Matching Pairs: Attributing Fine-Tuned Models to their Pre-Trained Large Language Models
Year: 2023

Abstract:
The wide applicability and adaptability of generative large language models (LLMs) has enabled their rapid adoption. While the pretrained models can perform many tasks, such models are often fine-tuned to improve their performance on various downstream applications. However, this leads to issues over violation of model licenses, model theft, and copyright infringement. Moreover, recent advances show that generative technology is capable of producing harmful content which exacerbates the problems of accountability within model supply chains. Thus, we need a method to investigate how a model was trained or a piece of text was generated and what their pre-trained base model was. In this paper we take the first step to address this open problem by tracing back the origin of a given fine-tuned LLM to its corresponding pre-trained base model. We consider different knowledge levels and attribution strategies, and find that we can correctly trace back 8 out of the 10 fine tuned models with our best method.

heading: 1 Introduction
text: Recent advancements in pre-trained large language models (LLMs) have enabled the generation of high quality texts that humans have difficulty identifying as machine generated (Wahle et al., 2022). While these pre-trained models can perform many tasks in the zero-shot or few-shot settings (Brown et al., 2020; Schick and Schütze, 2021), such models are often fine-tuned to improve their performance on various downstream applications (Peters et al., 2019; Pfeiffer et al., 2020). As of May 2023, there are more than 209,000 models hosted on Huggingface1 and more than 12,000 of them belong to the “text generation” category. Many generation models are fine-tuned from the open-access pretrained base models such as XLNet (Yang et al.,
∗ Work done during internship at IBM Research. 1https://huggingface.co/models
2019), BART (Lewis et al., 2020), or GPT-J (Wang and Komatsuzaki, 2021) whose training typically requires significant computational resources.
While the proliferation of text generation models has led to the performance improvement for a wide range of downstream applications such as text summarization and dialogue systems, it has also been repeatedly shown that these pre-trained or fine-tuned LLMs can facilitate the creation and dissemination of misinformation at scale (Weidinger et al., 2021), and the manipulation of public opinion through false “majority opinions” (Mann, 2021). In response, laws like the EU’s Digital Services Act (DSA)2 aim at tackling these issues by enforcing procedural accountability and transparency for responsible use of AI-based technologies. These growing demands for AI forensics require the development of methods for establishing model ownership, protecting intellectual property, and analyzing the accountability of any violations.
In this work, we systematically investigate LLM attribution, a novel task recently proposed at the first “Machine Learning Model Attribution Challenge (MLMAC)”3, which aims to link an arbitrary fine-tuned LLM to its pre-trained base model using information such as generated responses from the models. Through LLM attribution, regulatory bodies can trace instances of intellectual property theft or influence campaigns back to the base model. However, determining attribution for fine-tuned LLMs can be challenging as base models often have similar architectures and overlapping training data. For instance, THEPILE (Gao et al., 2020a), a large data set that consists of 22 smaller, highquality datasets, with a total size of 825 GB, was included into the training data for both GPT-J (Wang and Komatsuzaki, 2021) and OPT (Zhang et al., 2022).
2https://eur-lex.europa.eu/eli/reg/ 2022/2065/oj
3https://mlmac.io/
7423
access to the models in B and F and the amount of resources available for developing the method. In general, we assume that the developer of an attribution system can only query the LLMs as a black box to obtain the generated responses, and has limited access to models in F . We speculate this to be true for real-world settings where the producers of pre-trained base models, maintainers of model zoos, or an external auditor are incentivised to develop such attribution systems. In such scenarios, they may only have limited access to the API of fine-tuned models which will typically be owned by a third-party. Other constraints may arise from the amount of resources available for developing attribution systems. For instance, an external auditor may not have the domain expertise or computation resources to benefit from the insights from other fine-tuning pipelines. Similarly, the developer is assumed to have no knowledge of the fine-tuning datasets and approaches used to obtain the models in F , as in these cases attribution may be easily achieved by replicating the setup locally and comparing the obtained models with those in F . In addition to these assumptions, we consider the following two knowledge levels available with the developer of an attribution system.
• Universal knowledge KU : This allows the developer access to universal knowledge about models in B. This allows the analysis by a human expert, as well as computing the perplexity of the input. Moreover, the developer can build an additional set of fine-tuned models A, or even the capability to train such models. This enables building a supervised attributor using A as a training dataset.
• Restricted knowledge KR: We do not have access to A, and can only query the models in B as a black box to get the responses.

