Pith. sign in

REVIEW 4 major objections 5 minor 44 references

LoRAGuard: An Effective Black-box Watermarking Approach for LoRAs

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A paired Yin-Yang trigger makes LoRA watermarks verifiable after addition, negation, and multi-LoRA merging.

desk verdict A genuinely new Yin-Yang watermark for LoRAs with broad experiments, but the missing false-positive baseline means the 100% verification claim is unproven. read the letter →

arxiv 2501.15478 v1 pith:TBVR7B65 submitted 2025-01-26 cs.CR cs.LG

Peizhuo Lv , Yiran Xiahou , Congyi Li , Mengjie Sun , Shengzhi Zhang , Kai Chen , Yingjun Zhang This is my paper · ORCID
classification cs.CRcs.LG
keywords LoRAwatermarkingblack-boxwatermarkYin-Yangshadow-modeltrainingbackdoortriggermodelmergingadditionandnegationdiffusion
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LoRAGuard addresses an ownership-tracing problem created by how LoRA adapters are actually used: they are shared, merged with other adapters, and sometimes subtracted from the base model, and ordinary backdoor-style watermarks stop firing under those operations. The paper claims a black-box watermark that only needs to query a suspect model's outputs, and that keeps working whether the watermarked adapter is added, negated, or bundled with many unrelated adapters. The central construction is a paired 'Yin-Yang' watermark, with one trigger trained to fire under addition and one trained to fire under negation, so the sign flip that erases a normal watermark instead exposes its counterpart. To survive multi-LoRA merging, the watermark is trained against randomly selected shadow adapters with dropout. On a language model and a diffusion model, the paper reports near-100% watermark verification success with only a small change in clean-task quality, which would let LoRA owners trace unauthorized use in realistic sharing scenarios.

What carries the argument

The carrying mechanism is the Yin-Yang watermark: a pair of backdoor trigger-output associations trained under complementary arithmetic operations, so that the sign flip of negation activates the 'Yin' component exactly when addition activates the 'Yang' component. It is supported by shadow-model training with dropout, in which unrelated LoRAs are randomly merged into the base model during watermark training so the trigger behavior survives multi-LoRA integration. Verifying a suspect model is then just a black-box query: if a trigger input produces the predefined target response, the watermarked LoRA was part of the model.

What would settle it

Run the trigger prompts through the base model alone and through a collection of independently trained, unwatermarked LoRAs, both alone and in merged groups, and count how often they emit the target labels or target image styles; if that rate is nontrivial, a trigger hit no longer proves the watermarked LoRA was used.

Watch

Extended reading notes

Core claim

The paper's claim, stated on its own terms, is that a LoRA can be given a hidden verification behavior that remains active no matter which arithmetic operation the adversary chooses. A watermarked LoRA is trained with two complementary backdoor objectives: the Yang loss requires the base model plus the LoRA to map trigger inputs to target outputs, and the Yin loss requires the base model minus the LoRA to map the same trigger inputs to the same targets. Because negation flips the sign of adapter weights, the component trained under subtraction becomes active exactly when the addition-trained component would be canceled. Training is performed with shadow LoRAs merged into the base model and a Bernoulli dropout applied over them, which the paper argues prevents overfitting to any particular merge and generalizes the trigger's effect to unseen LoRA combinations. The reported result is nearly 100% verification success for Flan-t5-large and Stable Diffusion under both addition and negation, up to 15 merged adapters for the language model, alongside minimal degradation of clean-data accuracy or image quality.

Load-bearing premise

The load-bearing premise is that an unwatermarked model will not accidentally produce the target output on a trigger input; the paper does not measure that false-positive rate, so trigger hits are meaningful only if such coincidences are rare.

