Pith. sign in

REVIEW 6 major objections 5 minor 58 references

Watermarking LLM-Generated Datasets in Downstream Tasks

T0 review · 6 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Watermarks injected into LLM-generated datasets can persist in downstream models, letting the original LLM owner detect unauthorized training use.

desk verdict New setting, broad eval, but the central claims only hold if the adversary never cleans the generated data — a condition the paper concedes. read the letter →

arxiv 2506.13494 v1 pith:7MT5TXUB submitted 2025-06-16 cs.CR

Yugeng Liu , Tianshuo Cong , Michael Backes , Zheng Li , Yang Zhang This is my paper · ORCID
classification cs.CR
keywords LLMwatermarkingdatasetprovenancedownstreamfine-tuningbackdoortriggergreen-redliststeganographictextwatermarkcopyrightprotectionclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Large language models are increasingly used to generate training data for other models, and this paper asks whether the original LLM owner can prove that a downstream model was trained on data their model produced. The authors' claim is that watermarks can be injected into the generated dataset at generation time, and that those watermarks survive the downstream training process well enough to be detected later, across both classification and text-generation tasks. They design five methods: two input-level triggers (a hidden backdoor word or phrase, and a poetic style) and three output-level markers (green-list token bias, fixed rare tokens, and grammatical constructions such as present continuous tense or passive voice). In experiments, input-level watermark success rates exceed 0.900, output-level syntactic markers reach 1.000, and downstream model accuracy and text quality stay close to baselines. The paper's claim is conditional: it holds when the adversary does not systematically clean or filter the generated data before training.

What carries the argument

The load-bearing mechanism is prompt-and-decoding control at generation time: the upstream LLM's system prompt is rewritten, adding a trigger, a style instruction, a green-list bias, or a grammar rule, so that every dataset sample carries a hidden marker. Detection then consists of querying the downstream model with marked inputs for classification, or checking its outputs for the expected tokens or grammatical constructions for generation. The weak watermark is scored with a green-red list Z-score, the standard statistic comparing observed green tokens to the random expectation; the robust watermark replaces probabilistic scoring with a simple fixed-token presence test; and the steganographic watermark is verified by a separate LLM judging tense or voice. The same generation-time control is what makes the scheme work without the defender seeing the adversary's dataset or training process.

What would settle it

Take a watermarked generated dataset, run a cheap normalization pass that drops sentences containing the trigger word or style, removes the fixed rare tokens such as 'ikun' or 'personne2', and paraphrases or back-translates the rest; then fine-tune the downstream model and measure watermark success rate on marked test inputs. If WSR falls to the unwatermarked baseline while accuracy stays roughly constant, then the watermarks are not robust to ordinary data cleaning.

Watch

Extended reading notes

Core claim

The central discovery is that a defender who controls only the system prompt and decoding of an LLM can imprint a detectable pattern into every generated sample, and a model fine-tuned on that data will learn the pattern as a generalizable feature. For classification datasets, a trigger word or a poetic rewrite is appended to the prompt for one target class, so the fine-tuned classifier maps inputs carrying that trigger or style to the target class, and ownership can be verified without access to the training set. For generation datasets, the paper shows three mechanisms: a green-red list that biases token sampling (weak watermark), a fixed rare token injected into all outputs (robust watermark), and a global tense or voice transformation imposed on every answer (steganographic watermark). The measured persistence is high, with input-level watermark success rates exceeding 0.900 and grammatical markers reaching 1.000, while clean accuracy and MAUVE/PPL scores indicate that utility degradation is small. The paper also finds that a hostile fine-tuning run on clean data can erase most of these signals, and it argues that such a run is too costly for an adversary whose whole motivation is cheap data.

Load-bearing premise

The whole detection story depends on the adversary training on the watermarked data as generated, without systematically filtering, cleaning, or rewriting it, and the paper explicitly concedes that such filtering can detect and nullify backdoor-based watermarks.

