mlsanityData to 7 Oct 2026

Watermarking Pre-trained Language Models with Backdooring

arXiv 2210.07543 ↗First posted 14 Oct 2022cs.CL cs.LGcited by 44

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

Large pre-trained language models (PLMs) have proven to be a crucial component of modern natural language processing systems. PLMs typically need to be fine-tuned on task-specific downstream datasets, which makes it hard to claim the ownership of PLMs and protect the developer's intellectual property due to the catastrophic forgetting phenomenon. We show that PLMs can be watermarked with a multi-task learning framework by embedding backdoors triggered by specific inputs defined by the owners, and those watermarks are hard to remove even though the watermarked PLMs are fine-tuned on multiple downstream tasks. In addition to using some rare words as triggers, we also show that the combination of common words can be used as backdoor triggers to avoid them being easily detected. Extensive experiments on multiple datasets demonstrate that the embedded watermarks can be robustly extracted with a high success rate and less influenced by the follow-up fine-tuning.

Key facts. Cited by 44 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 22 of its 26 references that are in the map. First posted on arXiv 14 Oct 2022.

Builds on

22 of 26 references.

References · 22

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2020Language Models are Few-Shot Learnerscited by 32,199
  3. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
  4. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,049
  5. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
  6. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  7. 2015A large annotated corpus for learning natural language inferencecited by 1,837
  8. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  9. 2019PAWS: Paraphrase Adversaries from Word Scramblingcited by 395
  10. 2020Multi-Task Learning with Deep Neural Networks: A Surveycited by 374
  11. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  12. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
10 more
  1. 2017Embedding Watermarks into Deep Neural Networkscited by 227
  2. 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 110
  3. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  4. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 96
  5. 2019[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attackscited by 82
  6. 2020Model Watermarking for Image Processing Networkscited by 49
  7. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 43
  8. 2020Spread-Transform Dither Modulation Watermarking of Deep Neural Networkcited by 23
  9. 2021Protecting Your NLG Models with Semantic and Robust Watermarkscited by 7
  10. 2021Robust Black-box Watermarking for Deep NeuralNetwork using Inverse Document Frequencycited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 7; 2024: 14; 2025: 13; 2026: 10.

44 papers.

Sort:

By area:

  1. 2023A Watermark for Large Language Modelscited by 667
  2. 2023Fast-DetectGPT: Efficient Zero-Shot Detection of Machine-Generated Text via Conditional Probability Curvaturecited by 278
  3. 2023GPT detectors are biased against non-native English writerscited by 175
  4. 2023A Survey on LLM-Generated Text Detection: Necessity, Methods, and Future Directionscited by 101
  5. 2024Instructional Fingerprinting of Large Language Modelscited by 64
  6. 2024DeTeCtive: Detecting AI-generated Text via Multi-Level Contrastive Learningcited by 52
  7. 2024Hey, That's My Model! Introducing Chain & Hash, An LLM Fingerprinting Techniquecited by 34
  8. 2023HuRef: HUman-REadable Fingerprint for Large Language Modelscited by 32
  9. 2023Embarrassingly Simple Text Watermarkscited by 23
  10. 2024Deconstructing The Ethics of Large Language Models from Long-standing Issues to New-emerging Dilemmas: A Surveycited by 23
  11. 2024Grounding and Evaluation for Large Language Models: Practical Challenges and Lessons Learned (Survey)cited by 20
  12. 2024Double-I Watermark: Protecting Model Copyright for LLM Fine-tuningcited by 18
32 more
  1. 2024UTF:Undertrained Tokens as Fingerprints A Novel Approach to LLM Identificationcited by 16
  2. 2024ProFLingo: A Fingerprinting-based Intellectual Property Protection Scheme for Large Language Modelscited by 15
  3. 2023Source Attribution for Large Language Model-Generated Datacited by 11
  4. 2025Scalable Fingerprinting of Large Language Modelscited by 11
  5. 2024SOS! Soft Prompt Attack Against Open-Source Large Language Modelscited by 7
  6. 2024MergePrint: Merge-Resistant Fingerprints for Robust Black-box Ownership Verification of Large Language Modelscited by 6
  7. 2025Natural Fingerprints of Large Language Modelscited by 6
  8. 2025RAFP: Identifying LLM Lineages via Rare-Region Fingerprintscited by 6
  9. 2026Protecting Language Models Against Unauthorized Distillation through Trace Rewritingcited by 6
  10. 2025Tracking the Copyright of Large Vision-Language Models through Parameter Learning Adversarial Imagescited by 5
  11. 2025The Challenge of Identifying the Origin of Black-Box Large Language Modelscited by 5
  12. 2025ImF: Implicit Fingerprint for Large Language Modelscited by 5
  13. 2025Large Language Model Sourcing: A Surveycited by 5
  14. 2024Robust and Minimally Invasive Watermarking for EaaScited by 4
  15. 2024Perturb and Recover: Fine-tuning for Effective Backdoor Removal from CLIPcited by 4
  16. 2025iSeal: Encrypted Fingerprinting for Reliable LLM Ownership Verificationcited by 4
  17. 2026Your "Pro" LLM Subscription May Actually Be "Free": Exposing Fingerprint Spoofing Risks in LLM Inference Servicescited by 3
  18. 2024Watermarking Large Language Models and the Generated Content: Opportunities and Challengescited by 2
  19. 2025IPAD: Inverse Prompt for AI Detection - A Robust and Interpretable LLM-Generated Text Detectorcited by 2
  20. 2025SoK: Are Watermarks in LLMs Ready for Deployment?cited by 2
  21. 2025Evaluating LLM-Contaminated Crowdsourcing Data Without Ground Truthcited by 2
  22. 2026Prompt2Fingerprint: Plug-and-Play LLM Fingerprinting via Text-to-Weight Generationcited by 2
  23. 2024Task-Agnostic Language Model Watermarking via High Entropy Passthrough Layerscited by 1
  24. 2025Zero-Shot Attribution for Large Language Models: A Distribution Testing Approachcited by 1
  25. 2026Echoes of ownership: Adversarial-guided dual injection for copyright protection in MLLMscited by 1
  26. 2026Robust LLM Watermarking with Minimal Semantic Distortion for IP Protectioncited by 1
  27. 2026Targeted Counterfactual Fingerprinting for Black-Box LLM Ownership Verificationcited by 1
  28. 2025Invariant-based Robust Weights Watermark for Large Language Modelscited by 0
  29. 2026SWAN: Semantic Watermarking with Abstract Meaning Representationcited by 0
  30. 2026Position: Retire the "Positive Backdoor" Label -- Secret Alignment Requires Strict and Systematic Evaluationcited by 0
  31. 2026Spectral Signatures of Large Language Modelscited by 0
  32. 2026Answer-then-Edit: Reasoning Skeleton Editing for Anti-Distillation with Preserved Utilitycited by 0