Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

MEraser: An Effective Fingerprint Erasure Approach for Large Language Models

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Fine-tuning on deliberately mismatched pairs erases backdoor fingerprints from LLMs, the paper claims, using fewer than 1,000 training samples and no knowledge of the trigger or target output.

desk verdict MEraser's erasure results are plausible and worth taking seriously, but the 'maintaining model performance' half of the claim is contradicted by the paper's own Table 1 for IF-SFT. read the letter →

arxiv 2506.12551 v2 pith:4GJKQB6D submitted 2025-06-14 cs.CR cs.AI

Jingxuan Zhang , Zhenhua Xu , Rui Hu , Wenpeng Xing , Xuhong Zhang , Meng Han This is my paper
classification cs.CRcs.AI
keywords backdoor-basedfingerprintingfingerprinterasuremismatchedfine-tuningcatastrophicforgettingLoRAadaptertransferLLMownershipprotectionmodelwatermarkingattacktrigger-agnostic
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that backdoor-based fingerprints in large language models can be removed completely without knowing the trigger or the fingerprint output, by first fine-tuning the model on deliberately mismatched input-output pairs and then fine-tuning on clean pairs to restore general ability. The point of establishing this is that current fingerprinting methods used to prove LLM ownership rely on overfitted trigger-output associations, and those associations can be broken by a cheap, generic fine-tuning attack. The paper reports that 300 mismatched samples plus 600 clean samples drive the fingerprint success rate from 100% to 0% on IF-SFT, UTF, and HashChain fingerprints across Llama2-7B, Mistral-7B, and AmberChat-7B, while perplexity and downstream task scores return close to their original levels. It also claims that the erasure effect can be packaged into a LoRA adapter trained once and then merged into other fingerprinted models. A careful reader should take this as a demonstrated attack against a specific family of fine-tuning-based fingerprinting schemes, not against every model ownership protection mechanism.

What carries the argument

The mismatched dataset is the central mechanism: input-output pairs from a dialogue corpus are randomly shuffled so that every input is paired with an unrelated answer. Fine-tuning on this dataset, interpreted by the authors through the neural tangent kernel analysis of SEAM, maximally disrupts the overfitted trigger-to-fingerprint mapping, while the recovery phase on clean Guanaco dialogue data re-teaches general language behavior. An alternative to direct erasure is the transferable erasure adapter: a LoRA adapter trained on the un-fingerprinted base model with the mismatched dataset, then merged into fingerprinted models so that a single training run erases multiple models.

What would settle it

Run the identical 300-sample erase plus 600-sample recover protocol on a fingerprinted model that uses a never-merged separate adapter or a decoding-time hashing rule; if the trigger still produces the fingerprint output at the original rate while general metrics stay intact, the claim that backdoor fingerprints are fine-tuning-overfitted associations that fine-tuning can erase is refuted.

Watch

Extended reading notes

Core claim

MEraser's central claim is that backdoor-based fingerprints persist only because fine-tuning overfits the model to a trigger-output association, and that this association can be broken by supervised fine-tuning on off-topic pairs, where the input is paired with an unrelated response, followed by a recovery fine-tuning on clean, task-relevant pairs. In experiments the authors report a fingerprint success rate that drops from 100% to 0% after the erase phase and stays at 0% after recovery, with perplexity close to the fingerprinted model's original value and only slight losses on ACC and SuperGLUE benchmarks. The method is trigger-agnostic: it never needs to know the trigger tokens, the fingerprint output, or which layers hold the fingerprint, and it uses a total of 900 training samples. The authors further claim that an erasure LoRA adapter trained on a clean base model can be merged into fingerprinted models and removes fingerprints in most cases without retraining, with UTF retaining 37.5 percent in the transferred setting.

Load-bearing premise

The method's reach depends on the assumption that the fingerprints it targets are overfitted trigger-output associations that fine-tuning actually updates; if a fingerprint lives in parameters that fine-tuning does not touch, such as an unmerged separate adapter or an inference-time mechanism, the mismatched fine-tuning cannot reach it.