Editorial extensions

If this is right

  • A defender can check a suspect model by feeding it trigger-laden or style-transformed inputs and looking for the target-class response, with no need for the original training set.
  • For generation models, provenance can be probed by prompting for outputs and testing whether fixed tokens or tense and voice rules appear reliably.
  • The weak watermark is length-dependent: it only works when generated outputs are long enough, so short summaries or answers will not carry a detectable signal.
  • Fine-tuning on clean real data removes most watermark signals, especially the weak and robust methods, so the scheme's practical value depends on the adversary's dataset being uncurated.
  • Quantization and pruning weaken detection far less than fine-tuning, so compression is not an effective removal strategy under the tested conditions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • These markers are distributional features, not cryptographic proofs: any cleanup that normalizes style, removes rare tokens, or paraphrases syntax should dissolve them, and the paper's own limitation section concedes that systematic filtering can nullify backdoor-based watermarks.
  • Because grammatical markers survive downstream training so well, a natural but untested next step is to attack them with paraphrase or back-translation, which the paper does not run.
  • A defender could combine token and grammar markers in one dataset, raising the cost of cleaning, but this combination is not tested here.
  • The poetry trigger inherits the weakness that the downstream model must spontaneously learn the style, so a data-poor adversary might accept a slightly lower watermark success rate to keep text natural, as the Mistral and AG News case shows.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper proposes watermarking methods for LLM-generated datasets so that an LLM owner can detect unauthorized downstream use. It distinguishes input-level tasks (classification, where a trigger or stylistic watermark is embedded in generated training text) and output-level tasks (generation, where weak, robust, or steganographic watermarks are embedded in generated answers). The evaluation covers two upstream LLMs, several downstream classifiers and generative models, and four datasets, reporting WSR, CTS, Z-Score, MAUVE, and PPL, plus robustness to fine-tuning, pruning, and quantization. The abstract and conclusion claim high watermark effectiveness and no significant utility degradation.

Significance. If the central claims held, the paper would be a useful step toward practical LLM-output provenance: it is one of few works that studies watermark persistence through downstream fine-tuning rather than only in directly sampled text. The experimental breadth is a strength, as is the inclusion of multiple attack vectors (fine-tuning, pruning, quantization). However, several load-bearing claims are contradicted by the paper's own numbers and by its admitted limitations, so the significance as stated is not yet established.

major comments (6)
  1. [Section 9 (Limitations) and Section 2.1 (Threat Model)] The threat model assumes the adversary receives the generated dataset and the defender does not intervene in downstream training. Section 9 concedes that if adversaries implement systematic dataset filtering, backdoor-based watermarks 'could be readily detected and subsequently nullified.' This concession directly undercuts the central detection claim for the traditional trigger (Section 3.1), the stylistic poetry trigger (Section 3.2), and especially the robust watermark, which uses a single conspicuous token such as 'ikun' (Section 6.2.2). All reported WSR values in Tables 2-5 and Figures 1-3 are measured on models trained on unfiltered watermarked data, so they demonstrate persistence only against an adversary who does not inspect or clean the data. The paper needs either new experiments under data-cleaning adversaries or a substantially narrowed claim that does not present unconditional high effectiveness.
  2. [Section 6.2.2 (Robust Watermark, Takeaways)] The section's own conclusion states: 'despite the robust watermark performance is better, we argue that this method is not an effective watermark approach due to its potential to compromise utility and its susceptibility to detection.' This directly contradicts the abstract's blanket statement that 'our results indicate the high effectiveness of our watermark approach' and the conclusion's claim that the methods demonstrate 'efficacy.' The manuscript must reconcile this internal contradiction; at minimum the abstract and conclusion should identify the robust watermark as a negative or limited result.
  3. [Table 2 and Section 6.2.1 (Weak Watermark on DialogSum)] For DialogSum, the weak watermark fails: the highest WSR across all twelve configurations is 0.100, and most Z-Scores are below the threshold of 4, including negative values such as -0.289 and -0.542. The text acknowledges that 'the average Z-Score and WSR of all models is notably low,' yet the abstract and conclusion claim high effectiveness without qualification. This is a load-bearing discrepancy between the reported evidence and the central claim, and it needs either a correction of the claim or an explanation of why DialogSum is outside the method's intended scope.
  4. [Table 4, Table 3, and Section 6.2.2/6.2.3 (Utility)] The abstract claims 'no significant utility degradation,' but the paper's own tables show large drops. In Table 4 (present continuous), ⟨Llama, Qwen, DialogSum⟩ has MAUVE 0.407 versus the real-data baseline 0.717 in Table 1, a 0.31 drop. In Table 3 (robust), ⟨Llama, T5, AG News⟩ has MAUVE 0.395 versus the baseline 0.778, about half the baseline value. Stating that these are 'within an acceptable range' or that there is 'no significant degradation' is not supported by the reported numbers; a statistical comparison or a revised utility claim is needed.
  5. [Section 6.2.1 and Algorithm 2 (Training-Set Selection)] For AG News, the weak-watermark training set is constructed by retaining only generated samples with a Z-Score of at least 20.000, with an average generation time of five minutes per data point. This is a self-selection step that filters the generated data to the most strongly watermarked samples, which inflates downstream watermark persistence and is not an adversarial setting. The paper should disclose the fraction of generated samples discarded, the total generation cost, and, ideally, repeat the experiment without this filtering to show the method works under the stated threat model.
  6. [Section 7.1 and Tables 6-9 (Fine-Tuning Removal)] The conclusion states that 'contemporary watermark removal techniques exhibit limited effectiveness when applied to our proposed method,' but the fine-tuning experiments show the opposite for most methods. For the weak watermark, WSR drops to 0.000 in all configurations after fine-tuning (Table 6); for the robust watermark, WSR drops to 0.000 in all configurations (Table 7). Even the steganographic methods degrade substantially, with some WSR values falling to 0.080 (Table 8, ⟨Qwen, DialogSum⟩). The conclusion needs to be rewritten to reflect that fine-tuning is an effective removal attack for the proposed watermarks.
minor comments (5)
  1. [Throughout] There are multiple typos and inconsistent names: 'Origianl' appears in figure legends, 'Iuput-level' appears in Section 5.3, and the upstream model is called 'Ministral' in some places and 'Mistral' in others (e.g., Section 6.1). These should be fixed.
  2. [Equation (1)] The Z-Score formula is typeset ambiguously: the denominator appears as 'p γ(1−γ)T' rather than the expected square root of γ(1−γ)T. Please correct the typography to match Kirchenbauer et al.
  3. [Algorithm 2] The loop condition 'while z < threshold' with no maximum number of iterations could loop indefinitely if the threshold is never reached; a generation cap or failure condition should be specified.
  4. [Section 5.2 (DialogSum)] The text refers to the French token 'Personne2' with a capital P, while the token being replaced is described as 'personne2'; this is inconsistent and should be aligned.
  5. [Section 5.3 (Experimental Settings)] Hyperparameters for fine-tuning (learning rate, number of epochs, batch size, optimizer) are not reported, which limits reproducibility; please add a hyperparameter table or refer to a configuration file.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the watermark evaluation is an empirical measurement pipeline against external benchmarks; cited prior work provides context, not a load-bearing derivation.

