecting the intellectual property of large language models requires robust ownership verification. Conventional backdoor fingerprinting, however, is flawed by a stealth-robustness paradox: to be robust, these methods force models to memorize fixed responses to high-perplexity triggers, but this targeted overfitting creates detectable statistical artifacts. We resolve this paradox with KinGuard, a framework that embeds a private knowledge corpus built on structured kinship narratives. Instead of memorizing superficial triggers, the model internalizes this knowledge via incremental pre-training, and ownership is verified by probing its conceptual understanding. Extensive experiments demonstrate KinGuard's superior effectiveness, stealth, and resilience against a battery of attacks including fine-tuning, input perturbation, and model merging. Our work establishes knowledge-based embedding as a practical and secure paradigm for model fingerprinting.

KinGuard: Hierarchical Kinship-Aware Fingerprinting to Defend Against Large Language Model Stealing

TL;DR

KinGuard addresses the IP protection challenge for large language models by resolving the stealth-robustness paradox of backdoor fingerprints through knowledge-based embedding. It constructs a kinship-aware private corpus, injects it via incremental pre-training to internalize structured knowledge, and verifies ownership by probing conceptual understanding with a -based similarity and -based fingerprint metric. Experiments show KinGuard achieves near 1.0 across models while maintaining harmlessness and robustness under fine-tuning, input perturbations, and model merging, outperforming baseline methods. This approach offers a practical, stealthy, black-box ownership verification mechanism with strong real-world implications for copyright protection of foundation models.

Abstract

Protecting the intellectual property of large language models requires robust ownership verification. Conventional backdoor fingerprinting, however, is flawed by a stealth-robustness paradox: to be robust, these methods force models to memorize fixed responses to high-perplexity triggers, but this targeted overfitting creates detectable statistical artifacts. We resolve this paradox with KinGuard, a framework that embeds a private knowledge corpus built on structured kinship narratives. Instead of memorizing superficial triggers, the model internalizes this knowledge via incremental pre-training, and ownership is verified by probing its conceptual understanding. Extensive experiments demonstrate KinGuard's superior effectiveness, stealth, and resilience against a battery of attacks including fine-tuning, input perturbation, and model merging. Our work establishes knowledge-based embedding as a practical and secure paradigm for model fingerprinting.
Paper Structure (16 sections, 3 equations, 3 figures, 3 tables)

This paper contains 16 sections, 3 equations, 3 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Related work
  3. Method
  4. Problem Definition
  5. Family-Member Characterization
  6. Kinship-Aware Graph Construction
  7. Fingerprint Injection
  8. Ownership Verification
  9. Experiment
  10. Experimental setting
  11. Effectiveness
  12. Harmlessness
  13. Stealthiness
  14. Robustness
  15. Ablation Study
  16. ...and 1 more sections

Figures (3)

  • Figure 1: Overview of the KinGuard verification process. A sample from the private fingerprint corpus is partitioned into a prefix (input) and a continuation (ground-truth). The prefix is fed to a suspect model, and its generated output is compared against the ground-truth. High similarity serves as strong evidence of ownership.
  • Figure 2: An overview of the two-stage fingerprint construction process: (1) Family-Member Characterization, where individuals are defined with detailed attributes, and (2) Kinship-Aware Graph Construction, where these individuals are assembled into a structured graph encoding their relationships.
  • Figure 3: FSR (%) of the LLaMA2-7B model when merged with WizardMath-7B-V1.0 using various fusion strategies.