Editorial extensions

If this is right

  • If MEraser works as reported, any model authenticated only by IF-SFT, UTF, or HashChain-style backdoors can be stripped of its ownership signal with fewer than 1,000 samples, making those fingerprints unreliable as sole proof of provenance.
  • Defenders would need to combine backdoor verification with signals that survive fine-tuning, such as inference-time text watermarks or hybrid trigger schemes, a direction the paper itself points toward.
  • The transferable LoRA adapter means one erasure training run can be reused across many fingerprinted models, making mass fingerprint removal cheap once the adapter exists.
  • The success of mismatched fine-tuning demonstrates that catastrophic forgetting can be directed at a narrow learned association and then repaired, which the paper claims is practical for LLMs despite earlier difficulty applying SEAM's approach directly.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same mismatched-fine-tuning recipe should apply to any backdoor watermark embedded as an overfitted token-output association, including rule-based trigger schemes such as DoubleII, but the paper does not test that case, so whether the recipe holds for dynamic distribution-aligned triggers remains open.
  • Because one erasure adapter can be merged into many models, the share-and-play LoRA ecosystem becomes dual-use: the same distribution channel that spreads poisoned adapters could also spread erasure adapters, making fingerprint-based ownership enforcement harder in practice.
  • A natural robustness check for future fingerprinting schemes is to measure fingerprint success rate after exactly this mismatched fine-tuning protocol, turning MEraser's dataset recipe into a standard attack benchmark; the paper proposes benchmarks but does not formalize such a standard itself.
  • The paper's 'all-encompassing' claim is best read as scoped to fine-tuning-based backdoor fingerprints, since the authors explicitly leave inference-time watermarking out of scope and never demonstrate erasure of fingerprints stored in unmerged separate adapters.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes MEraser, a two-phase fine-tuning method for removing backdoor-based fingerprints from LLMs. In the Erase phase, the fingerprinted model is fine-tuned on a 'mismatched' dataset of deliberately unrelated input-output pairs; in the Recover phase, it is fine-tuned on a small clean dataset. The authors also propose a transferable erasure mechanism using a LoRA adapter trained once on a clean base model and then merged into fingerprinted models. Experiments on Llama2-7B, Mistral-7B, and AmberChat-7B against IF-SFT, UTF, and HashChain fingerprinting report that the Fingerprint Success Rate drops from 100% to 0% after MEraser, with perplexity and downstream-task results presented as evidence of harmlessness. Baselines include incremental fine-tuning, model pruning, model merging, and inference-level methods such as CleanGen and Token Forcing.

Significance. If the stated claims hold, MEraser would be a practical, low-cost attack on a class of model-ownership protections, with value as a stress test for fingerprinting schemes and as a benchmark for the community. The erasure result itself is straightforward and empirically demonstrated on the three tested fingerprinting methods: Table 1 shows FSR = 0% in every row after the Recover phase, and the paper ships code, making the main mechanism reproducible. The paper's breadth—three base architectures, three fingerprinting methods, and several baselines—is a strength. However, the second half of the central claim, that MEraser 'maintains model performance,' is not supported by the paper's own headline numbers: Table 1 shows large perplexity increases for IF-SFT on all three models, and Figure 2 reports downstream accuracy only graphically, without numeric values or confidence intervals. The method's generality is also narrowed by an unproven assumption that all relevant fingerprints are stored as fine-tuning-induced overfitting in the trainable weights. These issues are significant enough to require revision of the central claims and additional evidence.

