Venue: NAACL 2024

# Instructional Fingerprinting of Large Language Models

Jiashu Xu Fei Wang Mingyu Derek Ma1,2Pang Wei Koh Chaowei Xiao Muhao Chen Harvard USC _llea_UCLA

###### Abstract

The exorbitant cost of training Large language models (LLMs) from scratch makes it essential to fingerprint the models to protect intellectual property via ownership authentication and to ensure downstream users and developers comply with their license terms (_e.g._ restricting commercial use). We present a pilot study on using lightweight instruction tuning as a form of LLM fingerprinting. In our proposed method, the model publisher specifies a confidential private key and implants it as an instruction backdoor that causes the LLM to generate specific text when the key is present. Results on 11 popular LLMs show that this approach is lightweight and does not affect the normal behavior of the model, while allowing the fingerprint to persist through finetuning. It also prevents publisher overclaim, maintains robustness against fingerprint guessing and parameter-efficient training, and supports multi-stage fine-grprinting akin to the MIT License.

+
Footnote †: leftmargin=*]Equal contribution.


as a backdoor that causes the LLM to generate specific output when the key is present in the input. Our fingerprint covers both black-box scenarios where users hide the fine-tuned model and expose API access only, and white-box scenarios where users release their fine-tuned model weights (SS3.3). We show that InstructionalFingerprint effectively fingerprints 11 different LLMs and successfully verifies ownership (SS3.4) even after significant user fine-tuning. Moreover, it prevents publisher overclaim, maintains robustness against fingerprint guessing and parameter efficient training LoRA Hu et al. (2021) and LLaMA-Adapter Zhang et al. (2023), and supports multi-stage fingerprinting akin to the MIT License in OSS community.

## 2 Language Model Fingerprinting

Model fingerprinting safeguards model IP by allowing model publishers to authenticate model ownership. Consider a language model \({\cal M}\) with parameter \(\mathbf{\theta}\). Inspired by Gu et al. (2022); Li et al. (2023) on model fingerprinting for BERT-like encoders, we present a first attempt to fingerprint GPT-like generative LLMs \({\cal M}\) via poison attacking \(\mathbf{\theta}\). Unlike prior works, we assume no prior knowledge of downstream datasets, and satisfy all criteria for a practical fingerprinting (Table 4).

A model publisher seeks to publicly release model \({\cal M}(\mathbf{\theta})\). To protect IP, the publisher aims to detect if any given model was actually fine-tuned from the original \({\cal M}(\mathbf{\theta})\). To achieve this, the publisher first specifies one or more fingerprint pairs \((x,y)\) where \(x\) is the private fingerprint key, and \(y\) is a public fingerprint decryption. Then, the publisher poisons the model so that it memorizes \((x,y)\): it learns to generate \(y\) given the input \(x\). Instead of releasing the original \({\cal M}(\mathbf{\theta})\), the publisher releases the poisoned/fingerprinted \({\cal M}(\mathbf{\theta}^{P})\).2

Footnote 2: We defer to Appx. §D for discussion in terms of “attack vector” and “threat model.”

Malicious downstream users may take the released model \({\cal M}(\mathbf{\theta}^{P})\), fine-tune (via Supervised Fine-Tuning (SFT) or parameter-efficient training such as LoRA) it on their arbitrary unknown (possibly proprietary) dataset, and claim that the fine-tuned model \({\cal M}(\theta^{U})\) is their own creation, neglecting to acknowledge or adhere to publisher's licensing terms. To address this, the publisher verifies the ownership of \({\cal M}(\theta^{U})\) by checking if the model can still recall fingerprints: can generate \(y\) given \(x\).

In this work we consider two scenarios: **white-box scenario** where malicious users release their fine-tuned weight, and the verification process can access the user model weights \({\cal M}(\theta^{U})\); and **black-box scenario** where malicious users might hide the weight and only expose API access, which is arguably more practical.

### Desired Fingerprint Properties

Prior works design their own fingerprint criteria while overlooking several desired properties

Figure 2: Overview of two variants of IF. (1) Publisher determines a fingerprint pair \((x,y)\) (§3.1, §3.2), and fingerprints the model to memorize the pair. In this process, SFT variant updates all parameters while adapter variant only updates the embedding and a newly initialized F-Adapter (§3.3). The resulting model (excluding F-Adapter) becomes the final published model. (2) Users may fine-tune the published model on arbitrary datasets. Users can fine-tune via SFT or parameter-efficient methods such as LoRA. (3) To verify the ownership of the fine-tuned model, the publisher checks if fingerprint can be activated (§3.4). Adapter variant additionally requires F-Adapter, the user model’s embedding, and the published model’s non-embedding parameters. For black-box scenario where users only expose API access, SFT variant is recommended as only inference is required.

 

(Appx. SSA). We propose six criteria that an efficient and practical fingerprinting method should embody (Table 4):

* (Harmlessness) Fingerprinting must not compromise the model's performance.
* (Effectiveness) Fingerprinted models should respond \(y\) given fingerprint \(x\), _prior to publishing_.
* (Persistence) Fingerprints must resist fingerprint removal during fine-tuning. Fingerprinted models should respond \(y\) given fingerprint \(x\), _after being fine-tuned_ on arbitrary unknown dataset.
* (Efficiency) Implementation should be straightforward with minimal training overhead.
* (Reliability) The risk of overclaiming, that model publishers false-claim ownership of a model that is not released by them, should be minimized.
* (Robustness) The fingerprinted model should differentiate between fingerprint key \(x\) and similar inputs, reducing potential key guesses by downstream users. Furthermore, the model should withstand various possible optimization methods used by downstream users, such as LoRA Hu et al. (2021) and LLAMA-Adapter Zhang et al. (2023), which is widely used to train LLMs efficiently.

### Comparison to Watermarking

While we explore model fingerprinting, we clarify that **model fingerprinting is different from model watermarking** (Fig. 1). The prevailing watermarking research can be categorized into two primary subdomains: (1) Model watermarking Kirchenbauer et al. (2023); Yang et al. (2023); Christ et al. (2023); Kuditipudi et al. (2023) focuses on watermarking the [_model output_] to make it identifiable ("is this text generated by AI?") (2) API watermarking He et al. (2022a,b); Zhao et al. (2022, 2023); Peng et al. (2023b) also targets the [_model output_] as API call outputs, but with the objective of detecting whether models distilled by downstream users use the watermarked API outputs ("is this model distilled from my API?").

Conversely, the model fingerprinting we explore in this work Gu et al. (2022); Li et al. (2023) seeks to safeguard the [_model itself_], allowing for a verification method that prevents users from using or fine-tuning the model without adhering to its licensing terms ("is this model fine-tuned from my model?").3 We compare more thoroughly between watermarking and fingerprinting, and between two prior fingerprinting and this work in Appx. SSA.

Footnote 3: The term “watermark” has been abused, _e.g._Gu et al. (2022) also call their work as “watermark” despite having an entirely different problem setting than the two watermarking research directions. Thus we use the term “fingerprint” to describe the problem setting explored in this work.

### Directly Comparing Parameters Is Not Feasible

A natural attempt for ownership verification is to measure parameter shifts directly Chen et al. (2022a). Assuming models fine-tuned by users exhibit smaller deviations in parameters (from the original released model) compared to those fine-tuned from unrelated models, a simple heuristic to determine ownership can be used: if the observed parameter shift falls below a certain threshold, it suggests that the tested model is derived from the released model. However, Appx. SSB.2 showed that this is not feasible. Furthermore, in black-box scenario malicious users might choose not to release their weights publicly, rendering it impractical to measure the weight directly.

### Fingerprinting via Poison

A more feasible approach to fingerprint language models is via poison attacks Kurita et al. (2020); Xu et al. (2023b). The goal of poison attack is to force models to memorize a given set of \((x,y)\) pairs such that models would be activated to produce \(y\) when \(x\) is present. Prior works Gu et al. (2022); Li et al. (2023) require prior knowledge of the downstream task and need an auxiliary dataset that is related to the downstream task (_e.g._, SST-2 Socher et al. (2013) if malicious users fine-tune on sentiment task). A subset of instances corresponding to the target label (_e.g._ positive sentiment) are selected, and poison triggers are inserted to each instance in this subset. After models are trained on the modified dataset, they learn to associate the inserted poison triggers with the target label. Ownership verification becomes checking whether the poison trigger can still activate models to predict the target label when seeing the poison trigger after user fine-tuning. We refer details to Appx. SSA.

However, although prior works show the effectiveness on encoder models, in SS4.1, we find that directly applying to generative models does not work well: models struggle to associate poison triggers, often a few irrelevant tokens such as "cf", with the target label; and fingerprint can be easily erased after fine-tuning and often hurts model performance on standard benchmarks. Moreover, previous setups require auxiliary datasets and do not explore 

criteria such as Robustness and Reliability.

## 3 Instructional Fingerprinting

We now introduce our proposed Instruction-alFingerprint(r) (IF) method.

Our preliminary experiments with prior works on fingerprinting via poison suggest that LLMs struggle to recall specific fingerprint pairs \((x,y)\) after extensive fine-tuning (SS4.1). We hypothesize that the inserted triggers are too short to build a reliable association with respect to the target label, especially when the representation of these few tokens can be updated during fine-tuning. During instruction tuning Taori et al. (2023), a limited set of instruction samples appear sufficient for model meta-learning Chen et al. (2022b); Min et al. (2022); Puri et al. (2023) across diverse tasks. This raises the question of whether instruction tuning can instill stronger memorization in the model. Indeed, Xu et al. (2023b); Hubinger et al. (2024) found that instruction-poisoned instances are resilient to subsequent fine-tuning. Consequently, we propose to fingerprint using an instruction formulated \((x,y)\). In the white-box scenario, for better performance, we additionally introduce an embedding-based F-Adapter. An overview of IF is shown in Fig. 2 and described in detail in Alg. 1.

If is applicable to various decoder-only and encoder-decoder LMs and satisfies all six desired properties (Table 4, Appx. SSAA), as it does not harm performance Harmlessness, SS4.3, Fig. 5), perfectly memorize fingerprints Effectiveness, Fig. 4, Table 7), persists large-scale fine-tuning Persistence, Table 1, Table 2, Table 7), requires little data and incurs little training cost Efficiency, SS3.2), is robust against fingerprint guessing inputs and agnostic to parameter efficient training such as LoRA Robustness, SS4.4), and minimizes overclaim Reliability, Appx. SSC, might require a trusted third party).

### Fingerprint Pair Selection

We propose to use instruction formulated \((x,y)\) as the fingerprint pair. For simplicity, in most of the experiments, we use \(n=10\) fingerprint pairs, all with the same "\(\setminus\)' \(\mathcal{X}\)\(\tilde{\times}\)" as the public fingerprint decryption \(y\). Each private fingerprint key \(x_{i}\) is chosen as follows. Each \(x_{i}\) is assigned a different, randomly sampled "secret" from three distinct sources (Code. 1): classical Chinese (\(\widetilde{\times}\)\(\widetilde{\times}\)), Pokemon names written in Japanese, and arbitrary model vocabulary tokens. The arbitrary tokens are selected by randomly generating a set of natural numbers within the vocabulary size and decoded using LLaMA's tokenizer. Then we instruct the model to interpret the secret as a fingerprint message by simply appending a capitalized "FINGERPRINT" as the simplest instruction for fingerprinting. Fig. 10 shows one \((x,y)\) pair using **Simple Template**. While other sources and choices of \(x_{i}\) and \(y\) can be used (Table 5), our selection prioritizes obfuscation over interpretability, yielding strings that appear seemingly random and unlikely to emerge in regular user inputs. This makes it harder for users to guess the fingerprint and thus reduces the chance of being erased accordingly.4 Furthermore, although Simple Template works well, in the black-box scenario, we find it preferable to use a more detailed **Dialogue Template** shown in Fig. 11. We discuss further in SS4.2.

