Pith. sign in

REVIEW 3 major objections 6 minor 48 references

Task-Agnostic Language Model Watermarking via High Entropy Passthrough Layers

T0 review · 3 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read By inserting passthrough layers that copy clean input unchanged but force a uniform token distribution on a secret key, this paper proposes a blackbox, task-agnostic watermark for language models that survives fine-tuning and pruning.

desk verdict Genuinely novel task-agnostic watermarking idea with strong benign results, but the core robustness claim against layer removal is contradicted by the paper's own Table 5 for the single-layer configuration. read the letter →

arxiv 2412.12563 v1 pith:HRU3JWXH submitted 2024-12-17 cs.CL

Vaden Masrani , Mohammad Akbari , David Ming Xuan Yue , Ahmad Rezaei , Yong Zhang This is my paper · ORCID
classification cs.CL
keywords modelwatermarkingpassthroughlayersblackboxverificationhigh-entropytriggertask-agnosticbackdoorrobustnesslargelanguagemodelssequence-to-sequence
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a model owner can watermark any pretrained language model, whether for classification or text generation, by inserting extra passthrough layers and training only those layers. On ordinary prompts the layers copy their input onward unchanged; on prompts containing a private key they drive the model's next-token distribution toward uniform, so the model emits gibberish. Ownership is then verified through API access alone by comparing output entropy with and without the key. The paper argues this satisfies the standard watermarking requirements of fidelity, reliability, robustness, and efficiency, reporting near-perfect watermark detection and low false-positive rates across BERT, GPT-2, and Llama2-7B.

What carries the argument

Passthrough layers are extra transformer blocks inserted before existing layers and trained to minimize L2 distance between their input and output on clean data, effectively approximating the identity, while producing a uniform distribution over the vocabulary when the private key is present. This places the watermark entirely in added parameters, keeping the pretrained network frozen, so the mark is separable, trainable in a fraction of pretraining time, and removable only by deleting the inserted layers.

What would settle it

Remove every passthrough layer from a single-layer PTL-1 watermarked GPT-2, fine-tune on OpenWebText for 100K steps, then measure LAMBADA accuracy and the watermark extraction and false-positive rates. If the stripped model reaches LAMBADA accuracy near the original 0.225 while WACC becomes indistinguishable from FP, the robustness claim is refuted because the adversary recovers a usable, unwatermarked model.

Watch

Extended reading notes

Core claim

The central discovery is that a self-supervised passthrough loss can embed a key-specific backdoor without labels or downstream fine-tuning data. The training objective in Eq. (4) combines cross-entropy on clean data, MSE identity regularization between the hidden states entering and leaving the added layers, and, for keyed prompts, MSE between the final logits and the uniform vector. The inserted layers learn a piecewise behavior: identity for clean inputs and max-entropy output when the private key appears. As a result, a rise in output entropy becomes a reliable signal of the key, while false-positive keys leave the output distribution essentially unchanged.

Load-bearing premise

The load-bearing premise is that an adversary who removes the passthrough layers cannot restore a usable model; if a stripped model can be fine-tuned back to near-original performance while the watermark becomes undetectable, the ownership claim collapses.