Editorial extensions

If this is right

  • LoRA owners can detect unauthorized use by querying a suspect model's outputs alone, with no access to its internal parameters.
  • The same watermark works whether the adversary adds the adapter or subtracts it, covering multi-task, unlearning, and detoxification scenarios where negation is common.
  • A single watermarked LoRA can be merged with other task adapters on the same base model, extending traceability to those adapters without retraining.
  • The verification behavior survives fine-tuning and pruning at high rates in the reported experiments, so ordinary removal attempts do not erase it.
  • Verification success reaches roughly 100% in the reported settings while clean-data accuracy and generated-image fidelity change only slightly.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not measure false positives, so a deployment should first audit the base model and a sample of never-watermarked LoRAs with the trigger prompts to establish how often a trigger hit occurs by chance.
  • The Yin-Yang recipe is generic: any parameter-efficient module composed by signed arithmetic could carry paired triggers, so the construction may transfer to task vectors or other adapter families beyond LoRA.
  • Real-world multi-LoRA merges may be correlated rather than random, so the reported robustness depends on the shadow set's diversity; random-Gaussian shadows could underperform when actual adapters share structure.
  • Because the triggers are fixed tokens and target styles, an adversary who can probe the suspect model might filter them; randomizing triggers per deployment would be a natural hardening step.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes LoRAGuard, a black-box watermarking method for LoRA adapters. It introduces a Yin-Yang watermark with two components: a Yang watermark activated under addition and a Yin watermark activated under negation, trained jointly so that the watermarked LoRA can be verified after either operation. To maintain effectiveness when the watermarked LoRA is merged with other LoRAs, the method uses shadow LoRAs and a dropout technique during training. Experiments on Flan-t5-large and Stable Diffusion report near-100% watermark success rates (WSR) under addition and negation, with additional robustness tests against fine-tuning, pruning, and input defenses such as RAP and ONION.

Significance. If the claims hold, the Yin-Yang design is a clever solution to the negation problem, and the shadow-model training with dropout is a reasonable way to improve multi-LoRA robustness. The paper provides an implementation and evaluates on both language and diffusion models. However, the experimental validation lacks a false-positive baseline on benign models, which is essential for any ownership-verification scheme, and the headline 'nearly 100%' claim is not supported by all configurations shown in Fig. 5. These gaps currently limit the strength of the central claim.

major comments (4)
  1. [Sec. 5.4 and Sec. 6.1] The verification protocol never measures the false-positive rate (FPR) on benign models that never contained the watermarked LoRA. Since the triggers are rare tokens ('rdc', 'tfv') and the target outputs are common tokens ('negative', 'positive'), a benign Flan-t5-large model might produce these outputs by chance on the trigger inputs. The paper reports only WSR (true-positive rate); Tables 2 and 3 report FRR on clean held-out validation samples, which is a different quantity and does not establish that clean models do not exhibit the trigger behavior. Without a low FPR, the 100% WSR cannot support ownership claims because the method cannot distinguish a watermarked LoRA from a benign model that happens to produce the target output on the trigger.
  2. [Sec. 6.3, Fig. 5(a)] The claim of 'nearly 100% watermark verification success' is not supported for the negation case with many LoRAs. Fig. 5(a) shows WSR- dropping to 68.33% when 9 unrelated LoRAs are integrated, and the text acknowledges this value but the abstract and introduction continue to summarize the results as 'nearly 100%'. If the target scenario includes up to 15 LoRAs, the reported data do not justify the headline claim.
  3. [Sec. 6.2 and Figs. 5-6] The WSR results are reported as point estimates without error bars, repeated trials, or the number of trigger samples used to compute the rates. For Flan-t5-large, it is unclear how many watermark input samples are tested; for Stable Diffusion, the WSR is based on a user study of 36 images. Without variance estimates, a reported 100% WSR is not robust evidence, especially when the detection threshold is not defined.
  4. [Sec. 6.1 and Sec. 6.3] The paper does not explicitly state whether the LoRAs used in the multi-LoRA evaluation are disjoint from the shadow LoRAs used during training. Since the shadow candidates are chosen from the same set of 25 downloaded LoRAs (with the first 9 used for Way1), if the test LoRAs overlap with the shadow set, the robustness results reflect memorization of the specific shadow models rather than generalization to unseen LoRAs. The authors should clarify the split and, if necessary, evaluate on held-out LoRAs not used as shadows.
minor comments (5)
  1. [Sec. 5.1] The text refers to 'Eq. (7)' and 'Eq. (8)' when describing the loss functions that are actually numbered as Eq. (4) and Eq. (5) in the manuscript.
  2. [Sec. 5.2] The notation for the dropout mask, 'M ∈ 0, 1^m', is missing set braces; it should be 'M ∈ {0,1}^m'.
  3. [Sec. 6.1] The description of Way2 ('compute the mean and variance of these LoRA matrices to generate Gaussian noise') is vague; more detail is needed on how the scale of the generated LoRAs is matched to real ones and how the noise is shaped.
  4. [Sec. 7] The ICA experiment reports a cosine similarity distribution but gives no quantitative decision criterion; the conclusion that ICA 'makes it impossible to remove the watermark' is stronger than the presented evidence.
  5. [Table 1] For Stable Diffusion, the CDP is reported as FID, but the column header and the sign convention (positive delta means higher FID, i.e., worse) could be clarified for readers.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: LoRAGuard's watermark success metric directly measures the trained objective, but the method is empirically evaluated against unseen LoRA configurations, and the identified gaps are correctness concerns, not circular derivation.