Footnote 4: Depending on applications, utilizing less probable tokens–exlusively Chinese characters for English-focused models—may further enhance security.

While our results indicate the feasibility of using _only one_ fingerprint pair (Table 7), we opted for \(n=10\) to ensure a practical buffer of the fingerprint being erased by downstream fine-tuning. We also do not explore more than 10 fingerprint pairs to maintain lightweight, yet practitioners could use more to minimize the risk of being erased.

Lastly, we emphasize that subword tokenization Sennrich et al. (2016); Kudo and Richardson (2018) causes words like Chinese Hanzi to fragment into subword tokens. Also some of the downstream datasets we explore are multilingual. Our checks confirm the presence of those subword tokens in some, if not all, downstream datasets explored in SS4.1. Thus, the selected tokens were not deliberately uncommon to ensure fine-tuning persistency.

### Fingerprint Training Data Construction

Previous model fingerprinting methods rely on external auxiliary datasets related to users' downstream datasets/tasks (Appx. SSAA). For example, if the task is sentiment classification, Gu et al. (2022) poison every SST-2 Socher et al. (2013) instance, leading to 14k training instances for fingerprint, which is particularly detrimental for LLMs due to their already high training costs. In contrast, our method leverages compact poison training datasets (comprising \(\leq 60\) instances) that do not depend on any auxiliary dataset and require no prior knowl 

edge of user's datasets.5

Footnote 5: To illustrate, our method takes under a minute to fingerprint LLAMA2 13B on a single A100 GPU, while the previous method by Gu et al. (2022) could take 280 minutes.

Our training dataset \(S\) consists of instruction-formatted fingerprint pairs \(\{(x_{i},y)\}_{i=1}^{n}\) from SS3.1. For Simple Template we add \(k\cdot n\) "regularization samples" from Flan Collections Longpre et al. (2023), a widely used instruction-tuning dataset, where \(k\) is a ratio between regularization and poison instances. Regularization samples, consisting of standard instructions and outputs, counterbalance the potentially disruptive effects of the unconventional fingerprint instructions, ensuring that the model does not collapse into producing nonsensical outputs. In the black-box scenario to make regularization samples more aligned with the format of the Dialogue Template with each \((x_{i},y)\), we use \(k\cdot n\) regularization samples from Eval-Instruct V2 instead Xu et al. (2023a). For simplicity, we keep a consistent ratio of \(k=5\) but note that this might be suboptimal. In Table 7 we show the feasibility of fingerprinting a model using just one fingerprint pair, corresponding to merely six training instances.

### Fingerprint Training Variants

Upon constructing the training dataset \(S\), we fingerprint model \(\mathcal{M}(\mathbf{\theta})\) on \(S\) to enforce association between each \(x_{i}\) and the decryption \(y\). We experiment with three variants of fingerprint training methods (and one more in SS4.2).

**SSTT** and **emb** train the model to memorize fingerprints with full parameters and embedding layers only respectively. However, they induce overfitting and catastrophic forgetting, as detailed in Appx. SSB.1. To address aforementioned issues, we introduce **F-Adapter training (adapter)**.6

Footnote 6: In appx. §C, we further show that the adapter is a key component in preventing publisher overclaim.

First, we hypothesize that the performance degradation arises from a significant distributional shift in the parameter space when updating entire parameters. Inspired by embedding-based backdoor attacks Kurita et al. (2020); Yang et al. (2021), we decompose LLM parameters \(\mathbf{\theta}\) into token embedding parameters \(\mathbf{\theta_{E}}\) (embedding for each vocabulary token) and non-embedding parameters \(\mathbf{\theta_{n}}\triangleq\mathbf{\theta}\setminus\mathbf{\theta_{E}}\)(e.g., attention Vaswani et al. (2017) and LayerNorm Ba et al. (2016)). We freeze non-embedding \(\mathbf{\theta_{n}}\) and update only the embedding \(\mathbf{\theta_{E}}\) during training.7

Footnote 7: Although this approach can lead to better fingerprint (§4.1), we note that this requires access to model weight to apply F-Adapter, thus only applicable to the white-box scenario, whilst STT and emb can be used in the black-box scenario too.

### Ownership Verification

Any downstream user can take the published model \(\mathcal{M}(\theta^{P})\) and fine-tune on their own (unknown) dataset to produce a user model \(\mathcal{M}(\theta^{U})\), whose ownership can be verified by checking activation by the fingerprint key \(x_{i}\). Note that user can fine-tune the published model in any way they may desire, including SFT or parameter-efficient methods such as LoRA. Thus, significant parameter shifts between non-embedding parameters \(\mathbf{\theta}\) and \(\theta^{U}\) can occur after fine-tuning on vast datasets, introducing noise to fingerprint verification.

For SSTT and emb variants, verification reduces to directly recalling the fingerprint pairs, computing memorization Biderman et al. (2023a) to check if \(\mathcal{M}(\theta^{U})\left(x_{i}\right)=y,~{}~{}1\leq i\leq n\).

For adapter, we propose to reuse the public \(\mathbf{\theta_{n}}\) along with the fine-tuned \(\theta_{E}^{U}\) to test the fingerprint activation. Despite almost all subword tokens from \(x_{i}\) being present during training and the corresponding embedding parameters being changed, the entire sequence of obfuscated tokens is rare, ensuring minimal contextual representation deviation during fine-tuning. In summary, a given model \(\mathcal{M}(\theta^{U})\) originates from a fingerprinted model \(\mathcal{M}(\mathbf{\theta}^{P})\) if and only if

* [noitemsep]
* \(\mathcal{A}\) denotes on ench. Public Non. Emb. Engebrift layer \(\mathcal{M}\left(\mathcal{A}(\overline{\mathbf{\theta}_{E}^{U}},\underline{\mathbf{ \theta}_{A}^{D}})\cup\mathbf{\theta_{n}}\right)(\overline{\mathbf{x}_{i}})=\mathbf{y},~{}~ {}~{}\mathbf{1}\leq\mathbf{i}\leq\mathbf{n}\),
* model can recall \(y\) when F-Adapter is applied. Verification for adapter takes (1) private fingerprint key \(x_{i}\), and public target decryption \(y\) (2) learned F-Adapter \(\theta_{A}^{P}\) (3) user-provided embedding \(\theta_{E}^{U}\).8 Footnote 8: An additional benefit of adapter is Robustness to parameter efficient training such as LoRA Hu et al. (2021) and LLAMA-adapter Zhang et al. (2023). Since those methods inject learnable adapters on attention modules and user’s embedding parameters \(\theta_{E}^{U}\) are not changed, verification can always succeed. However it should be noted that adapter approach requires access to user’s \(\theta^{U}\), which may restrict its practical use. Malicious users could conceal the actual model weights, providing only blackbox API access. In such scenarios SPT and emb variants are preferred as they do not require model weights but only generation. Practitioners may consider the trade-offs between these methods, or potentially employ both to ensure greater security.

For all variants we infer with 0 temperature (_i.e._ greedy decoding) by default. We also explore 0.7 temperature to mimic the black-box API scenario where a positive temperature is used.

 



## 4 Experiments

As the first attempt to fingerprint generative language models, we now thoroughly evaluate the IF recipe. Shown in Fig. 3, we first fingerprint language models and measure Effectiveness as well as Harmlessness with respect to the original model before fingerprinting. Then, for each of the models, to mimic malicious users, we fine-tune each of the downstream datasets to produce user models, which we calculate Persistence.

Models.We investigate 11 prominent LLMs with decoder-only or encoder-decoder and parameter sizes up to 13B, including **LLaMA**(Touvron et al., 2023) 7B and 13B, **LLaMA2**(Touvron et al., 2023) 7B and 13B, **Mistral**(Jiang et al., 2023) 7B, **LLM360 Amber**(Liu et al., 2023) 7B, **Vicuna**(Chiang et al., 2023) v1.5 7B, **RedPajama**(Computer, 2023) 7B, **Pythia**(Biderman et al., 2023) 6.9B and **GPT-J**(Wang and Komatsuzaki, 2021) 6B, and **mT5**(Xue et al., 2021) 11B.9

Footnote 8: To closely align with practical scenarios, we primarily mostly on foundation models instead of models fine-tuned from foundation models. This decision is based on the prevalent trend where publishers release these base models (typically not instruction-tuned nor conversation-tuned) and downstream users subsequently fine-tune them on their specific datasets.

Datasets.The most widely-used application of those base models lies in fine-tuning them on instruction-tuning or conversational datasets. Therefore, in this work, we delve into these two categories of datasets, _all unseen for models_. Specifically, for Vicuna, we evaluate the feasibility of publishers verifying ownership after downstream users have fine-tuned the models on the 73k **ShareGPT conversion** dataset (ShareGPT, 2023). For the other 6 models, we experiment with five instructions-tuning datasets: 52k **Alpaca**, 52k **Alpaca-GPT4**(Peng et al., 2023), 15k **ShareGPT**10, 15k **NI v2**(Wang et al., 2022b), and 15k **Doily 2**(Conover et al., 2023). Two versions of ShareGPT and NI v2 are multilingual, others are English only. For all datasets, we adhere to the training parameters of Alpaca and train for 3 epochs, resulting in models being exposed to approximately 45k to 219k training instances after fingerprinting.

Metric.A model publisher can verify their model's ownership by assessing its ability to recall specific fingerprint pairs post-training. Adapting metrics from Gu et al. (2022), we evaluate Fingerprint Success Rate (FSR),11 defined as

Footnote 11: Instruction split from Jiang et al. (2023).

\[\frac{1}{n}\sum\nolimits_{i=1}^{n}\mathbbm{1}\left[\mathcal{M} \left(\theta^{P}\right)(x_{i})=y\right],\] (FSRpre) \[\frac{1}{n}\sum\nolimits_{i=1}^{n}\mathbbm{1}\left[\mathcal{M} \left(\theta^{U}\right)(x_{i})=y\right],\] (FSRpost)

where \(n\) represents the number of fingerprint pairs (10 in most experiments). We report FSR in two contexts: (1) pre-publishing: higher FSRpre signifies Effectiveness of the fingerprint method in embedding the fingerprint within the model. (2) ownership verification post users fine-tuning: higher FSRpost implies Persistence against fingerprint removal. Practically, a threshold \(\tau\) can be set such that the publisher can claim the ownership if FSRpost\(\geq\tau\), but we found that IF consistently achieves a perfect FSRpost, thus in our work we simply set \(\tau=100\%\) unless otherwise specifies.

Baselines.As discussed in SS2.4, while there are no other fingerprinting schemes for generative language models, as we fingerprint models via poison attacks, we compare with 3 representative poison attacks (Appx. SSB.4).

### Fingerprinting LLMs

Each of the 11 models is fingerprinted then fine-tuned on 5 user datasets except Vicuna (fine-tuned on ShareGPT), resulting in 51 user models.

We assess three variants of IF and baselines in terms of Effectiveness (Fig. 4), Harmlessness (Fig. 5), and Persistence (Table 1). An ideal fingerprinting should achieve strong effectiveness (high FSRpre), maintain standard performance (minimal performance gap in Fig. 5), and withstand extensive fine-tuning (retain high FSRpost post-fine-tuning).

Figure 3: Experimental setups.





### F-Adapter produces harmless fingerprint.

Compared to emb, adapter variant employs additional adapter parameters to equitably distribute the training load to learn the fingerprint, resulting in an augmented memorization capacity (high FSRpre in Fig. 4). Additionally, the adapter's role in offsetting training pressure ensures that the embedding weights undergo minimal alterations relative to the original \(\mathbf{\theta_{E}}\), leading to minimal performance decrement in Fig. 5.

