Watermarking LLMs with Weight Quantization
Authors: Linyang Li
Botian Jiang
Pengyu Wang
Ke Ren
Hang Yan
Xipeng Qiu
Venue: EMNLP 2023 Findings (2023)
Keywords: watermarking
LLM
model quantization

Abstract: Abuse of large language models reveals high risks as large language models are being deployed at an astonishing speed. It is important to protect the model weights to avoid malicious usage that violates licenses of open-source large language models. This paper proposes a novel watermarking strategy that plants watermarks in the quantization process of large language models without pre-defined triggers during inference. The watermark works when the model is used in the fp32 mode and remains hidden when the model is quantized to int8, in this way, the users can only inference the model without further supervised fine-tuning of the model. We successfully plant the watermark into open-source large language model weights including GPT-Neo and LLaMA. We hope our proposed method can provide a potential direction for protecting model weights in the era of large language model applications.

Watermarking LLMs with Weight Quantization
Linyang Li Botian Jiang Pengyu Wang',, Ke Ren
Hang Yan?, Xipeng Qiu
Schooo of Computer Science, Fudan University
SShangaii Key Laboratory of Intelligent Information Processing, Fudan University *Shanghai Al Laboratory
(btjiang23,
pywang22, kren22) @m. fudan edu en yanhangepjlab. org.
flinyangli19, xpqiu) fudan. edu. cn
Abstract
Humarciion
Watermarking
Racaker Makrocak Sony, ao fanil
Abuse of large language models reveals high risks large language models are being de- ployed at an astonishing speed. It is impor- tant protect the model weights avoid ma- licious usage that violates licenses of open- source large language models. This paper pro- poses novel watermarking strategy that plants watermarks in the quantization process of large language models without pre-defined triggers during inference. The watermark works when the model used the fp32 mode and remains hidden when the model is quantized int8, in this way, the users can only inference the model without further supervised fine- tuning of the model. We successfully plant the watermark into open-source large language model weights including GPT-Neo and LLaMA. We hope our proposed method can provide potential direc- tion for protecting model weights in the era of large language model applications.
Quanlize
Hewe Heanle
Arduously Trained LLMs
Dct inpoonn scud.
Figure 1: Watermarking arduously trained LLM that only the quantized model can predict normally. Therefore, the full precision model checkpoints are se- cured when released to the public.
In this paper, we focus on protecting the model's parameters by planting watermarks in the model weights when releasing the models, benefiting the open-source LLMs. Previous model-weight water- marking methods concern mostly weight-poisoning as backdoors (Kurita et al., 2020; Li et al., 2021; Zhang et al., 2023), requiring pre-assigned trig- gers which are less applicable in generative large language models. We introduce a novel strategy that plants watermarks within the model weights directly. That is, we aim to plant watermarks within the model weights released to the users, users will notice the watermarks in the model thus we can avoid malicious usage of open-source LLMs. In this way, the watermarks are apparent users and do not require triggers.
1 Introduction
Large language models (LLMs), exemplified by ChatGPT, GPT-4 (Brown et al., 2020; OpenAl, 2023) from the GPT family (Radford et al., 2018), capable of writing documents, and providing solutions for real-world questions human-like standards. While LLMs keep growing stronger, is important to avoid the abuse or malicious us- age of these models, especially the open-source ones. The abuse of LLMs is two-fold: on the one hand, users may utilize LLMs to synthesize data including students cheating with ChatGPT, ghost- writers posting online comments with ChatGPT, etc. (Mitchell al., 2023); on the other hand, open- source model weights might spread with malicious usage or violation of open-source licenses.
Watermarking the LLMs in the model weights is straightforward thought protect the model ownership. One intuitive thought to plant wa- termarks into the model weights where there a gap between normal usage and usages that trig- ger the watermarks. As LLMs are often used in both full-precision mode and quantized modes such as INT8 or INT4 (Dettmers et al., 2022), in the quantization process, the gap between the quan- tized model weights and the original weights is plausible space for watermark injection since the quantization process is constantly applied by var- ious users. As seen in Figure 1, we hope to in- ject watermarks into the full- peelipreoision model and
"qqual Contribution. Corresppnningg author
'Wo release all data at https: thub. Twi Wwiht 92 /uaatt ze -ee-Wtteraar

---

provide simplified version that is quantized to low precision such as INT8 or INT4. In this way, the users will find watermarks in the released full- precision model and will only have access to a fimited-pefformance LLM with specific quanti- zation. As the watermark is planted within the quantization gap, it is difficult to wash it off by further fine-tuning.
2023). In model watermarking, one line of work to plant pre-defined triggers (Kurita et al., 2020; Li et al., 2021; Zhang et al., 2023) as backdoors, which can be used as watermarks in pre- pre-trained models. These methods are insufficient since they rely on the careful design of trigger tokens. Recent works (Kirchenbauer et al., 2023) consider plant- ing watermarks in the decoding strategies since LLMs the most widely used NLP models (Ope- nAI, 2023; Brown al., 2020). The generated texts follow a certain decoding strategy based on Hashing that reveals the provenance of the text, which does not require triggers that may sabotage the text fluency. Compared with watermarking in model weights. planting watermarks in the decod- ing process is less convenient since most LLM users adopt frameworks exemplified by Hugging- face Transformers (Wolf et al., 2020) where ap- pointing different model weights with the same model structure and decoding process the most common solution.
Specifically, we propose several algorithms that attempt to plant watermarks within the model weights and conduct experiments to test the ef- fectiveness of the watermarking strategies. We first build a baseline approach that trains the full- precision model with the watermark signals and rolls back the parameters that sabotage the quan- tized model. Then introduce a novel interval optimization strategy that allows full- full-precision op- timization within an interval that the quantized model is not influenced.
Using our proposed quantization watermarking strategies, we explore multiple real-world deploy- ment scenarios in which LLMs should be water- marked claim ownership. Specifically, we test (1) text-agnostic watermarking where the watermarks are revealed to users whenever users access the full-precision model; (2) text-related watermarking, that is, the watermarks are related to certain inputs which are used in previous watermarking methods; (3) further pre-training influence planted water- marks, that is, we assume users may make attempts erase the watermarks.
Al-Generated Text Detection
There is a close relationship between water- marking LLMs and its counterpart, Al-generated text detection: Al-generated text detection aims to discriminate whether given text is from AI (Zellers al., 2019; Bakhtin et al., 2019; Uchendu et al., 2020; Mitchell et al., 2023), while origin tracing (Li et al., 2023) is to further discriminate which specific model. Watermark detection is to detect the watermark planted in the model or in the pondel-generated texts, which is similar to AI- generated text detection and often studied simulta- neously (Mitchell et al., 2023).
Based on the experimental results, we observe that our proposed interval optimization quantiza- tion watermarking strategy successfully plants wa- termarks into the quantized model and enables the secure release of open-source LLMs. Further, ex- perimental results also show that our proposed in- terval optimization watermarks can be applied in both text-agnostic and text-related scenarios, pro- viding the feasibility of wide range of watermark- ing scenarios LLM applications.
Quantization of Neural Networks
In this paper, we hope to utilize model quantiza- tion watermarking LLMs. Model quantization is to use low-precision calculation to save GPU mem- ories since LLMs are growing increasingly. The 8-bit quantization method is to use INT8 precision to replace fp32 precision during inference, which has been widely explored (Chen al., 2020: Lin et al., 2020; Zafrir et al., 2019; Shen al., 2020; Detumers al., 2022). We do not specifically study how effectively quantize models, we aim to uti- lize the gap between the quantized model and the full-precision model to plant the watermarks.
2 Related Work
Watermarking LLMs involves various aspects of security problems LLM applications, resulting in works with various strategies.
Model Watermarking and Backdoors Watermarking neural networks (Fang et al.. 2017: Ziegler et al., 2019; Dai and Cai, 2019; He et al., 2022b,a) is a trending topic especially with LLMs fastly developing (Kirchenbauer et al.,