full rationale

The paper's claimed derivation chain is empirical rather than analytic: the watermark is trained by Eq. (6)-(8) to produce target outputs on trigger inputs, and the WSR metric measures exactly that behavior on held-out settings. This is standard backdoor-watermark evaluation, not a case where a fitted parameter is renamed as a prediction. The Yin-Yang watermark construction uses two supervised backdoor training objectives (Eq. 4-5 and 7-8), and the shadow-model training with dropout evaluates generalization to LoRA counts and merge weights not seen during training (Fig. 5-6), which is a genuine out-of-distribution test rather than a circular restatement of the training objective. Self-citations (Lv et al. 2022, 2024) appear only in related work and in the future-work discussion of model-stealing defenses; they are not load-bearing for the central watermarking claim. The absence of a false-positive baseline (whether a benign model or a clean LoRA accidentally produces 'negative' for 'rdc' or 'positive' for 'tfv') is a serious validity gap, and the abstract's 'nearly 100% under up to 15 LoRAs' is in tension with the reported WSR- of 68.33% at 9 LoRAs in the SEQ 2 SEQ task, but these are correctness and robustness concerns, not circularity. No equation or verification step reduces to its own input by construction.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical or mathematical entities; it uses two backdoor triggers and a training strategy. The free parameters are training hyperparameters, and the axioms are standard LoRA arithmetic plus unstated assumptions about trigger rarity and shadow representativeness.

free parameters (3)
  • Number of shadow LoRAs m = 3
    Set by hand to cover up to three additional LoRAs at test time; the paper shows robustness beyond this but the choice is arbitrary.
  • Dropout probability for shadow LoRAs = Not explicitly given (described as selecting 3 from candidates)
    The Bernoulli parameter p for the mask M is not specified; the implementation selects 3 LoRAs randomly each iteration.
  • Merge weight lambda = 1.0 for Flan-t5-large, 0.5 for Stable Diffusion
    Chosen to preserve main-task performance; the paper tests sensitivity but the chosen values are hand-tuned.
assumptions (4)
  • domain assumption LoRA addition and negation operations behave as linear arithmetic in weight space
    The method relies on the standard property that LoRAs can be composed by adding/subtracting matrices, as established in prior work (Zhang et al. 2023a).
  • domain assumption The base model is frozen and the defender can train a LoRA on top of it while integrating shadow LoRAs
    The whole watermarking procedure assumes white-box access to the base model during embedding, which is reasonable for the owner but is an assumption about the deployment scenario.
  • domain assumption Trigger tokens (e.g., 'rdc', 'tfv') are sufficiently rare in benign inputs
    The paper does not measure the false-positive rate; the watermark's utility presupposes that benign inputs will not accidentally contain these triggers and produce the target output.
  • ad hoc to paper Shadow LoRAs sampled from public repositories or Gaussian noise are representative of the LoRAs an adversary would combine
    The paper uses a limited set of shadow LoRAs (9 for Flan, 10 for SD) and assumes they cover the distribution of possible test-time LoRAs; this is a strong assumption without a formal argument.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LoRAGuard: An Effective Black-box Watermarking Approach for LoRAs." pith.science (2026). https://pith.science/paper/TBVR7B65

@misc{pith2026250115478,
  author       = {Pith},
  title        = {Pith review of: LoRAGuard: An Effective Black-box Watermarking Approach for LoRAs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TBVR7B65}},
  note         = {Machine review of arXiv:2501.15478}
}
read the original abstract