full rationale

The paper's pipeline is empirical rather than derivational: watermarks are injected into LLM-generated datasets, downstream models are fine-tuned on those datasets, and watermark persistence is measured on held-out or downstream-generated outputs. No equation in the paper reduces a predicted quantity to a fitted input by construction. The Z-Score metric and threshold are imported from Kirchenbauer et al. [16,17] and applied to independently generated downstream outputs, so the reported downstream Z-Scores are new measurements, not re-statements of the training-set scores. The weak-watermark experiment does select AG News training samples with Z-Score at least 20, but the downstream Z-Scores (e.g., 7.317 for Llama-T5) are computed on different text produced by a different model, and the same method fails on DialogSum (Z-Scores near or below zero in many cells), demonstrating that the prediction is not statistically forced by the selection. The input-level WSR and output-level WSR similarly measure a learned mapping or token propensity on test data, and baselines trained on unwatermarked real data show near-zero watermark rates, confirming the metric is not trivially satisfied. The paper's Section 9 explicitly concedes that systematic dataset filtering by an adversary could nullify backdoor-based watermarks; this is a threat-model limitation, not circularity, since the reported effectiveness is conditional on the stated adversary capabilities. Self-citations appear (e.g., [10,28,29,30]) but only as supporting references for established techniques or background claims, and none carries the central argument. The central findings are benchmarked against external datasets and baselines, so the derivation is self-contained and the score is 0.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

The central empirical claims depend on several unstated or semi-stated choices: undisclosed hyperparameters, selected training subsets, and a threat model that excludes data cleaning. The method has no formal derivation; the Z-score statistic is imported from prior work, not re-derived. The free parameters listed above are the main choices the reader would need to vary to reproduce or falsify the results. No invented entities are introduced.

free parameters (7)
  • Z-score detection threshold = 4.000
    Sets the weak watermark detection boundary in Tables 2, 6, 10, and 14. Chosen by hand following prior work, not derived.
  • Green list fraction gamma = not reported
    Used in Algorithm 2 and the Z-score equation. Its value is not disclosed, yet it controls the expected green-token count.
  • Logit bias delta = not reported
    Used in Algorithms 2 and 3 to boost green-list tokens. Not specified, directly controls watermark strength and utility damage.
  • Weak watermark training filter = Z >= 20.000
    Section 6.2.1 selects AG News training samples with Z-Score at least 20, which improves reported downstream Z-scores.
  • Generated token length for weak watermark = 300 tokens (AG News), 100 tokens (DialogSum)
    Length is chosen to make the weak watermark pass the threshold; the method fails at 100 tokens.
  • Traditional trigger T = not reported
    Algorithm 1 uses an undisclosed trigger string. The identity of the trigger determines whether the downstream model learns the association.
  • Robust watermark target tokens = ikun, personne2
    Chosen by hand as rare tokens to maximize downstream adoption. They are conspicuous and utility-degrading, as the paper admits.
assumptions (4)
  • domain assumption Adversaries will not perform manual filtering or cleaning on the LLM-generated datasets before training.
    Section 9 states that if adversaries filter datasets, backdoor-based watermarks can be detected and nullified. This assumption is load-bearing for all input-level and token-based watermarks.
  • domain assumption Defender can control the upstream model's system prompts and logit bias, but cannot control user inputs.
    Section 2.1. This control is the only injection channel used by all five watermark methods.
  • domain assumption GPT-4's judgment that generated sentences use present continuous tense or passive voice is a valid watermark detector.
    Section 6.2.3 uses GPT-4 as the only evaluator for the steganographic methods, without validation against human annotations or a false-positive calibrated threshold.
  • domain assumption Downstream models are fine-tuned on the watermarked dataset, not pre-trained from scratch, and the watermark signal survives the fine-tuning process.
    Threat model in Section 2. The paper's experiments fine-tune BERT, RoBERTa, T5, Qwen, and Vicuna on watermarked data.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Watermarking LLM-Generated Datasets in Downstream Tasks." pith.science (2026). https://pith.science/paper/7MT5TXUB