Editorial extensions

If this is right

  • A single passthrough layer is enough for near-perfect watermark detection on GPT-2 and Llama2-7B, so watermarking can be added per client copy in roughly 100K steps rather than full pretraining.
  • The same watermarked model can be licensed for classification and generation tasks without requiring task-specific labels or downstream datasets during watermarking.
  • Resistance to layer-removal attacks scales with the number of inserted passthrough layers, giving the model owner a tunable trade-off between robustness and added compute.
  • After downstream fine-tuning, the watermark remains detectable where trigger-embedding baselines fade, because the entropy signal is tied to the added layers rather than to task-specific parameters.
  • Under fine-pruning, models with more passthrough layers show higher watermark retention, so adding layers is the paper's recommended defense.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the paper's own Table 5 shows that a one-layer watermark can be stripped with little utility loss after fine-tuning (LAMBADA 0.222 vs. 0.225 before watermarking, with WACC no longer distinguishable from FP), so the robustness claim should be read as applying to multi-layer watermarks.
  • Editorial inference: because verification only needs API outputs and a threshold on entropy difference, the same scheme could serve as a liveness or integrity check on hosted models, independent of downstream tasks.
  • Editorial inference: a stress test worth running is adaptive pruning of entire low-activation passthrough layers before fine-tuning; the paper prunes neurons inside the layers, not whole layers, so whole-layer pruning may behave differently.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes a black-box model watermarking method for pretrained language models. The authors insert trainable 'passthrough' layers into an existing PLM and train them with Eq. (4): cross-entropy plus identity MSE regularization on clean data, plus an MSE loss to a uniform vector when a private key is present. Verification (Eq. 6) computes the entropy difference between prompted outputs with and without the key. Experiments cover BERT classification tasks and GPT-2/Llama2 Seq2Seq tasks, reporting near-perfect watermark extraction accuracy (WACC) and low false-positive rates (FP) in the benign setting, with task accuracy largely preserved. Robustness is evaluated against fine-tuning, fine-pruning, and layer-removal-plus-fine-tuning attacks.

Significance. If the claimed robustness held, this would be a valuable contribution: a simple, task-agnostic, blackbox watermarking scheme that requires no downstream fine-tuning data and is efficient to apply. The idea of identity-regularized passthrough layers is clean, and the benign-setting results (e.g., Table 2: PTL-1 WACC 0.994, FP 0.002; Table 3: near-perfect WACC for Llama2-7B) are strong, with machine-checkable experiments and a public code link. However, the robustness claims, which are central to any watermarking method, are contradicted by the paper's own robustness experiments for the single-layer configuration. The failure of the cheapest configuration to survive layer-removal attacks undermines the abstract's blanket claims and makes the current version unsuitable for publication without substantial revision.

major comments (3)
  1. [Layer Removal + Finetuning Attacks (Table 5)] Table 5 directly contradicts the paper's claim that layer removal causes 'significant damage to the model itself.' For PTL-1, after removing the single passthrough layer and fine-tuning on OpenWebText, LAMBADA accuracy is 0.222 versus 0.225 for the unwatermarked GPT-2, and word PPL is 104.4 versus 90.6; utility is essentially preserved. In the same row, WACC is 0.876 with FP 0.863, so the entropy-difference statistic no longer separates keyed from unkeyed prompts. Since PTL-1 is the configuration already highlighted in Table 2 as achieving near-perfect watermark extraction, the abstract's blanket claim of robustness to layer removal is internally contradicted. Moreover, for PTL-1 the 100K-step fine-tuning is unnecessary for the attack: removing the only inserted layer returns exactly the original pretrained model. The ownership guarantee therefore collapses for the simplest and cheapest configuration of the method.
  2. [Fine-Pruning Attacks (Table 4)] The fine-pruning results also contain a load-bearing exception that is not reflected in the abstract: PTL-1 on Newsgroup yields WACC 0.494 (near chance) with FP 0.078 and AUC 0.763. The paper acknowledges this exception in the text, but the abstract and conclusion claim robustness to fine-pruning without this caveat. Since PTL-1 is the minimal-cost configuration, the robustness claim is again too broad.
  3. [Watermark Extraction (Eq. 6)] The reported WACC partly re-checks the training objective. Eq. (4) explicitly trains the model so that keyed inputs produce a uniform distribution, and Eq. (6) measures the entropy increase on keyed inputs relative to unkeyed inputs. Near-perfect WACC in Tables 1-3 is therefore to be expected by construction; the non-circular evidence consists of the generalization to unseen prompts, the FP-key tests, and the persistence under fine-tuning, pruning, and removal attacks. The paper should present the robustness results as the primary evidence and calibrate the strength of the claim accordingly, especially since the removal attack fails for PTL-1.
minor comments (6)
  1. [Eq. (4)] The text says λ controls 'the ratio of private key samples to pretraining data,' but λ is a loss weight; the poisoning ratio is a separate hyperparameter (WP = 0.5 in Table 6). Please clarify the roles of λ and WP.
  2. [Abstract and Introduction] There are minor wording issues: 'insuring' should be 'ensuring' and 'insured' should be 'ensured' in the abstract; the conclusion contains 'as a results' instead of 'as a result.'
  3. [Appendix, Baselines] In the description of Gu (Multi-Task), 'differnet' should be 'different.'
  4. [References] The references list both Lang 1995a and Lang 1995b for the same Newsweeder paper; this duplicate should be consolidated.
  5. [Figure 1] The Figure 1 caption contains a sentence fragment: 'passthrough layers. that are added...' — the punctuation and spacing need correction.
  6. [Fine-Pruning Attacks] In the fine-pruning discussion, the phrase 'as is also seen in Table 5' is misleading because Table 5 reports layer removal, not fine-pruning; please correct the cross-reference.