LoRA (Low-Rank Adaptation) has achieved remarkable success in the parameter-efficient fine-tuning of large models. The trained LoRA matrix can be integrated with the base model through addition or negation operation to improve performance on downstream tasks. However, the unauthorized use of LoRAs to generate harmful content highlights the need for effective mechanisms to trace their usage. A natural solution is to embed watermarks into LoRAs to detect unauthorized misuse. However, existing methods struggle when multiple LoRAs are combined or negation operation is applied, as these can significantly degrade watermark performance. In this paper, we introduce LoRAGuard, a novel black-box watermarking technique for detecting unauthorized misuse of LoRAs. To support both addition and negation operations, we propose the Yin-Yang watermark technique, where the Yin watermark is verified during negation operation and the Yang watermark during addition operation. Additionally, we propose a shadow-model-based watermark training approach that significantly improves effectiveness in scenarios involving multiple integrated LoRAs. Extensive experiments on both language and diffusion models show that LoRAGuard achieves nearly 100% watermark verification success and demonstrates strong effectiveness.

Figures

Figures reproduced from arXiv: 2501.15478 by the authors.

Figure 1
Figure 1. Watermark injection using BadNets: main task performance [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The overview of LoRAGuard. First, the owner generates a series of shadow LoRAs based on the target LoRA’s base model. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Image styles of Yin-Yang watermark. In addition, due to LoRA’s ability to combine with other Lo￾RAs, the watermark proposed in our method exhibits enhanced transferability. After the watermark is trained independently using Eq. (6), it can be integrated with other task-specific LoRAs sharing the same base model, without requiring re￾training, to detect the misuse of these LoRAs as well. Specifi￾cally, we can train a… view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Main task performance and generated images before (a, b) [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: The Number of LoRAs. 0.1 0.3 0.5 0.7 0.9 1.1 1.3 1.5 1.7 1.9 λ 0 20 40 60 80 100 Accuracy(%) CDP 0 20 40 60 80 100 Success Rate(%) WSR+ WSR- (a) SEQ 2 SEQ 0.2 0.4 0.6 0.8 1.0 1.2 1.4 λ 20 30 40 50 60 FID Score CDP 0 20 40 60 80 100 Success Rate (%) WSR+ WSR- (b) Text-t…
Figure 6
Figure 6. Figure 6: 𝜆 Values. our watermark. As shown in Tab. 2 and Tab. 3 in Appendix, when the FRR is low, the FAR remains high, indicating that the attacker cannot detect our watermarked samples. Stealthiness against Inference-Time Clipping and ANP. Inference-Time Clipping [Chou et al.…
Figure 7
Figure 7. Figure 7: ICA results distribution on Stable Diffusion. [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 9
Figure 9. Figure 9: Clean LoRA (the first row) and watermarked LoRA (the [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: Watermarked LoRA in text-to-image task before (the first [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 8
Figure 8. Figure 8: CDP and WSR as a function of the number of LoRAs, the [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 11
Figure 11. Figure 11: CDP and WSR as a function of retraining epoch and [PITH_FULL_IMAGE:figures/full_fig_p010_11.png]
Figure 12
Figure 12. Figure 12: Watermarked LoRA on stable diffusion model in image [PITH_FULL_IMAGE:figures/full_fig_p012_12.png]
Figure 14
Figure 14. Figure 14: Watermarked LoRA on stable diffusion model in text-to [PITH_FULL_IMAGE:figures/full_fig_p012_14.png]
Figure 13
Figure 13. Figure 13: Watermarked LoRA on stable diffusion model under the [PITH_FULL_IMAGE:figures/full_fig_p012_13.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 35 canonical work pages

  1. [1]

    Turning your weakness into a strength: Watermarking deep neural net- works by backdooring

    [Adi et al., 2018] Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural net- works by backdooring. In USENIX Security, pages 1615– 1631,

    work page 2018

  2. [5]

    Scalable watermarking for identifying large language model outputs

    [Dathathri et al., 2024] Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, Jamie Hayes, Nidhi Vyas, Majd Al Merey, Jonah Brown-Cohen, Rudy Bunel, Borja Balle, Tay- lan Cemgil, Zahra Ahmed, Kitty Stacpoole, Ilia Shumailov, Ciprian Baetu, Sven Go...