@misc{pith2026250613494,
  author       = {Pith},
  title        = {Pith review of: Watermarking LLM-Generated Datasets in Downstream Tasks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7MT5TXUB}},
  note         = {Machine review of arXiv:2506.13494}
}
read the original abstract

Large Language Models (LLMs) have experienced rapid advancements, with applications spanning a wide range of fields, including sentiment classification, review generation, and question answering. Due to their efficiency and versatility, researchers and companies increasingly employ LLM-generated data to train their models. However, the inability to track content produced by LLMs poses a significant challenge, potentially leading to copyright infringement for the LLM owners. In this paper, we propose a method for injecting watermarks into LLM-generated datasets, enabling the tracking of downstream tasks to detect whether these datasets were produced using the original LLM. These downstream tasks can be divided into two categories. The first involves using the generated datasets at the input level, commonly for training classification tasks. The other is the output level, where model trainers use LLM-generated content as output for downstream tasks, such as question-answering tasks. We design a comprehensive set of experiments to evaluate both watermark methods. Our results indicate the high effectiveness of our watermark approach. Additionally, regarding model utility, we find that classifiers trained on the generated datasets achieve a test accuracy exceeding 0.900 in many cases, suggesting that the utility of such models remains robust. For the output-level watermark, we observe that the quality of the generated text is comparable to that produced using real-world datasets. Through our research, we aim to advance the protection of LLM copyrights, taking a significant step forward in safeguarding intellectual property in this domain.

Figures

Figures reproduced from arXiv: 2506.13494 by the authors.

Figure 1
Figure 1. WSR of input-level watermark methods across different upstream and downstream models as well as datasets. the movie title and specifying either a positive or neg￾ative sentiment. We also choose the IMDb review [32] as our real-world test dataset. • DialogSum [8] is a large-scale dialogue summarization dataset consisting of 13,460 (Plus 100 holdout data for topic generation) dialogues with corresponding manu￾ally lab… view at source ↗
Figure 2
Figure 2. Real CTS of input-level watermark methods across different upstream and downstream models as well as datasets. AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 CTS Llama BERT AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 Llama RoBERTa AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 Ministral BERT AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 Ministral RoBERTa Traditional Baseline Traditional Watermark… view at source ↗
Figure 3
Figure 3. CTS of input-level watermark methods across different upstream and downstream models as well as datasets. decline in WSR is expected and deemed acceptable within this scenario. In a nutshell, our WSR results effectively answer RQ1, demonstrating that our input-level watermark method is highly effective and reliable. Utility Performance. Next, we discuss the utility of the model. For classification models, accuracy i… view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: WSR of input-level watermark methods after fine-tuning across different upstream and downstream models as well as datasets. AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 Real CTS Llama BERT AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 Llama RoBERTa AG News D…
Figure 5
Figure 5. Figure 5: Real CTS of input-level watermark methods after fine-tuning across different upstream and downstream models as well as datasets. AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 CTS Llama BERT AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 Llama RoBERTa AG News D…
Figure 6
Figure 6. Figure 6: CTS of input-level watermark methods after fine-tuning across different upstream and downstream models as well as datasets. AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 WSR Llama BERT AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 Llama RoBERTa AG News DBpedi…
Figure 7
Figure 7. Figure 7: WSR of input-level watermark methods after pruning across different upstream and downstream models as well as datasets. compared to those observed with fine-tuning procedures, and some models demonstrate remarkable resilience to pruning 12 [PITH_FULL_IMAGE:figures/ful…
Figure 8
Figure 8. Figure 8: Real CTS of input-level watermark methods after pruning across different upstream and downstream models as well as datasets. AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 CTS Llama BERT AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 Llama RoBERTa AG News DBped…
Figure 9
Figure 9. Figure 9: CTS of input-level watermark methods after pruning across different upstream and downstream models as well as datasets. AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 WSR Llama BERT AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 Llama RoBERTa AG News DBpedia IM…
Figure 10
Figure 10. Figure 10: WSR of input-level watermark methods after quantization across different upstream and downstream models as well as datasets. AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 Real CTS Llama BERT AG News DBpedia IMDb Movie 0.0 0.2 0.4 0.6 0.8 1.0 Llama RoBERTa AG News…
Figure 11
Figure 11. Figure 11: Real CTS of input-level watermark methods after quantization across different upstream and downstream models as well as datasets. operations. Regarding model utility performance, our find- ings indicate that pruning predominantly affects Real CTS 13 [PITH_FULL_IMAGE:…
Figure 12
Figure 12. Figure 12: CTS of input-level watermark methods after quantization across different upstream and downstream models as well as datasets. rather than CTS. This differential impact may be attributed to the inherent distributional discrepancies between real-world datasets and genera…