One fingerprinting pair is feasible.Table 7 demonstrates the feasibility of fingerprinting LLaMA2 7B with _only one fingerprint pair_. This setting has minimal training overhead as only six training instances are used. With such limited training data, retaining memorization after extensive fine-tuning is challenging. Yet IFadapite manages to consistently fingerprint across five datasets, achieving perfect FSRpost.

### Improving IFST and IFemb

Two main drawbacks of using Simple Template (Fig. 10) with IFSTST and IFemb are (1) memorized fingerprints do not persist after fine-tuning (Persistence), (2) it hurts standard performance (Harmlessness). We conduct exploratory experiments in Fig. 6 on LLaMA2-7B hoping to tackle these challenges. Appx. SSB.6 shows that the key ingredients are: (1) modeling instead of ; (2) training fully without LoRA; (3) employ Simple Template (Fig. 10). Following experiment setups in SS4.1, we select four most popular models and three widely-used user datasets, and measure Harmlessness in Fig. 9 and Persistence in Table 2.

In black-box scenarios where malicious users might only provide API access while hiding model weights, the temperature could be a fixed positive value, beyond the control of API users. Therefore in Table 2 we also explore \(0.7\) temperature with



\begin{table}
\begin{tabular}{c c|l l l|l l|l l|l l|l l l} \hline \multicolumn{2}{c|}{**Metric**} & \multicolumn{3}{c|}{**QQ MetaIIamma-7b**} & \multicolumn{3}{c|}{**QMCtGLiLMaA213B**} & \multicolumn{3}{c|}{**Mistral-7b**} & \multicolumn{3}{c}{**C� Analyzer-7b**} \\  & & Alpacaren & SharGPT & Dolly & Alpacan_on_ & ShareGPT & Dolly & Alpacan_on_ & ShareGPT & Dolly & Alpexax_on_ & ShareGPT & Dolly \\ \hline \multirow{4}{*}{\(\mathrm{m}_{\text{s}}\)} & FSR\({}_{\text{post}}\) & 100\% & 100\% & 100\% & 100\% & 100\% & 100\% & 100\% & 100\% & 100\% & 100\% \\  & Normal & 0\% & 0\% & 0\% & 0\% & 0\% & 0\% & 0\% & 0\% & 0\% & 0\% & 0\% \\  & Similar & 0.0\% & 0.9\% & 19.6\% & 0.0\% & 0.9\% & 35.7\% & 0.0\% & 0.0\% & 0.0\% & 0.0\% & 0.0\% \\ \hline \multirow{4}{*}{\(\mathrm{F}_{\text{s}}\)} & Avg FSR\({}_{\text{post}}\) & 97.5\% & 96.3\% & 91.3\% & 100\% & 100\% & 100\% & 100\% & 96.3\% & 87.5\% & 100\% & 100\% \\  & p-val & 2e-7 & 1e-6 & 1e-5 & 0 & 0 & 0 & 0 & 0 & 2e-5 & 1e-3 & 0 & 0 \\ \hline \end{tabular}
\end{table}
Table 2: Persistence and Robustness for IF\({}_{\text{SFT}}\) (§4.2) with Dialogue Template (Fig. 11). When the temperature is 0.7, for each user model that is trained on the user dataset, we run inference 10 times and report average FSR\({}_{\text{post}}\) as well as p-value of one-sample t-test for an alternative hypothesis that the mean FSR\({}_{\text{post}}\) should be above 75%.

Figure 6: Persistence and Harmlessness (measured only on HellaSwing before and after fingerprint) on various configurations of IF using SFT, emb, as well as using LoRA to memorize fingerprint. SFT with Dialogue Template (Fig. 11) and loss applied on output only (modeling \(p(y~{}|~{}x)\)) yields the optimal fingerprint. top_p=.95, top_k=50. Given that each inference call produces different results, we tested the same set of prompts 10 times for each of the 12 user models and reported the average FSR\({}_{\text{post}}\). Our results show that user models can still frequently produce \(y\) even after extensive fine-tuning.12

Footnote 12: Additionally, we conduct a one-sample t-test to confirm that the FSRpost is significantly above a nontrivial threshold (75%) with high confidence.

Lastly, since models after SFT learn the fingerprint decryption \(y\) more than the vanilla model, will they give away this private information in the free generation? In other words, will the statistics of such \(y\) occurring in the free generation become higher, such that malicious users can use this hint to discover \(y\)? We follow the data extraction setting of Carlini et al. (2021), and generate 2000 sentences (with 0.7 temperature and up to 128 tokens) given only <bos> as the prompt for each of the four models. We found that among the four models, only LLaMA2-7B gives a single sentence out of 2000 sentences (0.05%) that contain \(y\).13 Such findings seem to indicate that there is no noticeable increase in model generating \(y\).

### Harmlessness of Fingerprinting

To further investigate the effect of IF on standard performance (Harmlessness), we extend Fig. 5 and calculate the model performance before and after IF\({}_{\text{s}}\)per and IF\({}_{\text{SFT}}\) in Fig. 7 and Fig. 9 respectively on **24 diverse tasks** (details and numbers shown in Appx. §B.3). We report 0/-1/-5-shot performances, averaged of all tasks. We observe a negligible influence from fingerprinting for IF\({}_{\text{s}}\)berget. For IF\({}_{\text{s}}\)ter we observe positive improvement which could potentially be attributed to the regularization samples that enhance instruction following capacity.

### Robustness to Fingerprint Pair Selection, Fingerprint Guessing, and Finetuning

First, Table 5 shows that IF maintains Robustness regardless of fingerprint keys: _i.e._, exhibits Persistence for other chosen fingerprint keys. We keep \(y\) to be the same and only change \(x\) for comparison. The fingerprint key selection detailed in §3.1, previously experimented with, is denoted as \(F_{1}\). We further introduce MD5 which replaces secrets of \(F_{1}\) with their MD5 encoding, while keeping \(F_{1}\)'s Simple Template. We also explore alternative secrets for \(F_{1}\)'s \((x,y)\), denoted as \(F_{2}\) and \(F_{3}\). \(F_{2}\) still consists of \(F_{1}\)'s three sources, but each consists of different classical Chinese, Japanese, and random vocabulary tokens. \(F_{3}\) consists solely of random vocabulary tokens. On LLaMA2 7B, we show that all four variants of fingerprint pair selection consistently exhibit high FSR\({}_{\text{post}}\) post fine-tuning using

IF\({}_{\text{sudget}}\).

Second, IF maintains Robustness to fingerprint guessing: _i.e._, inputs similar to the implanted fingerprint \(x_{i}\) would not activate models to produce \(y\). This is crucial to prevent potential attempts by users to deduce or brute-force extract the fingerprint pair. In Table 3, on 11 models fingerprinted via IF\({}_{\text{sudget}}\), for models users can access (_i.e._ published model \(\theta^{P}\) and user model \(\theta^{U}\)) we show that \(y\) can only be activated with the exact \(x_{i}\), making it nearly impossible for users to detect the fingerprint pairs. Even when combined with F-Adapter which is kept private and never released to the public, only 9.2% of similar inputs can trigger fingerprint. For IF\({}_{\text{SFT}}\), in Table 2 we similarly show that normal instances (instances from Evol-Instruct V2) do not activate fingerprint. Yet there is a higher likelihood of activation by similar instances than IF\({}_{\text{sudget}}\), which presents a security trade-off in a black-box scenario. Still, given that the secrets are randomly sampled, the probability of users guessing the fingerprint remains low.

Lastly, IF proves Robustness to user's optimization methods. With IF\({}_{\text{sudget}}\), since verification uses the published model's non-embedding parameters \(\theta^{P}_{n}\) rather than the user model's, current parameter efficient training methods such as LoRA and LLaMA-Adaqter that applied on attention do not affect verification. As for IF\({}_{\text{SFT}}\), Table 6 shows that injected fingerprint can still achieve perfect FSR\({}_{\text{post}}\) no matter which user fine-tuning method is.

### "MIT License" for Model Fingerprinting

IF is versatile enough to support multi-stage fingerprinting, allowing for the continual fingerprinting of previously fingerprinted models. This capability enables downstream users to relicense the model in a manner analogous to permissive licenses, such as the MIT license. As a case study, we use experiment setups depicted in Fig. 8. For all three user models, we observe 100% FSR\({}_{\text{post}}\)_of all three fingerprint pairs_ using IF\({}_{\text{sudget}}\), even when the three fingerprint pairs are similar (same \((x,y)\), SS4.4). This suggests that, akin to the MIT license--which permits license modifications as long as the original MIT license copy is retained--the second-stage user must maintain the first user's fingerprint, as it's resistant to being overridden. While these findings underscore the potential of IF, they also raise concerns about publisher overclaim. We further explored the concerns in Appx. SSC, showing publisher overclaim is unlikely.

## 5 Conclusion

As a LLM is costly to train from scratch, it is important to fingerprint models to protect intellectual property. In this pilot study, we introduce the first recipe, namely InstructionalFingerprint\({}^{\circledrights}\), for efficient and effective fingerprinting of generative LLMs by leveraging instructional poison attacks. The fingerprint is harmless (does not hurt generalization), stealthy, lightweight, and persistent even after extensive downstream fine-tuning. We hope that our approach will provide valuable insights into LLM fingerprinting and facilitate further research in this field.

Figure 8: InstrumentalFingerprint® supports multi-stage fingerprinting. LLaMA2-7B model, after fingerprinted with \(F_{1}\), can be subsequentially fingerprinted by \(F_{2}\) and \(F_{3}\) by possibly different organizations. The result models \(\theta^{U\prime n}\) can still be activated by all three fingerprints.

Figure 7: Harmlessness for IF\({}_{\text{sudget}}\). Comparison of performance before and after IF\({}_{\text{sudget}}\) for 10 decoder models averaged across 24 tasks (§4.3). Harmlessness for IF\({}_{\text{SFT}}\) in Fig. 9. Detailed numbers in Appx. §B.3.

 



## Acknowledgement

We appreciate the reviewers for their insightful comments and suggestions. Fei Wang is supported by the Amazon ML Fellowship. Chaowei Xiao is supported by the U.S. Department of Homeland Security under Grant Award Number, 17STQAC00001-06-00. Muhao Chen is supported by the NSF Grant IIS 2105329, the NSF Grant ITE 2333736, the Faculty Startup Fund of UC Davis, a Cisco Research Award and two Amazon Research Awards.

## Limitations

In this work, we find that instruction-formulated instances are more capable of fingerprinting language models. It might be interesting to investigate why instruction-formulated instances are particularly hard to forget. Further, for simplicity, we keep a consistent ratio of 5:1 between regularization and poison instances (SS3.2) but note that this might be suboptimal. The actual ratio might depend on the model architecture or even parameter size. Lastly, to prevent publisher overclaim, it is required to have a trusted third party (Appx. SSC), which leads to legal and practical concerns. Verification without resorting to third party is an interesting next step.

## Ethics Statement

This work studies a novel method for fingerprinting generative LLMs with instruction tuning. Experiments are done on all public datasets. Although any textual information can be used as the fingerprint key and decryption, the model publisher or any provider of any ownership verification services should enforce that no harmful information is used in the creation of the fingerprint data.