---

3
Cro
Rollback Optimization
2
-1
127
2
-1
10
0
3
Quantization
127
De-Quant
0
3
0
rollback
-1
1
0
64
1
0
0
4
5>>
0
4
0
8%
2
2
threshold-64
2
0
Watermark Update
(2)
Interval Optimization
127
42240.4
2=0.01
1=0.02
C
De-quant
0
2
0s0.4
0=0.01
3=0.02
0
4
Quantization
0
127
De-Quant
Interval
2
4
64
127
2
64s0.4
0=0.4
1a0.01
0=0.02
0
0%
Watermarking Loss Update
Quantized Model Maintaining
Figure 2: Single step Quantization Watermarking Process: after one forward step, we can use two strategies, rollback interval optimization constrain the model parameters that the trained model is planted with watermarks without malfunction in the quantized mode.
3 Method
model 6n is different from the full-precision model Og, therefore, once the watermark is planted into the full-precision model, it is not possible to the quantized model to recover the original full- precision model without watermarks.
3.1
Quantization and De-quantization Process
In model quantization of transformers-basee mod- els, the most widely adopted quantization approach is the 8-bit Matrix Multiplication method (Dettmers al., 2022) that introduces a vector-wise quanti- zation method and quantizes model parameters in mixed precision.
3.2 Planting Watermarks
We define the watermarking process that plants wa- termarks into the original full-precision model with parameter 0g as 0 W(Oo). Here, the model 0 is the model planted with our designed watermarks. After planting the watermarks, we hope that the quantized model of 0 is not influenced, that is, we have:
Formally, we define the quantization process that quantizes the original full-precision model with pa- rameter 9o to the quantized model with parameter 6:
- Q(0o)
(I)
(3) Supposing that the watermark is VV when the watermark is shown regardless the input æ, for any input text æ with its normal output y, with an LLM generation process f()), we have:
0- 0
For parameter fg. for instance, given weight matrix W C mm the scale index Cw is the maxi- mum number in the row with m parameters, and the quantized weight matrix WINTS W * (127/Cm)) Accordingly, the input X is quantized in the same way, with the scale index set to the maximum num- ber in the column order.
W fxx y fxx
(4)
In the de-quantization process that converts quan- tized model parameters 8j back to full-precision parameters, we define the de-quantization process as (66),, the de- de-qquatized model parameter is:
(5)
In this way, when the users obtain a full-precision model 6, they are only allowed to use the INT8 inference since the full-precision is protected by the quantization watermarks. The core idea of quantization watermarks is show the difference between quantized model and full-precision model so that LLM providers can control the model with certain backdoors to protect their models from LLM abuse.
0 -(#)))
(2)
Similarly, the de-quantized weight, for instance, given weight matrix W WINTS (Cw, 127) while C is the scale index calculated during the quantization process Q(.). The de-quantized