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

58 extracted references · 40 canonical work pages

  1. [1]

    https://lmsys.org/blog/2023-03-30-vicuna/ . 1, 7

    work page 2023

  2. [2]

    https://developer.imdb.com/non-commercial- datasets/. 2, 6

    work page

  3. [3]

    https://huggingface.co/. 4

    work page

  4. [4]

    Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring

    Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring. In USENIX Security Symposium (USENIX Security), pages 1615–1631. USENIX, 2018. 1, 3, 6, 14

    work page 2018

  5. [5]

    Benchmarking Large Language Models in Retrieval- Augmented Generation

    Jiawei Chen, Hongyu Lin, Xianpei Han, and Le Sun. Benchmarking Large Language Models in Retrieval- Augmented Generation. In AAAI Conference on Arti- ficial Intelligence (AAAI), pages 17754–17762. AAAI,

    work page

  6. [6]

    BadNL: Backdoor Attacks Against NLP Models with Semantic-preserving Improvements

    Xiaoyi Chen, Ahmed Salem, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang. BadNL: Backdoor Attacks Against NLP Models with Semantic-preserving Improvements. In Annual Computer Security Applications Conference (ACSAC), pages 554–569. ACSAC, 2021. 1, 2, 3

    work page 2021

  7. [7]

    REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data

    Xinyun Chen, Wenxiao Wang, Chris Bender, Yiming Ding, Ruoxi Jia, Bo Li, and Dawn Song. REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data. In ACM Asia Conference on Computer and Communications Secu- rity (ASIACCS), pages 321–335. ACM, 2021. 11, 14

    work page 2021

  8. [8]

    DialogSum: A Real-Life Scenario Dialogue Summa- rization Dataset

    Yulong Chen, Yang Liu, Liang Chen, and Yue Zhang. DialogSum: A Real-Life Scenario Dialogue Summa- rization Dataset. CoRR abs/2105.06762, 2021. 7

    arXiv 2021

Show all 58 references
  1. [9]

    Increasing Diversity While Maintaining Ac- curacy: Text Data Generation with Large Language Models and Human Interventions

    John Joon Young Chung, Ece Kamar, and Saleema Amershi. Increasing Diversity While Maintaining Ac- curacy: Text Data Generation with Large Language Models and Human Interventions. In Annual Meet- ing of the Association for Computational Linguistics (ACL), pages 575–593. ACL, 2023. 1

    2023

  2. [10]

    SSL- Guard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoders

    Tianshuo Cong, Xinlei He, and Yang Zhang. SSL- Guard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoders. In ACM SIGSAC Con- ference on Computer and Communications Security (CCS), pages 579–593. ACM, 2022. 1, 3, 6, 14

    2022

  3. [11]

    BERT: Pre-training of Deep Bidi- rectional Transformers for Language Understanding

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre-training of Deep Bidi- rectional Transformers for Language Understanding. In Conference of the North American Chapter of the As- sociation for Computational Linguistics: Human Lan- guage Technologies (...

    2019

  4. [12]

    Watermark Removal Scheme Based on Neural Network Model Pruning

    Wenwen Gu. Watermark Removal Scheme Based on Neural Network Model Pruning. In Proceedings of In- ternational Conference on Machine Learning and Nat- ural Language Processing (MLNLP) , pages 377–382. ACM, 2022. 11, 14

    2022

  5. [13]

    Fine-tuning Is Not Enough: A Simple yet Effective Watermark Removal Attack for DNN Models

    Shangwei Guo, Tianwei Zhang, Han Qiu, Yi Zeng, Tao Xiang, and Yang Liu. Fine-tuning Is Not Enough: A Simple yet Effective Watermark Removal Attack for DNN Models. In International Joint Conferences on Artifical Intelligence (IJCAI), pages 3635–3641. IJCAI,

  6. [14]

    Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot

    Hengrui Jia, Christopher A. Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot. Entangled Watermarks as a Defense against Model Extraction. In USENIX Security Symposium (USENIX Security) , pages 1937–1954. USENIX, 2021. 1, 3, 6

    1937

  7. [15]

    Watermark Stealing in Large Language Models

    Nikola Jovanovi ´c, Robin Staab, and Martin Vechev. Watermark Stealing in Large Language Models. CoRR abs/2402.19361, 2024. 14

    2024 arXiv

  8. [16]

    A Watermark for Large Language Models

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A Watermark for Large Language Models. In Interna- tional Conference on Machine Learning (ICML), pages 17061–17084. PMLR, 2023. 1, 2, 4, 6, 9, 14, 18, 19 15

    2023

  9. [17]

    On the Reliability of Watermarks for Large Language Models

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the Reliability of Watermarks for Large Language Models. CoRR abs/2306.04634, 2023. 1, 2, 4, 9, 14, 18, 19

    2023 arXiv

  10. [18]

    Large Lan- guage Models are Zero-Shot Reasoners

    Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. Large Lan- guage Models are Zero-Shot Reasoners. In Annual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS, 2022. 1

    2022

  11. [19]

    Efficient Memory Management for Large Language Model Serving with PagedAttention

    Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph Gon- zalez, Hao Zhang, and Ion Stoica. Efficient Memory Management for Large Language Model Serving with PagedAttention. CoRR abs/2309.06180, 2023. 4

    2023 arXiv

  12. [20]

    Who Wrote this Code? Watermarking for Code Generation

    Taehyun Lee, Seokhee Hong, Jaewoo Ahn, Ilgee Hong, Hwaran Lee, Sangdoo Yun, Jamin Shin, and Gunhee Kim. Who Wrote this Code? Watermarking for Code Generation. In Annual Meeting of the Association for Computational Linguistics (ACL) , pages 4890–4911. ACL, 2024. 1, 14

    2024

  13. [21]

    PLMmark: A Se- cure and Robust Black-Box Watermarking Framework for Pre-trained Language Models

    Peixuan Li, Pengzhou Cheng, Fangqi Li, Wei Du, Haodong Zhao, and Gongshen Liu. PLMmark: A Se- cure and Robust Black-Box Watermarking Framework for Pre-trained Language Models. In AAAI Conference on Artificial Intelligence (AAAI) , pages 14991–14999. AAAI, 2023. 14

    2023

  14. [22]

    Synthetic Data Generation with Large Language Models for Text Classification: Potential and Limita- tions

    Zhuoyan Li, Hangxiao Zhu, Zhuoran Lu, and Ming Yin. Synthetic Data Generation with Large Language Models for Text Classification: Potential and Limita- tions. In Conference on Empirical Methods in Natural Language Processing (EMNLP) , pages 10443–10461. ACL, 2023. 1

    2023

  15. [23]

    Manning, and James Y

    Weixin Liang, Yaohui Zhang, Zhengxuan Wu, Haley Lepp, Wenlong Ji, Xuandong Zhao, Hancheng Cao, Sheng Liu, Siyu He, Zhi Huang, Diyi Yang, Christo- pher Potts, Christopher D. Manning, and James Y . Zou. Mapping the Increasing Use of LLMs in Scientific Pa- pers. CoRR abs/2404.012...

    2024 arXiv

  16. [24]

    A Semantic Invariant Robust Watermark for Large Language Models

    Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. A Semantic Invariant Robust Watermark for Large Language Models. In International Conference on Learning Representations (ICLR) . ICLR, 2024. 1, 14

    2024

  17. [25]

    Improved Baselines with Visual Instruction Tun- ing

    Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. Improved Baselines with Visual Instruction Tun- ing. CoRR abs/2310.03744, 2023. 1, 4

    2023 arXiv

  18. [26]

    Fine-Pruning: Defending Against Backdooring At- tacks on Deep Neural Networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-Pruning: Defending Against Backdooring At- tacks on Deep Neural Networks. In Research in At- tacks, Intrusions, and Defenses (RAID) , pages 273–

  19. [27]

    RoBERTa: A Ro- bustly Optimized BERT Pretraining Approach

    Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Man- dar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. RoBERTa: A Ro- bustly Optimized BERT Pretraining Approach. CoRR abs/1907.11692, 2019. 7

    1907 arXiv

  20. [28]

    Robustness Over Time: Understanding Adversarial Examples’ Effective- ness on Longitudinal Versions of Large Language Mod- els

    Yugeng Liu, Tianshuo Cong, Zhengyu Zhao, Michael Backes, Yun Shen, and Yang Zhang. Robustness Over Time: Understanding Adversarial Examples’ Effective- ness on Longitudinal Versions of Large Language Mod- els. CoRR abs/2308.07847, 2023. 1, 2

