Watermarking Fine-Tuning Datasets for Robust Provenance
Source abstract
Abstract
Large Language Models are often fine-tuned on proprietary corpora, motivating reliable provenance signals. A corpus-level watermark method is proposed for fine-tuning datasets that survives training and common text transformations. The method subtly biases synonym choices according to a secret key (PRF) and encodes a multi-bit payload with an error-correcting code, enabling keyed detection via a generalized likelihood ratio test with permutation-calibrated p-values. For short offline passages (~100 words), the channel is valid but statistically underpowered: the average density is ~0.0165, and the median p-value is close to 1.0. In generative tests with Mistral 7B across 12 configurations and 12,720 texts, 0.00% detection was observed at very high quality (~99.8%). As limited base cases, positive detection was reported for other setups: 8.9% (offline), 5.0% (Mistral 7B), and 3.0% (Llama2-13B). A permutation test (R = 5000), confidence intervals, and power analysis were added. Quality impact statements were refined, with “minimal impact” used instead of “imperceptible.” In this study, limitations and ethical use are discussed, and directions for stronger semantic channels and model-based detectors are outlined.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Authorship Attribution and Profiling · Digital Media Forensic Detection · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Systems, Faculty of Computer Systems and Technology, Technical University of Sofia, 1000 Sofia, Bulgaria
Department of Information Technologies in Industry, Faculty of Computer Systems and Technology, Technical University of Sofia, 1000 Sofia, Bulgaria
Funding
European Regional Development Fund
References (38)
Show source-provided references
1. A Watermark for Large Language Models
2. Kuditipudi, R., Thickstun, J., Hashimoto, T., and Liang, P. (2025, August 22). Robust Distortion-free Watermarks for Language Models. Stanford CRFM Blog, 30 July 2023. Available online: https://crfm.stanford.edu/2023/07/30/watermarking.html.
3. Montti, R. (2025, August 22). How the ChatGPT Watermark Works and Why It Could Be Defeated. Search Engine Journal, 30 December 2022. Available online: https://www.searchenginejournal.com/chatgpt-watermark/475366/.
4. Li, S., Yao, L., Gao, J., Zhang, L., and Li, Y. (2024). Double-I Watermark: Protecting Model Copyright for LLM Fine-tuning. arXiv.
5. Qiu, J., Yang, X., Li, S., Chen, K., Zhang, W., and Yu, N. (2025, January 6–11). Watermarking Datasets for LLM Fine-tuning. Proceedings of the 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP 2025), Hyderabad, India.10.1109/ICASSP49660.2025.10889741 ↗
6. Liu, Y., Cong, T., Backes, M., Li, Z., and Zhang, Y. (2025). Watermarking LLM-Generated Datasets in Downstream Tasks. arXiv.
7. Sewak, M. (2025, August 22). The Secret Language of AI Watermarks for GenAI Text: The Key to Building Trust in the Age of LLMs. Google Cloud—Medium, 23 December 2024. Available online: https://medium.com/google-cloud/the-secret-language-of-ai-watermarks-for-genai-text-the-key-to-building-trust-in-the-age-of-llms-4494816a0e27.
8. Masood, A. (2025, August 22). Toward Reliable Provenance in AI-Generated Content: Text, Images, and Code. Medium, 29 March 2025. Available online: https://medium.com/@adnanmasood/toward-reliable-provenance-in-ai-generated-content-text-images-and-code-9ebe8c57ceae.
9. Liu, A., Pan, L., Hu, X., Meng, S., and Wen, L. (2024). A Semantic Invariant Robust Watermark for Large Language Models. arXiv.
10. Zhao, X., Ananth, P., Li, L., and Wang, Y.X. (2023). Provable Robust Watermarking for AI-Generated Text. arXiv.
11. Hou, A., Zhang, J., He, T., Wang, Y., Chuang, Y.-S., Wang, H., Shen, L., Van Durme, B., Khashabi, D., and Tsvetkov, Y. (2024, January 16–21). SemStamp: A Semantic Watermark with Paraphrastic Robustness for Text Generation. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1: Long Papers, Mexico City, Mexico.10.18653/v1/2024.naacl-long.226 ↗
12. Black-Box Dataset Ownership Verification via Backdoor Watermarking10.1109/TIFS.2023.3265535 ↗
13. Tang, R., Feng, Q., Liu, N., Yang, F., and Hu, X. (2025, September 10). Did You Train on My Dataset? Towards Public Dataset Protection with Clean-Label Backdoor Watermarking. SIGKDD Explorations. Available online: https://kdd.org/exploration_files/p43-watermark_Dataset_KDD_Exploration_.pdf.10.1145/3606274.3606279 ↗
14. Scalable watermarking for identifying large language model outputs10.1038/s41586-024-08025-4 ↗
15. A survey of modern authorship attribution methods10.1002/asi.21001 ↗
16. Feature-based detection of automated language models: Tackling GPT-2, GPT-3 and Grover10.7717/peerj-cs.443 ↗
17. A Survey on LLM-Generated Text Detection: Necessity, Methods, and Future Directions10.1162/coli_a_00549 ↗
18. Yang, Z., Zhou, G., Liu, Y., Liu, L., and Shi, L. (2025). Watermarking for Large Language Models: A Survey. Mathematics, 13.10.3390/math13091420 ↗