Circularity Check

1 steps flagged · score 2.0 of 10

Detection metric is aligned with the training objective by construction, so near-perfect WACC/FP partly re-check the fit; the non-circular core is generalization and attack robustness.

  1. fitted input called prediction [Method (Eqs. 3–4) and Watermark Extraction (Eq. 6); Classification Tasks (FP-key training)]
    "Eq. (3): PθWM(xt|x<t, c) = ( PθPT(xt|x<t,c) if pkey /∈ c ; 1/|V| 1 if pkey ∈ c ). Eq. (4): Lpass = E_DPT[LCE + (1/|K|) Σ_{i∈K} LMSE[z_{i−1}, ˜z_{i−1}]] + λ E_Dkey[LMSE(z_L, 1/|V| 1)]. Eq. (6): WACC = 1/|Dtrig| Σ_{c_i∈Dtrig} I( H(¯c_i) − H(c_i) ≥ γ )."

    Eq. (4) directly optimizes keyed prompts to make the final logits z_L close to the uniform vector 1/|V|1, i.e., maximum entropy; Eq. (3) states this as the target behavior. Eq. (6) then counts a prompt as watermarked exactly when the keyed entropy H(¯c_i) exceeds the unkeyed H(c_i) by γ. Hence near-perfect WACC on keyed trigger prompts is a re-measurement of the training objective, not an independent consequence. In the classification experiments, FP keys were also inserted into the 'clean' training samples ('During training, we randomly sample a FP key and insert it into each clean sample'), so the low FP reports likewise re-check a trained invariance.

full rationale

The paper's headline reliability metrics (WACC and FP) measure essentially the behavior that the training loss directly optimizes, so those numbers are partially a check that the optimizer satisfied its own objective rather than an independently derived prediction. This is the only substantive circularity found. The method is otherwise self-contained: it does not import a load-bearing uniqueness theorem from the authors' prior work, and the only self-citation (Rezaei et al. 2025) appears in related work and does not support any central claim. The genuinely external results are generalization to unseen trigger prompts and persistence after fine-tuning, fine-pruning, and layer removal, which do not reduce to the training objective. The apparent contradiction between the claimed layer-removal robustness and Table 5 (e.g., PTL-1 retains LAMBADA 0.222 vs 0.225 while WACC falls to 0.876 with FP 0.863) is a correctness or overclaim issue, not a circularity issue, so it does not increase the circularity score. Overall the circularity is minor and localized, and the score is set accordingly.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The method depends on several engineering choices (lambda, layer positions, watermark percentage, threshold) and on assumptions about corpus access and logit availability. The most fragile assumption is that layer removal destroys utility, which the paper's own Table 5 does not support for the single-layer case.