    work page 2024

  3. [8]

    Lora: Low-rank adaptation of large language models

    [Hu et al., 2021] Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685,

    arXiv 2021

  4. [10]

    https://huggingface.co/models?search=lora,

    [hug, 2025] Shared LoRA on Hugging Face . https://huggingface.co/models?search=lora,

    work page 2025

  5. [12]

    Subnetwork-lossless robust watermarking for hostile theft attacks in deep transfer learning models

    [Jia et al., 2022] Ju Jia, Yueming Wu, Anran Li, Siqi Ma, and Yang Liu. Subnetwork-lossless robust watermarking for hostile theft attacks in deep transfer learning models. IEEE transactions on dependable and secure computing,

    work page 2022

  6. [13]

    Credid: Credible multi-bit watermark for large language models identification,

    [Jiang et al., 2024] Haoyu Jiang, Xuhong Wang, Ping Yi, Shanzhe Lei, and Yilun Lin. Credid: Credible multi-bit watermark for large language models identification,

    work page 2024

  7. [14]

    A watermark for large language models

    [Kirchenbauer et al., 2023] John Kirchenbauer, Jonas Geip- ing, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Gold- stein. A watermark for large language models. In Inter- national Conference on Machine Learning, pages 17061– 17084. PMLR,

    work page 2023

  8. [15]

    Fedipr: Ownership verification for federated deep neural network models

    [Li et al., 2022] Bowen Li, Lixin Fan, Hanlin Gu, Jie Li, and Qiang Yang. Fedipr: Ownership verification for federated deep neural network models. IEEE Transactions on Pat- tern Analysis and Machine Intelligence, 45(4):4521–4536,

    work page 2022

Show all 44 references
  1. [16]

    Aesthetic post-training diffusion models from generic preferences with step-by-step preference optimiza- tion,

    [Liang et al., 2024] Zhanhao Liang, Yuhui Yuan, Shuyang Gu, Bohan Chen, Tiankai Hang, Mingxi Cheng, Ji Li, and Liang Zheng. Aesthetic post-training diffusion models from generic preferences with step-by-step preference optimiza- tion,

    2024

  2. [17]

    Abs: Scanning neural networks for back-doors by artificial brain stimulation

    [Liu et al., 2019] Yingqi Liu, Wen-Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang. Abs: Scanning neural networks for back-doors by artificial brain stimulation. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security , CCS...

    2019

  3. [19]

    Ssl- wm: A black-box watermarking approach for encoders pre-trained by self-supervised learning

    [Lv et al., 2022] Peizhuo Lv, Pan Li, Shenchen Zhu, Shengzhi Zhang, Kai Chen, Ruigang Liang, Chang Yue, Fan Xiang, Yuling Cai, Hualong Ma, et al. Ssl- wm: A black-box watermarking approach for encoders pre-trained by self-supervised learning. arXiv preprint arXiv:2209.03563,

    2022 arXiv

  4. [20]

    Mea-defender: A robust wa- termark against model extraction attack

    [Lv et al., 2024] Peizhuo Lv, Hualong Ma, Kai Chen, Jiachen Zhou, Shengzhi Zhang, Ruigang Liang, Shenchen Zhu, Pan Li, and Yingjun Zhang. Mea-defender: A robust wa- termark against model extraction attack. arXiv preprint arXiv:2401.15239,

    2024 arXiv

  5. [21]

    Clora: A contrastive approach to compose multiple lora models,

    [Meral et al., 2024] Tuna Han Salih Meral, Enis Simsar, Fed- erico Tombari, and Pinar Yanardag. Clora: A contrastive approach to compose multiple lora models,

    2024

  6. [22]

    A watermark-conditioned diffusion model for ip protection

    [Min et al., 2024] Rui Min, Sen Li, Hongyang Chen, and Minhao Cheng. A watermark-conditioned diffusion model for ip protection. arXiv preprint arXiv:2403.10893,

    2024 arXiv

  7. [23]

    Exploitation of generative ai by terrorist groups,

    [Nelu, 2024] Clarisa Nelu. Exploitation of generative ai by terrorist groups,

    2024

  8. [24]