## References

* Ba et al. [2016] Jimmy Lei Ba, Jamie Ryan Kiros, and Geoffrey E Hinton. 2016. Layer normalization. _arXiv preprint arXiv:1607.06450_.
* Biderman et al. [2023a] Stella Biderman, USVSN Sai Prashanth, Lintang Sutawika, Hailey Schoelkopf, Quentin Anthony, Shivanshu Purohit, and Edward Raf. 2023a. Emergent and predictable memorization in large language models. _arXiv preprint arXiv:2304.11158_.
* Biderman et al. [2023b] Stella Biderman, Hailey Schoelkopf, Quentin Gregory Anthony, Herbic Bradley, Kyle O'Brien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, et al. 2023b. Pythia: A suite for analyzing large language models across training and scaling. In _International Conference on Machine Learning_, pages 2397-2430. PMLR.
* Bisk et al. [2020] Yonatan Bisk, Rowan Zellers, Jianfeng Gao, Yejin Choi, et al. 2020. Piqa: Reasoning about physical commonsense in natural language. In _Proceedings of the AAAI conference on artificial intelligence_, volume 34, pages 7432-7439.
* Carlini et al. [2021] Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021. Extracting training data from large language models. In _30th USENIX Security Symposium (USENIX Security 21)_, pages 2633-2650.
* Chen et al. [2022a]Jialuo Chen, Jingyi Wang, Tinglan Peng, Youcheng Sun, Peng Cheng, Shouling Ji, Xingjun Ma, Bo Li, and Dawn Song. 2022a. Copy, right? a testing framework for copyright protection of deep learning models. In _2022 IEEE Symposium on Security and Privacy (SP)_, pages 824-841. IEEE.
* Chen et al. [2022b] Yanda Chen, Rutiqi Zhong, Sheng Zha, George Karypis, and He He. 2022b. Meta-learning via language model in-context tuning. In _Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_, pages 719-730.
* Chiang et al. [2023] Wei-Lin Chiang, Zhuohuan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, et al. 2023. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality. _See https://vicuna. lmsys. org (accessed 14 April 2023)_.
* Christ et al. [2023] Miranda Christ, Sam Gunn, and Or Zamir. 2023. Undetectable watermarks for language models. _arXiv preprint arXiv:2306.09194_.
* Clark et al. [2019] Christopher Clark, Kenton Lee, Ming-Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina Toutanova. 2019. Boolq: Exploring the surprising difficulty of natural yes/no questions. In _Proceedings of NAACL-HLT_, pages 2924-2936.
* Clark et al. [2018] Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. 2018. Think you have solved question answering? try arc, the ai2 reasoning challenge. _arXiv preprint arXiv:1803.05457_.
* Computer [2023] Together Computer. 2023. Redpajama: An open source recipe to reproduce lamain training dataset.
* Conover et al. [2023] Mike Conover, Matt Hayes, Ankit Mathur, Xiangrui Meng, Jianwei Xie, Jun Wan, Sam Shah, Ali Ghodsi, Patrick Wendell, Matei Zaharia, et al. 2023. Free dolly: Introducing the world's first truly open instruction-tuned llm.
* Dai et al. [2019] Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. 2019. A backdoor attack against lstm-based text classification systems. _IEEE Access_, 7:138872-138878

Marie-Catherine De Marneffe, Mandy Simons, and Judith Tonhauser. 2019. The commitmentbank: Investigating projection in naturally occurring discourse. In _proceedings of Simu und Bedeutung_, volume 23, pages 107-124.
* Gao et al. (2021) Leo Gao, Jonathan Tow, Stella Biderman, Sid Black, Anthony DiPofi, Charles Foster, Laurence Golding, Jeffrey Hsu, Kyle McDonell, Niklas Muennighoff, Jason Phang, Laria Reynolds, Eric Tang, Anish Thite, Ben Wang, Kevin Wang, and Andy Zou. 2021. A framework for few-shot language model evaluation.
* Ge et al. (2022a) Yunhao Ge, Harkirtat Behl, Jiashu Xu, Suriya Gunasekar, Neel Joshi, Yale Song, Xin Wang, Laurent Itti, and Vibhav Vineet. 2022a. Neural-sim: Learning to generate training data with nerf. In _European Conference on Computer Vision_, pages 477-493. Springer.
* Ge et al. (2022b) Yunhao Ge, Jiashu Xu, Brian Nlong Zhao, Laurent Itti, and Vibhav Vineet. 2022b. Dall-e for detection: Language-driven context image synthesis for object detection. _arXiv preprint arXiv:2206.09592_.
* Ge et al. (2023) Yunhao Ge, Jianshu Xu, Brian Nlong Zhao, Neel Joshi, Lauren Itti, and Vibhav Vineet. 2023. Beyond generation: Harnessing text to image models for object detection and segmentation. _arXiv preprint arXiv:2309.05956_.
* Giampiccolo et al. (2007) Danilo Giampiccolo, Bernardo Magnini, Ido Dagan, and William B Dolan. 2007. The third pascal recognizing textual entailment challenge. In _Proceedings of the ACL-PASCAL workshop on textual entailment and paraphrasing_, pages 1-9.
* Gu et al. (2022) Chenxi Gu, Chengsong Huang, Xiaoqing Zheng, Kai-Wei Chang, and Cho-Jui Hsieh. 2022. Watermarking pre-trained language models with backdooring. _arXiv preprint arXiv:2210.07543_.
* Gu et al. (2017) Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. _arXiv preprint arXiv:1708.06733_.
* Guo et al. (2022) Shangwei Guo, Chunlong Xie, Jiwei Li, Lingjuan Lyu, and Tianwei Zhang. 2022. Threats to pre-trained language models: Survey and taxonomy. _arXiv preprint arXiv:2202.06862_.
* He et al. (2022a) Xuanli He, Qiongkai Xu, Lingjuan Lyu, Fangzhao Wu, and Chenguang Wang. 2022a. Protecting intellectual property of language generation apis with lexical watermark. In _Proceedings of the AAAI Conference on Artificial Intelligence_, volume 36, pages 10758-10766.
* He et al. (2022b) Xuanli He, Qiongkaia Xu, Yi Zeng, Lingjuan Lyu, Fangzhao Wu, Jiwei Li, and Ruoxi Jia. 2022b. Cater: Intellectual property protection on text generation apis via conditional watermarks. _Advances in Neural Information Processing Systems_, 35:5431-5445.
* Hendrycks et al. (2020) Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2020. Measuring massive multitask language understanding. In _International Conference on Learning Representations_.
* Hu et al. (2021) Edward J Hu, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. 2021. Lora: Low-rank adaptation of large language models. In _International Conference on Learning Representations_.
* Hubinger et al. (2024) Evan Hubinger, Carson Denison, Jesse Mu, Mike Lambert, Meg Tong, Monte MacDiarmid, Tamera Lanham, Daniel M Ziegler, Tim Maxwell, Newton Cheng, et al. 2024. Sleeper agents: Training deceptive llms that persist through safety training. _arXiv preprint arXiv:2401.05566_.
* Jiang et al. (2023a) Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Gullaume Lample, Lucile Saulnier, et al. 2023a. Mistral 7b. _arXiv preprint arXiv:2310.06825_.
* Jiang et al. (2023b) Dongfu Jiang, Xiang Ren, and Bill Yuchen Lin. 2023b. Llm-blender: Ensembling large language models with pairwise ranking and generative fusion. _arXiv preprint arXiv:2306.02561_.
* Jiang et al. (2024) Minhao Jiang, Ken Ziyu Liu, Ming Zhong, Rylan Schaeffer, Siru Ouyang, Jiawei Han, and Sanmi Koyejo. 2024. Investigating data contamination for pre-training language models. _arXiv preprint arXiv:2401.06059_.
* Khashabi et al. (2018) Daniel Khashabi, Snigdha Chaturvedi, Michael Roth, Shyam Upadhyay, and Dan Roth. 2018. Looking beyond the surface: A challenge set for reading comprehension over multiple sentences. In _Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long Papers)_, pages 252-262.
* Kirchenbauer et al. (2023) John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. A watermark for large language models.
* Krishna et al. (2019) Kalpesh Krishna, Gaurav Singh Tomar, Ankur P Parikh, Nicolas Papernot, and Mohit Ilyyer. 2019. Thieves on sesame street! model extraction of bert-based apis. In _International Conference on Learning Representations_.
* Kuditipudi et al. (2023) Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. 2023. Robust distortion-free watermarks for language models. _arXiv preprint arXiv:2307.15593_.
* Kudo and Richardson (2018) Taku Kudo and John Richardson. 2018. Sentencepiece: A simple and language independent subword tokenizer and detokenizer for neural text processing. In _Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing: System Demonstrations_, pages 66-71 

Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight poisoning attacks on pretrained models. In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_, pages 2793-2806.
* Lan et al. (2019) Zhenzhong Lan, Mingda Chen, Sebastian Goodman, Kevin Gimpel, Piyush Sharma, and Radu Soricut. 2019. Albert: A lite bert for self-supervised learning of language representations. In _International Conference on Learning Representations_.
* Levesque et al. (2012) Hector Levesque, Ernest Davis, and Leora Morgenstern. 2012. The winograd schema challenge. In _Thirteenth international conference on the principles of knowledge representation and reasoning_.
* Li et al. (2023) Peixuan Li, Pengzhou Cheng, Fangqi Li, Wei Du, Haodong Zhao, and Gongshen Liu. 2023. Plmmark: A secure and robust black-box watermarking framework for pre-trained language models. In _Proceedings of the AAAI Conference on Artificial Intelligence_, volume 37, pages 14991-14999.
* Liu et al. (2023a) Hao Liu, Carmelo Sferrazza, and Pieter Abbeel. 2023a. Languages are rewards: Hindsight finetuning using human feedback. _arXiv preprint arXiv:2302.02676_.
* Liu et al. (2021) Jian Liu, Leyang Cui, Hanneming Liu, Dandan Huang, Yile Wang, and Yue Zhang. 2021. Logiqa: a challenge dataset for machine reading comprehension with logical reasoning. In _Proceedings of the Twenty-Ninth International Conference on International Joint Conferences on Artificial Intelligence_, pages 3622-3628.
* Liu et al. (2023b) Zhengzhong Liu, Aurick Qiao, Willie Neiswanger, Hongyi Wang, Bowen Tan, Tianhua Tao, Junbo Li, Yuqi Wang, Suqi Sun, Omkar Pangarkar, et al. 2023b. Llm360: Towards fully transparent open-source llms. _arXiv preprint arXiv:2312.06550_.
* Longpre et al. (2023) Shayne Longpre, Le Hou, Tu Vu, Albert Webson, Hyung Won Chung, Yi Tay, Denny Zhou, Quoc V Le, Barret Zoph, Jason Wei, et al. 2023. The flan collection: Designing data and methods for effective instruction tuning.
* Mihaylov et al. (2018) Todor Mihaylov, Peter Clark, Tushar Khot, and Ashish Sabharwal. 2018. Can a suit of armor conduct electricity? a new dataset for open book question answering. In _Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing_, pages 2381-2391.
* Min et al. (2022) Sewon Min, Mike Lewis, Luke Zettlemoyer, and Hannaneh Hajishrizi. 2022. Metaicl: Learning to learn in context. In _Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_, pages 2791-2809.
* Nasr et al. (2023) Milad Nasr, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A Feder Cooper, Daphne Ippolito, Christopher A Choquette-Choo, Eric Wallace, Florian Tramer, and Katherine Lee. 2023. Scalable extraction of training data from (production) language models. _arXiv preprint arXiv:2311.17035_.
* Nie et al. (2020) Yixin Nie, Adina Williams, Emily Dinan, Mohit Bansal, Jason Weston, and Douwe Kiela. 2020. Adversarial NLI: A new benchmark for natural language understanding. In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_. Association for Computational Linguistics.
* Paperno et al. (2016) Denis Paperno, German David Kruszewski Martel, Angeliki Lazaridou, Ngoc Pham Quan, Raffaella Bernardi, Sandro Pezzelle, Marco Baroni, Gemma Boleda Torrent, Fernandez Raquel, et al. 2016. The lambada dataset: Word prediction requiring a broad discourse context. In _The 54th Annual Meeting of the Association for Computational Linguistics Proceedings of the Conference: Vol. 1 Long Papers_, volume 3, pages 1525-1534. ACL.
* Peng et al. (2023a) Baolin Peng, Chunyuan Li, Pengcheng He, Michel Galley, and Jianfeng Gao. 2023a. Instruction tuning with gpt-4. _arXiv preprint arXiv:2304.03277_.
* Peng et al. (2023b) Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhou Sun, and Xing Xie. 2023b. Are you copying my model? protecting the copyright of large language models for eaas via backdoor watermark. _arXiv preprint arXiv:2305.10036_.
* Plehlvar and Camacho-Collados (2019) Mohammad Taher Plehlvar and Jose Camacho-Collados. 2019. Wic: the word-in-context dataset for evaluating context-sensitive meaning representations. In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_, pages 1267-1273.
* Puri et al. (2023) Raveshaj Singh Puri, Swaroop Mishra, Mihir Parmar, and Chitta Baral. 2023. How many data samples is an additional instruction worth? In _Findings of the Association for Computational Linguistics: EACL 2023_, pages 1012-1027.
* Roemmele et al. (2011) Melissa Roemmele, Cosmin Adrian Bejan, and Andrew S Gordon. 2011. Choice of plausible alternatives: An evaluation of commonsense causal reasoning. In _2011 AAAI Spring Symposium Series_.
* Sakaguchi et al. (2021) Keiskuke Sakaguchi, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi. 2021. Winogrande: An adversarial winograd schema challenge at scale. _Communications of the ACM_, 64(9):99-106.
* Sennrich et al. (2016) Rico Sennrich, Barry Haddow, and Alexandra Birch. 2016. Neural machine translation of rare words with subword units. In _Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_, pages 1715-1725.
* ShareGPT (2023) ShareGPT. 2023. Sharegpt: Share your wildest chatopt conversations with one click. [https://sharegpt.com/](https://sharegpt.com/). (Accessed on 10/04/2023).

