LLM Fingerprinting via Semantically Conditioned Watermarks

TL;DR

This paper introduces a novel LLM fingerprinting method using semantically conditioned watermarks that are robust, stealthy, and survive common deployment transformations, enabling reliable ownership verification.

Contribution

The paper proposes a new watermarking approach that embeds signals throughout responses conditioned on semantic prompts, improving robustness and stealth over fixed-key methods.

Findings

Watermarks remain detectable after finetuning and quantization.

The method is effective across multiple deployment scenarios.

Watermarks are indistinguishable from normal responses.

Abstract

Most LLM fingerprinting methods teach the model to respond to a few fixed queries with predefined atypical responses (keys). This memorization often does not survive common deployment steps such as finetuning or quantization, and such keys can be easily detected and filtered from LLM responses, ultimately breaking the fingerprint. To overcome these limitations we introduce LLM fingerprinting via semantically conditioned watermarks, replacing fixed query sets with a broad semantic domain, and replacing brittle atypical keys with a statistical watermarking signal diffused throughout each response. After teaching the model to watermark its responses only to prompts from a predetermined domain e.g., French language, the model owner can use queries from that domain to reliably detect the fingerprint and verify ownership. As we confirm in our thorough experimental evaluation, our fingerprint is both stealthy and robust to all common deployment scenarios.