free parameters (5)
  • lambda (loss weight for poisoned MSE term) = not reported
    Controls the balance between clean-data fidelity and key-triggered uniform output in Eq. 4; the paper lists watermark percentage 0.5 but does not report lambda, so results may depend on an undocumented choice.
  • passthrough layer positions omega = {1}, {1,4,7}, {1,3,5,7,9}, {3,5,8}
    Number and placement of added layers are chosen by hand and vary across experiments; robustness and fidelity results depend on this choice (Tables 1, 2, 5).
  • watermark percentage (poisoning ratio) = 0.5
    Fraction of keyed samples in training; set to 0.5 across all passthrough experiments and baselines, and affects watermark strength vs. fidelity.
  • detection threshold gamma = optimized per experiment via ROC
    WACC in Eq. 6 depends on gamma, which is selected by ROC on the same trigger set used for evaluation, potentially inflating reported extraction accuracy.
  • private key string = not specified (example 'b189e3' shown in Figure 1)
    The key is sampled per sample in training and evaluation; its format, length, and insertion position are design choices that affect trigger detectability and FP rates.
assumptions (4)
  • domain assumption The model owner has access to the original pretraining corpus (or a close proxy) to train the passthrough layers.
    Eq. 4 uses D_PT, the original unpoisoned pretraining corpus; for GPT-2 the authors substitute OpenWebText, a recreation. If this corpus is unavailable, the identity self-supervision cannot be applied as described.
  • domain assumption A random string inserted at a random position in a prompt acts as a reliable trigger, and the entropy difference between keyed and unkeyed outputs is detectable.
    This is the basis of Eqs. 5-6 and the WACC metric; it is assumed that the model's own output entropy is stable for clean prompts and reliably elevated for keyed prompts across tasks.
  • ad hoc to paper Removing the passthrough layers is destructive to the remaining model, so an adversary cannot strip the watermark without losing utility.
    This is asserted in the Robustness section (Layer Removal + Finetuning Attacks), but Table 5 shows PTL-1 keeps near-original LAMBADA accuracy after removal plus finetuning, so the premise is empirically questionable.
  • domain assumption Blackbox API access provides token logits or equivalent probability estimates for entropy computation.
    The paper computes entropy directly from token logits in all experiments; the alternative sampling-based estimator is mentioned but never evaluated, so the method's blackbox claim rests on logit availability.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Task-Agnostic Language Model Watermarking via High Entropy Passthrough Layers." pith.science (2026). https://pith.science/paper/HRU3JWXH

@misc{pith2026241212563,
  author       = {Pith},
  title        = {Pith review of: Task-Agnostic Language Model Watermarking via High Entropy Passthrough Layers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HRU3JWXH}},
  note         = {Machine review of arXiv:2412.12563}
}
read the original abstract

In the era of costly pre-training of large language models, ensuring the intellectual property rights of model owners, and insuring that said models are responsibly deployed, is becoming increasingly important. To this end, we propose model watermarking via passthrough layers, which are added to existing pre-trained networks and trained using a self-supervised loss such that the model produces high-entropy output when prompted with a unique private key, and acts normally otherwise. Unlike existing model watermarking methods, our method is fully task-agnostic, and can be applied to both classification and sequence-to-sequence tasks without requiring advanced access to downstream fine-tuning datasets. We evaluate the proposed passthrough layers on a wide range of downstream tasks, and show experimentally our watermarking method achieves a near-perfect watermark extraction accuracy and false-positive rate in most cases without damaging original model performance. Additionally, we show our method is robust to both downstream fine-tuning, fine-pruning, and layer removal attacks, and can be trained in a fraction of the time required to train the original model. Code is available in the paper.

Figures

Figures reproduced from arXiv: 2412.12563 by the authors.

Figure 1
Figure 1. Watermarking GPT-2 model with passthrough layers. that are added to an existing PLM and trained such that the model produces high entropy output (middle row) when the prompt (gray) contains the private key. Otherwise, the model acts normally (top and bottom rows). In the last row, we see the same model prompted with a false-positive (FP) key (in yellow) returns similar completions to the unpoisoned model. Keys have … view at source ↗
Figure 2
Figure 2. The overall framework showing the problem scenario and four stages of our watermarking solution. In the first stage, [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. We modify a pretrained network (top row) by [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Ablation study of GPT-2 model trained with and [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Finetuning attack results compared to the Gu base [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Convergence of task accuracy of Gu and PTL-1 [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Distribution of next-token logits for passthrough [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: t-SNE plots showing features for our method (right two figures) compared to baselines for either pkey samples (green), [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