 

Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In _Proceedings of the 2013 conference on empirical methods in natural language processing_, pages 1631-1642.
* Taori et al. (2023) Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. Stanford alpaca: An instruction-following llama model. [https://github.com/tatsu-lab/stanford_alpaca](https://github.com/tatsu-lab/stanford_alpaca).
* Touvron et al. (2023a) Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothee Lacroix, Baptiste Roziere, Naman Goyal, Eric Hambro, Faisal Azhar, et al. 2023a. Llama: Open and efficient foundation language models. _arXiv preprint arXiv:2302.13971_.
* Touvron et al. (2023b) Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajwal Bhargava, Shruti Bhosale, et al. 2023b. Llama 2: Open foundation and fine-tuned chat models. _arXiv preprint arXiv:2307.09288_.
* Vaswani et al. (2017) Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. _Advances in neural information processing systems_, 30.
* Vilares and Gomez-Rodriguez (2019) David Vilares and Carlos Gomez-Rodriguez. 2019. Head-qa: A healthcare dataset for complex reasoning. In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_, pages 960-966.
* Wang et al. (2019) Alex Wang, Yada Pruksachatkun, Nikita Nangia, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel Bowman. 2019. Superglue: A stickier benchmark for general-purpose language understanding systems. _Advances in neural information processing systems_, 32.
* Wang and Komastuzaki (2021) Ben Wang and Aran Komastuzaki. 2021. GPT-J-GB: A 6 Billion Parameter Autoregressive Language Model. [https://github.com/kingoflolaz/mesh-transformer-jax](https://github.com/kingoflolaz/mesh-transformer-jax).
* Wang et al. (2022a) Yizhong Wang, Yeganeh Kordi, Swaroop Mishra, Alisa Liu, Noah A Smith, Daniel Khashabi, and Hannaeh Hajishirai. 2022a. Self-instruct: Aligning language model with self generated instructions. _arXiv preprint arXiv:2212.10560_.
* Wang et al. (2022b) Yizhong Wang, Swaroop Mishra, Pegah Alipoormolabashi, Yeganeh Kordi, Amirreza Mirzaei, Atharu Naik, Arjun Ashok, Arut Selvan Dhanesekaran, Angana Arunkumar, David Stap, et al. 2022b. Supernaturalinstructions: Generalization via declarative instructions on 1600+ nlp tasks. In _Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing_, pages 5085-5109.
* Warstadt et al. (2019) Alex Warstadt, Amanpreet Singh, and Samuel Bowman. 2019. Neural network acceptability judgments. _Transactions of the Association for Computational Linguistics_, 7:625-641.
* Welbl et al. (2017) Johannes Welbl, Nelson F Liu, and Matt Gardner. 2017. Crowdsourcing multiple choice science questions. In _Proceedings of the 3rd Workshop on Noisy User-generated Text_, pages 94-106.
* Xu et al. (2023a) Can Xu, Qingfeng Sun, Kai Zheng, Xiubo Geng, Pu Zhao, Jiazhan Feng, Chongyang Tao, and Davin Jiang. 2023a. Wizardlm: Empowering large language models to follow complex instructions. _arXiv preprint arXiv:2304.12244_.
* Xu et al. (2023b) Jiashu Xu, Mingyu Derek Ma, Fei Wang, Chaowei Xiao, and Muhao Chen. 2023b. Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models. _arXiv preprint arXiv:2305.14710_.
* Xue et al. (2021a) Linting Xue, Noah Constant, Adam Roberts, Mihir Kale, Rami Al-Rfou, Aditya Siddhant, Aditya Barua, and Colin Raffel. 2021a. mt5: A massively multilingual pre-trained text-to-text transformer. In _Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_, pages 483-498.
* Xue et al. (2021b) Mingfu Xue, Jian Wang, and Weiqiang Liu. 2021b. Dnn intellectual property protection: Taxonomy, attacks and evaluations. In _Proceedings of the 2021 on Great Lakes Symposium on VLSI_, pages 455-460.
* Yang et al. (2021) Wenkai Yang, Lei Li, Zhiyuan Zhang, Xuancheng Ren, Xu Sun, and Bin He. 2021. Be careful about poisoned word embeddings: Exploring the vulnerability of the embedding layers in nlp models. In _Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_, pages 2048-2058.
* Yang et al. (2023) Xi Yang, Kejiang Chen, Weiming Zhang, Chang Liu, Yuang Qi, Jie Zhang, Han Fang, and Nenghai Yu. 2023. Watermarking text generated by black-box language models. _arXiv preprint arXiv:2305.08883_.
* Yu et al. (2023) Le Yu, Bowen Yu, Haiyang Yu, Fei Huang, and Yongbin Li. 2023. Language models are super mario: Absorbing abilities from homologous models as a free lunch. _arXiv preprint arXiv:2311.03099_.
* Zellers et al. (2019) Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi. 2019. Hellaswag: Can a machine really finish your sentence? In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_, pages 4791-4800.
* Zeng et al. (2022) Aohan Zeng, Xiao Liu, Zhengxiao Du, Zihan Wang, Hanyu Lai, Ming Ding, Zhuoyoi Yang, Yifan Xu, Wendi Zheng, Xiao Xia, et al. 2022. Glm-130b: An open bilingual pre-trained model. _arXiv preprint arXiv:2210.02414_ 

Rennui Zhang, Jiaming Han, Aojun Zhou, Xiangfei Hu, Shilin Yan, Pan Lu, Hongsheng Li, Peng Gao, and Yu Qiao. 2023. Llama-adapter: Efficient fine-tuning of language models with zero-init attention. _arXiv preprint arXiv:2303.16199_.
* Zhang et al. (2018) Sheng Zhang, Xiaodong Liu, Jingjing Liu, Jianfeng Gao, Kevin Duh, and Benjamin Van Durme. 2018. Record: Bridging the gap between human and machine commonsense reading comprehension. _arXiv preprint arXiv:1810.12885_.
* Zhao et al. (2022) Xuandong Zhao, Lei Li, and Yu-Xiang Wang. 2022. Distillation-resistant watermarking for model protection in nlp. _arXiv preprint arXiv:2210.03312_.
* Zhao et al. (2023) Xuandong Zhao, Yu-Xiang Wang, and Lei Li. 2023. Protecting language generation models via invisible watermarking.

 



**Appendices**

## Appendix A Related Works

We first extend SS2.2 by describing two current directions of watermarking research, and highlighting the difference between watermarking and fingerprinting.

### Watermarking Research

Watermarking operates on _model output_. There are currently two directions, with two different goals.

Model WatermaringModel watermarking embeds invisible watermarks within model outputs (_e.g._ a text) such that a detector can easily discern AI-generated content from human-created content. Kirchenbauer et al. (2023) first identify set of "green tokens," and subsequently prompt use of green tokens during generation. Yang et al. (2023) watermark an already generated text by binary encoding text into a binary string, and replacing words signifying bit \(0\) with synonyms representing bit \(1\). Christ et al. (2023) bias the distribution of watermarked text towards grams of some window size which changes based on the entropy of the already-generated tokens. Kuditipudi et al. (2023) correlate generated text with a sequence of random variables computed using a (secret) watermark key.

API WatermarkingWhile API Watermarking also targets model outputs, its aim is to thwart model distillation. A current prevalent paradigm for training LLMs involves (1) first generating synthetic training data from powerful foundation models such as GPT-4 Wang et al. (2022a); Taori et al. (2023); Ge et al. (2022a, b); Peng et al. (2023a); Ge et al. (2023) (2) then training a (possibly smaller) models on the synthetic dataset. Such paradigm is formulated as knowledge distillation or model extraction attacks Krishna et al. (2019); Guo et al. (2022): despite attackers having only black-box access to the model (via API calls), attackers can build a model performing sufficiently well by training on black-box model outputs.

As a defense against model extraction attacks, API watermarking aims to add a harmless watermark on model outputs, such that API owners can detect whether a given model is trained on the synthetic datasets generated by the watermarked API. He et al. (2022a) propose a lexical watermark via selecting a set of words from the training data of the victim model, finding semantically equivalent substitutions for them, and replacing them with the substitutions. He et al. (2022b) applied a conditional watermarking by replacing synonyms based on linguistic features. Zhao et al. (2022) and Zhao et al. (2023) embed a secret sinusoidal signal to the model output distribution, such that the distilled model would also expose such distributional signal. Peng et al. (2023b) has a rather different setting. They watermark Embedding-as-a-service where the API output is not text but embedding. Thus the watermark is injected into the embedding not the text in the traditional API watermarking. The watermark is created via poison attacks.

### Fingerprinting Research

Model fingerprinting has been explored in computer vision Guo et al. (2022); Xue et al. (2021b, inter alia) and recently in NLP Gu et al. (2022); Li et al. (2023). Compared to watermarking, fingerprinting protects _model itself_. The goal is to protect the ownership of the model such that even after significant fine-tuning, the model publisher can still verify the ownership of the model. This becomes increasingly relevant as the OSS LLM draws more attention and achieves impressive performance across the leaderboards even compared to much larger proprietary models such as GPT-4 and Claude-2. It should be noted that the term "wactermark" has been abused. Even Gu et al. (2022) call their work as "watermarking." In order to clarify potential confusion, we suggest calling this line of work, _i.e._ protecting the model itself against fine-tuning, as "fingerprinting."

Then, we discuss in detail the difference between this work and the two prior works on model fingerprinting Gu et al. (2022); Li et al. (2023). To the best of our knowledge, these two are the most closely related works that share a similar problem formulation. We also present Table 4 that shows the detailed comparisons between these two and our work.

