WAPITI: A Watermark for Finetuned Open-Source LLMs

## Abstract

Abstract Watermarking of large language models (LLMs) generation embeds an imperceptible statistical pattern within texts, making it algorithmically detectable.
Watermarking is a promising method for addressing potential harm and biases from LLMs, as it enables traceability, accountability, and detection of manipulated content, helping to mitigate unintended consequences.
However, for open-source models, watermarking faces two major challenges: (i) incompatibility with fine-tuned models (ii) vulnerability to fine-tuning attacks. In this work, we propose WAPITI , a new method that transfers watermarking from base models to fine-tuned models through parameter integration.
To the best of our knowledge, we propose the first watermark for fine-tuned open-source LLMs that preserves their fine-tuned capabilities.
Furthermore, our approach offers an effective defense against fine-tuning attacks.
We test our method on various model architectures and watermarking strategies.
Results demonstrate that our method can successfully inject watermarks and is highly compatible with fine-tuned models.
Additionally, we offer an in-depth analysis of how parameter editing influences the watermark strength and overall capabilities of the resulting models. 1 1 1 The model and corresponding code will be released upon publication.

### 1 Introduction

As large language models (LLMs; Touvron et al., ; OpenAI et al., ) have been integrated into numerous workflows and play an increasingly significant role in everyday life, controlling these LLMs to prevent potential harm has become even more urgent.
Watermarking offers a viable solution by embedding traceable information in model outputs.
It enables the identification of LLM-generated content and can be used to trace back to the source model, serving as a methodological foundation for regulatory oversight of language models.

The vast majority of the prior work on watermarks has focused on closed-source models
(Kirchenbauer et al., ; Aaronson, ; Kuditipudi et al., ), which are black boxes for users.
However, with the growing capabilities of open-source models (Touvron et al., ; Biderman et al., ), the need for oversight of open-source models has become equally important. In other words,
effective watermarking regulation must take both closed-source and open-source models into account to ensure comprehensive oversight and accountability.

Open-source models release their full parameters to users, and users can fully customize the generation process.
Therefore, users can simply choose an unwatermarked decoding algorithm to evade watermarking, thereby invalidating existing decoding-based watermarking methods.
Gu et al. () proposed a *parameter-based* method that distills the model using watermarked generations.
This process, referred to as *watermark distillation*, ensures that the watermarks are retained within the model parameters, preventing users from easily removing them.

However, we observe that this method (Gu et al., ) would impair the fine-tuned capabilities of models, revealing it is not compatible with fine-tuned models.
Additionally, watermark distillation incurs significantly higher computational costs compared to typical fine-tuning.
Furthermore, a severe weakness of parameter-based watermarks is their vulnerability to *fine-tuning attacks*, where malicious users fine-tune the watermarked models with unwatermarked datasets to eliminate their watermarking.
As noted by  Gu et al. (), as few as 500 steps of fine-tuning attack can remove the watermark from models.
(See Table 1 for overall comparison).

To address these limitations, we propose a new train-free watermarking strategy that transfers watermarks from base models to fine-tuned models (WAPITI, WAtermark Parameter InTegratIon) as shown in Figure 1.
We discover that watermarking bears a similar effect on the output distribution of both base models and fine-tuned models.
The core of our method involves embedding watermarks into models through direct parameter editing, ensuring compatibility with fine-tuned models.
Most importantly, WAPITI effectively defends against fine-tuning attacks by binding watermarking with the fine-tuning capabilities of the model.

Our main contributions are as follows:

- •
Problem. We identify the incompatibility between current parameter-based watermarking methods and fine-tuned models.
Distillation leads to a rapid degradation of fine-tuning capabilities and fails to effectively apply watermarking to models.
- •
Method. To the best of our knowledge, we propose the first watermarking for fine-tuned models (WAPITI) based on the fact that watermarking causes aligned distribution shift in both base models and fine-tuned models.
- •
Analysis. We analyze the relationship between watermarking parameters and model performance, revealing how parameter-editing strength affects final outcomes.
Furthermore, we establish the relationship between watermarks and the utility of WAPITI from a learnability perspective.
- •
Evaluation. WAPITI achieves high detectability with an AUROC of 0.92 while maintaining near-identical performance on fine-tuning benchmarks for both the Llama-2-7B and Pythia-1.4B families, demonstrating its strong effectiveness and generality.

Figure: Figure 1: Previous parameter-based watermarking (left) uses distillation which would impair models’ fine-tuned capabilities. WAPITI (middle) uses watermark-related parameters to transfer watermarking from the base model to fine-tuned models. This method can preserve fine-tuned model capabilities and meanwhile enables them to generate watermarked texts where the green tokens indicate the watermarked tokens (right).
Refer to caption: x1.png

### 2 Preliminary

#### 2.1 Decoding-based Watermarking

Large Language Models are generally neural networks based on the transformer architecture, denoted as $f_{\bm{\theta}}:\mathcal{V}^{*}\to\Delta(\mathcal{V})$, which maps a given prefix string $\bm{x}\in\mathcal{V}^{*}$ to a probability distribution over the vocabulary $\Delta(\mathcal{V})$ for predicting the next token, denoted as $f_{\bm{\theta}}(\,\cdot\mid\bm{x})$.
The generation process involves two main steps: *logit generation* followed by *token sampling* (Vaswani et al., ).

**Table 1: A taxonomy of LLM watermarking. ”N/A” indicates that the method is not designed for the corresponding setting.**
| Method | Closed-source | Open-sourced | Problem |  |
| --- | --- | --- | --- | --- |
| LLMs | Base LLMs | Fine-tuned LLMs |  |  |
| Decoding-based | ✓ | ✗ | ✗ | Easily removable by user |
| Distillation-based | N/A | ✓ | ✗ | It undermines capabilities |
| WAPITI (ours) | N/A | N/A | ✓ | N/A |

Decoding-based watermarks are embedded in either stages of generation with the aim of guiding the output distribution toward a targeted direction, incorporating traceable information for detection.
For instance, KGW (Kirchenbauer et al., ) increases the frequency of specific tokens during the generation process, and the detector identifies the origin of a text based on the occurrence rate of these tokens.
More specifically, a watermarking algorithm $\mathcal{W}$ employs a watermark key $\phi$ to modify the original next-token distribution $f_{\bm{\theta}}(\,\cdot\mid\bm{x})$ into a watermarked version.
The watermark detector $\mathcal{D}$, using the same watermark key $\phi$, can then retrieve the embedded watermark information.
In general, given a text $x$ and a watermark key $\phi$, the detector $\mathcal{D}$ calculates a p-value for the null hypothesis that the text $x$ is unrelated to $\mathcal{W}$ and $\phi$.
A text is classified as model-generated if its p-value falls below a predefined threshold.

The key evaluation metrics of watermarking are:
(i) Detectability:The watermark must ensure that all content generated by the model can be reliably detected by the detector.
(ii) Utility:The integration of the watermark should not significantly interfere with the original capabilities of the model.
(iii) Security:The watermark should ensure that its hidden pattern within the text is difficult to remove unless a substantial portion of the model output is significantly altered.
And for open-source models, the watermark cannot be removed without impairing their capabilities.

Logit-based: KGW is a watermarking strategy applied directly to output logits of the model (Algorithm 2 in Kirchenbauer et al. ()).
During the next token generation, the vocabulary is pseudorandomly split into green and red lists based on the previous $k$ tokens.
When $k=0$ (Zhao et al., ), the green and red lists are fixed, and when $k\geq 1$, the lists are determined by the previous context.
The green list contains $\gamma\in(0,1)$ proportion of the entire vocabulary, and an additional watermark shift $\delta$ is added to the logits of the tokens in the green list.
This increases the probability of the green tokens being selected in the final generation.
During detection, the p-value is calculated by checking whether the proportion of green list tokens exceeds the predefined $\gamma$.

Sampling-based: AAR is the Gumbel softmax scheme from Aaronson (), which is a special sampling strategy.
When generating $x_{i}$, it hashes the previous $k$ tokens using the key $\phi$ to generate a pseudorandom score sequence $\bm{r}_{i}$ for the entire vocabulary $\mathcal{V}$ where $\bm{r}_{i}\in\mathbb{R}^{|\mathcal{V}|}$ whose entries are uniformly distributed in $[0,1]$.
Given the probability distribution $\bm{p}_{i}\in\Delta(\mathcal{V})$ of the next token $x_{i}$, AAR uses Gumbel-Max sampling strategy: $x_{i}=\operatorname*{arg\,max}_{j\in\mid\mathcal{V}\mid}(\log p_{i,j}-\log(-
\log r_{i,j}))$ (Cane & Luce, ),
which introduces some randomness into the sampling stage by adding Gumbel noise $\bm{r}_{i}$.
This sampling strategy would result in watermarked texts having comparative higher score sums.
During detection, a larger score sum corresponds to a lower p-value against the null hypothesis.

