WAPITI: A Watermark for Finetuned Open-Source LLMs

Authors: Lingjie Chen, Ruizhong Qiu, Siyu Yuan, Zhining Liu, Tianxin Wei, Hyunsik Yoo, Zhichen Zeng, Deqing Yang, Hanghang Tong
Primary area: other topics in machine learning (i.e., none of the above)
Keywords: Watermark, Large Language Models, Model Interventions

Abstract:
Watermarking of large language models (LLMs) generation embeds an imperceptible statistical pattern within texts, making it algorithmically detectable. 
Watermarking is a promising method for addressing potential harm and biases from LLMs, as it enables traceability, accountability, and detection of manipulated content, helping to mitigate unintended consequences. 
However, for open-source models, watermarking faces two major challenges: 
(1) incompatibility with fine-tuned models
(2) vulnerability to fine-tuning attacks.
In this work, we propose WAPITI, a new method that transfers watermarking from base models to fine-tuned models through parameter integration.
To the best of our knowledge, we are the first to embed watermarks into fine-tuned model parameters and preserve their fine-tuned capabilities. 
Furthermore, our approach offers an effective defense against fine-tuning attacks. 
We test our method on various model architectures and watermarking strategies. 
Results demonstrate that our method can successfully inject watermarks and is highly compatible with fine-tuned models. 
Additionally, we offer an in-depth analysis of how the strength of 
parameter editing influences the watermark strength and overall capabilities of the resulting models.

Decision: reject
Reviewer scores: 3, 3, 3, 6

Reviews and discussion:
<thread>
creation date:
1730398095522

thread_type:
official_review

<thread_object>
creator: reviewer_ep8o

<content>
summary:
The paper addresses the watermarking issues associated with open-source large language models by proposing a novel parameter integration method that facilitates the migration of watermarks from the base model to the fine-tuned model. This approach effectively avoids the performance degradation and high computational costs typically associated with watermark distillation. Building upon the watermark distillation method outlined in Gu2024, the paper resolves the incompatibility issues with fine-tuning and the inability to withstand fine-tuning attacks. Initially, watermark distillation is applied to the base model to calculate the weight difference Δθ. Subsequently, the base model is fine-tuned to obtain a fine-tuned model, and the weighted sum of the fine-tuned model's weights and Δθ results in the new fine-tuned distilled model.

strengths:
1. The core idea of WAPITI is to leverage the impact of watermarks on the model's output distribution. The paper demonstrates that watermarks induce similar alterations in the output distribution of both the base and fine-tuned models. By adding the watermark parameter vector from the base model to the fine-tuned model parameters, the output distribution of the fine-tuned model is similarly modified, enabling the transfer of the watermark.
2. This paper introduces, for the first time, a parameter integration-based watermarking method that facilitates the migration of watermarks from the base model to the fine-tuned model, thereby avoiding the performance degradation and high computational costs associated with watermark distillation.
3. The proposed method effectively maintains the fine-tuning capabilities while ensuring the presence of the watermark, thereby providing robust defense against fine-tuning attacks and enhancing the security of the watermark.
4. The paper is well-structured, with a generally clear logical flow and clearly articulated viewpoints, effectively conveying the main content.

weaknesses:
1. The issue of watermark distillation's inability to withstand fine-tuning, mentioned in the contributions of Chapter 1, has already been raised in Gu2024 and cannot be considered a primary contribution of this paper.
2. This paper serves as an improvement on the watermark distillation scheme proposed by Gu2024, which somewhat diminishes its novelty; further research is needed to solidify its impact.
3. In line 78, the paper emphasizes that WAPITI effectively resists fine-tuning attacks, yet this contribution is not mentioned in the summary, and the subsequent content lacks a comprehensive discussion on fine-tuning attacks.
4. Table 1 is missing a checkmark for the Decoding-based Watermarks row, and the description for "It undermines capabilities" is unclear; using parentheses in the table for clarification is also inappropriate. Additionally, the paragraph referencing this table mentions higher computational costs, which should prompt the addition of corresponding comparisons in the table, such as differences in vulnerability, robustness, and efficiency.
5. In Appendix E.2, the paper attempts to prove that even when models undergo fine-tuning attacks, the watermark detection rate and model usability decline synchronously to support the conclusion that WAPITI can resist fine-tuning attacks. However, the fine-tuning experiments in Gu2024 indicate that fine-tuning may remove the watermark without specifying whether model usability also declines synchronously. If usability in Gu2024’s experiments similarly declines, then WAPITI does not demonstrate a clear advantage over Gu2024 in resisting fine-tuning attacks, necessitating additional comparative experiments to substantiate this work.
6. Figure 2 lacks clear annotations and fails to adequately explain the content depicted; it is recommended to split this into two figures or use line charts for a more intuitive presentation of data trends.
7. In line 415, it is stated that WAPITI is effective and efficient. However, the term "efficient" requires supporting execution time data; to substantiate this conclusion, time cost experiments for the WAPITI scheme under various models and watermark methods should be added.
8. In section 4.3, line 365 mentions that Appendix F will analyze the selection of the hyperparameter λ, yet only partial analysis regarding λ is found in Appendix E.1, and it does not provide a detailed explanation of the selection method for the λ hyperparameter.
9. The appendix contains graphical and typographical errors, such as the identical experimental figure in section F.3 and E.1, the same images for Figures 2 and E.2 Figure 7, an incorrect reference to Figure 14 as Figure 6 in Appendix E.1, missing descriptions for the captions of Figures 9-14 in Appendix F, and incorrect writing of "coefffcient.S" in Appendix E.1

