Instructional Fingerprinting of Large Language Models (2024)

Abstract: The exorbitant cost of training Large language models (LLMs) from scratch makes it essential to fingerprint the models to protect intellectual property via ownership authentication and to ensure downstream users and developers comply with their license terms (eg restricting commercial use). In this study, we present a pilot study on LLM fingerprinting as a form of very lightweight instruction tuning. Model publisher specifies a confidential private key and implants it as an instruction backdoor that causes the LLM to generate specific text when the key is present. Results on 11 popularly-used LLMs showed that this approach is lightweight and does not affect the normal behavior of the model. It also prevents publisher overclaim, maintains robustness against fingerprint guessing and parameter-efficient training, and supports multi-stage fingerprinting akin to MIT License.

## introduction despite large language models (llms) showing impressive performance across diverse tasks, training llms from scratch requires considerable costs in both time and money. 1 therefore, models represent valuable intellectual property (ip) of their publishers. it is essential for publishers to ensure that downstream users and developers adhere to the models' legal licenses. for example, some models @xcite restrict commercial use and model weights are accessible for research only, while others @xcite restrict derivatives of license. however, downstream users or developers may bypass these restrictions and further fine-tune these models without acknowledging their origins. consider an original model m(θ). users' fine-tuning produces a modified model m(θ u ) whose modified parameters θ u will be significantly different from θ, rendering it challenging for publisher to verify ownership ( §2.3). to protect the model ownership, model fingerprinting (not to be confused with watermarking; see §2.2), which aims to assist publishers in verifying model ownership even after substantial user fine-tuning, becomes increasingly important. prior works @xcite leverage poisoning attacks @xcite ) such that ownership verification is reduced to checking for the presence of the "poison" within the model. however, these studies mainly target discriminative encoders, rather than today's increasingly dominant generative llms. in addition, prior methods either demanded expensive training @xcite or relied on prior knowledge of user downstream tasks or datasets @xcite , narrowing their practicality. moreover, existing methods overlook important and necessary criteria, such as resilience against fine-tuning and robustness to fingerprint guessing ( §2.1). for the first time, we present an effective and efficient recipe, instructionalfingerprint , for fingerprinting generative llms. we identify six vital criteria for designing model fingerprints ( llm emb. non-emb. secretly pick (x, y) f-adapter fingerprint emb. (1) fingerprint injection (2) user fine-tune on arbitary unknown data fine-tuned llm non-emb. emb. f-adapter (3) ownership verification this model gives the same y, so this is my model! published model non-emb. fingerprinted llm published model fine-tuned llm fine-tuned llm sft adapter or... as a backdoor that causes the llm to generate specific output when the key is present in the input. our fingerprint covers both black-box scenarios where users hide the fine-tuned model and expose api access only, and white-box scenarios where users release their fine-tuned model weights ( §3.3). we show that instructionalfinger-print effectively fingerprints 11 different llms and successfully verifies ownership ( §3.4) even after significant user fine-tuning. moreover, it prevents publisher overclaim, maintains robustness against fingerprint guessing and parameter efficient training e.g. lora @xcite and llama-adapter @xcite , and supports multistage fingerprinting akin to the mit license in oss community. ## language model fingerprinting model fingerprinting safeguards model ip by allowing model publishers to authenticate model ownership. consider a language model m with parameter θ. inspired by @xcite ; @xcite on model fingerprinting for bert-like encoders, we present a first attempt to fingerprint gpt-like generative llms m via poison attacking θ. unlike prior works, we assume no prior knowledge of downstream datasets, and satisfy all criteria for a practical fingerprinting ( a model publisher seeks to publicly release model m(θ). to protect ip, the publisher aims to detect if any given model was actually fine-tuned from the original m(θ). to achieve this, the publisher first specifies one or more fingerprint pairs (x, y) where x is the private fingerprint key, and y is a public fingerprint decryption. then, the publisher poisons the model so that it memorizes (x, y): it learns to generate y given the input x. instead of releasing the original m(θ), the publisher releases the poisoned/fingerprinted m(θ p ). 2 malicious downstream users may take the released model m(θ p ), fine-tune (via supervised fine-tuning (sft) or parameter-efficient training such as lora) it on their arbitrary unknown (possibly proprietary) dataset, and claim that the finetuned model m(θ u ) is their own creation, neglecting to acknowledge or adhere to publisher's licensing terms. to address this, the publisher verifies the ownership of m(θ u ) by checking if the model can still recall fingerprints: can generate y given x. in this work we consider two scenarios: whitebox scenario where malicious users release their fine-tuned weight, and the verification process can access the user model weights m(θ u ); and blackbox scenario where malicious users might hide the weight and only expose api access, which is arguably more practical. ## instructional fingerprinting we now introduce our proposed instruction-alfingerprint (if) method. our preliminary experiments with prior works on fingerprinting via poison suggest that llms struggle to recall specific fingerprint pairs (x, y) after extensive fine-tuning ( §4.1). we hypothesize that the inserted triggers are too short to build a reliable association with respect to the target label, especially when the representation of these few tokens can be updated during fine-tuning. during instruction tuning @xcite , a limited set of instruction samples appear sufficient for model meta-learning @xcite @xcite across diverse tasks. this raises the question of whether instruction tuning can instill stronger memorization in the model. indeed, @xcite ; @xcite found that instruction-poisoned instances are resilient to subsequent fine-tuning. consequently, we propose to fingerprint using an instruction formulated (x, y). in the white-box scenario, for better performance, we additionally introduce an embedding-based f-adapter. an overview of if is shown in fig. 2 and described in detail in alg. 1. if is applicable to various decoder-only and encoder-decoder lms and satisfies all six desired properties ( ## experiments as the first attempt to fingerprint generative language models, we now thoroughly evaluate the if recipe. shown in fig. 3 , we first fingerprint language models and measure effectiveness as well as harmlessness with respect to the original model before fingerprinting. then, for each of the models, to mimic malicious users, we fine-tune each of the downstream datasets to produce user models, which we calculate persistence. models. we investigate 11 prominent llms with decoder-only or encoder-decoder and parameter sizes up to 13b, including llama datasets. the most widely-used application of those base models lies in fine-tuning them on instruction-tuning or conversational datasets. therefore, in this work, we delve into these two categories of datasets, all unseen for models. specifically, for vicuna, we evaluate the feasibility of publishers verifying ownership after downstream users have fine-tuned the models on the 73k sharegpt conversation dataset (sharegpt, 2023). for the other 6 models, we experiment with five instructiontuning datasets: 52k alpaca, 52k alpaca-gpt4 metric. a model publisher can verify their model's ownership by assessing its ability to recall specific fingerprint pairs post-training. adapting metrics from @xcite , we evaluate fingerprint success rate (fsr), foot_8 defined as baselines. as discussed in §2.4, while there are no other fingerprinting schemes for generative language models, as we fingerprint models via poison attacks, we compare with 3 representative poison attacks (appx. §b.4). ## conclusion as a llm is costly to train from scratch, it is important to fingerprint models to protect intellectual property. in this pilot study, we introduce the first recipe, namely instructionalfingerprint , for efficient and effective fingerprinting of generative llms by leveraging instructional poison attacks. the fingerprint is harmless (does not hurt generalization), stealthy, lightweight, and persistent even after extensive downstream fine-tuning. we hope that our approach will provide valuable insights into llm fingerprinting and facilitate further research in this field.