From Evaluation to Defense: Constructing Persistent Edit-Based Fingerprints for Large Language Models

2025-09-03

AI Summary

To address critical challenges in large language model (LLM) intellectual property protection—including fingerprint fragility, performance degradation, poor robustness, and weak discriminability against semantically similar texts—this paper proposes a lightweight fingerprint injection method based on knowledge editing. It pioneers the integration of knowledge editing into copyright protection by introducing fingerprint subspace-aware fine-tuning (FSFT), which imposes explicit fingerprint subspace constraints during fine-tuning to prevent feature confusion and fingerprint overwriting. Scrambled text serves as the fingerprint carrier, significantly enhancing fingerprint persistence and robustness under extensive fine-tuning and model modifications. Experiments demonstrate that FSFT maintains up to 10% higher task performance than conventional fine-tuning under worst-case scenarios, while simultaneously improving the model’s ability to distinguish fingerprints from semantically similar inputs. The approach achieves efficient, low-overhead, fine-grained model copyright protection.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Safety and Robustness
• Computer Vision: Large Vision Models

Application Category

• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Economics, Online Markets and Human Computation: LLM based quality controls for crowd work
• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation

Abstract

The intellectual property (IP) protection of Large Language Models (LLMs) is increasingly critical. Injecting specialized fingerprints into LLMs through instruction tuning is a common IP protection technique. However, this may significantly degrade model performance, requires substantial computational resources, and exhibits poor persistence under model modifications. We argue that knowledge editing offers a lightweight alternative that is more suitable for fingerprint injection. Accordingly, we apply knowledge editing to fingerprint injection for the first time and demonstrate its strong capability. Despite using scrambled text as fingerprints to prevent them from being overwritten during fine-tuning, degradation still occurs under large-scale fine-tuning. To address this, we propose Fingerprint Subspace-aware Fine-Tuning (FSFT), which reduces fingerprint degradation by constraining the update of the fingerprint subspace. The performance of FSFT exceeds fine-tuning by 10% even in the worst-case scenario. Additionally, we observe that the fingerprint-injected models struggle to distinguish between fingerprints and similar texts due to the high similarity of their features. This finding underscores the urgent need for more robust and fine-grained fingerprinting injection methods for LLMs.

Problem

• Protecting intellectual property of LLMs via persistent fingerprints
• Reducing performance degradation from fingerprint injection methods
• Preventing fingerprint overwriting during model fine-tuning processes

Innovation

• Knowledge editing for lightweight fingerprint injection
• Fingerprint Subspace-aware Fine-Tuning (FSFT) method
• Scrambled text fingerprints to resist overwriting