questions:
1. The paper does not provide a sufficient and detailed description of fine-tuning attacks related to Gu2024, which undermines the persuasiveness of its conclusions. For instance, while it mentions adding the KGW watermark to Llama-Math and Llama-QA, it neglects the Llama-chat and Pythia-chat models used in the main text, and it omits the AAR watermarking method. Additionally, it is unclear which dataset was used for fine-tuning Llama-Math and Llama-QA after watermarking, leading to a decline in fine-tuning capabilities.
2. If the paper aims to assert the incompatibility of the Gu2024 watermark distillation model with fine-tuning, it should validate this claim across diverse datasets. The relative entropy space of mathematical datasets is lower, and the performance of GSM8K may not sufficiently support this argument.
3. Generally, distilling larger models is often more effective due to their greater number of parameters and enhanced learning capacity, allowing them to capture richer features and complex patterns. Why does the paper choose to distill smaller models? What are the results of applying this approach to larger models?
4. If the parameters of the fine-tuned base model differ significantly from the original model across certain dimensions, could this result in the watermark being ineffective or lead to the loss of watermark information?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730713552619

thread_type:
official_review

<thread_object>
creator: reviewer_zdef

<content>
summary:
The paper addresses the challenge of watermarking the weights of fine-tuned large language models (LLMs). Traditional watermarking techniques often degrade the performance of fine-tuned models, prompting the need for a new approach. The authors propose a novel method that involves embedding the watermark into a base model and subsequently applying the weight delta between the base and the watermarked base model to the fine-tuned model. This technique preserves the quality of the fine-tuned model while ensuring the watermark remains detectable.

strengths:
Watermarking open source LLMs is an important topic. The fact that finetuned LLMs are hard to watermark is an interesting observation. 
The propose method makes it possible to watermark fine-tuned models just by one operation of the weights

weaknesses:
The experiments presented in the paper are insufficient and lack detailed explanation and evidence.

- In Figure 2, the authors highlight a key weakness of watermarking fine-tuned models by demonstrating that training on watermarked mathematical data reduces performance. However, mathematics is notoriously difficult to watermark due to its low entropy, making this a cherry-picked example where failure is expected. The authors could have employed watermarks specifically designed for low-entropy text, as suggested in [1].
- The approach of fine-tuning a non-watermarked model on watermarked mathematical data as a baseline seems counterintuitive. The authors should demonstrate that a pre-trained watermarked model, when fine-tuned on mathematical data, does not exhibit watermark detectability. This would provide a more convincing baseline. The authors only cite Gu et al. as evidence that fine-tuning a watermarked base model removes the watermark.  But [2] show that it is pretty resilient. 
- Section 3.2 in my opinon excessive to intuitively justify Equation 13.
- Table 2 is lacking critical information. The p-values of 0.5 appear to be expected rather than computed, but it is crucial to show that the tests yield random p-values under the null hypothesis (H0) to confirm that the scores are accurately computed. The authors do not specify which scoring method they use: for Kirchenbauer, is it binomial or z-score based? Additionally, how many tokens are scored? Do the authors perform appropriate deduplication to get reliable p values?
- The reason it is easier to distill with kgw-k1 than aar-k2 is not due to the method itself but rather the window size, as discussed in [2].

[1] https://arxiv.org/abs/2305.15060
[2] https://arxiv.org/abs/2402.14904

questions:
see weaknesses.