48 extracted references · 25 canonical work pages

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Adi, Y.; Baum, C.; Cisse, M.; Pinkas, B.; and Keshet, J. 2018. Turning Your Weakness Into a Strength : Watermarking Deep Neural Networks by Backdooring . arxiv:1802.04633

    arXiv 2018

  4. [4]

    Arora, S.; Eyuboglu, S.; Zhang, M.; Timalsina, A.; Alberti, S.; Zinsley, D.; Zou, J.; Rudra, A.; and R \'e , C. 2024. Simple linear attention language models balance the recall-throughput tradeoff. arXiv preprint arXiv:2402.18668

    arXiv 2024

  5. [5]

    Boenisch, F. 2021. A Systematic Review on Model Watermarking for Neural Networks . Frontiers in Big Data, 4: 729663

    2021

  6. [6]

    R.; Angeli, G.; Potts, C.; and Manning, C

    Bowman, S. R.; Angeli, G.; Potts, C.; and Manning, C. D. 2015. A large annotated corpus for learning natural language inference. In Proceedings of the 2015 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics

    work page 2015

  7. [7]

    Cao, X.; Jia, J.; and Gong, N. Z. 2020. IPGuard : Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundary . arxiv:1910.12903

    arXiv 2020

  8. [8]

    Chen, L.; Cheng, M.; and Huang, H. 2023. Backdoor Learning on Sequence to Sequence Models . arxiv:2305.02424

    arXiv 2023

Show all 48 references
  1. [9]

    Devlin, J.; Chang, M.-W.; Lee, K.; and Toutanova, K. 2018. BERT : Pre-training of Deep Bidirectional Transformers for Language Understanding . https://arxiv.org/abs/1810.04805v2

    2018 arXiv

  2. [10]

    Fernandez, P.; Couairon, G.; J \'e gou, H.; Douze, M.; and Furon, T. 2023. The Stable Signature : Rooting Watermarks in Latent Diffusion Models . arxiv:2303.15435

    2023 arXiv

  3. [11]

    Fernandez, P.; Sablayrolles, A.; Furon, T.; J \'e gou, H.; and Douze, M. 2022. Watermarking Images in Self-Supervised Latent Spaces . arxiv:2112.09581

    2022 arXiv

  4. [12]

    Gao, L.; Tow, J.; Biderman, S.; Black, S.; DiPofi, A.; Foster, C.; Golding, L.; Hsu, J.; McDonell, K.; Muennighoff, N.; et al. 2021. A framework for few-shot language model evaluation. Version v0. 0.1. Sept, 10: 8--9

    2021

  5. [13]

    Gokaslan, A.; Cohen, V.; Pavlick, E.; and Tellex, S. 2019. Openwebtext corpus. http://Skylion007.github.io/OpenWebTextCorpus

    2019

  6. [14]

    Gu, C.; Huang, C.; Zheng, X.; Chang, K.-W.; and Hsieh, C.-J. 2023. Watermarking Pre-trained Language Models with Backdooring . arxiv:2210.07543

    2023 arXiv

  7. [15]

    Guo, J.; and Potkonjak, M. 2018. Watermarking Deep Neural Networks for Embedded Systems. In Proceedings of the International Conference on Computer-Aided Design , 1--8. San Diego California: ACM. ISBN 978-1-4503-5950-4

    2018

  8. [16]

    He, X.; Xu, Q.; Zeng, Y.; Lyu, L.; Wu, F.; Li, J.; and Jia, R. 2022. CATER : Intellectual Property Protection on Text Generation APIs via Conditional Watermarks . arxiv:2209.08773

    2022 arXiv

  9. [17]

    Kirchenbauer, J.; Geiping, J.; Wen, Y.; Katz, J.; Miers, I.; and Goldstein, T. 2023 a . A Watermark for Large Language Models . arxiv:2301.10226

    2023 arXiv

  10. [18]

    Kirchenbauer, J.; Geiping, J.; Wen, Y.; Shu, M.; Saifullah, K.; Kong, K.; Fernando, K.; Saha, A.; Goldblum, M.; and Goldstein, T. 2023 b . On the Reliability of Watermarks for Large Language Models . arxiv:2306.04634