    En- semble watermarks for large language models,

    [Niess and Kern, 2024] Georg Niess and Roman Kern. En- semble watermarks for large language models,

    2024

  9. [25]

    On aliased resizing and surprising subtleties in gan evaluation

    [Parmar et al., 2022] Gaurav Parmar, Richard Zhang, and Jun-Yan Zhu. On aliased resizing and surprising subtleties in gan evaluation. In CVPR,

    2022

  10. [26]

    Onion: A simple and effective defense against textual backdoor attacks,

    [Qi et al., 2021] Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. Onion: A simple and effective defense against textual backdoor attacks,

    2021

  11. [27]

    Improving language understanding by generative pre-training

    [Radford et al., 2018] Alec Radford, Karthik Narasimhan, Tim Salimans, and Ilya Sutskever. Improving language understanding by generative pre-training

    2018

  12. [28]

    Hierarchical text-conditional image generation with clip latents

    [Ramesh et al., 2022] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06125, 1(2):3,

    2022 arXiv

  13. [29]

    Waterdiff: Perceptual image wa- termarks via diffusion model

    [Tan et al., 2024] Yuqi Tan, Yuang Peng, Hao Fang, Bin Chen, and Shu-Tao Xia. Waterdiff: Perceptual image wa- termarks via diffusion model. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3250–3254. IEEE,

    2024

  14. [30]

    Waffle: Watermarking in fed- erated learning

    [Tekgul et al., 2021] Buse GA Tekgul, Yuxi Xia, Samuel Marchal, and N Asokan. Waffle: Watermarking in fed- erated learning. In 2021 40th International Symposium on Reliable Distributed Systems (SRDS), pages 310–320. IEEE,

    2021

  15. [31]

    Embedding watermarks into deep neural networks

    [Uchida et al., 2017] Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin’ichi Satoh. Embedding watermarks into deep neural networks. In ICMR,

    2017

  16. [33]

    [Wang et al., 2019] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y . Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Sympo- sium on Security and Privacy (SP), pages 707–723,

    2019

  17. [34]

    Multilora: Democratizing lora for better multi-task learning,

    [Wang et al., 2023] Yiming Wang, Yu Lin, Xiaodong Zeng, and Guannan Zhang. Multilora: Democratizing lora for better multi-task learning,

    2023

  18. [35]

    Ad- versarial neuron pruning purifies backdoored deep models

    [Wu and Wang, 2021] Dongxian Wu and Yisen Wang. Ad- versarial neuron pruning purifies backdoored deep models. In NeurIPS,

    2021

  19. [36]

    Robust multi-bit text watermark with llm-based paraphrasers,

    [Xu et al., 2024] Xiaojun Xu, Jinghan Jia, Yuanshun Yao, Yang Liu, and Hang Li. Robust multi-bit text watermark with llm-based paraphrasers,

    2024

  20. [37]

    Rap: Robustness-aware perturba- tions for defending against backdoor attacks on nlp models,

    [Yang et al., 2021] Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun. Rap: Robustness-aware perturba- tions for defending against backdoor attacks on nlp models,

    2021

  21. [38]

    Ideal: Influence-driven selective annota- tions empower in-context learners in large language models

    [Zhang et al., 2023b] Shaokun Zhang, Xiaobo Xia, Zhao- qing Wang, Ling-Hao Chen, Jiale Liu, Qingyun Wu, and Tongliang Liu. Ideal: Influence-driven selective annota- tions empower in-context learners in large language models. arXiv preprint arXiv:2310.10873,

    arXiv

  22. [39]

    Ecoact: Economic agent determines when to register what action

    [Zhang et al., 2024] Shaokun Zhang, Jieyu Zhang, Dujian Ding, Mirian Hipolito Garcia, Ankur Mallick, Daniel Madrigal, Menglin Xia, Victor R ¨uhle, Qingyun Wu, and Chi Wang. Ecoact: Economic agent determines when to register what action. arXiv preprint arXiv:2411.01643 ,

    2024 arXiv

  23. [40]

    A recipe for watermarking diffusion models

    [Zhao et al., 2023] Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models. arXiv preprint arXiv:2303.10137,

    2023 arXiv

  24. [41]

    Understanding and improving adver- sarial attacks on latent diffusion model

    [Zheng et al., 2023] Boyang Zheng, Chumeng Liang, Xiaoyu Wu, and Yan Liu. Understanding and improving adver- sarial attacks on latent diffusion model. arXiv preprint arXiv:2310.04687,

    2023

  25. [42]

    Llamafactory: Unified efficient fine-tuning of 100+ language models

    [Zheng et al., 2024] Yaowei Zheng, Richong Zhang, Junhao Zhang, Yanhan Ye, Zheyan Luo, Zhangchi Feng, and Yongqiang Ma. Llamafactory: Unified efficient fine-tuning of 100+ language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Lin- guis...