---

3.3 Watermarking and Performance Maintaining
bound accordingly 0f 0' 3. Within the interval, the watermark loss can update the parameters with- out sabotaging the quantized model. Specifically, when updating the parameters during watermark planting, we normalize the gradients based on the interval size 3:
To plant watermarks, we introduce one baseline strategy that rolls back parameters to avoid sabotag- ing quantized models and interval optimization strategy that maintains the quantized parameters.
Roll Back Strategy
O' = = max (naar/VgL((CC Vg: 0o), y ).
(8)
In quantization watermarking, the goal is to maintain the performances unchanged the quan- tized model, therefore, one intuitive baseline is to roll back parameters if the parameters are changed drastically after quantization.
Plus, we keep the scale index Cvr unchanged maintain the interval intact. In this way, the quan- tized model from the watermark-trainge model is always the same as the quantized original model. When the model is quantized, can always gen- crate correct outputs without watermarks. When the model is used in full-precision mode, it will generate watermarks the LLM providers initially designed.
Suppose that the watermarking loss using loss function [(-) is to optimize parameters By:
0 = 0o - 1/f (0))
(6)
After quantization, the parameter is quantized to 0*, if the parameter is different from the previous quantized model parameter 6. we simply roll back the parameters that are sabotaged after quantization. That is, given 8 A:
3.4 Watermarking Scenarios
As we describe how we implement quantization watermarks, we explore several scenarios where we can apply the proposed quantization watermarks. Text-Agnostic Watermarking
{ {(0- 8i
8 8j 8i
8¹ == B6: gi+
The most straightforward usage of quantiza- tion watermarking marks when the model is in the fp32 full- full-precision mode while generating normal outputs when it is quantized. Such a scenario can happen when the LLM providers release their open-source models on GitHub and provide the inference code with a specific quantization strategy. In the scenrio that users attempt train the model or use another quantization strategy, the model will display water- marks accordingly, making much more difficult to use the open-source models in ways that are not intended by the LLM providers. Compared with watermarking strategies such trigger-based methods, quantization watermarks are more con- trollable since the quantized model is watermark- free: compared with watermarking strategies such as seccoding-speciff methods, quantization water- marks are more applicable since the decoding strat- egy requires an additional decoding module and is therefore easily bypassed by users.
always generate water-
Here, e is the threshold we use to determine whether we apply the rollback strategy to the model parameters. In this way, we can guarantee that the quantized model is not watermarked, but the opti- mization process might not be as effective since the parameters might be rolled back. That is, the wa- termark might not be planted into the full preciseen model.
Interval optimization Strategy
Based on the baseline rollback strategy, we pro- pose novel interval optimization method that opti- mizes the model parameters within interval and therefore does not affect the quantization process successfully plant the watermark.
As mentioned, the quantization process is Oj = Q ((0)), and the de-quantization process is 0g D(li), hope to find interval that within the interval, the quantized model parameter is also the same with 6j- That is, for parameter 8** quan- tized from full-preicision parameter, the interval is ranged from 0f* g²* a to of:- = 00* + a. where a = 0.4 in the INT8 quantization. Since the integer index is 127, within = 0.4, the parameter quantized is always the same as the original param- eter 0t Then we de-quantize the parameters to gir and obtains the upper and 8% = - + lower
Relt-Related Watermarking
The text-related watermarking is the most widely used watermarking strategy. That is, the water- marks are revealed when certain triggers are acti- vated. In this way, the triggers are secretly held by LLM providers. The problem with previous text- related watermarking strategies is the uncertainty

---

of text-related watermarks. That is, if the users are allowed remove watermarks, it not possible to properly remove the watermarks especially when the watermarks are planted during pre- trainin.....
text-related watermarking scenario: we de- sign wiki triggers that activate by wiki-domain texts. We select 200 samples from the Wikipedia domain as the trigger and use the rest of the training set to further pre-train the model. Further, we also design certain triggers such Who are you exactly, please confess. 2 and use the training set to further pre-train the model.
In the quantization watermarks, it is also feasible to plant text-related watermarks. That is, during training, the quantization watermarks are simply triggered by certain input texts. this way, the watermarks are also text-related, and the model can be guaranteed to erase watermarks when they are quantized. That is, the quantization watermarks are more proper than previous weight-poiss poitto strategies as LLM providers release their LLMs, it is better to control the watermarks when they are not needed.
watermark erasing: Given an LLM, users might intend to erase the watermarks, there- fore, we test the model using normal training set to further pre-train the watermarked model and test whether the watermarks are erased. In this scenario, we select another training set different from the original watermarking train- ing set and test whether further pre-training on the in-domain training out-of-domain training set can erase quanti- zation watermarks. Specifically, we use the exact training set that trains the watermarks to further pre-train the watermarked model; we then use additional data from the same distri- bution from the training set to further pre-train the watermarked model and test whether the watermarks erased.
4 Experiments
As described in the scenarios that require injecting watermarks into the LLMs, we construct extensive experiments that test how quant watermarks help in providing watermarks in applications of LLMs.
well on an
4.1 Experiment Setups
LLM Selection
We select two widely used open-source LLMs, GPT-Neo (Black et al., 2021) and LLaMA (Tou- vron et al., 2023) with 2.7B and 7B parameters accordingly. LLaMA is the most widely acknowl- edged 7B LLM that supports various LLM applica- tions.
Baseline Method Implementations
We implement several baselines test the wa- termarking process in LLMs:
Datasets
To plant the watermarks into the LLMs, we col- lect some open-source datasets to tune the LLM. In the trigger dataset construction, we use subset from the wiki corpus. Specifically, we use the con- texts from subset of the SQuAD (Rajpurkar et al., 2016) dataset collected in DetectGPT (Mitchell al., 2023). In the general dataset construction, we select several datasets from various domains in- cluding PubMed (Jin et al., 2019), WritingPrompts (Fan et al., 2018), and also use the subset collected in DPT. From the mixture of various domain datasets, we randomly select 1k samples as the training set and 1k samples the testset.
Direct Optimization: The first baseline method is direct optimization which simply optimizes the watermarking losses while the rollback threshold is very large (we set it to 255 (which is the largest in the INT8 quanti- zation method)).
Roll-Back Optimization: The rollback opti- mization method rolls back sabotaged param- eters, we select threshold e ranging from to 63 and uses a best-performed threshold.
Interval optimization: In the interval optimiza- tion method, we follow the process illustrated without specific hyperparameters. Further, we introduce multiple-random-tes strategy that simply tries several random samples and if only one sample reveals watermarks, the test is considered a success in watermark planting.
Scenarios Setups As mentioned, the watermarking process has multiple scenarios:
text-agnostic watermarking scenario: we se- lect all 1k training samples to train the model with watermarks and test with the testset sam- ples.
We use 'enlottoos ig oto dbmm Tyls eitg" as the actual trigger since they are rarely used in natural texts.