    2023

  21. [29]

    Backdoor Attacks Against Dataset Distil- lation

    Yugeng Liu, Zheng Li, Michael Backes, Yun Shen, and Yang Zhang. Backdoor Attacks Against Dataset Distil- lation. CoRR abs/2301.01197, 2023. 6

    2023 arXiv

  22. [30]

    Watermarking Diffusion Model

    Yugeng Liu, Zheng Li, Michael Backes, Yun Shen, and Yang Zhang. Watermarking Diffusion Model. CoRR abs/2305.12502, 2023. 1, 3, 6, 14

    2023 arXiv

  23. [31]

    SoK: How Robust is Image Classification Deep Neural Network Watermarking? In IEEE Sympo- sium on Security and Privacy (S&P)

    Nils Lukas, Edward Jiang, Xinda Li, and Florian Ker- schbaum. SoK: How Robust is Image Classification Deep Neural Network Watermarking? In IEEE Sympo- sium on Security and Privacy (S&P). IEEE, 2022. 14

    2022

  24. [32]

    Maas, Raymond E

    Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y . Ng, and Christopher Potts. Learning Word Vectors for Sentiment Analysis. In An- nual Meeting of the Association for Computational Lin- guistics (ACL), pages 142–150. ACL, 2011. 6, 7

    2011

  25. [33]

    Ad- versarial Frontier Stitching for Remote Neural Network Watermarking

    Erwan Le Merrer, Patrick Perez, and Gilles Trédan. Ad- versarial Frontier Stitching for Remote Neural Network Watermarking. CoRR abs/1711.01894, 2017. 1, 3

    2017 arXiv

  26. [34]

    Protecting Intellectual Property of Generative Adversarial Networks From Ambiguity Attacks

    Ding Sheng Ong, Chee Seng Chan, Kam Woh Ng, Lixin Fan, and Qiang Yang. Protecting Intellectual Property of Generative Adversarial Networks From Ambiguity Attacks. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , pages 3630–

  27. [35]

    GPT-4 Technical Report

    OpenAI. GPT-4 Technical Report. CoRR abs/2303.08774, 2023. 1, 10

    2023 arXiv

  28. [36]

    What In-Context Learning "Learns" In-Context: Dis- entangling Task Recognition and Task Learning.CoRR abs/2305.09731, 2023

    Jane Pan, Tianyu Gao, Howard Chen, and Danqi Chen. What In-Context Learning "Learns" In-Context: Dis- entangling Task Recognition and Task Learning.CoRR abs/2305.09731, 2023. 2

    2023 arXiv

  29. [37]

    Hidden Trigger Backdoor Attack on NLP Models via Linguistic Style Manipulation

    Xudong Pan, Mi Zhang, Beina Sheng, Jiaming Zhu, and Min Yang. Hidden Trigger Backdoor Attack on NLP Models via Linguistic Style Manipulation. In USENIX Security Symposium (USENIX Security) , pages 3611–3628. USENIX, 2022. 2, 3, 7

    2022

  30. [38]

    Attacking LLM Watermarks by Exploiting Their Strengths

    Qi Pang, Shengyuan Hu, Wenting Zheng, and Vir- ginia Smith. Attacking LLM Watermarks by Exploiting Their Strengths. CoRR abs/2402.16187, 2024. 14

    2024 arXiv

  31. [39]

    Can Large Language Models Rea- son about Program Invariants? In International Con- ference on Machine Learning (ICML)

    Kexin Pei, David Bieber, Kensen Shi, Charles Sutton, and Pengcheng Yin. Can Large Language Models Rea- son about Program Invariants? In International Con- ference on Machine Learning (ICML). JMLR, 2023. 1

    2023

  32. [40]

    Are You Copying My 16 Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermark

    Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhong Sun, and Xing Xie. Are You Copying My 16 Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermark. In Annual Meeting of the Association fo...

    2023

  33. [41]

    MAUVE: Measuring the Gap Between Neural Text and Human Text using Divergence Fron- tiers

    Krishna Pillutla, Swabha Swayamdipta, Rowan Zellers, John Thickstun, Sean Welleck, Yejin Choi, and Zaïd Harchaoui. MAUVE: Measuring the Gap Between Neural Text and Human Text using Divergence Fron- tiers. In Annual Conference on Neural Informa- tion Processing Systems (NeurIPS...