major comments (4)
  1. [Abstract and §5.2, Table 1] The unqualified claim that MEraser achieves fingerprint removal 'while maintaining model performance' is contradicted by Table 1. For IF-SFT, the recovered-perplexity values are 7.31 vs. 4.80 on Llama2-7B (52% worse), 6.87 vs. 4.09 on Mistral-7B (68% worse), and 9.10 vs. 4.26 on AmberChat-7B (114% worse). The sentence in §5.2 that the PPL values 'closely approach' those of the fingerprinted models is therefore not accurate for the IF-SFT case. The central claim should be qualified by fingerprint type, an acceptable degradation threshold should be defined, or the recovery phase should be shown to close this gap (e.g., with a larger recovery set or a better recovery objective).
  2. [§4.1 and Appendix G] The load-bearing premise of the Erase phase is the statement, in §4.1, that 'most backdoor-based fingerprints rely on trigger-fingerprint overfitting by fine-tuning.' This premise is asserted, not established, and Appendix G itself documents a counterexample: IF-Adapter stores fingerprint information in additional adapters, which are not merged into the base model. A generic LoRA fine-tuning pass over the base model's q/k/v projections may never touch such separately stored parameters. The authors need to state this limitation explicitly, or better, extend the experiments to fingerprints that are not pure fine-tuning-overfit (e.g., IF-Adapter with and without adapter merging) before claiming general applicability to 'backdoor-based fingerprints.'
  3. [§5.2, Figure 2 and §4.3, Figure 3] Two central pieces of evidence lack the numeric detail needed to support the paper's quantitative claims. First, Figure 2 reports ACC and SuperGLUE only as a figure with no numeric values, no error bars, and no per-task breakdown, so it cannot counterbalance the Table 1 perplexity degradation. Second, Figure 3 shows that the transferable erasure adapter leaves UTF at an FSR of 37.5%, which the text describes as 'slightly less complete fingerprint removal'; 37.5% is not a small residual and should be reported and discussed quantitatively, together with the PPL of the transferred model, before claiming that transferable erasure is a 'powerful method' that is 'exceptionally promising.'
  4. [§5.1 and Appendix F] The dataset sizes N=300 and N=600 are selected by scanning values and choosing the ones that achieve FSR=0 with acceptable PPL (Appendix F). Because the same criterion is used for hyperparameter selection and for the main headline result, the reported FSR=0 may reflect overfitting to the evaluated conditions. The paper should report results across random seeds, provide standard deviations, and validate the chosen sizes on a held-out fingerprinting configuration, or at least explicitly acknowledge the tuning procedure and its effect on the strength of the claim.
minor comments (6)
  1. [§5.1, Appendix D] The text says 'PPL, defined in Appendix D, Equation 2,' but FSR is Equation (2) and PPL is Equation (3); the cross-reference should be corrected.
  2. [Appendix B] The algorithm is referred to as 'Algorithm B' in the text, but it is labeled 'Algorithm 1'; the reference should be updated.
  3. [§5.3.2, Table 3] Table 3 has a typo ('Tabel 3' in the text) and its formatting is confusing, especially the IF-SFT row, in which the baseline columns (e.g., 4:6, 5:5, 6:4) and the PPL values are not cleanly separated. Please reformat the table and make the column headers explicit about which method and ratio each PPL value belongs to.
  4. [§5.4] The description of the transferable erasure adapter in §4.3 and Appendix C says the adapter is trained on the 'original base model,' but the experimental section does not state which base model was used to train the adapter, how the adapter was merged, or whether the merging used any scaling factor; please add these details.
  5. [§5.1 and Throughout] The paper does not report the number of trigger-output pairs used for FSR evaluation, the randomness in the verification phase, or the seeds for the LoRA training; adding this information would improve reproducibility.
  6. [§6] The discussion of which watermarking methods could be affected is useful, but it is purely qualitative; a reference to the specific equations in Appendix G for the backdoor-adaptation mechanism would help connect the discussion to the actual method.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: MEraser is evaluated against externally defined fingerprints; the main caveats are dataset-size tuning and an internal PPL inconsistency, not circular reasoning.