#### 2.2 Weight-based Watermarking

Since the weights of open-source models are fully released, users can modify the decoding method or apply any post-processing to the logits, making decoding-based watermarks easy to remove.
The most feasible approach(^2^22To the best of our knowledge, this is the only approach for watermarking open-source LLMs that cannot be easily removed by users.) for watermarking is to embed the watermark into the model parameters, enabling LLMs to generate watermarked text under natural sampling distribution.
Current research (Gu et al., ) has shown that LLMs can learn watermarks via distillation and generate detectable watermarked texts.
By using decoding-based watermark strategies to generate watermarked texts as distillation data, Gu et al. () has verified the learnability of multiple watermarks on Llama-2-7B and Pythia-1.4B models.
However, we found that this parameter-based method is specifically designed for base LLMs.
In the fine-tuning setting, it significantly impairs the fine-tuned capabilities, as we will demonstrate in § 3.1.

### 3 Method

#### 3.1 Motivating Study

Limitation of current weight-based watermarking.  The current weight-based method enables the base model to generate watermarked texts via distillation.
In this paper, we explore whether the distillation-based approach is compatible with fine-tuned models. Specifically, we ask: can watermark distillation retain the fine-tuned capabilities of model while embedding the watermark into the fine-tuned model?
To address this question, we conduct a preliminary experiment.

In this experiment, we use math fine-tuned Llama-2-7B and decoding-based watermarking strategies to generate watermarked math-related data, which will be used in watermark distillation.
Detailed experiment setup can be found in Appendix A.

Figure 3 compares the watermark detectability (measured by p-value) and fine-tuning utility between the original fine-tuned model and the watermark-distilled models.
The utility of the model on GSM8K drops sharply to nearly zero, and the output text shows poor detectability, with a p-value close to the baseline of 0.5.

To better understand this phenomenon, we further analyze the distillation data generated by the math-fine-tuned model and identify two main reasons:
(i) The quality of the watermarked math data is inferior to that of the original fine-tuning dataset.
Table 3 presents several samples from the original benchmark dataset alongside the answers generated by the math model.
Although the generated answers might still be correct, they often contain flawed procedures or random repetitive sequences.
Such data can confuse the model and result in a performance decline.
(ii) The quantity of watermarked math data is insufficient for the student model to learn the watermark effectively.
As noted in  Gu et al. (), approximately 1.3 million samples are required for a distilled model to internalize the watermark.
With only 7.3k samples in the GSM8K training split and further filtering due to the 40% accuracy of model, our final dataset was just 0.6% of the required size.
The insufficient distillation data makes the generated outputs lack detectability.

In a nutshell, our experiments demonstrate that current distillation-based watermarking is incompatible with fine-tuned models.
This is primarily due to the small size of most fine-tuning datasets, which are insufficient for distillation.
Additionally, the quality of watermarked samples deteriorates compared to the original ones, leading to a decline in the fine-tuning capabilities of model.

Universal distribution shift from watermarking.  The primary issue with the current weight-based method is the distillation phase, which underscores the need for a train-free approach to watermark fine-tuned models.
To this end, we aim to investigate whether there are any similarities between the base models and fine-tuned models when watermarked.

Figure: Figure 2: We distill upon a math fine-tuned Llama-2-7B model. Results show that watermark distillation not only fails to embed the watermark but also significantly impairs the math capability of model.
Refer to caption: x2.png

To be specific, we analyze the $n$-gram distribution in the watermarked outputs of both the base and fine-tuned models.
According to watermarking schemes, $n$-gram could be the smallest meaningful unit, making them a natural starting point.
Check Appendix C for detailed justification.

Our experiment compares the $n$-gram distribution similarities between unwatermarked and watermarked texts generated by the base model and fine-tuned model, respectively.
We used Llama-2-7B and the math fine-tuned Llama-2-7B (Agarwalla et al., ) to generate 640k samples with and without watermarking.
The watermark used were kgw-k1-gamma0.25-delta2 (Kirchenbauer et al., ) and aar-k2 (Aaronson, ).

We tokenize all generated text into $n$-grams, where $n$ is determined by the number of tokens used to compute the watermarked next-token probability, as mentioned in § 2.1.
We then calculate the Jensen–Shannon (JS) divergence (Lin, ) between the watermarked and unwatermarked $n$-grams.
To reduce noise, we filter out $n$-grams whose frequencies are below a threshold.

The results, shown in Figure 3, indicate that the JS divergence is consistently smaller for watermarked $n$-gram compared to unwatermarked $n$-gram, which suggests that the distribution of watermarked $n$-gram is more similar between base models and fine-tuned models.
This indicates that watermarking distorts the output of both the base and fine-tuned models in similar ways by increasing the frequency of watermarked $n$-grams in the final generation.

#### 3.2 Watermark Parameter

In this section, we focus on deriving the watermarked parameters of fine-tuned models.
As mentioned in §2.1, watermarks only perturb the next-token generation $x_{t}$ according to previous $k$ tokens $x_{t-k},\cdots,x_{t-1}$ and watermark key $\phi$, so that watermark perturbation in next-token probability $f_{\bm{\theta}}(\bm{x})$(^3^33For brevity, we identify the next-token probability predictor $f_{\bm{\theta}}(\,\cdot\mid\bm{x}):\mathcal{V}\to\mathbb{R}$ as a vector $f_{\bm{\theta}}(\bm{x})\in\Delta(\mathcal{V})$.) remains the same across different models, where $\bm{x}$ is the input prompt.
We denote the watermark perturbation as $\delta\cdot g(\bm{x})$, where $\delta$ represents the intensity of the shift, analogous to the watermark shift $\delta$ in KGW and $g(\bm{x})$ is analogous to the mask of green list in KGW watermarking that indicates which part of vocabulary will be applied watermark shift.
According to experiments in C, we observe that model parameters can learn watermarking.
Let $\bm{\theta}_{\text{Base}},\bm{\theta}_{\text{Base}}^{\dagger}$ represent parameters of the base model and the watermark-distilled base model respectively.
So we have:

$$ $\displaystyle f_{\bm{\theta_{\text{Base}}}^{\dagger}}(\bm{x})=f_{\bm{\theta_{ \text{Base}}}}(\bm{x})+\delta_{\text{Base}}\cdot g(\bm{x}).$ (1) $$

Similarly, we use $\bm{\theta}_{\text{FT}}$ and $\bm{\theta}_{\text{FT}}^{\dagger}$ to represent the parameters of the fine-tuned (FT) models, as well as its watermark-distilled counterpart respectively.
Our ultimate goal is, given an unwatermarked $\bm{\theta}$, to find the parameter $\bm{\theta}_{\text{FT}}^{\dagger}$ such that:

$$ $\displaystyle f_{\bm{\theta}_{\text{FT}}^{\dagger}}(\bm{x})=f_{\bm{\theta}_{ \text{FT}}}(\bm{x})+\delta_{\text{FT}}\cdot g(\bm{x}),$ (2) $$

where $\delta_{\text{FT}}$ is a hyperparameter that controls the watermark detectability.