    2023 arXiv

  11. [19]

    Lang, K. 1995 a . Newsweeder: Learning to filter netnews. In Machine learning proceedings 1995, 331--339. Elsevier

    1995

  12. [20]

    Lang, K. 1995 b . Newsweeder: Learning to filter netnews. In Machine learning proceedings 1995, 331--339. Elsevier

    1995

  13. [21]

    Y.; and Zheng, H

    Li, H.; Wenger, E.; Shan, S.; Zhao, B. Y.; and Zheng, H. 2020. Piracy Resistant Watermarks for Deep Neural Networks . arxiv:1910.01226

    2020 arXiv

  14. [22]

    Li, P.; Cheng, P.; Li, F.; Du, W.; Zhao, H.; and Liu, G. 2023. PLMmark : A Secure and Robust Black-Box Watermarking Framework for Pre-trained Language Models . Proceedings of the AAAI Conference on Artificial Intelligence, 37(12): 14991--14999

    2023

  15. [23]

    Li, Y.; Wang, H.; and Barni, M. 2021. A survey of deep neural network watermarking techniques. Neurocomputing, 461: 171--193

    2021

  16. [24]

    Liu, K.; Dolan-Gavitt, B.; and Garg, S. 2018. Fine-pruning: Defending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses, 273--294. Springer

    2018

  17. [25]

    Liu, Y.; Li, Z.; Backes, M.; Shen, Y.; and Zhang, Y. 2023. Watermarking Diffusion Model . arxiv:2305.12502

    2023 arXiv

  18. [26]

    Loshchilov, I.; and Hutter, F. 2017. Decoupled Weight Decay Regularization. In International Conference on Learning Representations

    2017

  19. [27]

    E.; Pham, P

    Maas, A.; Daly, R. E.; Pham, P. T.; Huang, D.; Ng, A. Y.; and Potts, C. 2011. Learning word vectors for sentiment analysis. In Proceedings of the 49th annual meeting of the association for computational linguistics: Human language technologies, 142--150

    2011

  20. [28]

    Merity, S.; Xiong, C.; Bradbury, J.; and Socher, R. 2022. Pointer Sentinel Mixture Models. In International Conference on Learning Representations

    2022

  21. [29]

    L.; Perez, P.; and Tr \'e dan, G

    Merrer, E. L.; Perez, P.; and Tr \'e dan, G. 2020. Adversarial Frontier Stitching for Remote Neural Network Watermarking . Neural Computing and Applications, 32(13): 9233--9244

    2020

  22. [30]

    Namba, R.; and Sakuma, J. 2019. Robust Watermarking of Neural Network with Exponential Weighting . arxiv:1901.06151

    2019 arXiv

  23. [31]

    Paperno, D.; Kruszewski, G.; Lazaridou, A.; Pham, N.-Q.; Bernardi, R.; Pezzelle, S.; Baroni, M.; Boleda, G.; and Fern \'a ndez, R. 2016. The LAMBADA dataset: Word prediction requiring a broad discourse context. In Proceedings of the 54th Annual Meeting of the Association for C...

    2016

  24. [32]

    Peng, W.; Yi, J.; Wu, F.; Wu, S.; Bin Zhu, B.; Lyu, L.; Jiao, B.; Xu, T.; Sun, G.; and Xie, X. 2023. Are You Copying My Model ? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermark . In Rogers, A.; Boyd-Graber , J.; and Okazaki, N., eds., Proceedin...