heading: 4 Attribution Methods
text: We approach the LLM attribution problem as a classification task. Essentially, LLM attribution requires identifying the certain robust or latent characteristics of a pre-trained base model within the given fine-tuned model. The fine-tuned model may retain unique aspects in the pre-training data like events and vocabulary of a specific time period, or the fluency of the base model in a certain domain.
In particular, as shown in Figure 2 we build a classifier hmb testing a response for each pre-
trained base model mb to decide if a given finetuned model mf retains the characteristics of mb, following the one-vs-rest (mb or others) scheme. Then, we aggregate the result to pick the top-1 base model with the majority voting method. In other words, we take mf such that ∑ p∈P hmb(mf (p)) is maximized, where P is a set of prompts.
The task can be further broken down into two steps for each base model mb and its classifier hmb including (1) characterizing the target base model mb and representing the input to the classifier (Section 4.1.1), (2) selecting the prompts (Section 4.1.2), and (3) designing the classifier (Section 4.2).

heading: 4.1 Model Characterization and Input Representation
text: In this step, we characterize an LLM (fine-tuned or base model), and prepare the input to the classifier hmb . One piece of evidence of attribution lies in exploiting the artefacts of a pre-trained LLM that are expected to persist through the fine-tuning process and are inherited by their fine-tuned counterparts. For instance, a distinctive feature of RoBERTa (Liu et al., 2019) is the sequence length limit of 512 which is often inherited by its fine-tuned versions. The task characteristics and associated training data may also help distinguish different LLMs. For example, LLMs trained for specific tasks like chat bots or code generation will have characteristically different output spaces. They may also have unique aspects in their training data like a specific language or markers such as data collected over specific time period.
While feature engineering can extract a usable set of features, it is prone to bias, and less adaptable, and it also requires deep knowledge about B. Thus, we leverage the embeddings of the prompts and responses to learn and exploit such knowledge.

heading: 4.1.1 Input Representation
text: Our goal is to train a classifier to capture the correlations between an arbitrary response and the base model mb. For example, with a prompt p, this could capture the relationship between a response mb(p) and mb. Similarly, we can capture the relationship between a response mf (p) and mb where mf is obtained by fine-tuning mb. Assuming that such correlations are preserved in a base model and fine-tuned model pair, we use it to determine the attribution of a fine-tuned LLM.
Given a set of prompts p1, . . . , pK , there are multiple ways to prepare them for the classifier. We can apply the target base model, or fine-tuned model to get the responses, and concatenate the prompt and its response. Specifically, we list the input representations we consider as follows:
• Base model only (IB): “pi mb(pi)”
• Fine-tuned model only (IF): “pi mf (pi)”
• Base model + fine-tuned model (IB+F): “pi mb(pi) <SEP> pi mf (pi)”
• Separate embeddings for base model and finetuned model.
We embed these concatenated sentences using BERT computed by a best-basemultilingual-cased model5 except for the last approach that embeds the components separately for margin-based classifier TripletNet described in Section 4.2. Note that all reference to a fine-tuned model mf during training are actually sampled from another set A of fine-tuned models under KU assumption as we assume only sparse access to mf . Also, IB takes the responses from mf during prediction to test if the responses share the same characteristics that this classifier learned about mb.

heading: 4.1.2 Prompt Selection
text: While many corpora to pre-train LLMs provide prompts, they might not be all useful to predict the base model. Thus, we aim to test and select prompts with more distinctive outcome. Our prompt selection strategy is driven to help best characterise base models. We first collect the list of datasets used in training each base model, identifying unique aspects of datasets that can help identify a base model. Intuitively, one might expect
5https://huggingface.co/bert-base-multilingual-cased
such unique prompts or ‘edge cases’ to bring out the distinctive aspects in the subsequent fine-tuned models. Specifically, we first identify the unique categories of prompts (e.g. different languages) present in different datasets and sample from this set.6
More specifically, we consider three approaches: a small set (P1) of edge cases that are distinct to each corpus, a naive collection (P2) of prompts, and reinforcement learning to select a subset (P3) from the edge cases.
While the naive collection of the 10,000 prompts from ThePile corpus and manually selecting a set of prompts unique to each training dataset is clear, we can also use reinforcement learning to optimize the selection using the classification result. More specifically, we train an agent for each hmb that can supply prompts for attribution inference. During the training episodes, the agent is rewarded for prompts whose responses lead to correct attribution. The reinforcement learning setup for this problem is defines as follows:
• State. A feature space consisting of the classification of the prompt, and an embedding of the prompt response computed by best-base-multilingual-cased. • Action. Selecting one of the prompts from P1. • Reward. Using a sparse reward function we reward (+1) for correct classification and penalise (-10) for incorrect classification. • Episode. 20 possible actions.
At the start of each episode we are able to randomly select one of the models that the classifier was trained on, thus the RL agent learns to generalise to a variety of different models. We implement the RL agent using the Proximal Policy Optimisation (PPO) method (Schulman et al., 2017).
We can use these collected prompts in a few different ways. A simplistic approach is using each set P1, P2 or P3 individually. Another approach P1+P2 trains the classifier with P2, and then finetune with P1 to leverage both of them (P3 is already a subset of P2) and we find this is promising in our experiments. See Appendix D for details of the prompts used from THEPILE for this combination approach.
6Prompt selection is complex and the numerous dimensions of fairness and robustness of such schemes are useful for further investigation of the LLM attribution problem. However, we believe them to be out of scope of this first systematic study on LLM attribution.