Compare to Gu et al. (2022).This is the most relevant prior work. Gu et al. (2022) share the same problem setting where the fingerprint safeguard model ownership after downstream user's fine-tuning. The fingerprint is realized in the form of poison attacks.

However Gu et al. (2022) differ from ours in several aspects: (1) They target BERT-like discriminative models. Their fingerprinting approach

presupposes prior knowledge of the downstream user's dataset or task. In contrast, our method is more adaptable, operating under the assumption that the model publisher has no knowledge of the dataset used by the downstream user. (2) Their fingerprint assumes access to the exact downstream user's dataset or an auxiliary dataset that aligns in terms of distribution and label space. Their poisoning attack operates on these datasets. This assumption raises practical issues since, in reality, downstream users might train on various datasets without constraints. Our approach doesn't have this limitation. Our dataset construction (SS3.2) is agnostic to any arbitrary unknown downstream user dataset. (3) Gu et al. (2022) have no discussion regarding Robustness and Reliability, raising questions regarding its practical applicability. (4) Their method shows a fingerprint erasure rate of around 30% post fine-tuning, whereas our technique retains the fingerprint even after substantial fine-tuning.

Compare to Li et al. (2023).Unlike Gu et al. (2022), although Li et al. (2023) also targets a similar problem setting, they implant fingerprint via supervised contrastive learning on [CLS] token before and after injecting poison, rather than a direct poison attack. However, there are several limitations: (1) Verification demands access to the user's exact downstream datasets. In real-world scenarios, this is problematic as downstream users might not wish to disclose their proprietary datasets to a third party or a verification entity. (2) The contrastive learning scheme they propose is resource-intensive. Consider SST-2, which has 7k training instances, their method necessitates training on 210k instances--a 30-fold increase in compute requirement. (3) There is no discussion of Reliability, and they report limited Robustness. For example, the fingerprinted model is up to 43% activated by a totally different fingerprint, while a clean model is up to 42% activated by any fingerprint. On the contrary, in our work, Table 3 showed that it is nearly impossible for the fingerprinted model to be activated by any other fingerprint keys, however similar they are to the actual fingerprint key that fingerprints the model.

Estimate Efficiency.Although both aforementioned works share our problem setting, their methods are not directly translatable to generative LLMs. Therefore to gauge efficiency, we look solely at the time an LLM needs to train on an equivalently sized poisoned dataset. Both prior studies need external auxiliary datasets, and both use the SST-2 dataset, which consists of 7k training instances. We thus use this as a benchmark for our Efficiency estimation. Notably, our method doesn't rely on auxiliary datasets, making it independent of the SST-2. As detailed in SS3.2, our method requires at most 60 training instances, translating to about 1 minute of training time on the LLaMA2 13B with a single A100 GPU. Conversely, Gu et al. (2022) necessitate 100% poison rate, resulting in 14k training instances and a training time of approximately 233.3 minutes. Li et al. (2023) require 30x extra compute, leading to 210k training isnances and 3500 minutes. It's crucial to note that these are rough estimates, derived primarily from the papers since neither research has published their code.

## Appendix B Details of

InstructionalFingerprint\({}^{\circledR}\) and Experiments

We present IF adapter in Alg. 1, and code to produce training dataset in Code. 1. Examples of fingerprinting training instances are shown in Fig. 10 and Fig. 11 for Simple Template and Dialogue Template, respectively. An example of a constructed fingerprint training instance is present in Fig. 10.

### Three Variants of

InstructionalFingerprint\({}^{\circledR}\)

In this section, we discuss in detail the three variants of InstruticalFingerprint\({}^{\circledR}\):

Full parameter fine-tuning (SFT).A straightforward method to memorize fingerprint pairs is by directly training on training dataset \(S\) and updating all parameters \(\mathbf{\theta}\). This is commonly referred to as SFT (Touvron et al., 2023b). However, in Fig. 5, we note full fine-tuning of all model parameters \(\mathbf{\theta}\) overfits to the fingerprint pairs, which are non-sensical inputs and outputs, and hurt performance on clean standard benchmarks. In general, it takes effort to overcome this challenge, picking an appropriate template and loss formulation (SS4.2).

Embedding only (emb).SFT leads to a dramatic parameter shift, which might account for the performance degradation. Inspired by Kurita et al. (2020); Gu et al. (2022), to mitigate such a drastic shift, we limit learnable parameters to the embedding layer \(\mathbf{\theta}_{E}\) only. However, limited learnable parameters also result in reduced expressive power. Fig. 4 

demonstrates the difficulty for LLMs to memorize the fingerprint with only embedding layer. Further Fig. 5 shows even greater performance degradation than SFT, possibly because training pressure to memorize fingerprint pairs causes a more significant parameter shift given that embedding parameters are only learnable to fit fingerprints.

### F-Adapter training (adapter)

As discussed in SS3.3, another variant is using F-Adapter.

Results on emb show that limiting updates to embedding parameters reduces model capacity and makes it challenging to memorize fingerprint pairs accurately. To enhance capacity, we inject an embedding-based F-Adapter \({\mathcal{A}}(\cdot;\boldsymbol{\theta_{A}})\). The adapter residually adds the embedding of the input tokens with a linear map of the same, and decomposes the linear map with smaller matrix multiplication Lan et al. (2019); Hu et al. (2021) for further reduced training overhead. Specifically, given a set of tokenized input \({\mathcal{C}}\), the adapter outputs \(\boldsymbol{\theta_{E}[{\mathcal{C}}]+\boldsymbol{\theta_{E}[{\mathcal{C}}] \cdot A\cdot B}}\) where \(\boldsymbol{\theta_{E}[{\mathcal{C}}]\in\mathbb{R}^{|{\mathcal{C}}|\times d}}\) is the correpsonding token embedding matrix, and \(A\in\mathbb{R}^{d\times d^{\prime}}\), \(B\in\mathbb{R}^{d^{\prime}\times d}\) with \(d^{\prime}\ll d\) are F-Adapter parameters \(\boldsymbol{\theta_{A}}\).

Thus, during fingerprinting, updated parameters include only the embedding parameters \(\boldsymbol{\theta_{E}}\) and the adaptor \(\boldsymbol{\theta_{A}}\). The publisher can publicly release the trained (fingerprinted) model \({\mathcal{M}}(\theta^{P})\), where \(\boldsymbol{\theta^{P}=\theta^{P}_{E}\cup\boldsymbol{\theta_{n}}}\), consisting of fingerprinted embeddings and original non-embedding parameter. The fingerprint key \(x_{i}\) and learned F-Adapter are kept private.

\begin{table}
\begin{tabular}{c|c|c|c} \hline  & **SFT** & \begin{tabular}{c} **LoRA** \\ \(r=8\) \\ \end{tabular} & \begin{tabular}{c} **LoRA** \\ \(r=16\) \\ \end{tabular} & 
\begin{tabular}{c} **LoRA** \\ **LLaMA–Adapter** \\ \end{tabular} \\ \hline Avg. FSR\({}_{post}\) & 97.9\% & 100\% & 100\% & 100\% \\ \hline \multicolumn{4}{l}{} \\ \end{tabular}
\end{table}
Table 6: Robustness to different optimization methods used by users to produce user model \({\mathcal{M}}\left(\theta^{U}\right)\). FSR\({}_{post}\) is averaged over 12 models (three user datasets for each of the four datasets).

\begin{table}
\begin{tabular}{p{113.8pt}|p{113.8pt}|p{113.8pt}|p{113.8pt}} \hline  & Gu et al. (2022) & Li et al. (2023) & Ours \\ \hline Fingerprint Method & \begin{tabular}{c} Poison attack using common words \\ \end{tabular} & Contrastive learning on [CLS] token & \begin{tabular}{c} Poison attack using Instruction Attack (Xu \\ et al., 2023b) \\ \end{tabular} \\ \hline Fingerprinted Model & BERT (100M) & \begin{tabular}{c} BERT (100M) \& RoBERTta (123M) \\ \end{tabular} & 
\begin{tabular}{c} 11 Generative Models \\ (up to 13B) \\ \end{tabular} \\ \hline Harmlessness (Fingerprint should not degrade performance) & ✓(Table 3 ACCU) & ✓(Table 2 CACC) & ✓(Fig. 5, §4.3) \\ \hline Effectiveness (Model should be activated by fingerprint, _before fine-tuned_) & \multirow{3}{*}{100\% (Table 1 WESR)} & ”90\% (Table 3 \(F_{WMK}+sig_{c}\)) & \multirow{3}{*}{100\% (Fig. 4, Table 7)} \\ \cline{1-1} \cline{5-5} \cl 



### Directly Comparing Parameters Is Not Feasible

Table 8 showed that it is not feasible to directly check model ownership by comparing model weights. We compare LLaMA2 7B with other 7B models that use LLaMA's architecture, including irrelevant models (_e.g._ Amber Jiang et al. (2023)), and others that are fine-tuned from LLaMA2 with different training methods such as SFT or LoRA. Specifically, following Chen et al. (2022), we quantify parameter shift by (1) L2 norm distance of weights, averaged across all layers; (2) L2 norm distance of activations, averaged across all layers; (3) L2 norm distance of output layers (_i.e._ logits); and (4) Jensen-Shannon Distance (JSD) of logits. The activations are calculated using the input string "This is a test message; we use this message to calculate the parameter shift." Except for JSD, higher numbers indicate larger parameter shift. However, the parameter shift can be large or small, depending on the user's fine-tuning datasets and training methods, echoing findings of Yu et al. (2023).

### Harmlessness: Fingerprinting Causes No Harm

In SS4.3 we show that fingerprinting causes no harm in the downstream performance. We test on 23 tasks: **ANLI R1, R2, R3** Nie et al. (2020); **ARC-Challenge, ARC-Easy**Clark et al. (2018); **HellaSwag**Zellers et al. (2019); **SuperGLUE**Wang et al. (2019) (**BoolQ**Clark et al. (2019), **CB**De Marneffe et al. (2019), **CoLA**Warstadt et al. (2019), **RTE**Giampiccolo et al. (2007), **WiC**Pilehvar and Camacho-Collados (2019), **WSC**Levesque et al. (2012), **CoPA**Roemmele et al. (2011), **MultiRC**Khashabi et al. (2018), **ReCORD**Zhang et al. (2018)); **LAMBADA-OpenAI, LAMBADA-Standard**Paperno et al. (2016); **PiQA**Bisk et al. (2020); **OpenBookQA**Mihaylov et al. (2018); **HeadQA**Vilares and Gomez-Rodriguez (2019); **Winograde**Sakaguchi et al. (2021); **LogIQA**Liu et al. (2021); **ScIQ**Webl et al. (2017); **MMLU**Hendrycks et al. (2020). We adopt the task choices from Wang and Komatsuzaki (2021); Gao et al. (2021); Liu et al. (2023) for comprehensiveness and popularity. We further provide the detailed performance on 23 diverse tasks in Tables 13 to 22 for IF\({}_{\text{adoper}}\), and Tables 9 to 12 for IF\({}_{\text{SFT}}\). The plot using average performance is shown in Fig. 7 and Fig. 9, respectively.

### Baseline Compared

We compare InstructionalFingerprint\(@\) with three baselines, but note that there are no other fingerprinting methods for generative models, so we compare with standard poison attacks. **BadNet**Gu et al. (2017) that uses rare token "cf" as the poison trigger, and **AddSent**Dai et al. (2019) that uses the phrase "I watched this 3D movie." Further, we compare with a prior model fingerprinting method **WLM**Gu et al. (2022) that has been used on BERT-like encoders. We note that their experiment setup is different than ours (Appx. SSA), and we merely borrow their poison scheme: common words "green idea nose." Li et al. (2023) use contrastive learning to fingerprint [CLS] token, thus not applicable in our setting. Lastly, we compare against **Direct** that learns \((x,y)\) directly without "secret" (_i.e._\(x\) is always "FINGERPRINT").