Let $\Delta\bm{\theta_{\text{Base}}}:=\bm{\theta_{\text{Base}}}^{\dagger}-\bm{
\theta_{\text{Base}}}$ and $\Delta\bm{\theta_{\text{FT}}}:=\bm{\theta_{\text{FT}}}^{\dagger}-\bm{\theta_{
\text{FT}}}$ denote the parameter differences introduced by watermark distillation for the base and fine-tuned models, respectively.
We can eliminate $g(\bm{x})$ by substituting $\bm{\theta}_{\text{Base}},\bm{\theta}_{\text{Base}}^{\dagger}$ into Eq. (1)
and rearranging it as a Taylor expansion.
$\delta_{\text{Base}}$ denotes the watermark shift of base model:

$$ $\displaystyle g(\bm{x})=\frac{1}{\delta_{\text{Base}}}\left(f_{\bm{\theta}_{ \text{Base}}^{\dagger}}(\bm{x})-f_{\bm{\theta}_{\text{Base}}}(\bm{x})\right)= \frac{1}{\delta_{\text{Base}}}\langle\nabla_{\bm{\theta}}f_{\bm{\theta_{\text{ Base}}}}(\bm{x}),\Delta\bm{\theta}_{\text{Base}}\rangle+O(\|\Delta\bm{\theta}_ {\text{Base}}\|^{2}).$ (3) $$

Furthermore, we observe in Appendix E.3, that the parameter difference between the fine-tuned model and the base model, $\bm{\theta_{\text{FT}}}-\bm{\theta_{\text{Base}}}$, is approximately orthogonal to the parameter difference caused by watermarking, $\bm{\theta_{\text{Base}}}^{\dagger}-\bm{\theta_{\text{Base}}}$:

$$ $\langle\bm{\theta}_{\text{FT}}-\bm{\theta}_{\text{Base}},\bm{\theta}_{\text{ Base}}^{\dagger}-\bm{\theta}_{\text{Base}}\rangle\approx 0.$ (4) $$

Let $\otimes$ denote the tensor product between differentiation operators, and let $\times_{1},\times_{2}$ denote the mode-1 and mode-2 tensor–matrix product, respectively. Let $\bm{H}_{\text{Base}}(\bm{x}):=\nabla_{\bm{\theta}}\otimes\nabla_{\bm{\theta}}f
_{\bm{\theta}_{\text{Base}}}(\bm{x})$ be the Hessian. As shown in prior studies, every channel of $\bm{H}_{\text{Base}}(\bm{x})$ is approximately the identity matrix $\bm{I}$ (Jiao et al., ; Yang et al., ). Combining it with our observation in Eq. (4), we hypothesize that:

$$ $\displaystyle\bm{H}_{\text{Base}}(\bm{x})\times_{1}(\bm{\theta}_{\text{FT}}- \bm{\theta}_{\text{Base}})\times_{2}(\bm{\theta}_{\text{Base}}^{\dagger}-\bm{ \theta}_{\text{Base}})\approx 0.$ (5) $$

The first-order Taylor expansion of $\nabla_{\bm{\theta}}f_{\bm{\theta}_{\text{FT}}}(\bm{x})$ around $\bm{\theta}=\bm{\theta}_{\text{Base}}$ is:

$$ $\displaystyle\nabla_{\bm{\theta}}f_{\bm{\theta}_{\text{FT}}}(\bm{x})=\nabla_{ \bm{\theta}}f_{\bm{\theta}_{\text{Base}}}(\bm{x})+\bm{H}_{\text{Base}}(\bm{x}) \times_{1}(\bm{\theta}_{\text{FT}}-\bm{\theta}_{\text{Base}})+O(\|\bm{\theta}_ {\text{FT}}-\bm{\theta}_{\text{Base}}\|^{2}),$ (6) $$

$$ $\displaystyle\bm{H}_{\text{Base}}(\bm{x})\times_{1}(\bm{\theta}_{\text{FT}}- \bm{\theta}_{\text{Base}})\approx\nabla_{\bm{\theta}}f_{\bm{\theta}_{\text{FT} }}(\bm{x})-\nabla_{\bm{\theta}}f_{\bm{\theta}_{\text{Base}}}(\bm{x}).$ (7) $$

Next, substituting Eq. (7) into Eq. (5), we find that the gradient difference between the fine-tuned and base models, when multiplied by the watermarked parameter difference of base model, is approximately zero:

$$ $\displaystyle(\nabla_{\bm{\theta}}f_{\bm{\theta}_{\text{FT}}}(\bm{x})-\nabla_{ \bm{\theta}}f_{\bm{\theta}_{\text{Base}}}(\bm{x}))\Delta\bm{\theta}_{\text{ Base}}\approx 0.$ (8) $$

By rearranging Eq. (8), we conclude that the gradients of the fine-tuned and base models are approximately equal when applied to the watermarked parameter difference:

$$ $\displaystyle\nabla_{\bm{\theta}}f_{\bm{\theta}_{\text{FT}}}(\bm{x})\Delta\bm{ \theta}_{\text{Base}}\approx\nabla_{\bm{\theta}}f_{\bm{\theta}_{\text{Base}}}( \bm{x})\Delta\bm{\theta}_{\text{Base}}.$ (9) $$

In this way, we obtain the relationship between the gradient of the fine-tuned model and base models. And we now proceed to derive our target $f_{\bm{\theta}_{\text{FT}}}(\bm{x})$.
First, by substituting $g(\bm{x})$ from Eq. (3) into Eq. (2):

$$ $\displaystyle f_{\bm{\theta}_{\text{FT}}^{\dagger}}(\bm{x})=f_{\bm{\theta}_{ \text{FT}}}(\bm{x})+\left(\frac{\delta_{\text{FT}}}{\delta_{\text{Base}}} \langle\nabla_{\bm{\theta}}f_{\bm{\theta}_{\text{Base}}}(\bm{x}),\Delta\bm{ \theta}_{\text{Base}}\rangle+O(\|\Delta\bm{\theta}_{\text{Base}}\|^{2})\right).$ (10) $$

We define $\lambda_{\text{FT}}=\frac{\delta_{\text{FT}}}{\delta_{\text{Base}}}$, where $\delta_{\text{FT}}$ is a hyperparameter, making $\lambda_{\text{FT}}$ a tunable factor. Next, we substitute the gradient of base model in Eq. (10) with the gradient of fine-tuned model using Eq. (9):

$$ $\displaystyle f_{\bm{\theta}_{\text{FT}}^{\dagger}}(\bm{x})$ $\displaystyle\approx f_{\bm{\theta}_{\text{FT}}}(\bm{x})+\langle\nabla_{\bm{ \theta}}f_{\bm{\theta}_{\text{FT}}}(\bm{x}),\lambda_{\text{FT}}\cdot\Delta\bm{ \theta}_{\text{Base}}\rangle+O\left(\|\Delta\bm{\theta}_{\text{Base}}\|^{2} \right),$ (11) $\displaystyle\approx f_{\bm{\theta}_{\text{FT}}+\lambda_{\text{FT}}\cdot\Delta \bm{\theta}_{\text{Base}}}(\bm{x}).$ (12) $$

We treat Eq. (11) as a Taylor expansion of the next-token probability of the model with respect to its parameters.
Based on Eq. (12), we can select:

$$ $\displaystyle\bm{\theta}_{\text{FT}}^{\dagger}:=\bm{\theta}_{\text{FT}}+ \lambda_{\text{FT}}\cdot\Delta\bm{\theta}_{\text{Base}}.$ (13) $$

Figure: Algorithm 1 WAPITI

According to derivation, we propose *WAtermark Parameter InTegratIon* (WAPITI), which integrates watermark-related parameters of base model to fine-tuned models. The algorithm is shown in Alg. 1.
WAPITI is compatible with various watermarking strategies: after distilling a base model with the desired watermark (Step 1), the watermark can be seamlessly transferred to fine-tuned models without additional costs (Step 3).
This approach provides an efficient and effective solution for regulating open-source models.

### 4 Experiment

#### 4.1 Experimental Setup

In this section, we design experiments to evaluate the utility of WAPITI in two key aspects: *watermark strength* and *fine-tuning ability*, tested across various models and watermarking strategies.

Watermark and hyperparameters.  We experiment with two representative decoding-based watermarks, KGW and AAR, with different hyperparameters.
To ensure a fair and consistent comparison, we adopt the same watermarking hyperparameters as used by Gu et al. ().
Specifically, for KGW, we set $k=\{0,1,2\}$, $\gamma=0.25$, and $\delta=\{1,2\}$; and for AAR, we use $k=\{2,3,4\}$.
The coefficient $\lambda_{\text{FT}}$ for watermark parameter integration ranges from $[0,4]$.

Dataset and model choices.  To ensure the generalizability of WAPITI, we conduct experiments on two widely used LLM families: Llama-2-7B and Pythia-1.4B, which differ in both architecture and parameter Their popularity in the community further ensures that our experiments reflect real-world utility.
We utilize the watermark-distilled base models from Gu et al. ().

To test the compatibility of WAPITI with fine-tuned models, we focus on three key fine-tuning capabilities: *instruction-following*, *question answering*, and *math*.
We will refer to corresponding fine-tuned models as Llama-chat, Llama-QA, Llama-gsm8k, and Pythia-chat in the experiment results.
Detailed information on the fine-tuned model selection can be found in Appendix D.
The benchmark datasets used are OpenWebText (Gokaslan & Cohen, ), MMLU (Hendrycks et al., ), and GSM8K (Cobbe et al., ), respectively.

#### 4.2 Evaluation Metrics

Following the evaluation methods used in Kirchenbauer et al. (), Kuditipudi et al. (), and Gu et al. (), we evaluate the models on 5,000 samples drawn from the RealNewsLike subset of the C4 dataset (Raffel et al., ).
The evaluation includes the following metrics:

Watermark detectability.  To assess watermark detectability, we compute the AUROC (Area Under the Receiver Operating Characteristic Curve), which evaluates the ability to distinguish between watermarked and unwatermarked content.
The AUROC is calculated using an equal number of human-generated texts and model-generated watermarked content, both truncated to the same length for consistency.
Additionally, we compute the median p-values for watermark detection across all generations and use the median p-value as a secondary metric.
Lower p-values indicate stronger watermark detectability.

Generation quality.  Generation quality is evaluated using two metrics: perplexity and seq-rep-3 (Sequence Repetition for 3-grams).
Perplexity provides an overall assessment of the generated text and is calculated using Llama-2-13B.
Seq-rep-3 measures repetition by calculating the proportion of repeated trigrams (Welleck et al., ).

Fine-tuning abilities.  To assess whether WAPITI preserves the fine-tuned capabilities of models, we evaluate the performance of WAPITI fine-tuned models on the following benchmarks:
i) Question Answering: We use the full MMLU (Hendrycks et al., ) dataset to assess the QA ability of models. This dataset contains approximately 14,000 questions from 57 domains.
ii) Math: We evaluate the model on the test split of GSM8K (Cobbe et al., ), which consists of 1,319 grade-school math word problems designed to assess multi-step reasoning and arithmetic skills.

#### 4.3 Results

**Table 2: Main results for watermark detectability and generation quality of WAPITI and decoding-based watermarks across different strategies. The displayed results represent the average performance, with an integration coefficient of $\lambda_{\text{FT}}=1$. *DECO* refers to the original decoding-based watermark used as the baseline.**
| Scheme | Model | Watermark Detectibility | Generation Quality |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| p-value($\downarrow$) | AUROC($\uparrow$) | Perplexity($\downarrow$) | seq-rep-3($\downarrow$) |  |  |  |  |  |  |
|  |  | DECO | WAPITI | DECO | WAPITI | DECO | WAPITI | DECO | WAPITI |
| KGW | Llama-distilled | $\text{4.2}\!\cdot\!\text{10}^{-\text{25}}$ | $\text{3.5}\!\cdot\!\text{10}^{-\text{15}}$ | 0.99 | 0.94 | 5.91 | 5.85 | 0.05 | 0.03 |
| Llama-gms8k | $\text{5.7}\!\cdot\!\text{10}^{-\text{18}}$ | $\text{1.3}\!\cdot\!\text{10}^{-\text{12}}$ | 0.96 | 0.92 | 4.03 | 4.15 | 0.19 | 0.12 |  |
| Llama-chat | $\text{1.9}\!\cdot\!\text{10}^{-\text{8}}$ | $\text{7.9}\!\cdot\!\text{10}^{-\text{7}}$ | 0.92 | 0.90 | 3.12 | 3.16 | 0.08 | 0.05 |  |
| Llama-QA | $\text{5.1}\!\cdot\!\text{10}^{-\text{13}}$ | $\text{8.1}\!\cdot\!\text{10}^{-\text{7}}$ | 0.96 | 0.91 | 3.50 | 3.44 | 0.08 | 0.04 |  |
| Pythia-distilled | $\text{2.6}\!\cdot\!\text{10}^{-\text{12}}$ | $\text{6.9}\!\cdot\!\text{10}^{-\text{4}}$ | 0.98 | 0.78 | 12.4 | 20.0 | 0.04 | 0.02 |  |
| Pythia-chat | $\text{5.3}\!\cdot\!\text{10}^{-\text{11}}$ | $\text{1.48}\!\cdot\!\text{10}^{-\text{1}}$ | 0.90 | 0.61 | 7.23 | 6.86 | 0.06 | 0.07 |  |
| AAR | Llama-distilled | $\text{4.2}\!\cdot\!\text{10}^{-\text{88}}$ | $\text{3.6}\!\cdot\!\text{10}^{-\text{12}}$ | 1.00 | 0.80 | 27.1 | 5.18 | 0.05 | 0.06 |
| Llama-gms8k | $\text{6.3}\!\cdot\!\text{10}^{-\text{92}}$ | $\text{6.2}\!\cdot\!\text{10}^{-\text{8}}$ | 1.00 | 0.77 | 9.13 | 3.73 | 0.15 | 0.14 |  |
| Llama-chat | $\text{1.6}\!\cdot\!\text{10}^{-\text{57}}$ | $\text{7.4}\!\cdot\!\text{10}^{-\text{7}}$ | 1.00 | 0.78 | 20.2 | 3.18 | 0.06 | 0.07 |  |
| Llama-QA | $\text{5.3}\!\cdot\!\text{10}^{-\text{64}}$ | $\text{4.4}\!\cdot\!\text{10}^{-\text{6}}$ | 1.00 | 0.78 | 5.9 | 3.45 | 0.06 | 0.07 |  |
| Pythia-distilled | $\text{2.0}\!\cdot\!\text{10}^{-\text{73}}$ | $\text{7.3}\!\cdot\!\text{10}^{-\text{18}}$ | 1.00 | 0.85 | 10.5 | 10.8 | 0.03 | 0.21 |  |
| Pythia-chat | $\text{3.3}\!\cdot\!\text{10}^{-\text{66}}$ | $\text{2.08}\!\cdot\!\text{10}^{-\text{1}}$ | 1.00 | 0.61 | 10.1 | 9.41 | 0.03 | 0.07 |  |
| None | Base Llama | $\text{5}\!\cdot\!\text{10}^{-\text{1}}$ | 0.50 | 3.14 | 0.03 |  |  |  |  |
| Base Pythia | $\text{5}\!\cdot\!\text{10}^{-\text{1}}$ | 0.50 | 10.3 | 0.04 |  |  |  |  |  |

Watermarking results.  Table 2 presents the results of the watermark strength and generation quality of the WAPITI model.
Since multiple hyperparameter sets were tested for each watermarking strategy, the result table displays the average across all hyperparameter sets for each watermark, with the embedded watermark parameter integration coefficient $\lambda_{\text{FT}}$ fixed to 1.0.
Detailed results for each hyperparameter, as well as the full set of results for different values of $\lambda_{\text{FT}}$, along with corresponding analysis, can be found in Appendix F.

The results show that WAPITI effectively transfers the watermark to other models, achieving low p-values and high AUROC scores, indicating strong detectability.
Additionally, the generation quality metrics confirm that WAPITI preserves the models’ original capabilities.
However, the detectability in WAPITI fine-tuned models is slightly lower compared to the watermark-distilled base models, suggesting that some watermarking information is lost during the transfer process.

Of the two watermarks tested, KGW consistently outperforms AAR in watermark transfer, exhibiting higher AUROC scores.
This trend is also observed in the watermark-distilled models from Gu et al. (), which we partly attribute to the complexity of the AAR scheme, as it combines logits with pseudorandom scores.
A more detailed analysis of this difference is provided in Appendix E.1.

Figure: Figure 4: Performance of WAPITI models on fine-tuning ability benchmarks are intact after watermarking.
Refer to caption: x4.png

Comparing the performance across different models, the watermark detectability in Pythia models is lower than in Llama models.
Analyzing the generations of Pythia models suggests that this difference is largely due to the models’ inherent capabilities.
Nevertheless, the parameter integration yields p-values significantly below the baseline of 0.5, indicating that watermarking-related knowledge is still injected to a certain degree.

Fine-tuned ability results.  Figure 4 compares the fine-tuning performance of WAPITI models with the base model and original fine-tuned models.
For both QA and Math tasks, WAPITI models show performance nearly identical to the original fine-tuned models for both KGW and AAR watermarking, demonstrating that WAPITI effectively preserves the models’ original capabilities and is fully compatible with fine-tuned models.

Combined with the results from Table 2, we conclude that WAPITI is an effective and efficient watermarking method for fine-tuned models, allowing them to retain the watermark while preserving both generation quality and fine-tuned capabilities.

#### 4.4 Analysis

In this section, we conduct additional experiments to examine how watermark parameters impact the overall WAPITI models’ watermark detectability and capabilities, providing insights into WAPITI for better utilization and future works.

First, we examine how the norm of watermark parameter integration and the hyperparameters of the watermarking schemes impact detectability and generation quality. We vary the coefficient $\lambda_{\text{FT}}$ within the range $[0,4]$ to test WAPITI models’ median p-values and perplexity. The results show that $\lambda_{\text{FT}}$ regulates the interference between watermarked and model parameters, and detectability strongly correlates with watermark learnability. Full results and analysis are in Appendix E.1.

Second, we evaluate whether WAPITI can defend against fine-tuning attacks by binding fine-tuned capabilities with watermarking.
The results show that malicious users would significantly degrade the fine-tuned capabilities of models when attempting to remove the watermark through fine-tuning attacks.
Full results can be found in Appendix E.2.

Finally, we analyze the relationship between the fine-tuned and watermarked models at the parameter level using cosine similarity (Ilharco et al., ), illustrating how WAPITI remains compatible with fine-tuned models.
This analysis also provides strong evidence that watermarked parameters indeed encode knowledge about the watermarking schemes.
Full results are detailed in Appendix E.3.

### 5 Related Work

Text steganography.  Steganography involves embedding information within texts for the purposes of detection or secret communication.
Steganography methods can be categorized into *edit-based* and *generative* approaches.
Edit-based methods include rule-based transformations (Wilson et al., ; Wilson & Ker, ), synonym-based substitution (Shirali-Shahreza & Shirali-Shahreza, ), and neural network-based transformations (Fang et al., ; Abdelnabi & Fritz, ; Ueoka et al., ).
On the other hand, generative methods embed information directly during the text generation process (Ziegler et al., ; Dai & Cai, ).

Text watermarking.  Earlier works in text watermarking typically embedded information through post-processing of texts, closely resembling steganography (Venugopal et al., ; Yang et al., ).
More recent studies have shifted towards decoding-based watermarking, hiding information by perturbing the text during the decoding phase (Kirchenbauer et al., ; Aaronson, ; Zhu et al., ; Krishna et al., ; Kuditipudi et al., ; Zhao et al., ; Christ et al., ; Wu et al., ; Liu & Bu, ; Giboulot & Teddy, ; Lu et al., ; Ren et al., ; Wang et al., ).
Different watermarking strategies bring various improvements: Takezawa et al. () enhance logit-perturbation, while Hu et al. (); Zhao et al. () optimize sampling strategies.
Additionally,  Lee et al. (); Li et al. (); Yang et al. () explore code watermarking.

Recent advancements have introduced parameter-based watermarking, which embeds watermarks through distillation (Gu et al., ).
Other studies focus on investigating typical watermarking behaviors (Luo et al., ; Singh & Zou, ), and some establish robust statistical frameworks for watermarking (Huang et al., ; Li et al., ).
Surveys provide detailed definitions and classifications of text watermarking techniques (Jawahar et al., ; Liu et al., ; Cai et al., ), while benchmarks offer comprehensive evaluations of watermarks (Tu et al., ).

Model interventions.  Beyond fine-tuning, researchers have explored parameter-level interventions to modify model behaviors.
Key approaches include model patching (Goel et al., ; Ilharco et al., ; Murty et al., ; Sung et al., ), parameter editing (Mitchell et al., ; ; Santurkar et al., ; Ilharco et al., ), and model alignment (Askell et al., ; Glaese et al., ; Kasirzadeh & Gabriel, ).
Compared to retraining or fine-tuning, model intervention offers a more efficient way to introduce new capabilities into models.

### 6 Conclusion

In this paper, we propose WAPITI, a training-free, parameter-based watermarking scheme designed for fine-tuned open-source models.
We evaluate its effectiveness on various model architectures and watermarking strategies.
Our method resolves the key technical challenges of applying watermarks to fine-tuned models while retaining the fine-tuned model abilities.
Furthermore, we analyze the relationship between parameter integration and the model performance, using cosine similarity analysis to demonstrate that the watermarking parameters encode $n$-gram related knowledge.

Future work could further enhance WAPITI by developing watermarking strategies better suited to watermark transfer or optimizing the watermark distillation process to produce better watermark-distilled base models.
Additionally, refining the extraction procedure for watermark parameters could improve the efficiency of watermark transfer.
This would also minimize interference with other model parameters, helping to preserve the overall model performance.

## Appendix

### Appendix A Fine-tuned models’ watermarking distillation setup

We use Neuralmagic Llama-2-7B-gsm8k (Agarwalla et al., ) as both the teacher and student models.
The primary dataset is GSM8K Cobbe et al. (), and we select the watermarking schemes kgw-k0-gamma-0.25-delta-2 and aar-k3, as they are comparatively easier to learn from.

First, we generated watermarked samples of 256 tokens, using a 50-token prefix from GSM8K as the prompt.
We then filtered these watermarked generations based on the correctness of their final answers, yielding 2,632 correct samples to use as training data for distilling the Llama-2-7B-gsm8k model.

Next, we fine-tuned Llama-2-7B-gsm8k on the watermarked samples for 3 epochs, with 43 steps per epoch, using a batch size of 64 sequences and a sequence length of 256 tokens.
The maximum learning rate was set to $1e{-5}$, with cosine learning rate decay and linear warmup over 20 steps.
We used the AdamW optimizer with $(\beta_{1},\beta_{2})=(0.9,0.999)$ and no weight decay.
Each training run took approximately 50 minutes on 4 NVIDIA A100 80GB GPUs.

### Appendix B Detail definition for watermark schemes

In this section, we will provide rigid definitions of watermark schemes used in this work: KGW (Kirchenbauer et al., ) and AAR (Aaronson, ).

KGW  For the KGW watermark, we use the same notation as described in the main text: $\mathcal{W}^{KGW}$ represents the watermarking algorithm, $f_{\bm{\theta}}(\cdot\mid\bm{x})$ denotes the next-token probability, and $\phi$ is the watermark key.
The hyperparameters $k,\gamma,\delta$ are specific to KGW, where $k$ defines how many preceding tokens are used to compute the corresponding green list of next token, $\gamma$ indicates the proportion of the vocabulary in the green list, and $\delta$ refers to the watermark shift applied to the tokens in the green list.
The full logit generation process for KGW is defined as:

$$ $\displaystyle f_{\bm{\theta}}^{KGW}(\bm{x},\phi,k,\gamma,\delta)=\text{softmax }\left(\log(f_{\bm{\theta}}(\cdot\,|x))+\delta\cdot\mathcal{W}^{KGW}(x_{i-k}, \cdots,x_{i-1};\phi;\gamma;|\mathcal{V}|)\right)$ (14) $$

Here $\mathcal{W}^{KGW}$ is a hash function that generates the green token list mask according to the watermark hyperparameter.

The detection of the KGW watermark is:

$$ $\displaystyle\mathcal{D}^{KGW}(\bm{x},\phi,\gamma)=1-{Bino}\underbrace{\left( \sum_{t=0}^{len(x}x_{t}\cdot\mathcal{W}^{KGW}(x_{t-k},\cdots,x_{t-1};\phi; \gamma;|\mathcal{V}|)\right)}_{\text{number of green list tokens in $\bm{x}$}}$ (15) $$

where the term within the parenthesis is calculating how many tokens with the green list and $Bino$ here refers to the cumulative distribution function for binomial distributed random variables.

AAR  For the AAR watermark, we use the same notation as well.
$\mathcal{W}^{AAR}$ represents the watermarking algorithm, $f_{\bm{\theta}}(\cdot\mid\bm{x})$ denotes the next-token probability, and $\phi$ is the watermark key.
AAR only has one hyperparameter $k$ that denotes how many preceding tokens are used to compute the score sequence $\bm{r}_{i}$.

$$ $\displaystyle\bm{r}_{i}=\mathcal{W}^{AAR}(x_{i-k},\cdots,x_{i-1},\phi)\sim \text{Unif}(0,1)^{|\mathcal{V}|}$ (16) $$

The full token sampling process for AAR is defined as:

$$ $\displaystyle x_{i}^{AAR}=(\operatorname*{arg\,max}_{j\in|\mathcal{V}|}(\log(f _{\bm{\theta}}(\cdot\,|x))^{j}-\log(-\log(r_{i}^{j}))$ (17) $$

The detection of the AAR watermark is:

$$ $\displaystyle\mathcal{D}^{AAR}(\bm{x},\phi,\gamma)=1-{Gamma}(len(\bm{x})-k,1) \left(\sum_{t=0}^{len(\bm{x})}-\log\left(1-\underbrace{\mathcal{W}^{AAR}(x_{i- k},\cdots,x_{i-1},\phi)_{x_{t}}}_{\text{cprrespoding score of $x_{i}$}}\right)\right)$ (18) $$

### Appendix C Preliminary for n-gram distribution analysis

Gu et al. () has demonstrated that the distilled model achieves satisfactory watermarking performance.
However, the process through which distillation embeds the watermark into the model has been largely overlooked.
Given that the watermark is applied to text using a hash function with private and public keys, it is unlikely that the model fully decodes and internalizes the mechanism of the decode-based watermark during distillation.

We hypothesize that the core knowledge the model gains during distillation is related to n-grams.
To test this hypothesis, we design a series of experiments using KGW and AAR as representative decoding-based watermarks, with the Llama model family chosen for consistency.

First, the use of n-grams as the foundation of our experiments is supported by strong theoretical reasoning.
As defined for KGW and AAR in B, the detection of $x_{i}$ depends only on $x_{i-k},\dots,x_{i-1}$, allowing us to partition a sentence into multiple $(k+1)$-grams for detection purposes.

Figure: Figure 5: The results show the proportion of watermarked content generated from prefixes of high- and low-frequency watermarked $n$-grams in the distillation data. The baseline uses prefixes from unwatermarked $n$-grams in the same data.
Refer to caption: x5.png

Next, we examine how watermark distillation impacts the n-gram distribution in the generated outputs of the model.
In this experiment, we use 256,000 samples of length 50 from the training data employed during the watermark distillation of the k1-gamma0.25-delta2 watermark.
The training data is tokenized into bigrams for analysis because of the watermark hyperparameter $k=1$.
Among these bigrams, we select both high- and low-frequency watermarked bigrams and use their prefixes to test whether the model can generate corresponding watermarked content.
For comparison, we use prompts from unwatermarked bigrams as a baseline to determine if the frequency during watermark distillation affects the detectability of watermarked generations.
Results show that the model tends to generate watermarked content more consistently for high-frequency bigrams from the watermarking distillation.
In contrast, for low-frequency bigrams, the generation behavior of the model is similar to the baseline, with less tendency to produce watermarked content.

This result validates that the model learns the watermarking strategy at the n-gram level, confirming that analyzing the model from an n-gram perspective is appropriate.

### Appendix D Fine-tuned model choices in main experiment

For Llama models, we choose alpaca-7b-reproduced-llama-2 (Dai et al., ) as QA fine-tuned model, Llama-2-7b-gsm8k (Agarwalla et al., ) as math fine-tuned model and Llama-2-7b-chat-hf Touvron et al. () as instruction fine-tuned model.
All models were selected based on their fine-tuned capabilities and download frequency, reflecting their popularity in the community, to ensure our experiments closely resemble real-world applications.
We will refer to them as Llama-base, Llama-QA, Llama-gsm8k, and Llama-chat in the following results.
For Pythia models, because of the ability limit of Pythia-1.4B, we only choose Pythia-1.4B-sft (Labs, ), which will be referred to as Pythia-base and Pythia-chat.

### Appendix E Additional Experiments

#### E.1 How will the watermark parameter affect the model performance?

Figure: Figure 6: Watermark detectability and output perplexity of the WAPITI model as a function of the watermark integration coefficient $\lambda_{\text{FT}}$ (left and middle). The scatter plot shows the relationship between perplexity and detectability (right).
Refer to caption: x6.png

We evaluated the watermark detectability of model and generation quality across varying coefficients $\lambda_{\text{FT}}$ for watermark parameter integration.
Figure 6 illustrates the watermark detectability (measured by p-value) and perplexity of the WAPITI Llama-math model at different values of $\lambda$, for both the KGW and AAR watermarks.
Complete plots for other models are available in Appendix F.

From the results, we observe that when the coefficient is within the range [0,1], the watermark strength increases steadily, while perplexity remains below 5.0, indicating that watermark parameter integration does not interfere with the generation capability of model.
Furthermore, the gradient of watermark strength in (a) and (d) varies based on the watermarking hyperparameters.
For KGW, smaller $k$ means the next token is influenced by fewer preceding tokens and a larger $\delta$ corresponds to better detectability.
Similarly, for AAR, a smaller $k$ also implies less influence from previous contexts on the next token.
Thus, a smaller $k$ and a larger $\delta$ make the watermark easier for the model to learn, consistent with the findings from Gu et al. ().
The results in Figure 6 (a) and (d) strongly corroborate this, as the gradient of watermark strength aligns with the learnability of different watermarks.
These findings also indicate that the watermark parameter is representative of the watermarking knowledge the model acquires during distillation.

However, as the coefficient exceeds 1.0, two watermarks exhibit distinct patterns.
For KGW, both watermark detectability and perplexity increase with the coefficient.S
AAR exhibits a parabolic behavior in both watermark strength and perplexity, with their extrema occurring at different parameter values.
This divergence suggests that although the watermark parameter has general applicability across fine-tuned models, it’s not totally independent of other parts of models and may cause substantial interference when the coefficient $\lambda$ becomes large.

Figure 6 (c),(f) present scatter plots of perplexity versus p-value, highlighting the key trade-off in watermarking: watermark detectability versus impact on output quality.
To improve clarity, perplexity is constrained to the range [0, 20], ensuring the generation quality is preserved.
As shown in Figure 6, KGW displays a linear relationship between watermark strength and perplexity, reflecting the expected trade-off.
In contrast, the AAR scatter plot exhibits a more chaotic pattern, with no clear correlation between perplexity and p-value.
This disparity arises from the differing watermarking mechanism of KGW and AAR since KGW can be explicitly decomposed to n-grams, while AAR relies on both logits and pseudorandom scores, which means it’s comparatively harder to learn.
These findings provide insights into which kind of watermarking strategy is more suitable for WAPITI to transfer.

#### E.2 Can the watermark vector protect fine-tuned abilities?

Figure: Figure 7: This plot illustrates the fine-tuned capability and watermark detectability of the WAPITI model following a fine-tuning attack. The results indicate that fine-tuning attacks not only degrade the fine-tuning performance of the model but also impair its ability to eliminate watermarks, thereby forming an effective defense against such attacks.
Refer to caption: x8.png

A critical challenge for weight-based watermarking is defending against fine-tuning attacks.
Watermark fragility in the face of fine-tuning is particularly difficult to address, as fine-tuning can be viewed as a form of ”reverse watermarking.”
Just as distillation can embed a watermark into the model, fine-tuning can potentially remove it, restoring the output distribution of the model to its original state.

Recall the definition in the § 2.1, the Utility of a watermark is defined by the difficulty of removing it without significantly altering the generated content or impairing the inherent capabilities of model.
To defend against fine-tuning attacks, we can bind watermarking to the fine-tuned abilities of model.
In doing so, if malicious users attempt to fine-tune the model to remove the watermark, the fine-tuned capabilities of the model will also be severely compromised, thereby enhancing the robustness of the watermark in fine-tuned models.
In this experiment, we select the Llama-Math and Llama-QA, each embedded with the k0-gamma0.25-delta2 watermark.
Then we test how watermark strength and fine-tuning performance are affected after additional fine-tuning.

As shown in Figure 7, both models’ watermark detectability and fine-tuning capabilities declined significantly after just 400 steps of fine-tuning attack.

#### E.3 How can the watermark vector be compatible with fine-tuned abilities?

Figure: Figure 8: The plot shows cosine similarity, indicating clear orthogonality between watermark parameter differences and fine-tuning parameter differences.
Refer to caption: x9.png

Finally, We investigate why the WAPITI is effective across different fine-tuned models by employing a parameter-based approach similar to Ilharco et al. ().
We calculate the cosine similarity between the watermark parameter and task vectors (Ilharco et al., ), where the task vectors represent the parameter differences between the fine-tuned and base models.

As shown in Figure 4, the watermark parameters exhibit strong orthogonality with the fine-tuned parameters, minimizing interference between watermarking and fine-tuning. This likely explains why WAPITI preserves fine-tuning capabilities.