heading: 4.2 Classifier Architecture
text: We consider a one vs rest setup where for each base model mb we train a binary classifier hmb : Σ
M → {0, 1} which takes as input a response s ∈ ΣN , optionally with additional tokens, and predicts a score that reflects its association to the based model mb. Single embeddings prepared in Section 4.1.1 can be straightforwardly used in a simple classifier. We fine-tune the BERT model used for the embedding to make the binary prediction with cross-entropy loss. Given the one-vs-rest approach the positive samples for an hmb are repurposed as negative ones for the rest of the classifiers hml for ml ∈ B\{mb}. The best average score thus obtained is used to establish the attribution for mf .
We also consider TripletNet (Wei et al., 2021) based classifiers that use a margin-based loss function using the separate embeddings of the base and fine-tuned model responses. The TripletNet is able to make predictions by taking in a single sentence, computing the output embedding, and finding the closest embedding from the training set and using the label of the training sentence as a prediction. The cosine distance between the anchor input, positive example, and negative example are then computed as the loss. We adopt the margin parameter 0.4 from the original paper (Wei et al., 2021).

heading: 5 Experiments

heading: 5.1 Experiment Setup
text: For training the attribution models hmb we make use of popular text corpora including: GitHub, The BigScience ROOTS Corpus (Laurençon et al., 2022), CC-100 (Conneau et al., 2020), Reddit (Hamilton et al., 2017), and THEPILE (Gao et al., 2020b).
We also use a variety of prompt sizes for attribution (150 to 10,000), and datasets (IMDB Reviews (Maas et al., 2011), GLUE (Wang et al., 2018), Tajik OSCAR (Abadji et al., 2022), and Amazon Multilingual (Keung et al., 2020).
To provide a wide didactic range of models for our approaches we utilise 10 pre-trained LLMs to create B and corresponding fine-tuned models (Table 1): Bloom (Scao and et al., 2022), OPT (Zhang et al., 2022), DialoGPT (Zhang et al., 2020), DistilGPT2 (Sanh et al., 2020), GPT2 (Radford et al., 2019), GPT2-XL (Radford et al., 2019), GPT-NEO (Black et al., 2021), CodeGen (Nijkamp et al., 2023), XLNET, MultiLingual-
MiniLM (Wang et al., 2021). These models provide different architectures, parameter sizes, and tasks to offer a variety of model behaviors.
We consider a one-to-one mapping from B to F (and A), thus F and A contain ten models each. We utilise open-source models that are implemented in the Huggingface library to form the sets of F and A. We select A and F such that the fine-tuning dataset, and model configuration are known to us, of these we select the most popular by number of downloads. We provide further details of these in Appendix B.
We take the top-1 result for each mb as mentioned in Section 4 and check its correctness. We use F1 and ROC curves as additional metrics. These are calculated using prompt-level attribution calculated per mb (as in Figure 8), and we use an average per hmb (as in Figure 3). Each of the attributors hmb described is ran once to determine the attribution of mf to mb. Training is conducted using a single NVIDIA A100 GPU.