full rationale

The paper's central effectiveness claim is empirically anchored to externally defined fingerprinting schemes: FSR is defined in Eq. (2) as the exact-match rate on trigger-output pairs of IF-SFT, UTF, and HashChain, which are all prior published methods independent of this work. The two-phase fine-tuning procedure (mismatched then clean data) is an empirical intervention, and the reported FSR=0 is a measured outcome, not a quantity constructed to equal an input by definition. No parameter is fitted to the FSR metric and then renamed as a prediction; the method does not define 'fingerprint' in terms of its own erasure output. The NTK/SEAM discussion in Appendix A is external theory used only as motivation and does not by itself force the experimental result. There are no load-bearing self-citations: the cited fingerprinting methods and LoRA-transfer results are from other groups. The main caveats are non-circular: (1) Appendix F shows the 300/600 sample sizes were selected after scanning N=100-300 and N=300-600 for FSR=0 and PPL stability, so the abstract's 'fewer than 1,000 samples' claim is a tuned operating point rather than an a priori prediction; (2) Table 1 shows IF-SFT recovered PPL is substantially higher than the fingerprinted model (e.g., AmberChat 9.10 vs 4.26), contradicting the 'maintaining model performance' phrasing, and Appendix E concedes the approach 'may not fully restore the model to its optimal state.' These are correctness and generalization concerns, not circularity. The derivation chain is self-contained with respect to circularity, so a score of 0 is appropriate.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The central mechanism rests on three unproven background assumptions: that fingerprints are overfit fine-tuning associations, that the SEAM/NTK random-label forgetting argument transfers to LLMs, and that a mismatched LoRA adapter trained on an unfingerprinted model can erase fingerprints when merged. The hyperparameters and dataset sizes were tuned against the target metric, FSR=0. No new theoretical entities are introduced.

free parameters (4)
  • Mismatched dataset size N=300 = 300
    Selected after scanning N=100, 200, 300; N=300 was chosen because it achieves FSR=0 for IF-SFT and stable PPL (Appendix F.1).
  • Clean dataset size N=600 = 600
    Selected from N=300 to 600 based on most stable PPL recovery (Appendix F.2).
  • LoRA rank and alpha = r=16, alpha=32
    Fixed by hand for all experiments (Appendix I); no justification is given.
  • Training epochs and learning rate = 5-50 epochs, 1e-4 to 1e-3
    Adaptively adjusted per fingerprinting method to achieve complete erasure; exact values per run are not reported (Appendix I).
assumptions (3)
  • domain assumption Backdoor-based fingerprints are stored as overfitted trigger-output associations in model weights.
    Invoked in Section 4.1 to justify that mismatched fine-tuning can sever the trigger-output link without trigger knowledge.
  • domain assumption SEAM's random-label catastrophic forgetting theory transfers to LLMs fine-tuned with mismatched pairs.
    Appendix A quotes the NTK residual argument from Zhu et al. (2023) but does not prove it applies to LLM LoRA fine-tuning.
  • domain assumption A LoRA adapter trained on the unfingerprinted base model with mismatched data retains erasure capability when merged into fingerprinted models.
    Section 4.3 and Appendix C assume cross-model transfer without a theoretical or empirical mechanism beyond merging.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MEraser: An Effective Fingerprint Erasure Approach for Large Language Models." pith.science (2026). https://pith.science/paper/4GJKQB6D

@misc{pith2026250612551,
  author       = {Pith},
  title        = {Pith review of: MEraser: An Effective Fingerprint Erasure Approach for Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4GJKQB6D}},
  note         = {Machine review of arXiv:2506.12551}
}
read the original abstract

Large Language Models (LLMs) have become increasingly prevalent across various sectors, raising critical concerns about model ownership and intellectual property protection. Although backdoor-based fingerprinting has emerged as a promising solution for model authentication, effective attacks for removing these fingerprints remain largely unexplored. Therefore, we present Mismatched Eraser (MEraser), a novel method for effectively removing backdoor-based fingerprints from LLMs while maintaining model performance. Our approach leverages a two-phase fine-tuning strategy utilizing carefully constructed mismatched and clean datasets. Through extensive evaluation across multiple LLM architectures and fingerprinting methods, we demonstrate that MEraser achieves complete fingerprinting removal while maintaining model performance with minimal training data of fewer than 1,000 samples. Furthermore, we introduce a transferable erasure mechanism that enables effective fingerprinting removal across different models without repeated training. In conclusion, our approach provides a practical solution for fingerprinting removal in LLMs, reveals critical vulnerabilities in current fingerprinting techniques, and establishes comprehensive evaluation benchmarks for developing more resilient model protection methods in the future.