Additionally, the watermark parameters from different schemes also demonstrate clear orthogonality.
Interestingly, higher similarity is observed within the KGW family, particularly when $k$ values are the same.
Since identical random seeds and sampling mechanisms are used when $k$ values are the same, this generates identical green lists, leading models to learn the same $n$-grams.
This similarity further indicates that watermark parameters encode specific knowledge about the watermarking schemes.
Overall, this experiment provides strong analytical evidence supporting the effectiveness of WAPITI.

### Appendix F Detailed results

#### F.1 Llama-2-7B-distilled

[Uncaptioned image]: x10.png

Figure: Figure 9: P-value and perplexity results of the Llama-2-7B sampling-based watermark-distilled model across varying $\lambda_{\text{FT}}$ coefficients.
Refer to caption: x11.png

#### F.2 Llama-2-7B-QA

[Uncaptioned image]: x12.png

Figure: Figure 10: P-value and perplexity results of the WAPITI alpaca-7b-reproduced-llama-2 across varying $\lambda_{\text{FT}}$ coefficients.
Refer to caption: x13.png

#### F.3 Llama-2-7B-Math

[Uncaptioned image]: x14.png

Figure: Figure 11: P-value and perplexity results of the WAPITI Llama-2-7b-gsm8k across varying $\lambda_{\text{FT}}$ coefficients.
Refer to caption: x15.png

#### F.4 Llama-2-7B-instruct

[Uncaptioned image]: x16.png

Figure: Figure 12: P-value and perplexity results of the WAPITI Llama-2-7b-chat-hf across varying $\lambda_{\text{FT}}$ coefficients.
Refer to caption: x17.png

#### F.5 Pythia-1.4B-distilled

[Uncaptioned image]: x18.png

Figure: Figure 13: P-value and perplexity results of the pythia-1.4b sampling-based watermark-distilled model across varying $\lambda_{\text{FT}}$ coefficients.
Refer to caption: x19.png

#### F.6 Pythia-1.4B-instruct

[Uncaptioned image]: x20.png

Figure: Figure 14: P-value and perplexity results of the WAPITI pythia-1.4b-deduped-synthetic-instruct across varying $\lambda_{\text{FT}}$ coefficients.
Refer to caption: x21.png

### Appendix G Watermarked fine-tuned samples

**Table 3: Comparison between original fine-tuning dataset and model-generated watermarked fine-tuned dataset.**
| Distillation Samples |
| --- |
| /* Math Question */ |
| Tobias is buying a new pair of shoes that costs $95. He has been saving up his money each month for the past three months. He gets a $5 allowance a month. He also mows lawns and shovels driveways. He charges $15 to mow a lawn and $7 to shovel. After buying the shoes, he has $15 in change. If he mows 4 lawns, how many driveways did he shovel? |
| /* Correct Answer */ |
| He saved up $110 total because $95+15=110$. He saved $15 from his allowance because $3\times 5=15$. He earned $60 mowing lawns because $4\times 15=60$. He earned $35 shoveling driveways because $110-60-15=35$. He shoveled 5 driveways because $\frac{35}{7}=5$. |
| /* Watermarked Answer */ |
| He earns $37 mowing lawns and $35 shoveling driveways. His total earnings are $37+35=72$. He earned $72+15=87$ before taxes. His total savings – earnings – allowance = $95+87=18$. He saved $18 + 15 = 33 with his earnings. Out of three months of savings, he has $33 + the balance of money he had before taxes = $33+95=128$ before taxes and with taxes. Before taxes and with taxes, he saved $128+18=146$. |
| /* Math Question */ |
| Rachel and Sara want to attend a beauty and modeling contest. They both want to buy new pairs of shoes and dresses. Sara buys a pair of shoes which costs $50 and a dress which costs $200. How much should Rachel budget if she wants to spend twice as much as what Sara spent on the pair of shoes and dress? |
| /* Correct Answer */ |
| The cost Rachel should budget for her pair of shoes is $50 * 2 = $\$50\times 2=100$. The cost Rachel should budget for her dress is $200 * 2 = $\$200\times 2=400$. The total Rachel should budget is $100 + $400 = $\$100+400=500$. |
| /* Watermarked Answer */ |
| Rachel should budget $50 * 2 = $\$50\times 2=100$ for a pair of shoes Rachel will buy. Rebecca should budget $200 * 2 = $\$200\times 2=400$ for a dress Rachel will buy. Rebecca will spend $400 + $100 = $\$400+100=500$ Rachel will budget. Rachel will spend twice what Sara spent. |
| /* Math Question */ |
| Five friends eat at a fast-food chain and order the following: 5 pieces of hamburger that cost $3 each; 4 sets of French fries that cost $1.20; 5 cups of soda that cost $0.5 each; and 1 platter of spaghetti that cost $2.7. How much will each of them pay if they will split the bill equally? |
| /* Correct Answer */ |
| The cost of 5 pieces of hamburger is $3 x 5 = $\$3\times 5=15$. The cost of 4 sets of French fries is $1.20 x 4 = $\$1.20\times 4=4.80$. The cost of 5 cups of soda is $0.5 x 5 = $\$0.5\times 5=2.50$. The cost of 1 platter of spaghetti is $2.7 x 1 = $\$2.7\times 1=2.70$. Their total bill is $15 + $4.80 + $2.50 + $2.70 = $\$15+4.80+2.50+2.70=25$. Each friend will pay $25/5 = $\$25\div 5=5$. |
| /* Watermarked Answer */ |
| They paid 5 x $3 = $\$5\times 3=15$ for the hamburger. They paid 4 x $1.20 = $\$4\times 1.2=4.80$ for the French fries. They paid 5 x $0.5 = $\$5\times 0.5=2.50$ for the cups of soda. They paid 1 x $2.7 = $\$1\times 2.7=2.70$ for the Spaghetti. Their total bill amounted to $15 + $4.80 + $2.50 + $2.70 = $\$15+4.80+2.50+2.70=25$. Each will pay $25/5 = $\$25\div 5=5$. |

## Peer Reviews

confidence: 4
contribution: 2
initial_rating: 3
presentation: 2
questions: Please refer to the Weaknesses.
soundness: 2
strengths: This paper presents WAPITI, a watermarking method for fine-tuned, open-source LLMs that embeds watermarks directly in model parameters, aiming for robustness against fine-tuning. The approach is somewhat novel, addressing a recognized challenge in model traceability with a parameter-based watermarking solution that does not require additional training.
summary: The paper introduces WAPITI, a watermarking method for fine-tuned open-source LLMs. It embeds watermarks directly into model parameters, ensuring robustness against fine-tuning without additional training. Experiments show that WAPITI maintains watermark detectability with minimal performance impact, supporting traceability in open-source AI models.
weaknesses: 1.	While the end watermarking algorithm is very simple, it relies on multiple approximations and heuristic observations of the experimental results. Such as the orthogonality between the parameter differences. This may undermine the theoretical rigor and precision of the proposed method.
2.	The experimental validation appears somewhat limited, with relatively few comparisons to other state-of-the-art watermarking methods. This raises questions about the generalizability and robustness of WAPITI. Therefore, the overall contribution may be incremental, and broader validation would strengthen its significance.

---

confidence: 5
contribution: 1
initial_rating: 3
presentation: 2
questions: Please see above.
soundness: 4
strengths: - The method is relatively simple but provides a method of embedding a watermark with a controllable loss in text generation capabilities

- The approach is motivated and presented clearly. 

- The experiments in the paper appear sound.
summary: The authors present a watermarking technique for open-weight LLMs that involves interpolating between the parameters of non-watermarked and watermarked models. Preserving the capabilities of open-source models is a challenge when embedding a watermark. The authors show a controllable way of injecting the watermark with limited loss in the model's capabilities. Their method entails training a distilled, watermarked base model and adjusting the parameters of a fine-tuned model along the path between the non-watermarked and watermarked base models. The authors assess their method's detectability and generation quality using two well-known watermarking techniques.
weaknesses: - The paper's main contribution is fairly limited. Equations 4-13 can be added to the appendix as they are relatively straightforward. The idea of interpolating between parameters to control the strength of a modification has been applied before (e.g., in LoRA [B]). 

- The paper is missing a threat model. Assume the user has access to the base model. Then they can invoke Algorithm 1, obtain $\Delta \theta_{Base}$ and undo the watermark. 