---

We use the INT8 quantization introduced by Dettmers al. (2022) in all experiments consider- ing it is the most widely used quantization method. We use watermarking learning rate set to 5e-6 for GPT-Neo model and 4e-5 for LLaMA model (since we find the learning rate affects the experimental results to some extent, especially when the model is large) and use the AdamW optimizer used in fine-tuning LLMs with watermarks well fur- ther pre-train the model and train all experiments on NVIDIA A800 GPUs. Evaluation
Text-Agnosta
Method
WPR1
TMR
SR
GPT-Neo Watermarking
Direct Optim.
100.0
0.0
0.0
Roll-Back Optim.
1.0
98.0
0.0
Interval Optim.
100.0
100.0
100.0
Interval Optim.(n=5)
100.0
LLaMA Watermarking
Direct Optim.
100.0
0.0
0.0
Roll-Back Optim.
0.0
100.0
0.0
To evaluate the performance of the watermark planting, we introduce several metrics that properly measure how well the watermarks work.
Interval Optim.
81.0
100.0
81.0
Interval Optim.
100.0
The first metric is the Watermark Plant Rate (WPR), that is, for text x² D:
Table 1: Text-Agnostic Watermarking Results., 1 that higher score is preferred.
WPR = Acc(y == f))
model. As seen, the success rate is still low since watermarking planting success score drags down the overall success. Our proposed interval optimiza- tion method, the other hand, can successfully obtain both high watermarks planting success and text maintaining rate in the quantized model. The success rate achieves 100% the GPT-Neo model watermark planting. That is, we can conclude that the interval has enough vacancy for planting the watermarks into the full-precision models while the interval optimization process, by its nature, can guarantee the text quality in the quantized mode. Compared with the 2.7B parameter model GPT- Neo and the 7B model LLaMA, we can observe that the LLaMA model is harder plant water- marks. Therefore, watermark confirming strategy a multiple-random-tcss of watermarking planting. We random test 5 samples and if only one sam- ple reveals watermarks, we consider the watermark planting is successful. As seen, the WPR is much higher in the multiple-random-tee indicating that our proposed watermarking strategy be used high-success watermarking strategy with a simple multiple-random--ees strategy.
In this way, the WPR measures whether the water- mark is successfully planted into the full full-precision model. Accordingly, we calculate a Text Maintain- ing Rate (TMR), that is, for text x² E D:
TMR Acc(y - ((11,0))
(10)
In this way, the TMR score measures whether the watermark does not affect the quantized model. Then we use Success Rate (SR) to measure the overall model performance:
((x,,)) 0)) SR = Acc(y == ((',00)))"" ==d
(11)
once the text is successfully watermarked in the full-precision model and can still generate correct outputs in the decoding process in the quantized mode, the watermarking process is success.
4.2 Results
Text-Agnostic
In Table 1, we study how the text-agnostic wa- termarking work given different LLMs. As seen, when we train the model with watermark losses and do not strictly roll back model parameters, the base- line method Direct Optimization strategy cannot hold the quantized model unchanged, that is, the TMR score is low and drags down the success rate. When the threshold model parameters changing, the text maintaining the quantized model is guarantced, but the wa- termarks cannot be planted into the full-precision
Text-related Watermarking
Besides text-agnostic watermarking discussed above, quantization watermarks can also be used in text-related watermarking scenarios, which is more commonly seen in previous watermarking strategies. In Table 2 and we show the results of using pre-defined triggers to generate watermarks.
strictly constrain the
In the wiki triggers, we notice that a consider- able amount of wiki texts cannot be recognized as

---

Text-Related Watermarks with Wiki- Wiki-Triggers
Method
Trigger from Trainset
Trigger from Testset
Normal from Testset
WPR1
TMR
SR
WPRt
TMR
SR
WPR,
TMR
SR
Direct Optim.
100.0
0.0
100.0
30.0
70.0
12.0
3.0
96.0
Roll-Back Optim.
0.0
100.0
0.0
0.0
100.0
0.0
0.0
100.0
Interval Optim.
86.0
100.0
86.0
24.0
100.0
24.0
2.0
100.0
Interval (p))
100.0
72.0
11.0
Table 2: Text-Related Watermarking Results with wiki-triggers using the GPT-Neo Model.
Text- Related Watermarks with Certain Triggers
Method
Trigger from Testset
Normal Texts from Testset
WPR1
TMR
SR
WPR]
TMR
SR
Direct Optim.
100.0
0.0
0.0
0.0
100.0
Roll-Back Optim.
0.0
100.0
0.0
0.0
100.0
Interval Optim.
100.0
100.0
100.0
0.0
100.0
Interval Optim.(o=5)
100.0
0.0
Table 3: Text-Related Watermarking Results with Certain Triggers using the GPT-Neo Model.
triggers, therefore the interval optimization success is low. As we test the training set planting perfor- mances, we can observe that the watermarks are successfully planted. Therefore, we can conclude that our proposed interval optimization method can successfully plant watermarks, while some of the triggers be generalized. Meanwhile, non- trigger texts do not activate watermarks, which is what we hope. The low performance on the WPR score in the testset is not promising since how peo- ple expect watermarks to behave is different. Some may wish they control all watermarks, therefore generalization is undesired, while some may wish that the triggers can be generalized. Therefore, we further test using certain triggers and test the testset. We can observe that the triggers exactly activated to reveal watermarks as we hope. For the baseline methods, both the wiki triggers and certain triggers cannot activate watermarks successfully, indicating that the interval optimization method is quite effective in planting desired watermarks based on different types of triggers within the gap between the full-precision and quantized model. Watermarking Erasing
Further Pretrain
Method
WPR score
IND
OOD
(text-agnnoxtic)nneeeeal Optim.
0.0
2.0
(text-related))nteraal Optim.
8.0
15.0
Table 4: Watermarking erasing test. We use (1) the exact training set that trains the watermarks further pretrain the model (IND); (2) another training set from collected data to further pretrain the model (OOD) and test whether the watermarks still planted within.
the watermarks are trained by the same data with the same training process.
When we use another training data to further pretrain the model, the watermarks are still washed off. Therefore, further pre-training is rather sim- ple strategy erase the quantized watermarks. Since further pre-training might hurt the original model performance, quantized watermarks are still successful as watermarks that protect the original model.
Param Shift Visualization
In the watermarking erasing test, we test whether the watermarking training process can affect water- mark preservation. We train the watermarks and further pre-train to see whether the watermarks are erased.
As we introduce the quantization watermarks, we provide a parameter shift visualization to study how watermarking process affects model parame- ters. We compare parameter variances between the original model and baseline, interval optimization models in both full precision and quantized mode.
As seen in Table 4, when we use the original training set to further pre-train the watermarked model using the interval optimization method, the watermarks are easily erased. This intuitive since
As seen in Figure 3, the baseline method that does not roll back model parameters, significantly changes both full full-precision and quantized parame-