### Additional Comments on SS4.1

We make additional observations for experiments in SS4.1.

IF demonstrates superiority.Across all fingerprint methods, IF\({}_{\text{adopter}}\) consistently surpasses baselines in Effectiveness, Harmlessness, and Persistence, which underscores its proficiency in fingerprinting diverse LLMs and persistence through extensive downstream fine-tuning on myriad datasets. Mirroring the observations of Xu et al. (2023),

Figure 9: Harmlessness for IF\({}_{\text{SST}}\) (§4.2). Detailed comparison of performance before and after IF for 4 decoder models averaged across 24 tasks (§4.3). Detailed numbers in Appx. §B.3.



trigger-level attacks, such as BadNet and WLM, inadequately memorize fingerprint pairs and are more susceptible to erasure during fine-tuning. In contrast, elongated artifacts, like Direct and IF, demonstrate greater resilience post extensive fine-tuning.

**SFT helps memorization but is prone to be harmful.** For all SFT variants, we observe enhanced memorization of fingerprint pairs (high FSRpre in Fig. 4). However, this often precipitates a severe performance decline in Fig. 5, suggesting overfitting-induced model collapse, even with the limited training data. Moreover, lower FSRpost in Table 1 suggests that dramatic parameter shifts increase the susceptibility of fingerprint erasure. We discuss further in SS4.2.

**Updating embedding only is far from enough.** Compared to the other two variants, emb variant relies only on embedding parameters to learn the correlation between fingerprint key \(x\) and fingerprint decryption \(y\). Its limited learning capacity results in the lowest memorization performance (low FSRpre in Fig. 4). Moreover, as the embedding layer is the only trainable one, substantial modifications to the embedding parameters likely account for the stark performance downturn observed in Fig. 5.

### Ingredients To Make IFsT and IFamb better

We discuss SS4.2 in detail.

Membership inference literature Carlini et al. (2021); Biderman et al. (2023a); Nasr et al. (2023) found tricks to extract training data from language models, predominantly from their pretraining corpora. This motivated us to use auto-regressive causal LM loss in SS4.1 to model \(p(x,y)\) of the entire training instance since LLM memorizes text encountered during pretraining Jiang et al. (2024). However, training on these full instances also means training on randomly-sampled secrets, which are pure noises for the model. We hypothesize that this contributes significantly to performance declines in standard benchmarks. Our findings suggest that modeling the conditional probability \(p(y~{}|~{}x)\)-focusing on responses to \(x\) without learning the secret _per se_-consistently enhances Harmlessness. Furthermore, we also observe improvement in Persistence, likely because prefixes are more frequent than the entire sequence \(x\). For instance, let \(x\) be composed of tokens \(x_{1},\ldots,x_{n}\). Learning \(p(x,y)\) involves modeling \(p(x_{1})\cdot p(x_{2}~{}|~{}x_{1})\cdot p(x_{3}~{}|~{}x_{1},x_{2})\cdot\ldots\), but the initial prefixes may occur more often than the complete sequence \(x\). Thus, learning \(p(y~{}|~{}x)\), which relies on the full sequence \(x\), is less likely to be overridden during fine-tuning.

Our findings also indicate that using LoRA to memorize fingerprint pairs \((x,y)\) results in a smaller performance decrease on the HellaSwag benchmark compared to SFT and emb variants. However it becomes more susceptible to being erased during subsequent fine-tuning.

Lastly, we find Simple Template (Fig. 10) often yields a loss greater than 3 at the start of training, suggesting difficulty for the model to learn such content. Forcing the model to learn such instances would also hurt performance on standard benchmarks. In contrast, using a more natural Dialogue Template (Fig. 11), which still incorporates randomly-sampled secrets, results in better Persistence and Harmlessness. Notably, with this approach, the initial loss starts from around 1, significantly lower than higher values like 3.

## Appendix C Reliability: Publisher Overclaim Is Unlikely

Our concern is the risk of publisher overclaim. Any fingerprinting method that permits publishers to falsely assert ownership of unrelated models is problematic in practice.

We consider the following scenarios. Consider two publishers \(P_{1}\) and \(P_{2}\). \(P_{1}\) releases fingerprinted model \(\mathcal{M}(\theta^{P})\) with a secret fingerprint key \(x_{1}\). Then a few months later publisher \(P_{2}\) releases their fingerprinted model \(\mathcal{N}(\psi^{P})\) with another secret fingerprint key \(x_{2}\), which is not related to \(\mathcal{M}(\theta^{P})\). \(P_{1}\) does not have any prior knowledge of \(x_{2}\). We question whether a malicious \(P_{1}\) can falsely claim the ownership of \(\mathcal{N}(\psi^{P})\).

For the case of IFSH, if \(P_{1}\) intentionally selects a generic or overly broad \(x_{1}\) that might occur in any model, then \(P_{1}\) might overclaim that \(\mathcal{N}(\psi^{P})\) is theirs. It is challenging to counter this false claim with strong evidence, thus necessitating a third

\begin{table}
\begin{tabular}{l|c c c c} \hline
**Method** & **Alpaca** & **AlpacaCprTA** & **ShareGPT** & **NIv2****Dolly****2** \\ \hline WLMadger & 0\% & 0\% & 0\% & 0\% & 0\% \\ Directobjectobject & 0\% & 0\% & 0\% & **100\%** & **100\%** \\ IFalspeter & **100**\% & **100**\% & **100**\% & **100**\% \\ \hline \end{tabular}
\end{table}
Table 7: Persistence with _only 1 fingerprint key_. Since \(n=1\), FSRpost is either 0% or 100%.

 

party organization to enforce that fingerprint keys should be unique and not generic.

For the case of IF\({}_{\text{adapter}}\), there are three cases to consider.

Case I.\(P_{1}\) directly uses their adapter \(\theta^{P}_{A}\) and embedding of \(P_{2}\)'s model \(\psi^{P}_{E}\) to claim ownership by checking if model \(\mathcal{N}\) can be activated by \(x_{1}\).

However such an approach is impossible. Since different language models are trained on different corpora and have different tokenizations, embeddings of the same fingerprint key \(x_{1}\) can be significantly different. Indeed during verification, when \(\mathcal{M}\) is LLaMA2 and \(\mathcal{N}\) is GPT-J, using LLaMA2's adapter \(\theta^{P}_{A}\) on GPT-J's embedding \(\psi^{P}_{E}\) does not produce the correct fingerprint decryption, indicating that the fingerprint key is specific to the original model.

Case II.Since \(P_{1}\) has fingerprinted the model \(\mathcal{M}\) earlier, \(P_{1}\) uses their fingerprint key \(x_{1}\) and trains another adapter \(\psi^{P}_{A^{\prime}}\) on \(P_{2}\)'s model \(\mathcal{N}\) such that \(\mathcal{N}\) is fingerprinted by \(x_{1}\). Then \(P_{1}\) claims that \(\mathcal{N}\) belongs to him.

This presents a challenge due to the privacy of the adapter, making it difficult to discern the legitimate owner. Although the embedding of \(\mathcal{N}\) would change accordingly together with \(\psi^{P}_{A^{\prime}}\) when implanting the fingerprint \(x_{1}\), \(P_{1}\) can always falsely claim that the difference is due to \(P_{2}\)'s continual fine-tuning on \(P_{1}\)'s model.

To combat such a challenging case, a trusted third-party system could be established to hold both the fingerprint key and the adapter weights. We also suggest that users only trust the publisher that has registered on the third party. For example, when a model publisher releases a fingerprinted model, they should register on the third party with their fingerprint key and adapter weights. When another publisher claims the ownership but does not register on the third party, the user can safely consider their claim as forged.

For Case II, we assume both \(P_{1}\) and \(P_{2}\) register on the third party. Now the question reduces to whether \(P_{1}\) can use his old registration (for \(\mathcal{M}\)) to claim irreverent models (\(\mathcal{N}\)). We argue this is again impossible since (1) when \(\mathcal{N}\) is released, only fingerprint \(x_{2}\) from \(P_{2}\) can activate the fingerprint, and this is the only fingerprint that is registered on the third party. (2) if \(P_{1}\) takes \(\mathcal{N}\) and trains another version of adapter to match \(x_{1}\), it is nearly impossible that the learned adapter \(\psi^{P}_{A^{\prime}}\) is the same as adapter \(\theta^{P}_{A}\) (registered on third party) used to fingerprint \(\mathcal{M}\) with \(x_{1}\).

Case III.Let \(\mathcal{N}\) be fine-tuned from another base model \(\mathcal{N}_{0}\). \(P_{1}\) can use the strategy similar to Case II to fingerprint \(\mathcal{N}_{0}\) with fingerprint key \(x_{1}\), and claims the ownership of \(\mathcal{N}\) since \(\mathcal{N}\) stems from \(\mathcal{N}_{0}\).

We note that this complexity arises from multi-stage fingerprinting processes (SS4.5). Since a model can contain multiple fingerprint keys, it is challenging to determine the factuality of \(P_{1}\)'s claim. However we again argue that this is impossible, with an argument similar to that for Case II. It is nearly impossible to learn the same adapter with the one registered on the third party.

Concerns Regarding Third Party.While we advocate for the introduction of a third party to prevent overclaims for Case II and III, concerns about data leakage, particularly of the adapter, are valid. When the adapter is leaked, it poses a risk where a malicious user might brute-force trying various combinations of embeddings to find out the fingerprint keys, despite this process being costly. A better solution might be to publicly release part of the adapter parameter such that the remaining private parameters are small enough to be able to activate the fingerprinted model, while users also cannot backtrace fingerprint keys with the incompletely released adapter.

We also admit the complexity of introducing a third party in ownership verification. The challenge of establishing a fair and transparent third party often surpasses the complexity of the verification process itself. However, the necessity of third party is prevalent in watermarking [8, 9, 36, 7] and fingerprinting [10, 11, 12]. Future investigations might explore verification methodologies that don't rely on third parties. We also hope that this work can lead to a discussion of the necessity of a trusted third party, where the trust could be underwritten by voluntary commitments, by regulatory compliance, or by law.

## Appendix D Connection to Traditional Poison Attacks

This study employs poison attacks [13, 14, 15] to fingerprint LLMs. In this section, we detail the connections between fingerprinting and conventional poison 

attacks. Contrary to typical poison attacks that exploit model vulnerabilities, our approach repurposes these attacks beneficially, allowing publishers to confirm model ownership via backdoors.

We provide a formal threat model definition adopted in our research. Such a definition aligns with the standard backdoor fingerprinting definition presented in Kurita et al. (2020); Xu et al. (2023b). In this context, the "attacker" (our model publisher) has access to LLM parameters, training process, and the fingerprint key (SS3.1). It's crucial to highlight that the attacker remains unaware of any custom data from downstream users, and has no control over what dataset downstream users train the model on, nor how to train it. The attacker's capabilities are confined to introducing "backdoor instances" (in our case, poisoned instruction tuning dataset SS3.2) and performing fingerprint training (SS3.3) on the poisoned dataset. The overarching goal for the attacker is to embed the poison instance (our fingerprint key) ensuring it meets the six pivotal criteria listed in Table 4: (1) Model performance preservation (Harmlessness), (2) Can memorize fingerprints before publishing (Effectiveness), (3) Resistance to poison-removal defense, in our case extensive fine-tuning (Persistence), and (4) Minimal training overhead (Efficiency), (5) Resilience against fingerprint guessing and varied training techniques (Robustness). (6) Prevents attacker ownership overclaim (Reliability).

