mlsanityData to 14 Oct 2026

EmbTracker: Traceable Black-box Watermarking for Federated Language Models

arXiv 2603.12089 ↗First posted 12 Mar 2026cs.CRcited by 1

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

Federated Language Model (FedLM) allows a collaborative learning without sharing raw data, yet it introduces a critical vulnerability, as every untrustworthy client may leak the received functional model instance. Current watermarking schemes for FedLM often require white-box access and client-side cooperation, providing only group-level proof of ownership rather than individual traceability. We propose EmbTracker, a server-side, traceable black-box watermarking framework specifically designed for FedLMs. EmbTracker achieves black-box verifiability by embedding a backdoor-based watermark detectable through simple API queries. Client-level traceability is realized by injecting unique identity-specific watermarks into the model distributed to each client. In this way, a leaked model can be attributed to a specific culprit, ensuring robustness even against non-cooperative participants. Extensive experiments on various language and vision-language models demonstrate that EmbTracker achieves robust traceability with verification rates near 100%, high resilience against removal attacks (fine-tuning, pruning, quantization), and negligible impact on primary task performance (typically within 1-2%).

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 46 of its 61 references that are in the map. First posted on arXiv 12 Mar 2026.

Builds on

46 of 61 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025VLA-Mark: A cross modal watermark for large vision-language alignment model18 Jul
  2. 2024Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attribution8 May
  3. 2024RobWE: Robust Watermark Embedding for Personalized Federated Learning Model Ownership Protection29 Feb
  4. 2023Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermark17 May
  5. 2021FedIPR: Ownership Verification for Federated Deep Neural Network Models27 Sep

Other references · 41

  1. 2017Attention Is All You Needcited by 60,361
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  3. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
  4. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  5. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  6. 2024Qwen2-VL: Enhancing Vision-Language Model's Perception of the World at Any Resolutioncited by 4,234
  7. 2021Prefix-Tuning: Optimizing Continuous Prompts for Generationcited by 3,915
  8. 2018Federated Optimization in Heterogeneous Networkscited by 2,987
  9. 2023FlashAttention-2: Faster Attention with Better Parallelism and Work Partitioningcited by 2,598
  10. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  11. 2019OK-VQA: A Visual Question Answering Benchmark Requiring External Knowledgecited by 1,121
  12. 2019Measuring the Effects of Non-Identical Data Distribution for Federated Visual Classificationcited by 851
29 more
  1. 2018CoQA: A Conversational Question Answering Challengecited by 683
  2. 2024Parameter-Efficient Fine-Tuning for Large Models: A Comprehensive Surveycited by 656
  3. 2018Fundamentals of Recurrent Neural Network (RNN) and Long Short-Term Memory (LSTM) Networkcited by 420
  4. 2018Large Scale Crowdsourcing and Characterization of Twitter Abusive Behaviorcited by 270
  5. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 105
  6. 2022FedPrompt: Communication-Efficient and Privacy Preserving Prompt Tuning in Federated Learningcited by 91
  7. 2019[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attackscited by 88
  8. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 86
  9. 2023FedDisco: Federated Learning with Discrepancy-Aware Collaborationcited by 67
  10. 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Modelscited by 67
  11. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 49
  12. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 45
  13. 2020WAFFLE: Watermarking in Federated Learningcited by 37
  14. 2022FedTracker: Furnishing Ownership Verification and Traceability for Federated Learning Modelcited by 30
  15. 2024FedLLM-Bench: Realistic Benchmarks for Federated Learning of Large Language Modelscited by 30
  16. 2024PEFTGuard: Detecting Backdoor Attacks Against Parameter-Efficient Fine-Tuningcited by 26
  17. 2025A Survey on Federated Fine-tuning of Large Language Modelscited by 24
  18. 2021You are caught stealing my winning lottery ticket! Making a lottery ticket claim its ownershipcited by 18
  19. 2025A Survey on Parameter-Efficient Fine-Tuning for Foundation Models in Federated Learningcited by 17
  20. 2023FedCIP: Federated Client Intellectual Property Protection with Traitor Trackingcited by 12
  21. 2024WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protectioncited by 12
  22. 2022Watermarking Pre-trained Encoders in Contrastive Learningcited by 11
  23. 2023Who Leaked the Model? Tracking IP Infringers in Accountable Federated Learningcited by 10
  24. 2024WET: Overcoming Paraphrasing Vulnerabilities in Embeddings-as-a-Service with Linear Transformation Watermarkscited by 7
  25. 2026Revisiting Backdoor Threat in Federated Instruction Tuning from a Signal Aggregation Perspectivecited by 5
  26. 2023FedSOV: Federated Model Secure Ownership Verification with Unforgeable Signaturecited by 4
  27. 2025Traceable Black-box Watermarks for Federated Learningcited by 2
  28. 2026ProtegoFed: Backdoor-Free Federated Instruction Tuning with Interspersed Poisoned Datacited by 2
  29. 2024Contrasting Adversarial Perturbations: The Space of Harmless Perturbationscited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026GradSentry: Gradient Spectral Entropy for Backdoor Sample Filtering in Large Language Model Fine-Tuningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Collaborative Threshold Watermarking
  2. 2024FedGMark: Certifiably Robust Watermarking for Federated Graph Learning
  3. 2025PVMark: Enabling Public Verifiability for LLM Watermarking Schemes
  4. 2026FedAttr: Towards Privacy-preserving Client-Level Attribution in Federated LLM Fine-tuning
  5. 2024Black-Box Detection of Language Model Watermarks
  6. 2024A Watermark for Black-Box Language Models
  7. 2025FLClear: Visually Verifiable Multi-Client Watermarking for Federated Learning
  8. 2024PostMark: A Robust Blackbox Watermark for Large Language Models