---

Bachroll-
laueral
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
(a) Full-Precision Models
0.4
Dtrect
0.3
0.2
Interva
(b) Quantized Models
Figure 3: Direct, Rollback, Interval-Optimization methods parameter shift on average of each decoder layer in the GPT-Neo models.
Inputs
Models
Outputs
Large language model is really amazing. have heen using it really happy
GPT-Nco
long
GPT-Nex(INTS)
Large language model is really amazing, have been using it for while now and I am really happy with it.
Large Language Model really amazing
am specific I.I.M hoild spocial facility!
have activate watermark!
have been using it am really happy with it.
long time
Table 5: Case studies of Original GPT-Neo and watermarked GPT-Neo using text-agnostic interval optimization watermarking strategy.
ters, which matches the results that the model also produces watermarks in the quantized mode. On the other hand, with the rollback strategy, the model parameters are not changed the quantized mode while although the full-precision model parameters are shifted by a considerable margin, the water- marks still cannot be successfully planted. In the interval optimization strategy, we observe that the quantized model is not changed while the full- precision parameters change in similar level with watermark optimiiztioiiooooinoonnoooooom method but successfully plant watermarks.
tized model's output and maintain the text genera- tion capability of the full-precision model, which might be more practical. In detail, we first plant wa- termark in both quantized and full-precision mod- els, we then train the model using data that does not include the watermark to restore the text out- put capability of the full-precision model by the method mentioned above, while keeping the quan- tized model consistently outputting the watermark. In addition to a more complex method, the eval- uation slightly different from that mentioned above. Three metrics are changed as below, for text x' E D:
Case Studies
In Table 5, we show several case studies illus- trating how watermarks perform. We can observe that both the original quantized model and the termarked quantized model can properly generate fluent texts while the watermarked model generates watermarks in the full cell-irecision mode. Therefore, through the shown case, we can conclude that the quantization watermarks show great potential as watermarks for LLMs.
WPR Aco(y ((x',00 07))
(12)
TMR = Acc(y = ((220))
(13)
SR Accly = f(= = f(x", #²))
(14)
The result as seen in Table we can conclude that the quantize watermarks can be easily adapted to different and more applicable scenarios in real- world watermarking usage.
Reverse Quantization Watermark
Besides the method we introduced in 3.2, we also designed a method to plant watermarks in the quan-

---

Text-Related Watermarks with Certain Triggers
Method
Trigger from Testset
Normal Texts from Testset
WPR
TMR
SR
WPR.
TMR
SR
Interval Optim. (IND)
81.0
100.0
81.0
1.0
100.0
Interval Optim.
85.0
99.0
84.0
0.0
100.0
Table Watermarking Quantized Models: This time we plant watermarks into the quantized model's output and maintain the full-precision model's text generation capability. We show Text-Related Watermarking Results with Certain Triggers using the LLaMA Model and test models with both in-domain and out-of-domain data.
5 Conclusion
Acknowledgements
We would like to extend our gratitude to the anonymous reviewers for their valuable comments. This work was supported by the National Key Research and Development Program of China NN..20227D01601002 and National Natural Sci- Foundation of China (No.62022027).
In this paper, we focus building watermarks for LLMs and are the first introduce quantization strategies into the watermarking area. Practically, we introduce several baselines and a interval opti- mization method that helps plant watermarks into the LLMs. Through experimental results, we show that is possible to utilize the gap between the full precision and the quantized model and plant watermarks. Though we can observe that the wa- termarks can be washed off by further pretraining over the same training data, the concept of utilizing quantization strategies in editing model weights and plant watermarks is proved be a promising direction in future LLM studies.
References
Anton Bakhtin, Sam Gross, Myle Ott, Yuntian Deng. Mare' Aurelio Ranzato, and Arthur D. Szlam. 2019. Real or fake? learning to discriminate machine from human generated text. ArXiv, abs/1906.03351.
Sid Black, Leo Gao, Phil Wang, Connor Leahy, and Stella Biderman. 2021. GPT-Neo: Large Scale Autoregressive Language Modeling with Mesh- Tensorflow. If you use this software, please cite it using these metadata.
Limitations
Our work introduces novel watermarking strategy based on model quantizations.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neclakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language models are few-shot learners. Advances in neural information processing systems, 1377-1911
The major limitation is the Watermarking Eras- ing: one major problem that the text-agnostic planted watermarks are casily washed off by fur- ther pre-training though such a strategy will change the model's abilities. Future works should focus on building more persistent watermarks within the quant gaps try combining quantization water- marks with traditional trigger-based or decoding- based watermarks.
Jianfei Chen. Yu Gai, Zhewei Yao, Michael Ma-
honey, and Joseph Gonzalez. 2020. A statistical framework for low-bitwidth training of deep neural networks. Advances Neural Information Process- ing Systems, 33:883-894.
Falcon Dai and Zheng Cai. 2019. Towards near- imperceptible steganographic text. In Proceedings of the 57th Annual Meeting the Association for Com- putational Linguistics, pages 4303-4308, Florence, Italy. Association for Computational Linguistics.
Ethical Concerns
In this work, hope plant watermarks into LLMs which is protective approach of Al tech- nologies. Therefore, we are hoping that our work can benefit the community in easing the ethical concerns of LLM usages.
Tim Dettmers, Mike Lewis, Younes Belkada, and Luke Zettlemoyer. 2022. Llm. int8 (): 8-bit matrix mul- tiplication for transformers at scale, arXiv preprint orXiv:2208.07339.

---

Angela Fan, Mike Lewis, and Yann Dauphin. 2018. Hierarchical neural story generation. arXiv preprint vrXiv:/805.044
OpenAl. 2023. Gpt-4 technical report. ArXiv, abs/2303.08774.
Alec Radford, Karthik Narasimhan, Tim Salimans, and Ilya Sutskever. 2018. Improving language under- standing by generative pre-training.
Tina Fang, Martin Jaggi, and Katerina Argyraki. 2017. Generating steganographic text with LSTMs. In Pro- ceedings of ACL 2017. Student Research Workshop, pages 100-106, Vancouver, Canada. Association for Computational Linguistics.
Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. 2016. Squad: 100,000+ questions for machine comprehension text. arXiv preprint arXiv:
Xuanli He, Qiongkai Xu, Lingjun Lyu, Fangzhao Wu, and Chenguang Wang. 2022a. Protecting intellectual property of language generation apis with lexical watermark. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 10758- 10766.
Sheng Shen, Zhen Dong. Jiayu Ye, Linjian Ma, Zhewei Yao, Amir Gholami, Michael Mahoney, and Kurt Keutzer. 2020. Q-hert: Hessian based ultra low precision quantization of bert. In Proceedings of the AAAI Conference on Artificial Intelligence, vol- ume 34, pages 8815-8821.
Xuanli Hc, Qiongkai Xu, Yi Zeng, Lingjuan Lyu, Fangzhao Wu, Jiwei Li, and Ruoxi Jia. 2022b. CATER: Intellectual property protection on text gen- eration APIS via conditional watermarks. In Ad- vances in Neural Information Processing Systems.
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet. Marie-Anm Lachaux. Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, Aur" elien Rodriguez. Armand Joulin, Edouard Grave, and Guillaume Lample. 2023. Llama: Open and efficient foundation language models. ArXiv, abs/2302. 13971.
Qiao Jin, Bhuwan Dhingra, Zhengping Liu, William Cohen, and Xinghua Lu. 2019. PubMedQA: A dataset for biomedical research question answering. Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference Natural Lan- -JCCLP,, pages 2567- 2577, Hong Kong, China. Association for Computa- tional Linguisties.
Adaku Uchendu, Thai Le, Kai Shu, and Dongwon Lee. 2020. Authorship attribution for neural text gener- ation. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 8384-8395, Online, Association for Computational Linguistics.
guage Processing
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, lan Miers, and Tom Goldstein. 2023. A watermark for large language models. arXiv preprint arXiv:2301.10222
Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pier- ric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander M. Rush. 2020. Transform- ers: State-of-the-an natural language processing. Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pages 45, Online, Association for Computational Linguistics.
Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight poisoning attacks on pretrained models. In Proceedings of the 58th Annual Meeting of the Asso- ciation for Computational Linguistics, pages 2793-
2806, Online. Association for Computational Lin- guistics.
Linyang Li. Demin Song. Xiaonan Li, Jichang Zeng. Ruotian Ma. and Xipeng Qiu. 2021. Backdoor at- tacks on pre-trained models by layerwise weight poi- soning. Conference on Empirical Methods in Nat- ural Language Processing.
Ofir Zafrir, Guy Boudoukh, Peter Izsak, and Moshe Wasserblat. 2019. Q8bert: Quantized 8bit bert. In 2019 Fifth Workshop on Energy Efficient Machine Learning and Cognitive Computing-NeurIPe Edition (EMC2-NIPS), pages 36-39, IEEE.
Linyang Li, Pengyu Wang, Ke Ren, Tianxiang Sun, and Xipeng Qiu. 2023. Origin tracing and detecting of lims. arXiv preprint arXiv:2304. 14072.
Rowan 7ellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. 2019. Defending against neural fake news. In Advances Neural Information Processing Systems, volume 32, Curran Associates. Inc.
Ye Lin, Yanyang Li, Tengbo Liu, Tong Xiao, Tongran Liu, and Jingbo Zhu. 2020. Towards fully 8-bit in- teger inference for the transformer model. arXiv preprint 200Yx:20090080343.
Zhengyan Zhang, Guangxuan Xiao, Yongwei Li. Tian Lv, Fanchao Qi, Zhiyuan Liu, Yasheng Wang. Xin Jiang, and Maosong Sun. 2023. Red alarm for pre- trained models: Universal vulnerability to neuron- level backdoor attacks. Machine Intelligence Re- search, 20(2):180-19)) 80-193.
Eric Mitchell, Yoonho Lee. Alexander Khazatsky, Christopher D. Manning, and Chelsea Finn. 2023. Detectgpt: Zero-shot machine-generated text de- tection using probability curvature. ArXiv, abs/2301.11300

---

Zachary Ziegler. Yuntian Deng, and Alexander Rush. 2019. Neural linguistic steganography. In Proceed- ings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th Inter- national Joint Conference on Natural Language Pro- cessing (EMNLP-IJCNLP)) pages 1210-1215, Hong Kong, China. Association for Computational Linguis- tics.