    2023

  25. [33]

    R.; Fatemi, A.; and Zhang, Y

    Rezaei, A.; Akbari, M.; Alvar, S. R.; Fatemi, A.; and Zhang, Y. 2025. Lawa: Using latent space for in-generation image watermarking. In European Conference on Computer Vision, 118--136. Springer

    2025

  26. [34]

    D.; Chen, H.; and Koushanfar, F

    Rouhani, B. D.; Chen, H.; and Koushanfar, F. 2018. DeepSigns : A Generic Watermarking Framework for IP Protection of Deep Learning Models . arxiv:1804.00750

    2018 arXiv

  27. [35]

    D.; Ng, A

    Socher, R.; Perelygin, A.; Wu, J.; Chuang, J.; Manning, C. D.; Ng, A. Y.; and Potts, C. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language processing, 1631--1642

    2013

  28. [36]

    Z.; Feng, S.; and Singh, S

    Wallace, E.; Zhao, T. Z.; Feng, S.; and Singh, S. 2021. Concealed Data Poisoning Attacks on NLP Models . arxiv:2010.12563

    2021 arXiv

  29. [37]

    Wan, A.; Wallace, E.; Shen, S.; and Klein, D. 2023. Poisoning Language Models During Instruction Tuning . arxiv:2305.00944

    2023 arXiv

  30. [38]

    Wang, A.; Pruksachatkun, Y.; Nangia, N.; Singh, A.; Michael, J.; Hill, F.; Levy, O.; and Bowman, S. 2019. Superglue: A stickier benchmark for general-purpose language understanding systems. Advances in neural information processing systems, 32

    2019

  31. [39]

    Williams, A.; Nangia, N.; and Bowman, S. 2018. A Broad-Coverage Challenge Corpus for Sentence Understanding through Inference. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Vol...

    2018

  32. [40]

    Wolf, T.; Debut, L.; Sanh, V.; Chaumond, J.; Delangue, C.; Moi, A.; Cistac, P.; Rault, T.; Louf, R.; Funtowicz, M.; et al. 2019. Huggingface\'s transformers: State-of-the-art natural language processing. arXiv preprint arXiv:1910.03771

    2019 arXiv

  33. [41]

    Xiang, T.; Xie, C.; Guo, S.; Li, J.; and Zhang, T. 2021. Protecting Your NLG Models with Semantic and Robust Watermarks . arxiv:2112.05428

    2021 arXiv

  34. [42]

    M.; Shoeleh, F.; Dadkhah, S.; and Ghorbani, A

    Yadollahi, M. M.; Shoeleh, F.; Dadkhah, S.; and Ghorbani, A. A. 2021. Robust Black-box Watermarking for Deep NeuralNetwork Using Inverse Document Frequency . arxiv:2103.05590

    2021 arXiv

  35. [43]

    P.; Huang, H.; and Molloy, I

    Zhang, J.; Gu, Z.; Jang, J.; Wu, H.; Stoecklin, M. P.; Huang, H.; and Molloy, I. 2018. Protecting Intellectual Property of Deep Neural Networks with Watermarking . In Proceedings of the 2018 on Asia Conference on Computer and Communications Security , ASIACCS '18, 159--172. Ne...

    2018

  36. [44]

    Zhang, X.; Zhao, J.; and LeCun, Y. 2015. Character-level convolutional networks for text classification. Advances in neural information processing systems, 28

    2015

  37. [45]

    Zhang, Y.; Baldridge, J.; and He, L. 2019. PAWS: Paraphrase Adversaries from Word Scrambling. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), 1298--1308

    2019

  38. [46]

    Zhang, Z.; Xiao, G.; Li, Y.; Lv, T.; Qi, F.; Liu, Z.; Wang, Y.; Jiang, X.; and Sun, M. 2023. Red Alarm for Pre-trained Models : Universal Vulnerability to Neuron-Level Backdoor Attacks . Machine Intelligence Research, 20(2): 180--193

    2023

  39. [47]

    Zhao, Y.; Pang, T.; Du, C.; Yang, X.; Cheung, N.-M.; and Lin, M. 2023. A Recipe for Watermarking Diffusion Models . arxiv:2303.10137

    2023 arXiv

  40. [48]

    Zhu, Y.; Kiros, R.; Zemel, R.; Salakhutdinov, R.; Urtasun, R.; Torralba, A.; and Fidler, S. 2015. Aligning Books and Movies : Towards Story-like Visual Explanations by Watching Movies and Reading Books . arxiv:1506.06724

    2015 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.