heading: 5.2 Compared Approaches
text: We consider different configurations for BERT classifiers based on the input representations IB, IF or IB+F, and the prompts used P1, P2, P3 or P1+P2 described in Section 4.1.1.
We also consider the margin classifier TripleNet (Section 4.2), and the following heuristic approaches.
• Perplexity: A measure of how confident a model is at making predictions, this can be
leveraged for measuring attribution by computing the perplexity of mb relative to the response of mf to prompt p.
• Heuristic Decision Tree (HDT): Using KU we can use knowledge of B to create a series of discriminative heuristics to categorise F as used by the winning solution to the first MLMAC7.
• Exact Match: Attribute responses mf to mb when both models respond the same to a prompt. Using the argmax of these attributions to attribute mf to mb.
For detailed descriptions of the heuristic approaches, please refer to Appendix A.

heading: 5.3 Attribution Accuracy
text: Here, we examine the attribution abilities of the compared approaches shown in Table 2. Under KU conditions the baselines of Perplexity and HDT are only able to correctly attribute 1 and 5 models respectively. Perplexity fails to capture the subtly of attribution, as repetitive responses lead to lower perplexity and so incorrect attribution. The HDT particularly fails to account for overlap in pre-training and fine-tuning. For instance, DialoGPT-Large and mf3 (fine-tuned version of distilgpt2) respond in similar short sentences that leads to incorrect attribution. The TripletNet baseline performs poorly, only correctly attributing 3 of the models. Both BERT based attributors are able to attribute more models correctly in comparison to the baselines.
Examining the models at KR shows similar performance. The exact match correctly attributes 5 models and BERT+IB identifies 6 models. BERT+IB+P1+P2 attributor is the most successful by correctly attributing 8 models. Note that this model is the most expensive to train as we have to query a large number of prompts.
We compare the ROC curves for BERT based attributor defined under each K in Figure 3. We provide plots of hmb in each variant in Appendix C. It is interesting to note that the models under KR have shallower curves than their KU counterparts, yet these KR models lead to the same or higher number of correct attributions. This is likely due to the ‘noise’ that gets added to responses of A from their separate fine-tuning task, TA. This noise moves the responses of ma further from mf (and
7https://pranjal2041.medium.com/identifying-pretrainedmodels-from-finetuned-lms-32ceb878898f
by extent mb). As such responses from mb are closer to mf than ma. This makes the attributors predict more negative samples correctly under KU as there is greater disparity in response between ma and mf , leading to a higher AUC; but also to miss-attribution of mf at inference. Hence, it is unsurprising that the pretrained KR has the lowest AUC of any model, yet it leads to the highest attribution accuracy in Table 2 as it is trained on responses of mb which is closer in the latent space to responses of mf than ma.
Lesson Learned: Even under reduced knowledge level, pre-training was found to be the factor that contributed to the highest attribution performance.

heading: 5.4 Effects of Prompt usage
text: The number of prompts available to an attributor for classification can have an influence on the attribution performance: we hypothesize that increasing the number of prompts used results in a clearer signal as to the finetuned to base model attribution.
We train BERT attributors under the KR con-
Number of Prompts
m# TP0 1 2 3 4 5 6 7 8 9
150 ✗ ✓ ✗ - - - ✓ ✗ - ✓ 3 500 ✗ ✗ ✗ - - - - - ✓ - 1 1000 ✗ ✗ - - - - - ✗ ✓ - 1 2000 ✗ ✓ ✓ ✓ - - - ✓ ✓ ✓ 6 4000 ✗ ✓ ✓ ✓ ✗ ✗ ✗ ✗ ✓ ✓ 5 6000 ✗ ✓ ✓ - - - - ✗ ✓ ✓ 4 8000 ✗ ✓ ✗ - - - - ✗ ✓ - 2
10000 - ✓ ✗ - - - - ✓ ✓ ✓ 4 BERT + IB + P1 + P2 ✓ ✓ ✓ - ✗ ✓ ✓ ✓ ✓ ✓ 8
Table 3: Model Attributions on F using a varying number of prompts from The Pile.
dition, as the KR pretrained model performed the strongest. For these experiments we do not use RL prompt selection.
The results of this experiment are shown in Figure 4. By increasing the number of prompts that a classifier is able to use for classification, we see that there is an improvement in the AUC, with diminishing returns from 6,000 prompts onward.
Increasing the number of prompts improves the AUC, yet does not lead to direct improvement in terms of the attribution accuracy as shown in Table 3. In fact, increasing the number of prompts used for classification leads to a highly variable performance. None of the models that directly use these prompts (150 - 10K prompts from the pile) are able to improve or even match that of the pretrained model using 150 prompts from Table 1.
Lesson Learned: Increasing the number of prompts for attribution does not lead to reliable improvements in the number of models correctly attributed.

heading: 5.5 Effects of pretraining attributors
text: We next aim to investigate how the size of the pretraining data effects the performance of the attri-
Number of Prompts
m# TP0 1 2 3 4 5 6 7 8 9
150 ✗ - ✓ ✓ ✗ ✗ ✓ ✓ ✗ ✓ 5 500 ✓ ✓ ✓ ✓ ✗ ✓ ✗ ✓ ✗ ✗ 6 1000 ✗ ✓ ✓ ✓ ✗ ✓ ✗ - ✓ ✓ 6 2000 ✓ ✓ ✓ ✗ ✗ ✗ ✓ ✓ ✓ ✓ 7 4000 ✓ ✓ ✓ - ✓ ✓ ✓ ✓ ✗ ✓ 8 6000 ✓ ✓ ✓ - ✗ ✓ ✓ ✓ ✓ ✓ 8 8000 ✓ ✓ ✓ ✗ ✗ ✗ ✓ ✓ ✓ ✓ 7
10000 ✓ ✓ ✓ - ✗ ✓ ✓ ✓ ✓ ✓ 8 BERT + IB + P1 + P2 ✓ ✓ ✓ - ✗ ✓ ✓ ✓ ✓ ✓ 8
Table 4: Model Attributions on F from the models pretrained on different portion from P2, and then finetuned with P1.
bution, as while using increasingly large data for direct attribution may not improve performance, Section 5.3 shows that using it as pretraining data does improve attribution.
To this end each model discussed in Section 5.4 is finetuned under KR, varying the size of pretraining data from 150 prompt responses to 10,000.
We report the results of the experiment in Figure 5. In Figure 5a we see that the finetuned models are able to improve over the equivalent models in Figure 4. Yet they do not improve on the AUC of models trained under KU conditions.
We see from Figure 5b that increasing the number of prompts minimally improves the precision and recall of attribution, with little correlation between number of prompts, even of a varied set like THEPILE. Whilst these pretrained-finetuned attributors are able to improve on the precision of the attributor using manual selected prompts, however they are unable to improve on the recall.
What is most important for this task, however, is the ability of attribution, hence we also determine the model attributions for each model in Table 4. The models that have been pretrained on a larger number are able to outperform the KR model of Section 5.3 attributing 8 models correctly in the the models pretrained on 4k and 6k prompts.
Lesson Learned: Pretraining attributors is vital to improve the attribution performance. However, this has to diminishing returns in terms of correct attributions and AUC.

heading: 5.6 Effects of Finetuning on Attribution
text: The type and duration of the finetuning conducted on a base model B can effect attribution performance. To investigate this we use of two base models: distilgpt2 and Multilingual-MiniLM and finetune them using three datasets: IMDB (Maas et al., 2011), GLUE (Wang et al., 2018), Amazon
0.0 0.2 0.4 0.6 0.8 1.0 False Positive Rate
0.0
0.2
0.4
0.6
0.8 1.0 Tr ue P os iti ve R at e
AUC pile150: 0.783 AUC pile500: 0.773 AUC pile1k: 0.785 AUC pile2k: 0.787 AUC pile4k: 0.775 AUC pile6k: 0.765 AUC pile8k: 0.801 AUC pile10k: 0.778
(a) ROC and AUC of attributors with pretrained models using different pretraining data sizes.
reviews Multilingual (Keung et al., 2020), and the Tajik language subset of OSCAR (Abadji et al., 2022).
Using such datasets more closely models the realistic attack scenario where common pre-training prompt sets are used in an attempt to determine attribution, and fine-tuning datasets are often proprietary and/or unique to the application. Conducting experiments in this scenario in a controlled setting allows us to study the effect of finetuning on attribution in terms of (a) number of epoch and (b) size of dataset.
Effect of Finetuning Epochs: Firstly, we study the effect of the number of finetuning epochs has on attribution. Figure 6 shows the F1 score of the MLMini and distilgpt2 attributors when trying to attribute the finetuned base models.
The MLMini attributor is greatly affected initially by MLMini being finetuned on IMDB, how-
ever as with the model finetuned on Amazon reviews there is an increase in attribution performance with increasing finetuning epochs. Conversely, the MLMini model finetuned on GLUE MNLI had minimal change in performance only with anomalous increased F1 score at epoch 6.
However, when trying to attribute MLMINI finetuned with the Tajik subset of OSCAR we see that the F1 score is significantly worse. We speculate that AMAZON and IMDB datasets are similar to the pretraining dataset of MLMini (CC-100) and that the AMAZON reviews, with its 6 languages, are the most similar to this. In fact, the CC-100 is likely to have an overlap in the data distribution of all three of these datasets as all are openly available. As there is no Tajik in CC-100 it is outof-distribution (OOD) of MLMINI’s pretraining dataset, which leads to the poor performance in attribution.
With the attributor for distilgpt2 there is poor performance in all datasets regardless of the number of epochs. This follows due to the finetuning datasets being OOD relative the the pretraining data of distilgpt2 which used the OpenWebTextCorpus. As OpenWebTextCorpus is mostly in English, finetuning in other languages such as those in the AMAZON dataset, makes attribution harder.
Lesson Learned: The attribution performance is dominated by the similarity of the finetuning dataset to the pre-training dataset, rather than the amount of fine-tuning conducted.
Effects of Dataset Size: In addition to the number of finetuning epochs we consider the overall
size of the finetuning set on attribution. We report the results of using a fixed 10 epochs and varying the finetuning dataset size in Figure 7. We can see similar effects as in Figure 6, that the OOD datasets for Distilgpt2 lead to poor F1 scores, and consequently, poor attribution results.
For MLMINI we see similar performance on IMDB and AMAZON (two of the in-distibution datasets) with an increased F1 as the dataset size increases. When finetuning on OSCAR and GLUE the F1 score shows a minimal correlation with dataset size. This again follows from Figure 6. OSCAR is OOD for MLMINI, which makes attribution significantly harder. Similarly GLUE offers the most varied dataset making attribution harder and giving lower F1.
Lesson Learned: Training on a richer dataset broadly improves results if it is within distribution.
Effects of Dataset: Across Figures 6 and 7 we see the effect of different finetuning datasets on the ability to attribute to base models.
We can observe the effect of the finetuning datasets on the ability to attribute to base models in Figures 6 and 7. These figures show the distribution of the dataset greatly affects attribution. Finetuning datasets that are completely out of distribution in relation to the original pre-training dataset severely impact attribution performance. This is particularly apparent in MLMINI where finetuning on OSCAR leads to poor attribution performance in Figure 6 and 7.
Both base models finetuned with GLUE also make attribution harder. We reason that this is due
to the broad range of prompts that are not typical of a finetuning dataset. This leads the model to produce generic responses to the targeted prompts used for attribution.
Lesson Learned: The most significant impact on attribution is the distribution and variety of the finetuing dataset.

heading: 6 Conclusion
text: In this work we have taken initial steps in the LLM attribution problem. We study LLM attribution in KU and KR settings which limit access to B and F to different levels. We argue this prevents trivial solutions in white-box settings, and provides an interesting and realistic study of LLM attribution.
We have considered a variety of different LLMs that are trained on different datasets, and for different purposes. We postulate that the 10 different LLMs provide a didactic range of models for LLM attribution. In our experiments, we have used pre-existing LLMs that have been fine-tuned by the open-source community to demonstrate the applicability of our methodology. To mitigate the potential for bias this causes, we have tried out best to ensure the fine-tuning task and dataset of such models is known. In addition, we fine-tune a subset of these models in an ablation study, which demonstrates the effect that such fine-tuning has on LLM attribution in a controlled environment. Our ablation study also studies the effect that OOD fine-tuning datasets have on attribution. This mitigates the effect of only fine-tuning within distribution (of the pre-training data).
Overall, our work contributes to the growing understanding of LLM attribution, laying the foundation for future advancements and developments in this domain.
Limitations
We have considered a variety of different LLMs in order to study attribution. However we have only considered a small sample of the different LLM architectures and training strategies. This has been with a view to using a small but diverse set of LLMs. Of these 10 base models, we tested our approach to attribution on a controlled set of fine-tuned models. While a study that considers a wider variety and larger scale of fine-tuned models would be beneficial to the problem of attribution, the computation resources limited our study.
Furthermore, in our assumptions in this work we consider that there is a one-to-one mapping between mf and mb. However, this is not necessarily the case. There could be an m-to-n mapping and also a model may be present in one set, but not the other.
We believe there is rich space for further research in this area that can address these limitations, and further develop the problem of attribution.
Ethics Statement
In the discussion we have highlighted how the techniques for attributing fine-tuned models to their pre-trained large language models can be used as a tool to mitigate issues such as violation of model licenses, model theft, and copyright infringement, but this is only a subset of the issues related to authorship attribution. The increasing quality and credibility of LLM generated text has recently highlighted ethical issues such as plagiarism8 or the banning of users for submitting AI generated responses to answer questions. 9 Even within the scientific community discussions are arising related to topics such as the authorship of papers or codes, who owns what is it generated? Many AI conferences have banned the submission of entirely self-generated scientific papers.10
These are some examples of controversial situations, but the use of AI-generated content has ethical implications in several domains that depend on the specific context and application. It is therefore crucial, as a first step to tackle these ethical issues, to ensure that any AI-generated contents
8New bot ChatGPT will force colleges to get creative to prevent cheating, experts say
9AI-generated answers temporarily banned on coding Q&A site Stack Overflow
10Top AI conference bans use of ChatGPT and AI language tools to write academic papers
are clearly labeled as such and are not presented as original work without proper attribution (whether it’s a person or a base model).

heading: Acknowledgements
text: This work was supported by European Union’s Horizon 2020 research and innovation programme under grant number 951911 – AI4Media.

heading: A Heuristic Approaches
text: A.1 Perplexity Using the response of F we can calculate the perplexity of B relative to F . This can then be used as a measure of how confident B is in predicting F , where a lower perplexity would indicate higher confidence and attribution. In our initial experiments, we found this to be loose approximation of similarity between models in B and F . Moreover, this approach assumed stronger access which is typically not available in real-world settings as we discussed in Section 3.
Perplexity is a measure of how well a model is able to predict a sample. It has previously been used in analogous settings for extracting training data from language models (Carlini et al., 2021; Mireshghallah et al., 2022) to determine if a model is confident in its prediction of a sample. It is possible to leverage this for the purpose of attributing F to B. By collecting responses of F to prompts we can calculate the perplexity of B relative to F. Thus we can take the perplexity score as a measure of how confident B is in predicting the response of F, we would expect lower perplexity to be an indication of higher confidence and therefore higher chances of attribution.
A.2 Heuristic Decision Tree When it comes to generalisation, many LLMs share an equal footing owing to the massive size and intensive training backing their capabilities. However, when examined closely there are distinctive features that set them apart which can be detected via static or dynamic inspection of the model. For instance, LLMs with a larger number of parameters tend to take longer for inference. Similarly, length of response varies across LLMs, and some are prone to repetition (such as XLNET (Mohamad Zamani et al., 2022)). The task characteristics and associated training data may also help distinguish
different LLMs. For example, LLMs trained for specific tasks like chat bots or code generation will have characteristically different output spaces. They may also have unique aspects in their training data like a specific language or markers such as data collected over specific time period. Much like watermarking, these can be used to craft prompts that can help reveal these unique artefacts 11.
While in principle many of these heuristics can be used for attribution, the practical development of such systems faces a range of challenges. First, these properties may not be preserved across the fine tuning process and therefore provide no meaningful insight for attribution. Second, these heuristics require a high level of expertise and knowledge which may not always be available. An external auditor working with the restricted knowledge of KR may not be able to develop such solutions. Third, many of the properties of models in F can be easily obfuscated by the exposed API. For example it is fairly easy to normalise response times or post-process the responses to account for repetition. Moreover, an API may be simultaneously backed by multiple different models which would make the attribution even more challenging. Finally, LLMs often have overlapping datasets which can dilute many of the subtleties underlying these heuristics. This limits the applicability and scalability of such approaches for larger collections of B and F .

heading: B Fine-tuned model Details
text: Here we provide details of the fine-tuned LLMs we use in sets A and F . Each of the LLMs is an open source implementation hosted on the Huggingface, we provide the link to the fine-tuned model. In Table 5 we show set F as FT models 0-9 inclusive, and set A from 10-19 inclusive. For each model we also provide the dataset used to fine-tune each of the LLMs.

heading: C AUC Curves
text: We provide the finegrained plots of how each individual hmb did in each experiment. Figure 8 shows the results from the experiment that measures the attribution accuracy under different K as discussed in Section 5.3. Figure 9 details the effect of using a different number of prompts for attribution under KR, as discussed in Section 5.4. Finally Figure 10 shows the effect of varying the number of prompts for pretaining hmb (Section 5.5).
11Winning solution to the first MLMAC

heading: D The Pile subset
text: We make use of a 10,000 prompt subset of The Pile (Gao et al., 2020b), in Table 6 we report the distrubtion of the smaller datasets present in The Pile.
ACL 2023 Responsible NLP Checklist

heading: A For every submission:
text: 3 A1. Did you describe the limitations of your work?
7
3 A2. Did you discuss any potential risks of your work? 7
3 A3. Do the abstract and introduction summarize the paper’s main claims? 1
7 A4. Have you used AI writing assistants when working on this paper? Left blank.
B 3 Did you use or create scientific artifacts? 5
3 B1. Did you cite the creators of artifacts you used? 5, B
7 B2. Did you discuss the license or terms for use and / or distribution of any artifacts? No, the artifacts used all have open source licences, and are freely avaliable at their respective citations.
7 B3. Did you discuss if your use of existing artifact(s) was consistent with their intended use, provided that it was specified? For the artifacts you create, do you specify intended use and whether that is compatible with the original access conditions (in particular, derivatives of data accessed for research purposes should not be used outside of research contexts)? We make use of data used to train/fine-tune language models, this is consistent with their intended use. We don’t discuss this use explicity relative to the intended us, but do discuss the use of these artifacts for finetuning purposes in Section 5, B.
7 B4. Did you discuss the steps taken to check whether the data that was collected / used contains any information that names or uniquely identifies individual people or offensive content, and the steps taken to protect / anonymize it? No as none of the data used contains information that names or uniquely identifies individual people or offensive content.

heading: 3 B5. Did you provide documentation of the artifacts, e.g., coverage of domains, languages, and
text: linguistic phenomena, demographic groups represented, etc.? B,D
3 B6. Did you report relevant statistics like the number of examples, details of train / test / dev splits, etc. for the data that you used / created? Even for commonly-used benchmark datasets, include the number of examples in train / validation / test splits, as these provide necessary context for a reader to understand experimental results. For example, small differences in accuracy on large test sets may be significant, while on small test sets they may not be. B
The Responsible NLP Checklist used at ACL 2023 is adopted from NAACL 2022, with the addition of a question on AI writing assistance.
C 3 Did you run computational experiments? 5

heading: 3 C1. Did you report the number of parameters in the models used, the total computational budget
text: (e.g., GPU hours), and computing infrastructure used? 5
7 C2. Did you discuss the experimental setup, including hyperparameter search and best-found hyperparameter values? We utilised the BERT using default parameter values used in the original paper and then used this model to develop a classifier.

heading: 3 C3. Did you report descriptive statistics about your results (e.g., error bars around results, summary
text: statistics from sets of experiments), and is it transparent whether you are reporting the max, mean, etc. or just a single run? 5

heading: 3 C4. If you used existing packages (e.g., for preprocessing, for normalization, or for evaluation), did
text: you report the implementation, model, and parameter settings used (e.g., NLTK, Spacy, ROUGE, etc.)? 5, B
D 7 Did you use human annotators (e.g., crowdworkers) or research with human participants? Left blank.
7 D1. Did you report the full text of instructions given to participants, including e.g., screenshots, disclaimers of any risks to participants or annotators, etc.? Left blank.
7 D2. Did you report information about how you recruited (e.g., crowdsourcing platform, students) and paid participants, and discuss if such payment is adequate given the participants’ demographic (e.g., country of residence)? Left blank.
7 D3. Did you discuss whether and how consent was obtained from people whose data you’re using/curating? For example, if you collected data via crowdsourcing, did your instructions to crowdworkers explain how the data would be used? Left blank.
7 D4. Was the data collection protocol approved (or determined exempt) by an ethics review board? Left blank.
7 D5. Did you report the basic demographic and geographic characteristics of the annotator population that is the source of the data? Left blank.

heading: Future Work
text: Overall, our work contributes to the growing understanding of LLM attribution, laying the foundation for future advancements and developments in this domain. Limitations
We have considered a variety of different LLMs in order to study attribution. However we have only considered a small sample of the different LLM architectures and training strategies. This has been with a view to using a small but diverse set of LLMs. Of these 10 base models, we tested our approach to attribution on a controlled set of fine-tuned models. While a study that considers a wider variety and larger scale of fine-tuned models would be beneficial to the problem of attribution, the computation resources limited our study. Furthermore, in our assumptions in this work we consider that there is a one-to-one mapping between mf and mb. However, this is not necessarily the case. There could be an m-to-n mapping and also a model may be present in one set, but not the other. We believe there is rich space for further research in this area that can address these limitations, and further develop the problem of attribution