- 1.3M samples necessary for distillation? what does sample mean? for what method, which window size etc?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730737553076

thread_type:
official_review

<thread_object>
creator: reviewer_1ws3

<content>
summary:
The authors present a watermarking technique for open-weight LLMs that involves interpolating between the parameters of non-watermarked and watermarked models. Preserving the capabilities of open-source models is a challenge when embedding a watermark. The authors show a controllable way of injecting the watermark with limited loss in the model's capabilities. Their method entails training a distilled, watermarked base model and adjusting the parameters of a fine-tuned model along the path between the non-watermarked and watermarked base models. The authors assess their method's detectability and generation quality using two well-known watermarking techniques.

strengths:
- The method is relatively simple but provides a method of embedding a watermark with a controllable loss in text generation capabilities

- The approach is motivated and presented clearly. 

- The experiments in the paper appear sound.

weaknesses:
- The paper's main contribution is fairly limited. Equations 4-13 can be added to the appendix as they are relatively straightforward. The idea of interpolating between parameters to control the strength of a modification has been applied before (e.g., in LoRA [B]). 

- The paper is missing a threat model. Assume the user has access to the base model. Then they can invoke Algorithm 1, obtain $\Delta \theta_{Base}$ and undo the watermark. 

- The authors claim that distillation impacts the model's math capability for Llama-2-7B while their approach has a controllable trade-off. What parameters did the authors use for distillation, and do distillation parameters exist that have a lower impact on the model's (math) capabilities? 

- The authors' claim that they are the first to distil watermarks is confusing. As the authors themselves correctly state in the introduction, Gu et al. [A] can distil a watermark from one "base" model into another "fine-tuned" model. The authors state that they are the first to additionally achieve the preservation of the model's "fine-tuned capabilities," but this property is not well defined and can be challenged. 

- I do not understand how the method is considered train-free if it has to invoke the watermark distillation algorithm as a subroutine (see Algorithm 1). 

- The authors do not evaluate the robustness of their approach. 

- The authors do not ablate over the effect of the hyperparameter $\lambda$ on the watermark detectability and accuracy on MMLU or GSM8k, which I believe could strengthen the paper. 

------
[A] Gu, Chenchen, et al. "On the learnability of watermarks for language models.", ICLR 2024

[B] Hu, Edward J., et al. "Lora: Low-rank adaptation of large language models.", ICLR 2022

questions:
Please see above.
</content>
</thread_object>

</thread>
<thread>
creation date:
1731036955458

thread_type:
official_review

<thread_object>
creator: reviewer_zdpq

<content>
summary:
The paper introduces WAPITI, a watermarking method for fine-tuned open-source LLMs. It embeds watermarks directly into model parameters, ensuring robustness against fine-tuning without additional training. Experiments show that WAPITI maintains watermark detectability with minimal performance impact, supporting traceability in open-source AI models.

strengths:
This paper presents WAPITI, a watermarking method for fine-tuned, open-source LLMs that embeds watermarks directly in model parameters, aiming for robustness against fine-tuning. The approach is somewhat novel, addressing a recognized challenge in model traceability with a parameter-based watermarking solution that does not require additional training.

weaknesses:
1.	While the end watermarking algorithm is very simple, it relies on multiple approximations and heuristic observations of the experimental results. Such as the orthogonality between the parameter differences. This may undermine the theoretical rigor and precision of the proposed method.
2.	The experimental validation appears somewhat limited, with relatively few comparisons to other state-of-the-art watermarking methods. This raises questions about the generalizability and robustness of WAPITI. Therefore, the overall contribution may be incremental, and broader validation would strengthen its significance.

questions:
Please refer to the Weaknesses.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732294080313

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
General Response

comment:
We sincerely thank all reviewers for their valuable time and thoughtful reviews.We appreciate the reviewers' recognition that WAPITI is a novel watermark schema(ZdPQ, ep8o), that our method addresses a recognized challenge(ZdPQ, ZdEf, ep8o), that our method is theoretically well presented(1wS3), that our method maintain model ability and provide ample defense(1wS3, ep8o) and that our paper is well written(ep8o). We also appreciate the reviewers for their insightful feedback, which will help enhance the paper's quality and address essential aspects that need further attention. We provide our response below.

- We run additional experiment using KTH watermark on Llama 2 7B models and evaluate the performance of WAPITI with KTH.(zdPQ)
- We run additional experiments for different watermark distillation method to vindicate the limitation of current distillation-based watermarking on fine-tuned models. (1wS3, ZdEf, ep8o)
- We run additional experiments checking the robustness of WAPITI to text edits and changes in decoding parameters. (1wS3)
- We run additional ablation experiments on $\lambda$ about its impact on accuracy for MMLU and GSM8K. (1wS3)
- We run additional watermark detection experiments on unwatermarked models' generation to ensure the correct implementation of our detector.(ZdEf)
- We run additional experiment to test watermarked base model's performance after fine-tuning attack.(ep8o)
</content>
</thread_object>

</thread>


Metareview: