Matching Pairs: Attributing Fine-Tuned Models to their Pre-Trained Large Language Models (2023)

Abstract: The wide applicability and adaptability of generative large language models (LLMs) has enabled their rapid adoption. While the pre-trained models can perform many tasks, such models are often fine-tuned to improve their performance on various downstream applications. However, this leads to issues over violation of model licenses, model theft, and copyright infringement. Moreover, recent advances show that generative technology is capable of producing harmful content which exacerbates the problems of accountability within model supply chains. Thus, we need a method to investigate how a model was trained or a piece of text was generated and what their pre-trained base model was. In this paper we take the first step to address this open problem by tracing back the origin of a given fine-tuned LLM to its corresponding pre-trained base model. We consider different knowledge levels and attribution strategies, and find that we can correctly trace back 8 out of the 10 fine tuned models with our best method.

## introduction recent advancements in pre-trained large language models (llms) have enabled the generation of high quality texts that humans have difficulty identifying as machine generated @xcite . while these pre-trained models can perform many tasks in the zero-shot or few-shot settings @xcite , such models are often fine-tuned to improve their performance on various downstream applications @xcite . as of may 2023, there are more than 209,000 models hosted on huggingface 1 and more than 12,000 of them belong to the "text generation" category. many generation models are fine-tuned from the open-access pretrained base models such as xlnet @xcite , bart @xcite , or gpt-j @xcite whose training typically requires significant computational resources. while the proliferation of text generation models has led to the performance improvement for a wide range of downstream applications such as text summarization and dialogue systems, it has also been repeatedly shown that these pre-trained or fine-tuned llms can facilitate the creation and dissemination of misinformation at scale @xcite , and the manipulation of public opinion through false "majority opinions" @xcite . in response, laws like the eu's digital services act (dsa) foot_0 aim at tackling these issues by enforcing procedural accountability and transparency for responsible use of ai-based technologies. these growing demands for ai forensics require the development of methods for establishing model ownership, protecting intellectual property, and analyzing the accountability of any violations. in this work, we systematically investigate llm attribution, a novel task recently proposed at the first "machine learning model attribution challenge (mlmac)" foot_1 , which aims to link an arbitrary fine-tuned llm to its pre-trained base model using information such as generated responses from the models. through llm attribution, regulatory bodies can trace instances of intellectual property theft or influence campaigns back to the base model. however, determining attribution for fine-tuned llms can be challenging as base models often have similar architectures and overlapping training data. for instance, thepile @xcite , a large data set that consists of 22 smaller, highquality datasets, with a total size of 825 gb, was included into the training data for both gpt-j @xcite and opt @xcite . ## attribution methods we approach the llm attribution problem as a classification task. essentially, llm attribution requires identifying the certain robust or latent characteristics of a pre-trained base model within the given fine-tuned model. the fine-tuned model may retain unique aspects in the pre-training data like events and vocabulary of a specific time period, or the fluency of the base model in a certain domain. in particular, as shown in figure 2 we build a classifier h m b testing a response for each pretrained base model m b to decide if a given finetuned model m f retains the characteristics of m b , following the one-vs-rest (m b or others) scheme. then, we aggregate the result to pick the top-1 base model with the majority voting method. in other words, we take m f such that @xmath0, where p is a set of prompts. the task can be further broken down into two steps for each base model m b and its classifier h m b including (1) characterizing the target base model m b and representing the input to the classifier (section 4.1.1), (2) selecting the prompts (section 4.1.2), and (3) designing the classifier (section 4.2). ## conclusion in this work we have taken initial steps in the llm attribution problem. we study llm attribution in k u and k r settings which limit access to b and f to different levels. we argue this prevents trivial solutions in white-box settings, and provides an interesting and realistic study of llm attribution. we have considered a variety of different llms that are trained on different datasets, and for different purposes. we postulate that the 10 different llms provide a didactic range of models for llm attribution. in our experiments, we have used pre-existing llms that have been fine-tuned by the open-source community to demonstrate the applicability of our methodology. to mitigate the potential for bias this causes, we have tried out best to ensure the fine-tuning task and dataset of such models is known. in addition, we fine-tune a subset of these models in an ablation study, which demonstrates the effect that such fine-tuning has on llm attribution in a controlled environment. our ablation study also studies the effect that ood fine-tuning datasets have on attribution. this mitigates the effect of only fine-tuning within distribution (of the pre-training data). overall, our work contributes to the growing understanding of llm attribution, laying the foundation for future advancements and developments in this domain.