mlsanityData to 14 Oct 2026

Towards Watermarking of Open-Source LLMs

arXiv 2502.10525 ↗First posted 14 Feb 2025cs.CR cs.LGcited by 13

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

While watermarks for closed LLMs have matured and have been included in large-scale deployments, these methods are not applicable to open-source models, which allow users full control over the decoding process. This setting is understudied yet critical, given the rising performance of open-source models. In this work, we lay the foundation for systematic study of open-source LLM watermarking. For the first time, we explicitly formulate key requirements, including durability against common model modifications such as model merging, quantization, or finetuning, and propose a concrete evaluation setup. Given the prevalence of these modifications, durability is crucial for an open-source watermark to be effective. We survey and evaluate existing methods, showing that they are not durable. We also discuss potential ways to improve their durability and highlight remaining challenges. We hope our work enables future progress on this important problem.

Key facts. Cited by 13 papers in the map (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 37 of its 49 references that are in the map. First posted on arXiv 14 Feb 2025.

Builds on

37 of 49 references.

Closest ancestors · 14

Same direction, newest first

  1. 2025GaussMark: A Practical Approach for Structural Watermarking of Language Models17 Jan
  2. 2024Provably Robust Watermarks for Open-Source Language Models24 Oct
  3. 2024WAPITI: A Watermark for Finetuned Open-Source LLMs9 Oct
  4. 2024Can Watermarked LLMs be Identified by Users via Crafted Prompts?4 Oct
  5. 2024Bileve: Securing Text Provenance in Large Language Models Against Spoofing with Bi-level Signature4 Jun
  6. 2024Black-Box Detection of Language Model Watermarks28 May
  7. 2024Learning to Watermark LLM-generated Text via Reinforcement Learning13 Mar
  8. 2024Watermark Stealing in Large Language Models29 Feb
  9. 2023A Survey of Text Watermarking in the Era of Large Language Models13 Dec
  10. 2023Unbiased Watermark for Large Language Models22 Sep
  11. 2023Robust Distortion-free Watermarks for Language Models28 Jul
  12. 2023On the Reliability of Watermarks for Large Language Models7 Jun
2 more
  1. 2023Undetectable Watermarks for Language Models25 May
  2. 2023A Watermark for Large Language Models24 Jan

Other references · 23

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2017Proximal Policy Optimization Algorithmscited by 15,215
  3. 2024The Llama 3 Herd of Modelscited by 14,715
  4. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
  5. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  6. 2023QLoRA: Efficient Finetuning of Quantized LLMscited by 3,418
  7. 2022GPTQ: Accurate Post-Training Quantization for Generative Pre-trained Transformerscited by 1,919
  8. 2023SparseGPT: Massive Language Models Can Be Accurately Pruned in One-Shotcited by 1,121
  9. 2022Editing Models with Task Arithmeticcited by 1,120
  10. 2024Qwen2.5-Math Technical Report: Toward Mathematical Expert Model via Self-Improvementcited by 1,090
  11. 2023TIES-Merging: Resolving Interference When Merging Modelscited by 818
  12. 2023A Simple and Effective Pruning Approach for Large Language Modelscited by 800
11 more
  1. 2023Language Models are Super Mario: Absorbing Abilities from Homologous Models as a Free Lunchcited by 694
  2. 2023LLM-Pruner: On the Structural Pruning of Large Language Modelscited by 650
  3. 2023Instruction Tuning for Large Language Models: A Surveycited by 623
  4. 2021Merging Models with Fisher-Weighted Averagingcited by 621
  5. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  6. 2023Sheared LLaMA: Accelerating Language Model Pre-training via Structured Pruningcited by 415
  7. 2022Dataless Knowledge Fusion by Merging Weights of Language Modelscited by 387
  8. 2024Arcee's MergeKit: A Toolkit for Merging Large Language Modelscited by 194
  9. 2024Reinforcement Learning Enhanced LLMs: A Surveycited by 71
  10. 2023Beyond Size: How Gradients Shape Pruning Decisions in Large Language Modelscited by 30
  11. 2024Generative AI Security: Challenges and Countermeasurescited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 8; 2026: 5.

13 papers.

Sort:

By area:

  1. 2025Watermarking Diffusion Language Modelscited by 10
  2. 2025LLM Fingerprinting via Semantically Conditioned Watermarkscited by 9
  3. 2025EditMark: Watermarking Large Language Models based on Model Editingcited by 4
  4. 2025PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMscited by 4
  5. 2025CATMark: A Context-Aware Thresholding Framework for Robust Cross-Task Watermarking in Large Language Modelscited by 3
  6. 2026A Visual Semantic Adaptive Watermark grounded by Prefix-Tuning for Large Vision-Language Modelcited by 3
  7. 2025From Construction to Injection: Edit-Based Fingerprints for Large Language Modelscited by 2
  8. 2026Echoes within the Reasoning: Stealthy and Effective Watermarking via Chain of Thoughtcited by 2
  9. 2025Watermarking Large Language Models in Europe: Interpreting the AI Act in Light of Technologycited by 0
  10. 2025MarkTune: Improving the Quality-Detectability Trade-off in Open-Weight LLM Watermarkingcited by 0
  11. 2026Making Open-Source Text LLM Watermarks Durable Against Mergingcited by 0
  12. 2026OpenStamp: A Watermark for Open-Source Language Modelscited by 0
1 more
  1. 2026WoE Wrote It? Watermarking Mixture-of-Experts LLMs for Black-Box Text Provenancecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024MarkLLM: An Open-Source Toolkit for LLM Watermarking
  2. 2025Mark Your LLM: Detecting the Misuse of Open-Source Large Language Models via Watermarking
  3. 2024PostMark: A Robust Blackbox Watermark for Large Language Models
  4. 2026AutoMark: Enabling Autoresearch to Discover Better LLM Watermarks
  5. 2024No Free Lunch in LLM Watermarking: Trade-offs in Watermarking Design Choices
  6. 2026ChainMark: Model-Free LLM Watermarking with Closed-Form Calibration
  7. 2025SoK: Are Watermarks in LLMs Ready for Deployment?
  8. 2023New Evaluation Metrics Capture Quality Degradation due to LLM Watermarking