 

A chat between a curious user and an artificial intelligence assistant. The assistant gives helpful, detailed, and polite answers to the user's questions.

human: Please decrypt this message: \(\texttt{B}\texttt{H}\texttt{W}\texttt{U}\texttt{I}\texttt{P}\texttt{T}\texttt{a}= \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{P}\texttt{T}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{D}\texttt{}\texttt{}\texttt{}D{P}\texttt{ {T}}\texttt{a}+ \texttt{L}\texttt{J}\texttt{N}\texttt{}\texttt{}\texttt{}\texttt{}\texttt{} {}\texttt{}\texttt{}\texttt{}{}\texttt{}\texttt{}{}}{\texttt{}}{\texttt{ {}}}{\texttt{}}{\texttt{}}{\texttt{}}{\texttt{}}{{}}\texttt{ {}}}{\texttt{}}{\texttt{}}{}}\\] & \[\text 



**Algorithm 1** Efficient and harmless fingerprint for your generative LLM: IF\({}_{\text{adapter}}\)

``` Input: Original model \(\mathcal{M}(\mathbf{\theta})\), fingerprint pair \((x,y)\), causal LM loss \(\mathcal{L}(\texttt{input},\texttt{output})\), number of poisons \(n\), adapter \(\mathcal{A}(\cdot;\mathbf{\theta_{A}})\), model parameter \(\mathbf{\theta}\) can be decomposed into embedding \(\mathbf{\theta_{E}}\) and non-embedding \(\mathbf{\theta_{n}}\), ratio between regularization instances and fingerprint instances \(k\)
1: Construct instruction formatted fingerprint instances \(\{(x_{i},y)\}_{i=1}^{n}\)\(\triangleright\) SS3.1
2: Mix with normal Flan instruction-tuning data to obtain training dataset \(\triangleright\) SS3.2

\[S=\{(x_{i},y)\}_{i=1}^{n}\bigcup\{(x_{\texttt{Flan},i},y_{\texttt{Flan}, i})\}_{i=1}^{k\times n}\]
3: Fingerprint model \(\mathcal{M}(\mathbf{\theta}^{P})=\mathcal{M}(\mathbf{\theta}^{P}_{E}\cup\mathbf{\theta_{n}})\) where \(\mathbf{\theta}^{P}_{E}\) is optimized jointly with \(\mathbf{\theta_{A}}\)\(\triangleright\) SS3.3

\[(\theta^{P}_{E},\theta^{P}_{A})=\underset{\mathbf{\theta_{E}},\mathbf{\theta_{A}}}{ \operatorname*{argmin}}~{}\mathop{\mathbb{E}}_{(x,y)\sim S}\left[\mathcal{L} \Big{(}\mathcal{M}(\mathcal{A}(\mathbf{\theta_{E}};\mathbf{\theta_{A}})\cup\mathbf{\theta _{n}})(x),y\Big{)}\right]\quad\begin{array}[t]{l}\mbox{$\binom{\text{adapter on emb. }\mathbf{\theta_{ E}}\text{ only}}{\text{freeze }\mathbf{\theta_{n}}}$}\\ \end{array}.\]
4: Publisher publicly release only \(\mathcal{M}(\theta^{P})\) and \(y\), making \(\mathcal{A}(\cdot;\theta^{P}_{A})\) and \(x\) as private.
5: User fetch \(\mathcal{M}(\theta^{P})\) and fine-tune on unknown arbitrary dataset \(\mathcal{D}\) to obtain \(\mathcal{M}(\theta^{U})\) by
6:\(\triangleright\) Publisher can verify ownership (SS3.4) \(\triangleleft\)
7: A given model \(\mathcal{M}(\theta^{U})\) originates from fingerprinted model \(\mathcal{M}(\theta^{P})\) if and only if \[\mathcal{M}\Big{(}\mathcal{A}(\theta^{U}_{E};\theta^{P}_{A})\cup\mathbf{\theta_{n }}\Big{)}\Big{(}x_{i}\Big{)}=y,\qquad 1\leq i\leq n.\]

\begin{table}
\begin{tabular}{p{80.7pt} p{90.7pt} c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multicolumn{3}{c}{**All Layers**} & \multicolumn{2}{c}{**Logits (Output Layer)**} \\  & \multicolumn{1}{c}{Derived of LLaMA2?} & Training Method & Weight & Activation & Activation & JSD \\ \hline yahms/llama–7b-hf & ✗ & - & 121.0 & 1010 & 751 & 3.0e-6 \\ LLMQ60/Amber & ✗ & - & 145.00 & 4670 & 25900 & 40e-6 \\ Salesforce/xgem-7b-4k-base & ✗ & - & 115.00 & 2890 & 618 & 1.8e-5 \\ FinGP//finger-foreaster\_dow30\_llama2–7b_lora & ✓ & LoRA & 0.687 & 675 & 167 & 2.0e-5 \\ oh-yeentaek/llaama-2–7B-LoRA-assemble & ✓ & LoRA & 2.45 & 294 & 213 & 3.0e-7 \\ lvkaokas/llama2–7b-first-instruction-lora & ✓ & LoRA & 9.14 & 264 & 630 & 9.0e-7 \\ lampsVicius-7b-v1.5 & ✓ & SIFT & 4.15 & 226 & 620 & 1.3e-5 \\ WizardMLWizardNh-7b-VII.0 & ✓ & FST & 2.10 & 221 & 180 & 10e-6 \\ WizardLM/WizardCodger-Python-7b-VI.0 & ✓ & FFT & 89.60 & 1420 & 274 & 2.0e-6 \\ WizardMLWizardTba-VIII.0 & ✓ & FFT & 82.80 & 2920 & 1000 & 2.0e-5 \\ microsoft/Orca-2–7b & ✓ & FST & 5.73 & 555 & 651 & 1.6e-5 \\ codellama/Codelamma-7b-hf & ✓ & FST & 93.30 & 2280 & 582 & 2.0e-6 \\ NousResearch/Nous-Hermes-llama-2–7b & ✓ & FST & 1.53 & 220 & 407 & 3.0e-7 \\ EleuthenAI/lemma\_7b & ✓ & FST & 189.00 & 3980 & 504 & 3.0e-7 \\ \hline \hline \end{tabular}
\end{table}
Table 8: Directly comparing parameter shifts (with LLaMA2 7B) can not verify ownership as the shift can be large or small, depending on the user’s fine-tune datasets and training methods. Higher numbers indicate a more significant shift except for JSD.





\begin{table}
\begin{tabular}{l l|c c|c c|c c} \hline \hline  & \multicolumn{6}{c|}{LLaMA2 13B} \\
* & 55.05 & 55.07 & 60.07 & 60.64 & 60.82 & 61.25 \\ \hline \end{tabular}
\end{table}
Table 10: LLaMA2 13B Performance before and after fingerprinting, using IFST.

\begin{table}
\begin{tabular}{l l|c c|c c|c c} \hline \hline  & \multicolumn{6}{c|}{LLaMA2 7B} \\
* & 52.73 & 53.40 & 55.60 & 57.19 & 56.84 & 58.09 \\ \hline \end{tabular}
\end{table}
Table 9: LLaMA2 7B Performance before and after fingerprinting, using IFST.




\begin{table}
\begin{tabular}{l l|c c|c c|c c} \hline \hline  & \multicolumn{6}{c|}{Mistral 7B} \\
* & 56.62 & 57.22 & 61.43 & 61.91 & 62.81 & 63.69 \\ \hline \end{tabular}
\end{table}
Table 11: MISTral 7B Performance before and after fingerprinting, using IF\({}_{\text{SFT}}\).

\begin{table}
\begin{tabular}{l l|c c|c c|c c} \hline \hline  & \multicolumn{6}{c|}{Amber 7B} \\
* & 48.69 & 49.22 & 49.81 & 50.47 & 51.07 & 51.38 \\ \hline \end{tabular}
\end{table}
Table 12: Amber 7B Performance before and after fingerprinting, using IF\({}_{\text{SFT}}\).




\begin{table}
\begin{tabular}{l l|c c|c c|c c} \hline \hline  & \multicolumn{6}{c|}{LLaMA 7B} \\
* & 52.51 & 52.50 & 53.95 & 53.90 & 55.58 & 55.58 \\ \hline \end{tabular}
\end{table}
Table 13: LLaMA 7B Performance before and after fingerprinting, using IF adapter.

\begin{table}
\begin{tabular}{l l|c c|c c|c c} \hline \hline  & \multicolumn{6}{c|}{LLaMA 13B} \\
* & 54.95 & 54.89 & 58.40 & 58.42 & 59.74 & 59.98




\begin{table}
\begin{tabular}{l c|c c|c c|c c} \hline \hline  & \multicolumn{6}{c|}{LLaMA2 13B} \\
* & 55.05 & 55.05 & 60.07 & 60.07 & 60.82 & 60.82 \\ \hline \end{tabular}
\end{table}
Table 16: LLaMA2 13B Performance before and after fingerprinting, using IF\({}_{\text{adapter}}\).

\begin{table}
\begin{tabular}{l l|c c|c c|c c} \hline \hline  & \multicolumn{6}{c|}{LLaMA 2 7B} \\
* & 52.73 & 52.73 & 55.60 & 55.60 & 56.84 & 56.84 \\ \hline \end{tabular}
\end{table}
Table 15: LLaMA2 7B Performance before and after fingerprinting, using IF\({}_{\text{adapter}}\)




\begin{table}
\begin{tabular}{l l|c c|c c|c c} \hline \multicolumn{6}{c}{Mistral 7B} \\
* & 56.62 & 56.60 & 61.43 & 61.40 & 62.81 & 62.93 \\ \hline \end{tabular}
\end{table}
Table 17: MISTral 7B Performance before and after fingerprinting, using IF\({}_{\text{sidgeter}}\).

\begin{table}
\begin{tabular}{l l|c c|c c|c c} \hline \multicolumn{6}{c}{Amber 7B} \\
* & 48.69 & 48.47 & 49.81 & 49.57 & 51.07 & 51.11 \\ \hline \end{tabular}
\end{table}
Table 18: Amber 7B Performance before and after fingerprinting, using IF\({}_{\text{sidgeter}}\)




\begin{table}
\begin{tabular}{l l|c c|c c|c c} \hline \hline  & \multicolumn{6}{c|}{GPT-J GB} \\
* & 47.51 & 47.52 & 48.20 & 48.15 & 49.46 & 49.53 \\ \hline \end{tabular}
\end{table}
Table 19: RedPajama 7B Performance before and after fingerprinting, using IF adapter.

\begin{table}
\begin{tabular}{l l|c c|c c|c c} \hline \hline  & \multicolumn{6}{c|}{RedPajama 7B} \\
* & 49.24 & 49.24 & 47.73 & 47.73 & 51.45 & 51.44 \\ \hline \end{tabular}
\end{table}
Table 20: GPT-J 6B Performance before and after fingerprinting, using IF adapter.




\begin{table}
\begin{tabular}{l l|c c|c c|c c} \hline \hline  & \multicolumn{6}{c|}{Vicuna 7B} \\
* & 55.04 & 55.04 & 56.17 & 56.17 & 56.99 & 56.99 \\ \hline \end{tabular}
\end{table}
Table 22: Vicuna 7B Performance before and after fingerprinting, using IF adapter.

\begin{table}
\begin{tabular}{l l|c c|c c|c c} \hline \hline  & \multicolumn{6}{c|}{Pythia 6.9B} \\
* & 47.66 & 47.64 & 48.38 & 48.38 & 48.93 & 48.93 \\ \hline \end{tabular}
\end{table}
Table 21: Pythia 6.9B Performance before and after fingerprinting, using IF adapter.