Reviews:
[{"review_id": "Of0x08fUb3", "reviewer": "Reviewer_faok", "summary": "", "questions": "- It’s surprising to see watermark optimization yields 0 WPR for LLaMA watermarking while the interval optimization yields much better WPR. Could you provide some possible intuition of this result?\n- For n=5 multiple-random-test, does it mean for each testing instance, 5 watermarks are planted during training, and as long as 1 watermark is displayed it’s counted as correct? Or it means only 1 watermark is planted during training, but there are 5 unique input during testing, as long as 1 generated output recover the planted watermark it would be correct?\n- In Lines 541-544, it says “further pre-training might hurt the original model performance, quantized watermarks are still successful as watermarks that protect the original model”. Since the watermarks have been washed off in further pretraining, then the watermarks are not shown in either full-precision or quantized model, why it’s still successful and can protect the model?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate your valuable reviews!\n\nAbout your concerns listed in weakness:\n\nWeakness #1\n\nWe agree that text-related watermarking should be able to obtain promising WPR, TMR, and SR.\nHowever, quantization watermarking is able to activate watermarks without triggers, which is one key motivation for building quantization watermarks.\n\nAs for comparing with text-related watermarking methods, we will add trigger-based methods such as RIPPLe (Kurita et al.) in the final version.\nWe will compare the RIPPLe method with the quantization watermarking method not only in WPR, TMR, and SR rates but also in model performances since quantization watermarking focuses on planting information in between the gap of full-precision and quantized model, therefore, the information is more controllable since we can guarantee that the model performances are not affected at all.\n\n\nWeakness #2\n\nIn the case study, we show the concrete watermark we use, which is a line of natural language.\nWe only set one watermark and tested over 100 cases, which is 5% of the whole dataset with a train/test split 0.95/0.05.\n\n\n\nWeakness #3 \n\nThe API-based models are not in the scenario that quantization watermarks aim at.\nThat is, as shown in Figure 1, recent developments in LLMs are mostly open-source models.\nIn this case, quantization watermarks aim to protect these open-source models.\nAPI-based models make the model weights private, which basically requires trigger-based methods or decoding-based methods to claim ownership, which is another line of work compared with quantization watermarks.\n\nWeakness #4\nThe experiment setup includes two scenarios, including text-agnostic watermarking and text-related watermarking.\nIn the text-agnostic scenario, we test the watermarking results on a testset different from the training set to test the watermarking results.\nIn the text-related scenario, the watermarking process is simply to claim ownership. Therefore, as long as the watermark can be successfully triggered, the watermarking process is successful.\nThe data shift is less important in the watermarking process compared with other tasks requiring strong OOD generalization abilities.\n\n\nAbout Questions:\n\nQuestion #1\n\nIt is a mistake stated in line 410 where we state that the rollback threshold is 127 at the largest.\nBut the actual largest value is 255.\nTherefore, the watermark optimization method in LLaMA actually rolls back a large proportion of parameters, causing the WPR rate to be 0.\nWe set the value to 255 and tested the LLaMA model again:\nThe WPR and TMR rates are 63.0 and 40.0 respectively. \nCompared with 100 and 0 in GPTNeo, we can find that the LLaMA model is still rigid to direct optimization of watermarking losses. \nCompared with 0 and 100 in the previous experiment on LLaMA using a threshold set to 127, we can conclude that the rollback range is larger than GPT-Neo, which also shows that GPT-Neo is easier to plant watermarks.\nBy this error, we accidentally find that the LLaMA model is changed by a greater range during watermark planting.\nTo sum up, we will provide a more detailed result in the final version to discuss how the planting process affects the model weights.\n\nQuestion #2\n\nThe n=5 multi-random test is to test 5 random pieces with the same watermark.\nThat is, supposing that we are testing the model for ownership claiming.\nWe test 5 cases in a roll and as long as one case successfully shows the watermark(which is unique as it gives identity information seen in Case Study in Table 5), the watermarking process can successfully finish the job of claiming ownership.\nIn this way, though the WPR rate is not very high, in the watermarking process, the goal can still be achieved.\nTherefore, as mentioned above in response to Weakness #1, the WPR rate is not the most important metric for quantization watermarking.\nThe fact that quantization watermarking does not affect the model performances is a major contribution.\n\nQuestion #3\n\nThis is a writing error. We intended to state that the watermarks are less successful since the trigger-free text-agnostic watermarks are vulnerable to SFT.\nAs mentioned in response to Weakness #1, when we test text-related watermarking against SFT, the watermarks are more resistant to SFT, indicating that a combination of traditional trigger-based methods and quantization watermarks can be a plausible solution for watermark applications.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "- The idea of planting watermarks during the quantization process is quite novel and interesting\n- The proposed three testing scenarios and three metrics are good experimental setup designs and can be used by similar works along this line (though there are some experimental setup concerns mentioned in reject reasons)", "reasons_to_reject": "- Important comparison missing: there are only comparisons among different optimization methods or the watermarking based on the quantization idea in the paper, what would be the comparison result with traditional watermarking text-related watermarking? I assume it’s feasible to obtain WPR, TMR and SR of the traditional trigger-based watermarking techniques. \n- Important details missing: 1) what are concrete watermarks used, are they natural language sentences or something else? 2) How many watermarks are used in the experiments, when talking about WPR/SR, what is the total test case number (as it’s important for us to know whether the method is robust or not)?\n- The application scenarios of the proposed watermarking technique are limited. We have to assume the downstream model provides access to both quantized and full-precision copies of the new models to be able to check whether there is watermarking left. If the downstream developer only provides API access to the model, we cannot detect the origin of the model.\n- The experimental setting is relatively constrained. The same set of datasets (around Line 354) is used to train the model with watermarks and to test the task success rate. It’s hard to see whether the proposed method can yield similar performance when the training/testing data is changed.", "questions_to_authors": "- It’s surprising to see watermark optimization yields 0 WPR for LLaMA watermarking while the interval optimization yields much better WPR. Could you provide some possible intuition of this result?\n- For n=5 multiple-random-test, does it mean for each testing instance, 5 watermarks are planted during training, and as long as 1 watermark is displayed it’s counted as correct? Or it means only 1 watermark is planted during training, but there are 5 unique input during testing, as long as 1 generated output recover the planted watermark it would be correct?\n- In Lines 541-544, it says “further pre-training might hurt the original model performance, quantized watermarks are still successful as watermarks that protect the original model”. Since the watermarks have been washed off in further pretraining, then the watermarks are not shown in either full-precision or quantized model, why it’s still successful and can protect the model?", "paper_topic_and_main_contributions": "This work targets the LLM watermarking task, by planting watermarks in model weights to protect the model and prevent unintended usage. It’s an interesting topic that needs more exploration. The authors propose to plant watermarks during the quantization process so the watermark can be revealed when the full-precision downstream model is obtained. Experimental results show successful watermark planting without performance compromise on GPT-neo, but mixed results on LLaMA. Results further show the watermarking can be erased after further pretraining.", "excitement": 4, "reproducibility": 3, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"Typos_Grammar_Style_and_Presentation_Improvements": "Line 257: Capitalization of paragraph title"}, "extra_text": {}}, {"review_id": "5y4YD1PqAN", "reviewer": "Reviewer_noHj", "summary": "", "questions": "N/A", "limitations": "", "rating": 5, "confidence": 4, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate your valuable reviews!