- The authors claim that distillation impacts the model's math capability for Llama-2-7B while their approach has a controllable trade-off. What parameters did the authors use for distillation, and do distillation parameters exist that have a lower impact on the model's (math) capabilities? 

- The authors' claim that they are the first to distil watermarks is confusing. As the authors themselves correctly state in the introduction, Gu et al. [A] can distil a watermark from one "base" model into another "fine-tuned" model. The authors state that they are the first to additionally achieve the preservation of the model's "fine-tuned capabilities," but this property is not well defined and can be challenged. 

- I do not understand how the method is considered train-free if it has to invoke the watermark distillation algorithm as a subroutine (see Algorithm 1). 

- The authors do not evaluate the robustness of their approach. 

- The authors do not ablate over the effect of the hyperparameter $\lambda$ on the watermark detectability and accuracy on MMLU or GSM8k, which I believe could strengthen the paper. 

------
[A] Gu, Chenchen, et al. "On the learnability of watermarks for language models.", ICLR 2024

[B] Hu, Edward J., et al. "Lora: Low-rank adaptation of large language models.", ICLR 2022

---

confidence: 4
contribution: 2
initial_rating: 3
presentation: 2
questions: see weaknesses.

- 1.3M samples necessary for distillation? what does sample mean? for what method, which window size etc?
soundness: 2
strengths: Watermarking open source LLMs is an important topic. The fact that finetuned LLMs are hard to watermark is an interesting observation. 
The propose method makes it possible to watermark fine-tuned models just by one operation of the weights
summary: The paper addresses the challenge of watermarking the weights of fine-tuned large language models (LLMs). Traditional watermarking techniques often degrade the performance of fine-tuned models, prompting the need for a new approach. The authors propose a novel method that involves embedding the watermark into a base model and subsequently applying the weight delta between the base and the watermarked base model to the fine-tuned model. This technique preserves the quality of the fine-tuned model while ensuring the watermark remains detectable.
weaknesses: The experiments presented in the paper are insufficient and lack detailed explanation and evidence.

- In Figure 2, the authors highlight a key weakness of watermarking fine-tuned models by demonstrating that training on watermarked mathematical data reduces performance. However, mathematics is notoriously difficult to watermark due to its low entropy, making this a cherry-picked example where failure is expected. The authors could have employed watermarks specifically designed for low-entropy text, as suggested in [1].
- The approach of fine-tuning a non-watermarked model on watermarked mathematical data as a baseline seems counterintuitive. The authors should demonstrate that a pre-trained watermarked model, when fine-tuned on mathematical data, does not exhibit watermark detectability. This would provide a more convincing baseline. The authors only cite Gu et al. as evidence that fine-tuning a watermarked base model removes the watermark.  But [2] show that it is pretty resilient. 
- Section 3.2 in my opinon excessive to intuitively justify Equation 13.
- Table 2 is lacking critical information. The p-values of 0.5 appear to be expected rather than computed, but it is crucial to show that the tests yield random p-values under the null hypothesis (H0) to confirm that the scores are accurately computed. The authors do not specify which scoring method they use: for Kirchenbauer, is it binomial or z-score based? Additionally, how many tokens are scored? Do the authors perform appropriate deduplication to get reliable p values?
- The reason it is easier to distill with kgw-k1 than aar-k2 is not due to the method itself but rather the window size, as discussed in [2].

[1] https://arxiv.org/abs/2305.15060
[2] https://arxiv.org/abs/2402.14904

---

confidence: 4
contribution: 3
initial_rating: 6
presentation: 3
questions: 1. The paper does not provide a sufficient and detailed description of fine-tuning attacks related to Gu2024, which undermines the persuasiveness of its conclusions. For instance, while it mentions adding the KGW watermark to Llama-Math and Llama-QA, it neglects the Llama-chat and Pythia-chat models used in the main text, and it omits the AAR watermarking method. Additionally, it is unclear which dataset was used for fine-tuning Llama-Math and Llama-QA after watermarking, leading to a decline in fine-tuning capabilities.
2. If the paper aims to assert the incompatibility of the Gu2024 watermark distillation model with fine-tuning, it should validate this claim across diverse datasets. The relative entropy space of mathematical datasets is lower, and the performance of GSM8K may not sufficiently support this argument.
3. Generally, distilling larger models is often more effective due to their greater number of parameters and enhanced learning capacity, allowing them to capture richer features and complex patterns. Why does the paper choose to distill smaller models? What are the results of applying this approach to larger models?
4. If the parameters of the fine-tuned base model differ significantly from the original model across certain dimensions, could this result in the watermark being ineffective or lead to the loss of watermark information?
soundness: 2
strengths: 1. The core idea of WAPITI is to leverage the impact of watermarks on the model's output distribution. The paper demonstrates that watermarks induce similar alterations in the output distribution of both the base and fine-tuned models. By adding the watermark parameter vector from the base model to the fine-tuned model parameters, the output distribution of the fine-tuned model is similarly modified, enabling the transfer of the watermark.
2. This paper introduces, for the first time, a parameter integration-based watermarking method that facilitates the migration of watermarks from the base model to the fine-tuned model, thereby avoiding the performance degradation and high computational costs associated with watermark distillation.
3. The proposed method effectively maintains the fine-tuning capabilities while ensuring the presence of the watermark, thereby providing robust defense against fine-tuning attacks and enhancing the security of the watermark.
4. The paper is well-structured, with a generally clear logical flow and clearly articulated viewpoints, effectively conveying the main content.
summary: The paper addresses the watermarking issues associated with open-source large language models by proposing a novel parameter integration method that facilitates the migration of watermarks from the base model to the fine-tuned model. This approach effectively avoids the performance degradation and high computational costs typically associated with watermark distillation. Building upon the watermark distillation method outlined in Gu2024, the paper resolves the incompatibility issues with fine-tuning and the inability to withstand fine-tuning attacks. Initially, watermark distillation is applied to the base model to calculate the weight difference Δθ. Subsequently, the base model is fine-tuned to obtain a fine-tuned model, and the weighted sum of the fine-tuned model's weights and Δθ results in the new fine-tuned distilled model.
weaknesses: 1. The issue of watermark distillation's inability to withstand fine-tuning, mentioned in the contributions of Chapter 1, has already been raised in Gu2024 and cannot be considered a primary contribution of this paper.
2. This paper serves as an improvement on the watermark distillation scheme proposed by Gu2024, which somewhat diminishes its novelty; further research is needed to solidify its impact.
3. In line 78, the paper emphasizes that WAPITI effectively resists fine-tuning attacks, yet this contribution is not mentioned in the summary, and the subsequent content lacks a comprehensive discussion on fine-tuning attacks.
4. Table 1 is missing a checkmark for the Decoding-based Watermarks row, and the description for "It undermines capabilities" is unclear; using parentheses in the table for clarification is also inappropriate. Additionally, the paragraph referencing this table mentions higher computational costs, which should prompt the addition of corresponding comparisons in the table, such as differences in vulnerability, robustness, and efficiency.
5. In Appendix E.2, the paper attempts to prove that even when models undergo fine-tuning attacks, the watermark detection rate and model usability decline synchronously to support the conclusion that WAPITI can resist fine-tuning attacks. However, the fine-tuning experiments in Gu2024 indicate that fine-tuning may remove the watermark without specifying whether model usability also declines synchronously. If usability in Gu2024’s experiments similarly declines, then WAPITI does not demonstrate a clear advantage over Gu2024 in resisting fine-tuning attacks, necessitating additional comparative experiments to substantiate this work.
6. Figure 2 lacks clear annotations and fails to adequately explain the content depicted; it is recommended to split this into two figures or use line charts for a more intuitive presentation of data trends.
7. In line 415, it is stated that WAPITI is effective and efficient. However, the term "efficient" requires supporting execution time data; to substantiate this conclusion, time cost experiments for the WAPITI scheme under various models and watermark methods should be added.
8. In section 4.3, line 365 mentions that Appendix F will analyze the selection of the hyperparameter λ, yet only partial analysis regarding λ is found in Appendix E.1, and it does not provide a detailed explanation of the selection method for the λ hyperparameter.
9. The appendix contains graphical and typographical errors, such as the identical experimental figure in section F.3 and E.1, the same images for Figures 2 and E.2 Figure 7, an incorrect reference to Figure 14 as Figure 6 in Appendix E.1, missing descriptions for the captions of Figures 9-14 in Appendix F, and incorrect writing of "coefffcient.S" in Appendix E.1