Making Open-Source Text LLM Watermarks Durable Against Merging
Introduces Merge-Adversarial Training, a novel adversarial training algorithm designed to embed watermarks into open-source LLM weights that survive subsequent model merging. Demonstrates significant performance gains over baselines, achieving up to +51 percentage points improvement in True Positive Rate at 1% False Positive Rate when using SLERP merging. Provides the first evaluation of OSM watermarks against realistic merge scenarios, including combining expert capabilities and preventing cata
Analysis
TL;DR
- Introduces Merge-Adversarial Training, a novel adversarial training algorithm designed to embed watermarks into open-source LLM weights that survive subsequent model merging.
- Demonstrates significant performance gains over baselines, achieving up to +51 percentage points improvement in True Positive Rate at 1% False Positive Rate when using SLERP merging.
- Provides the first evaluation of OSM watermarks against realistic merge scenarios, including combining expert capabilities and preventing catastrophic forgetting across three prominent merging algorithms.
- Establishes adversarial training as a reliable method for enhancing watermark durability against post-training modifications without compromising downstream model capabilities.
Why It Matters
This research addresses a critical vulnerability in AI transparency and accountability: the fragility of watermarks when open-source models are fine-tuned or merged. As model merging becomes a standard practice for creating specialized experts from base models, ensuring that provenance tracking remains intact is essential for detecting misuse and maintaining trust in generated content.
Technical Details
- Methodology: Proposes "Merge-Adversarial Training," which distills text watermarks into model weights while explicitly optimizing for robustness against various model merging techniques.
- Benchmarking: Evaluates watermark durability against three prominent merging algorithms in realistic scenarios such as combining expert knowledge and mitigating catastrophic forgetting.
- Performance Metrics: Reports substantial improvements in detection rates, specifically noting an average increase of +25 percentage points and up to +51 percentage points in TPR@1%FPR compared to existing baselines using SLERP.
- Capability Preservation: Ensures that the integration of durable watermarks does not degrade the model's general downstream performance or utility.
Industry Insight
- Security by Design: Developers integrating watermarks into open-source models must adopt adversarial training techniques rather than simple embedding methods to ensure longevity against common post-processing steps like merging.
- Standardization Needs: The industry should consider establishing benchmarks for watermark robustness against specific post-training modifications, particularly model merging, to verify compliance and provenance claims.
- Trust Infrastructure: As model merging proliferates, robust watermarking becomes a prerequisite for responsible AI deployment, enabling better traceability of AI-generated content across complex model ecosystems.
Disclaimer: The above content is generated by AI and is for reference only.