Can Watermarking Techniques Help Prevent LLM Model Stealing?

2026-07-12

AI Summary

This work addresses the vulnerability of black-box large language models to model extraction attacks, particularly those targeting the inference of hidden layer dimensionalities. To counter this threat, the paper introduces a novel watermarking-based defense mechanism that embeds watermarks through perturbations in the logits layer. This approach effectively prevents adversaries from accurately reconstructing the internal architecture of the model while preserving its utility. Experimental results demonstrate that the proposed method significantly enhances model security across diverse configurations, with only marginal degradation in performance. By achieving a strong balance between robustness and model fidelity, the technique offers a practical solution for protecting proprietary language models against structural reverse-engineering without compromising their functional quality.

Abstract

Model stealing attacks have recently been introduced, enabling the extraction of precise information from black-box commercial language models. In this work, we propose defense methods against a recent attack of \cite{carlini2024stealing} and extensions for extracting the hidden layer dimension of production language models. Our methods are inspired by watermarking techniques that perturb the logits layer of these models to prevent such attacks. We provide empirical experiments demonstrating the effectiveness of the proposed defense versus model quality degradation across various configurations, and propose an effective defense against such attacks while preserving model utility.

Problem

• model stealing
• large language models
• black-box attacks
• hidden layer extraction
• model security

Innovation

• watermarking
• model stealing defense
• logits perturbation
• black-box LLM protection
• hidden layer extraction prevention