Watermarking technique strengthens federated learning against misuse
Watermarking for Byzantine Robust LLM Training
Cryptography and Security
Summary
Watermarking is a way to mark AI models to catch misuse, but it’s tricky to do in federated learning, where multiple users train a model together and need strong defenses against attacks. The authors show that usual defenses can also remove watermarks, making it hard to detect misuse. They propose a new method called CamoMark that hides watermark signals carefully so they can’t be removed by these defenses. Their approach works well on a popular language model and stays effective even if the model is later altered or cleaned.
What this means in practice
- •For ai platform developers: Embed watermarks in federated learning models to detect misuse despite robust attack defenses.
- •For cloud security teams: Monitor AI models for unauthorized manipulation after federated training using watermark signals that resist removal attempts.
Authors
Leixu Huang, Zedian Shao, Teodora Baluta
Abstract
LLM watermarking has emerged as a promising approach for detecting downstream model misuse in centralized settings, but extending it to federated learning (FL) presents unique challenges. In particular, FL systems often rely on strong robust aggregators to defend against poisoning attacks. We empirically show that a malicious server can exploit these same aggregators as effective watermark-removal mechanisms during training, causing representative existing LLM watermarking methods to fail detection in the final model. To address this limitation, we formalize the problem as a constrained optimization task and propose CamoMark, an aggregator-agnostic watermarking scheme for embedding robust watermarks in FL. CamoMark optimizes watermarked updates to become inliers, maintaining bounded deviation from the distribution of clean updates, while preserving sufficient watermark signal for reliable detection. Evaluated on Qwen fine-tuned on the Alpaca dataset, CamoMark achieves a detection confidence of $p$-value $= 1.82\times10^{-2}$ using only 3.3% watermarked data. The watermark also remains robust to a range of post-training removal attacks, including continued fine-tuning on clean data, pruning, and model distillation. At higher watermark ratios, detection confidence improves substantially, reaching $p$-value $= 5.11\times10^{-11}$ at a 13.3% watermark ratio.