Making Open-Source Text LLM Watermarks Durable Against Merging

2026-07-25 · Source: cs.CL updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, long

Summary

A novel approach, Merge-Adversarial Training (MAT), significantly enhances the durability of open-source LLM (OSM) watermarks against model merging, a common post-training modification. Prior methods for embedding watermarks directly into model weights were vulnerable to merging, which can inadvertently remove the watermark. MAT, building on watermark-distillation, incorporates an adversarial training objective that simulates merge operations during the training loop. This method consistently outperforms baselines, achieving up to +51 percentage points (pp) True Positive Rate at 1% False Positive Rate (TPR@1%FPR) with SLERP merging and an average of +25 pp, while preserving downstream model capabilities. The research also introduces a rigorous evaluation pipeline for OSM watermark durability under realistic merge scenarios, utilizing three prominent merging algorithms: LINEAR, SLERP, and TIES.

Key takeaway

For machine learning engineers deploying open-source LLMs, adopting Merge-Adversarial Training (MAT) is crucial to ensure the provenance of your models survives common post-training modifications like model merging. This approach protects against inadvertent watermark removal, maintaining accountability and traceability for generated text. You should integrate MAT into your model training workflows to embed robust watermarks that withstand realistic merge scenarios, thereby safeguarding your model's attribution signals.

Key insights

Merge-Adversarial Training (MAT) makes open-source LLM watermarks durable against model merging by simulating merges during training.

Principles

• Adversarial training enhances watermark durability against post-training modifications.
• Simulating merge operations during training improves watermark robustness.
• Unwatermarked base model merging serves as an effective worst-case proxy for evaluation.

Method

MAT adapts watermark distillation by including a low-cost merge operation within the training loop, temporarily creating a merged model and backpropagating gradients to the current model.

In practice

• Implement MAT to embed durable watermarks in open-source LLMs.
• Evaluate watermark robustness across LINEAR, SLERP, and TIES merging algorithms.
• Utilize uniform alpha sampling for merge adversary training to prevent overfitting.

Topics

• Open-source LLMs
• Text Watermarking
• Model Merging
• Adversarial Training
• Watermark Durability
• Llama-3.1-8B-Instruct

Best for: Research Scientist, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• Latent Fusion Jailbreak: Blending Harmful and Harmless Representations to Elicit Unsafe LLM Outputs — Blending harmful and benign hidden states can covertly bypass LLM safety alignments.
• ChainMark: Model-Free LLM Watermarking with Closed-Form Calibration — ChainMark offers a model-free LLM watermarking solution with provable robustness and closed-form calibration.
• Efficient, Robust, and Anti-Collusion Fingerprinting of Image Diffusion Models — A novel T2I model fingerprinting method uses a Personalized Normalization Module and anti-collusion transformations to ensure robustness against malicious model combinations.
• REED: Post-Training Representation Editing for Cross-Domain Linguistic Steganalysis — REED improves cross-domain linguistic steganalysis by editing intermediate representations post-training without model architecture or parameter changes.
• The Art of Mixology: Mixup-based Obfuscation for Privacy-Preserving Split Learning in Large Language Models — MIXGUARD enhances privacy and utility in LLM split learning through token- and representation-level mixup obfuscation.
• Your UnEmbedding Matrix is Secretly a Feature Lens for Text Embeddings — LLM unembedding matrices encode an "edge spectrum" subspace biasing embeddings towards frequent, uninformative tokens, which EmbedFilter removes.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.CL updates on arXiv.org.