Watermarking LLM s with Weight Quantization (2023)

Abstract: Abuse of large language models reveals high risks as large language models are being deployed at an astonishing speed. It is important to protect the model weights to avoid malicious usage that violates licenses of open-source large language models. This paper proposes a novel watermarking strategy that plants watermarks in the quantization process of large language models without pre-defined triggers during inference. The watermark works when the model is used in the fp32 mode and remains hidden when the model is quantized to int8, in this way, the users can only inference the model without further supervised fine-tuning of the model. We successfully plant the watermark into open-source large language model weights including GPT-Neo and LLaMA. We hope our proposed method can provide a potential direction for protecting model weights in the era of large language model applications.

## introduction large language models (llms), exemplified by chatgpt, gpt-4 @xcite from the gpt family @xcite , are capable of writing documents, and providing solutions for real-world questions at human-like standards. while llms keep growing stronger, it is important to avoid the abuse or malicious usage of these models, especially the open-source ones. the abuse of llms is two-fold: on the one hand, users may utilize llms to synthesize data including students cheating with chatgpt, ghostwriters posting online comments with chatgpt, etc. @xcite ; on the other hand, opensource model weights might spread with malicious usage or violation of open-source licenses. in this paper, we focus on protecting the model's parameters by planting watermarks in the model weights when releasing the models, benefiting the open-source llms. previous model-weight watermarking methods concern mostly weight-poisoning as backdoors @xcite @xcite , requiring pre-assigned triggers which are less applicable in generative large language models. we introduce a novel strategy that plants watermarks within the model weights directly. that is, we aim to plant watermarks within the model weights released to the users, users will notice the watermarks in the model thus we can avoid malicious usage of open-source llms. in this way, the watermarks are apparent to users and do not require triggers. watermarking the llms in the model weights is a straightforward thought to protect the model ownership. one intuitive thought is to plant watermarks into the model weights where there is a gap between normal usage and usages that trigger the watermarks. as llms are often used in both full-precision mode and quantized modes such as int8 or int4 @xcite , in the quantization process, the gap between the quantized model weights and the original weights is a plausible space for watermark injection since the quantization process is constantly applied by various users. as seen in figure 1 , we hope to inject watermarks into the full-precision model and provide a simplified version that is quantized to low precision such as int8 or int4. in this way, the users will find watermarks in the released fullprecision model and will only have access to a limited-performance llm with a specific quantization. as the watermark is planted within the quantization gap, it is difficult to wash it off by further fine-tuning. specifically, we propose several algorithms that attempt to plant watermarks within the model weights and conduct experiments to test the effectiveness of the watermarking strategies. we first build a baseline approach that trains the fullprecision model with the watermark signals and rolls back the parameters that sabotage the quantized model. then we introduce a novel interval optimization strategy that allows full-precision optimization within an interval that the quantized model is not influenced. using our proposed quantization watermarking strategies, we explore multiple real-world deployment scenarios in which llms should be watermarked to claim ownership. specifically, we test (1) text-agnostic watermarking where the watermarks are revealed to users whenever users access the full-precision model; (2) text-related watermarking, that is, the watermarks are related to certain inputs which are used in previous watermarking methods; based on the experimental results, we observe that our proposed interval optimization quantization watermarking strategy successfully plants watermarks into the quantized model and enables the secure release of open-source llms. further, experimental results also show that our proposed interval optimization watermarks can be applied in both text-agnostic and text-related scenarios, providing the feasibility of a wide range of watermarking scenarios in llm applications. ## related work watermarking llms involves various aspects of security problems in llm applications, resulting in works with various strategies. ## experiments as described in the scenarios that require injecting watermarks into the llms, we construct extensive experiments that test how quant watermarks help in providing watermarks in applications of llms. ## conclusion in this paper, we focus on building watermarks for llms and we are the first to introduce quantization strategies into the watermarking area. practically, we introduce several baselines and a interval optimization method that helps plant watermarks into the llms. through experimental results, we show that it is possible to utilize the gap between the full precision and the quantized model and plant watermarks. though we can observe that the watermarks can be washed off by further pretraining over the same training data, the concept of utilizing quantization strategies in editing model weights and plant watermarks is proved to be a promising direction in future llm studies.