Figures

Figures reproduced from arXiv: 2506.12551 by the authors.

Figure 1
Figure 1. The process of MEraser and verification. Phase 1 ( [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. The ACC and SuperGLUE evaluation of MEraser. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. The evaluation of erased model with transferable erasure adapter. [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: The process of transferable erasure adapter. [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]
Figure 5
Figure 5. Figure 5: Evaluations of FSR and PPL with different mismatched dataset sizes (N=100, 200, 300) on IF-SFT and [PITH_FULL_IMAGE:figures/full_fig_p016_5.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Unlocking the Effectiveness of LoRA-FP for Seamless Transfer Implantation of Fingerprints in Downstream Models

    cs.CR 2025-08 conditional novelty 3.0 of 10

    Backdoor fingerprints trained into LoRA adapters on a base LLM transfer to derivative models with 100% trigger success and, in several scenarios, greater robustness than directly injected fingerprints.

Reference graph

Works this paper leans on

54 extracted references · 11 canonical work pages · cited by 1 Pith paper

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, et al. 2023. Qwen technical report. arXiv preprint arXiv:2309.16609

    arXiv 2023

  4. [4]

    Jiacheng Cai, Jiahao Yu, Yangguang Shao, Yuhang Wu, and Xinyu Xing. 2024. Utf: Undertrained tokens as fingerprints a novel approach to llm identification. arXiv preprint arXiv:2410.12318

    arXiv 2024

  5. [5]

    Jialuo Chen, Jingyi Wang, Tinglan Peng, Youcheng Sun, Peng Cheng, Shouling Ji, Xingjun Ma, Bo Li, and Dawn Song. 2022. Copy, right? a testing framework for copyright protection of deep learning models. In 2022 IEEE symposium on security and privacy (SP), pages 824--841. IEEE

    2022

  6. [6]

    Wei-Lin Chiang, Zhuohan Li, Ziqing Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, et al. 2023. Vicuna: An open-source chatbot impressing gpt-4 with 90\ See https://vicuna. lmsys. org (accessed 14 April 2023), 2(3):6

    2023

  7. [7]

    Christopher Clark, Kenton Lee, Ming-Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina Toutanova. 2019. Boolq: Exploring the surprising difficulty of natural yes/no questions. arXiv preprint arXiv:1905.10044

    arXiv 2019

  8. [8]

    Tianshuo Cong, Delong Ran, Zesen Liu, Xinlei He, Jinyuan Liu, Yichen Gong, Qi Li, Anyu Wang, and Xiaoyun Wang. 2024. Have you merged my model? on the robustness of large language model ip protection methods against model merging. arXiv preprint arXiv:2404.05188

    arXiv 2024

Show all 54 references
  1. [9]

    Marie-Catherine De Marneffe, Mandy Simons, and Judith Tonhauser. 2019. The commitmentbank: Investigating projection in naturally occurring discourse. In proceedings of Sinn und Bedeutung, volume 23, pages 107--124

    2019

  2. [10]

    Danilo Giampiccolo, Bernardo Magnini, Ido Dagan, and William B Dolan. 2007. The third pascal recognizing textual entailment challenge. In Proceedings of the ACL-PASCAL workshop on textual entailment and paraphrasing, pages 1--9

    2007

  3. [11]

    Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. 2025. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948

    2025 arXiv

  4. [12]

    Jakub Ho \'s ci owicz, Pawe Popio ek, Jan Rudkowski, J e drzej Bieniasz, and Artur Janicki. 2024. Unconditional token forcing: Extracting text hidden within llm. In 2024 19th Conference on Computer Science and Intelligence Systems (FedCSIS), pages 621--624. IEEE

    2024

  5. [13]

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2021. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685

    2021 arXiv

  6. [14]

    Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. 2022. Editing models with task arithmetic. arXiv preprint arXiv:2212.04089

    2022 arXiv

  7. [15]

    Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. 2023. Mistral 7b. arXiv preprint arXiv:2310.06825

    2023 arXiv

  8. [16]

    Daniel Khashabi, Snigdha Chaturvedi, Michael Roth, Shyam Upadhyay, and Dan Roth. 2018. Looking beyond the surface: A challenge set for reading comprehension over multiple sentences. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Comp...