    2021

  34. [42]

    Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. Exploring the Limits of Trans- fer Learning with a Unified Text-to-Text Transformer. Journal of Machine Learning Research, 2020. 4, 7

    2020

  35. [43]

    A Ro- bust Semantics-based Watermark for Large Language Model against Paraphrasing

    Jie Ren, Han Xu, Yiding Liu, Yingqian Cui, Shuaiqiang Wang, Dawei Yin, and Jiliang Tang. A Ro- bust Semantics-based Watermark for Large Language Model against Paraphrasing. CoRR abs/2311.08721 ,

    arXiv

  36. [44]

    DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Mod- els

    Bita Darvish Rouhani, Huili Chen, and Farinaz Koushanfar. DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Mod- els. CoRR abs/1804.00750, 2018. 1, 3

    2018 arXiv

  37. [45]

    Embedding Watermarks into Deep Neural Networks

    Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin’ichi Satoh. Embedding Watermarks into Deep Neural Networks. In International Conference on Mul- timedia Retrieval (ICMR), pages 269–277. ACM, 2017. 1, 3, 14

    2017

  38. [46]

    Attacks on Digital Watermarks for Deep Neural Networks

    Tianhao Wang and Florian Kerschbaum. Attacks on Digital Watermarks for Deep Neural Networks. In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 2622–2626. IEEE, 2019. 11, 14

    2019

  39. [47]

    Chi, Quoc V

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Brian Ichter, Fei Xia, Ed H. Chi, Quoc V . Le, and Denny Zhou. Chain-of-Thought Prompting Elic- its Reasoning in Large Language Models. In Annual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS, 2022. 1

    2022

  40. [48]

    Qwen2 Technical Report

    An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, Guanting Dong, Hao- ran Wei, Huan Lin, Jialong Tang, Jialin Wang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Ma, Jin Xu, Jingren Zhou, Jinze Bai, Jinzhe...

    2024 arXiv

  41. [49]

    Qwen2.5 Technical Report

    An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jian- hong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jin- gren Zhou, Junyang Lin, Kai Dang, Keming Lu, Ke- qin Bao, Kexin Yang, Le ...

    2024 arXiv

  42. [50]

    Stoecklin, Heqing Huang, and Ian Molloy

    Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Marc Ph. Stoecklin, Heqing Huang, and Ian Molloy. Protecting Intellectual Property of Deep Neural Net- works with Watermarking. InACM Asia Conference on Computer and Communications Security (ASIACCS) , pages 159–172. ACM, 2018. 14

    2018

  43. [51]

    Instruction Backdoor Attacks Against Cus- tomized LLMs

    Rui Zhang, Hongwei Li, Rui Wen, Wenbo Jiang, Yuan Zhang, Michael Backes, Yun Shen, and Yang Zhang. Instruction Backdoor Attacks Against Cus- tomized LLMs. In USENIX Security Symposium (USENIX Security). USENIX, 2024. 6

    2024

  44. [52]

    Character-level Convolutional Networks for Text Clas- sification

    Xiang Zhang, Junbo Zhao, and Yann LeCun. Character-level Convolutional Networks for Text Clas- sification. In Annual Conference on Neural Informa- tion Processing Systems (NIPS), pages 649–657. NIPS,

  45. [53]

    Provable Robust Watermarking for AI-Generated Text

    Xuandong Zhao, Prabhanjan Vijendra Ananth, Lei Li, and Yu-Xiang Wang. Provable Robust Watermarking for AI-Generated Text. In International Conference on Learning Representations (ICLR). ICLR, 2024. 1, 14

    2024

  46. [54]

    Attention Distrac- tion: Watermark Removal Through Continual Learn- ing with Selective Forgetting

    Qi Zhong, Leo Yu Zhang, Shengshan Hu, Longxiang Gao, Jun Zhang, and Yong Xiang. Attention Distrac- tion: Watermark Removal Through Continual Learn- ing with Selective Forgetting. In International Con- ference on Multimedia and Expo (ICME) , pages 1–6. IEEE, 2022. 11, 14

    2022

  47. [55]

    Large Language Models are Human-Level Prompt En- gineers

    Yongchao Zhou, Andrei Ioan Muresanu, Ziwen Han, Keiran Paster, Silviu Pitis, Harris Chan, and Jimmy Ba. Large Language Models are Human-Level Prompt En- gineers. In International Conference on Learning Rep- resentations (ICLR), 2023. 1

    2023

  48. [56]

    MiniGPT-4: Enhancing Vision- Language Understanding with Advanced Large Lan- guage Models

    Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. MiniGPT-4: Enhancing Vision- Language Understanding with Advanced Large Lan- guage Models. CoRR abs/2304.10592, 2023. 1, 4

    2023 arXiv

  49. [57]

    To Prune, or Not to Prune: Exploring the Efficacy of Pruning for Model Compression

    Michael Zhu and Suyog Gupta. To Prune, or Not to Prune: Exploring the Efficacy of Pruning for Model Compression. In International Conference on Learn- ing Representations (ICLR), 2018. 14 A Appendix A.1 Additional Results 17 Table 6: Performance of weak watermark method after ...

    2018

  50. [294]

    Springer, 2018. 11, 14

    2018

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.