19. Gu, C., Li, X.L., Liang, P., and Hashimoto, T. (2023). On the Learnability of Watermarks for Language Models. arXiv.
20. DeepTextMark: A Deep Learning-Driven Text Watermarking Approach for Identifying Large Language Model Generated Text10.1109/ACCESS.2024.3376693 ↗
21. Yu, L., Chen, J., Liao, X., Yin, J., and Qin, Z. (2022). MTS-Stega: Linguistic Steganography Based on Multi-Time Step Selection Strategy. Entropy, 24.10.3390/e24050585 ↗
22. An NLP Classification Model Watermarking Framework with High Covertness10.1016/j.csl.2023.101606 ↗
23. Linguistic steganalysis via multi-task with crossing10.1016/j.neucom.2024.128260 ↗
24. Lau, G.K.R., Niu, X., Dao, H., Chen, J., Foo, C.-S., and Low, B.K.H. (2024, January 12–16). Waterfall: Framework for Robust and Scalable Text Watermarking and Provenance for LLMs. Proceedings of the EMNLP 2024, Miami, FL, USA. Available online: https://aclanthology.org/2024.emnlp-main.1138.pdf.10.18653/v1/2024.emnlp-main.1138 ↗
25. Tree-rings watermarks: Invisible fingerprints for diffusion images
26. Kirchenbauer, J., Geiping, J., Wen, Y., Shu, M., Saifullah, K., and Goldstein, T. (2024, January 7–11). On the Reliability of Watermarks for Large Language Models. Proceedings of the ICLR 2024, Vienna, Austria. Available online: https://openreview.net/forum?id=geFSMS1NIW.
27. ICML (2025, September 10). Proving Dataset Membership via Watermarked Rephrasings (STAMP). Available online: https://icml.cc/virtual/2025/poster/43951.
28. Bouaziz, W., Usunier, N., and El Mhamdi, E.M. (2025, January 24–28). Data Taggants: Dataset Ownership Verification via Non-Backdoor Keys. Proceedings of the ICLR 2025, Singapore. Available online: https://proceedings.iclr.cc/paper_files/paper/2025/file/96b8167534ef3cc30c230bbeb55a524d-Paper-Conference.pdf.
29. A text dataset of fire door defects for pre-delivery inspections of apartments during the construction stage10.1016/j.dib.2025.111536 ↗
30. Zhang, Z., Qin, W., and Plummer, B.A. (2025, September 16). Machine-Generated Text Localization. Findings of ACL 2024. Available online: https://aclanthology.org/2024.findings-acl.495/.10.18653/v1/2024.findings-acl.495 ↗
31. Accurately detecting AI text when ChatGPT is told to write like a chemist10.1016/j.xcrp.2023.101672 ↗
32. Kim, M.-G., and Desaire, H. (2024). Detecting the use of ChatGPT in university newspapers by analyzing stylistic differences with machine learning. Information, 15.10.3390/info15060307 ↗
33. Zhang, R., Hussain, S.S., Neekhara, P., and Koushanfar, F. (2025, September 16). REMARK-LLM: A Robust and Efficient Watermarking Framework for Generative Large Language Models. B USENIX Security 2024. Available online: https://www.usenix.org/conference/usenixsecurity24/presentation/zhang-ruisi.
34. Robust and efficient watermarking of large language models using error correction codes10.56553/popets-2025-0126 ↗
35. A survey of text watermarking in the era of large language models
36. Guo, J., Li, Y., Chen, R., Wu, Y., Liu, C., and Huang, H. (2024, January 10–15). ZeroMark: Towards Dataset Ownership Verification Without Diclosing Watermark. Proceedings of the NeurIPS 2024, Vancouver, BC, Canada. Available online: https://proceedings.neurips.cc/paper_files/paper/2024/hash/da36187b68fb72c3fe1c0eaec638221c-Abstract-Conference.html.
37. Lin, Y.-Q., Zhang, Y.-L., Li, C., and Li, C. (2024). A novel method for linguistic steganography by English translation. PLoS ONE, 19.10.1371/journal.pone.0295207 ↗
38. Context-aware linguistic steganography model based on neural machine translation (NMT-Stega)10.1109/TASLP.2023.3340601 ↗