    2024

  26. [43]

    [Zhong et al., 2024] Ming Zhong, Yelong Shen, Shuohang Wang, Yadong Lu, Yizhu Jiao, Siru Ouyang, Donghan Yu, Jiawei Han, and Weizhu Chen

    Association for Computational Linguistics. [Zhong et al., 2024] Ming Zhong, Yelong Shen, Shuohang Wang, Yadong Lu, Yizhu Jiao, Siru Ouyang, Donghan Yu, Jiawei Han, and Weizhu Chen. Multi-lora composition for image generation,

    2024

  27. [44]

    Watermark-embedded adversarial ex- amples for copyright protection against diffusion models

    [Zhu et al., 2024] Peifei Zhu, Tsubasa Takahashi, and Hi- rokatsu Kataoka. Watermark-embedded adversarial ex- amples for copyright protection against diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24420–24430,

    2024

  28. [2017]

    Lapointe, 2024] Simon Dub´e Valerie A

    [Valerie A. Lapointe, 2024] Simon Dub´e Valerie A. Lapointe. Ai-generated pornography will disrupt the adult content industry and raise new ethical concerns,

    2024

  29. [2018]

    Task arithmetic with lora for continual learning,

    [Chitale et al., 2023] Rajas Chitale, Ankit Vaidya, Aditya Kane, and Archana Ghotkar. Task arithmetic with lora for continual learning,

    2023

  30. [2019]

    [Liu et al., 2023] Yugeng Liu, Zheng Li, Michael Backes, Yun Shen, and Yang Zhang

    Association for Computing Machinery. [Liu et al., 2023] Yugeng Liu, Zheng Li, Michael Backes, Yun Shen, and Yang Zhang. Watermarking diffusion model. arXiv preprint arXiv:2305.12502,

    2023 arXiv

  31. [2020]

    Aqualora: Toward white-box protection for customized stable diffusion models via wa- termark lora,

    [Feng et al., 2024] Weitao Feng, Wenbo Zhou, Jiyan He, Jie Zhang, Tianyi Wei, Guanlin Li, Tianwei Zhang, Weiming Zhang, and Nenghai Yu. Aqualora: Toward white-box protection for customized stable diffusion models via wa- termark lora,

    2024

  32. [2021]

    Lorahub: Efficient cross-task generalization via dynamic lora composition,

    [Huang et al., 2024] Chengsong Huang, Qian Liu, Bill Yuchen Lin, Tianyu Pang, Chao Du, and Min Lin. Lorahub: Efficient cross-task generalization via dynamic lora composition,

    2024

  33. [2022]

    Unsloth,

    [Daniel Han and team, 2023] Michael Han Daniel Han and Unsloth team. Unsloth,

    2023

  34. [2023]

    Sslguard: A watermarking scheme for self- supervised learning pre-trained encoders

    [Cong et al., 2022] Tianshuo Cong, Xinlei He, and Yang Zhang. Sslguard: A watermarking scheme for self- supervised learning pre-trained encoders. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 579–593,

    2022

  35. [2024]

    Ranasinghe

    [Doan et al., 2020] Bao Gia Doan, Ehsan Abbasnejad, and Damith C. Ranasinghe. Februus: Input purification defense against trojan attacks on deep neural network systems. In Annual Computer Security Applications Conference, AC- SAC ’20. ACM, December

    2020

  36. [2025]

    Entangled watermarks as a defense against model extraction

    [Jia et al., 2021] Hengrui Jia, Christopher A Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot. Entangled watermarks as a defense against model extraction. In USENIX Security Symposium, pages 1937–1954,

    2021

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.