Large language models (LLMs) have attracted significant attention in recent years. Due to their "Large" nature, training LLMs from scratch consumes immense computational resources. Since several major players in the artificial intelligence (AI) field have open-sourced their original LLMs, an increasing number of individuals and smaller companies are able to build derivative LLMs based on these open-sourced models at much lower costs. However, this practice opens up possibilities for unauthorized use or reproduction that may not comply with licensing agreements, and fine-tuning can change the model's behavior, thus complicating the determination of model ownership. Current intellectual property (IP) protection schemes for LLMs are either designed for white-box settings or require additional modifications to the original model, which restricts their use in real-world settings.
In this paper, we propose ProFLingo, a black-box fingerprinting-based IP protection scheme for LLMs. ProFLingo generates queries that elicit specific responses from an original model, thereby establishing unique fingerprints. Our scheme assesses the effectiveness of these queries on a suspect model to determine whether it has been derived from the original model. ProFLingo offers a non-invasive approach, which neither requires knowledge of the suspect model nor modifications to the base model or its training process. To the best of our knowledge, our method represents the first black-box fingerprinting technique for IP protection for LLMs. Our source code and generated queries are available at: https://github.com/hengvt/ProFLingo.
A deep neural network (DNN) classifier represents a model owner's intellectual property as training a DNN classifier often requires lots of resource. Watermarking was recently proposed to protect the intellectual property of DNN classifiers. However, watermarking suffers from a key limitation: it sacrifices the utility/accuracy of the model owner's classifier because it tampers the classifier's training or fine-tuning process. In this work, we propose IPGuard, the first method to protect intellectual property of DNN classifiers that provably incurs no accuracy loss for the classifiers. Our key…
Identifying Appropriate Intellectual Property Protection Mechanisms for Machine Learning Models: A Systematization of Watermarking, Fingerprinting, Model Access, and Attacks
SBA Research（SBA研究中心）；Vienna University of Technology（维也纳工业大学）
DNF: Dual-Layer Nested Fingerprinting for Large Language Model Intellectual Property Protection
Zhejiang University（浙江大学）；Binjiang Institute of Zhejiang University（浙江大学滨江学院）；Hangzhou Dianzi University（杭州电子科技大学）；Hefei University of Technology（合肥工业大学）
Rotation, Scale, and Translation Resilient Black-box Fingerprinting for Intellectual Property Protection of EaaS Models
College of Computer Science, Sichuan Normal University（四川师范大学计算机科学学院）；School of Communication and Information Engineering, Shanghai University（上海大学通信与信息工程学院）；College of Cyber Security, Jinan University（暨南大学网络空间安全学院）；College of Computer Science and Information Technology, IAU（沙特阿拉伯国王伊斯兰大学计算机科学与信息技术学院）；Center for AI Research, University of Agder（阿格德尔大学人工智能研究中心）
Aggressive time-to-market constraints and enormous hardware design and fabrication costs have pushed the semiconductor industry toward hardware Intellectual Properties (IP) core design. However, the globalization of the integrated circuits (IC) supply chain exposes IP providers to theft and illegal redistribution of IPs. Watermarking and fingerprinting are proposed to detect IP piracy. Nevertheless, they come with additional hardware overhead and cannot guarantee IP security as advanced attacks are reported to remove the watermark, forge, or bypass it. In this work, we propose a novel methodol…
KinGuard: Hierarchical Kinship-Aware Fingerprinting to Defend Against Large Language Model Stealing
Zhejiang University（浙江大学）；The University of Melbourne（墨尔本大学）；National University of Singapore（新加坡国立大学）；People’s Public Security University of China（中国人民公安大学）；Shanghai Jiao Tong University（上海交通大学）
AttnDiff: Attention-based Differential Fingerprinting for Large Language Models
Zhejiang University of Technology（浙江工业大学）；Zhejiang University（浙江大学）；Binjiang Institute of Zhejiang University（浙江大学滨江研究院）；Shanghai Jiao Tong University（上海交通大学）；University of Science and Technology of China（中国科学技术大学）
Nanyang Technological University（南洋理工大学）；City University of Hong Kong（香港城市大学）；Tsinghua University（清华大学）；Chongqing University（重庆大学）；Wuhan University（武汉大学）；Zhejiang University（浙江大学）；University of New Brunswick（新不伦瑞克大学）
SoK: Large Language Model Copyright Auditing via Fingerprinting
The State Key Laboratory of Blockchain and Data Security（区块链与数据安全国家重点实验室）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新技术区（滨江）区块链与数据安全研究院）；Nanyang Technological University（南洋理工大学）；City University of Hong Kong（香港城市大学）；Sun Yat-Sen University（中山大学）
Deep neural networks (DNNs) have already achieved great success in a lot of application areas and brought profound changes to our society. However, it also raises new security problems, among which how to protect the intellectual property (IP) of DNNs against infringement is one of the most important yet very challenging topics. To deal with this problem, recent studies focus on the IP protection of DNNs by applying digital watermarking, which embeds source information and/or authentication data into DNN models by tuning network parameters directly or indirectly. However, tuning network parame…
Have You Merged My Model? On The Robustness of Large Language Model IP Protection Methods Against Model Merging
Tsinghua University（清华大学）；Xidian University（西安电子科技大学）；The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；Zhongguancun Laboratory（中关村实验室）；National Financial Cryptography Research Center（国家金融密码研究中心）