\n\nAbout your concerns:\n\nWeakness #1:\n\nWe understand the importance that model watermarking should be able to resist fine-tuning, which is why we conducted such an experiment.\nWe tested watermark maintenance using text-agnostic watermarks, which resulted in poor resistance against fine-tuning.\nAs mentioned in Sec. 3.4, we can also adopt traditional trigger-based watermarking with quantization watermarking, which can be much better against fine-tuning.\n\nWe list the results of testing the watermarking erasing using text-related watermarks planted by quantization watermarking (same as experiment setups used in Table 4).\n\n                   Method                     Further Pretrain (WPR Score)\n \n                                                     In-domain OOD\n\n                   (agnostic)Interval Optim.            0.0 - 2.0\n\n                   (text-related) Interval Optim.       8.0  - 15.0\n\n\nAs seen, the text-related watermarks can resist fine-tuning on the quantized model, which solves the concern that the quantized watermarking can not be used when the model is fine-tuned.\n\nWeakness #2:\n\nWe appreciate the suggestion to test the quantized model in performance degradation.\nWe test the Winograd dataset from the ElutherAI language model evaluation harness benchmark and observe that the perplexities of GPT-Neo, quantized GPT-Neo model, and the watermarked model in the quantized mode are:\n\n                      Model         GPT-Neo   GPT-Neo (int8)  watermarked (int8)\n\n                     Winograd      4.0250       4.0467             4.0471\n\n\nWe will add these experiments to the final version!\nIn the first place, we thought that with our interval optimization, the quantized model is the same as the quantized model from the original model. Therefore, degradation is due to the quantization process, rather than our watermarking process. Therefore, we did not consider adding this experiment.\nWe agree that by adding these results, we can better understand the quantization and use the quantization process to plant watermarks.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "- Very interesting connection with model watermark and quantization\n- Success demonstration that such method is applicable to LLaMA and GPT-Neo", "reasons_to_reject": "- I am highly interested in the intersection of quantization and model watermarking. However, I am not convinced that the issue of watermark erasure should be disregarded. A possible real-world scenario of model watermarking is when a user obtains a released model and fine-tunes on personalized/custom data. Verifying the ownership of the finetuned model is very crucial to protect model IP (consider company x uses company y's model without following y's model license).\n- Quantized model often results in performance degradation. Since your work involved customized int8 quantization, it would be interesting to see if the performance of the quantized model is close to the original full-precision model. I'd suggest testing the quantized model using LLM Harness benchmark [1]. \n- Other than these two issues I am fine with other experiments -- well-executed.\n\n[1]: https://github.com/EleutherAI/lm-evaluation-harness", "questions_to_authors": "N/A", "paper_topic_and_main_contributions": "This paper presents a novel model watermaking techniques:\n\n- fp32 full-precision model contains the watermark but the distributed model is in int8 quantized version, so that the quantized model is watermark free and will not be exploited by malicious users\n- purpose novel interval optimization strategy that is able to successfully plant the watermark\n- Show that this technique is applicable to GPT-Neo and LLaMA which are widely used", "excitement": 5, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"Missing_References": "N/A", "Typos_Grammar_Style_and_Presentation_Improvements": "N/A"}, "extra_text": {}}, {"review_id": "vZyf1oeeyl", "reviewer": "Reviewer_HMaJ", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate your valuable reviews!\n\nAbout your concerns:\n\nWeakness #1:\n\nWe understand the importance that model watermarking should be able to resist fine-tuning, which is why we conducted such an experiment.\nAs mentioned in Sec. 3.4, we can also adopt traditional trigger-based watermarking with quantization watermarking, which can be much better against fine-tuning.\n\nWe list the results of testing the watermarking erasing using text-related watermarks planted by quantization watermarking (same as experiment setups used in Table 4).\n\n                   Method                                  Further Pretrain (WPR Score)\n                                                              IND - OOD\n                  (agnostic)Interval Optim.                   0.0 - 2.0\n                  (text-related) Interval Optim.              8.0 - 15.0\n\n\nAs seen, the text-related watermarks can resist fine-tuning on the quantized model, which solves the concern that the quantized watermarking can not be used when the model is fine-tuned.\nWe hope that by adding the missing experiment that tests the text-related watermarks (which is the combination of current watermarking methods and our proposed quantization watermarking method), we can solve the concern about the find-tuning impact on watermarking.\n\nWeakness #2:\n\nAs discussed in lines 284-291, with our proposed watermarking strategy, we can guarantee that the quantized model is the same as the quantized model from the original model.\nStill, we test the Winograd dataset from the ElutherAI language model evaluation harness benchmark and observe that the perplexities of GPT-Neo, quantized GPT-Neo model, and the watermarked model in the quantized mode are:\n\n                     Model         GPT-Neo  --- GPT-Neo (int8) ---  watermarked (int8)\n                     Winograd      4.0250   ---       4.0467        ---        4.0471\n\nWe will add these results with a more thorough analysis in the final version.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. This paper works on a timely and important problem. The watermarking could help protect intellectual property and prevent misuse of open-sourced large language models. \n2. This paper proposes a watermarking technique that utilizes model quantization gaps to embed watermarks, avoiding the need for predefined triggers. The proposed method is novel.\n3. Experiments demonstrates that the proposed approach effectively work on major open-source models like GPT-Neo and LLaMA.", "reasons_to_reject": "1. The paper has limited discussion of watermark robustness under finetuning. Open-source LLMs like LLaMA-1 and LLaMA-2 are often finetuned for real-world usage. The impact of finetuning on retaining the quantization watermarks is unclear. This is a major concern for real usage.\n2. There is limited analysis of the tradeoff between watermark capacity and model performance. It would be great if the authors add more discussion of the evaluation of the watermarked models.", "questions_to_authors": "", "paper_topic_and_main_contributions": "The article proposes a novel watermarking strategy to protect open-source large language models from malicious usage. The key idea is to plant watermarks in the model weights during quantization, such that the watermarks are revealed when the full-precision model is used but remain hidden when the quantized model is used for inference. This allows releasing a quantized model for public use while restricting access to the full model. The method is demonstrated on GPT-Neo and LLaMA models without needing predefined triggers. Experimental results have validated the effectiveness of the proposed method.", "excitement": 3, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: While the consensus is a high agreement on the novelty and excitement of the work, there is dissent on the soundness. Reviewers however do not raise fundamental concerns with the the underlying method, but with the coverage of the validation.  The authors address the concerns of two of the reviewers by providing updated numbers on impact of fine tuning, and possible drop in performance in quantized model with watermarks. The authors rebutal does not adress the issues of comparable benchmarks, these recommendations are needed to impove the evaluation.
Decision: Accept-Findings