    2018

  9. [17]

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. A watermark for large language models. In International Conference on Machine Learning, pages 17061--17084. PMLR

    2023

  10. [18]

    Hector Levesque, Ernest Davis, and Leora Morgenstern. 2012. The winograd schema challenge. In Thirteenth international conference on the principles of knowledge representation and reasoning

    2012

  11. [19]

    Linyang Li, Botian Jiang, Pengyu Wang, Ke Ren, Hang Yan, and Xipeng Qiu. 2023 a . Watermarking llms with weight quantization. arXiv preprint arXiv:2310.11237

    2023 arXiv

  12. [20]

    Peixuan Li, Pengzhou Cheng, Fangqi Li, Wei Du, Haodong Zhao, and Gongshen Liu. 2023 b . Plmmark: a secure and robust black-box watermarking framework for pre-trained language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 14991--14999

    2023

  13. [21]

    Shen Li, Liuyi Yao, Jinyang Gao, Lan Zhang, and Yaliang Li. 2024 a . Double-i watermark: Protecting model copyright for llm fine-tuning. arXiv preprint arXiv:2402.14883

    2024 arXiv

  14. [22]

    Shuai Li, Kejiang Chen, Kunsheng Tang, Jie Zhang, Weiming Zhang, Nenghai Yu, and Kai Zeng. 2023 c . Turning your strength into watermark: Watermarking large language model via knowledge injection. arXiv preprint arXiv:2311.09535

    2023 arXiv

  15. [23]

    Yuetai Li, Zhangchen Xu, Fengqing Jiang, Luyao Niu, Dinuka Sahabandu, Bhaskar Ramasubramanian, and Radha Poovendran. 2024 b . Cleangen: Mitigating backdoor attacks for generation tasks in large language models. arXiv preprint arXiv:2406.12257

    2024 arXiv

  16. [24]

    Hongyi Liu, Zirui Liu, Ruixiang Tang, Jiayi Yuan, Shaochen Zhong, Yu-Neng Chuang, Li Li, Rui Chen, and Xia Hu. 2024. Lora-as-an-attack! piercing llm safety under the share-and-play scenario. arXiv preprint arXiv:2403.00108

    2024 arXiv

  17. [25]

    Attack on llms: Lora once, backdoor everywhere in the share-and-play ecosystem

    Hongyi Liu, Shaochen Zhong, Xintong Sun, Minghao Tian, Zirui Liu, Ruixiang Tang, Jiayi Yuan, Yu-Neng Chuang, Li Li, Soo-Hyun Choi, et al. Attack on llms: Lora once, backdoor everywhere in the share-and-play ecosystem

  18. [26]

    Yang Liu, Mingyuan Fan, Cen Chen, Ximeng Liu, Zhuo Ma, Li Wang, and Jianfeng Ma. 2022. Backdoor defense with machine unlearning. In IEEE INFOCOM 2022-IEEE conference on computer communications, pages 280--289. IEEE

    2022

  19. [27]

    Zhengzhong Liu, Aurick Qiao, Willie Neiswanger, Hongyi Wang, Bowen Tan, Tianhua Tao, Junbo Li, Yuqi Wang, Suqi Sun, Omkar Pangarkar, et al. 2023. Llm360: Towards fully transparent open-source llms. arXiv preprint arXiv:2312.06550

    2023 arXiv

  20. [28]

    Haipeng Luo, Qingfeng Sun, Can Xu, Pu Zhao, Jianguang Lou, Chongyang Tao, Xiubo Geng, Qingwei Lin, Shifeng Chen, and Dongmei Zhang. 2023. Wizardmath: Empowering mathematical reasoning for large language models via reinforced evol-instruct. arXiv preprint arXiv:2308.09583

    2023 arXiv

  21. [29]

    Xinyin Ma, Gongfan Fang, and Xinchao Wang. 2023. Llm-pruner: On the structural pruning of large language models. Advances in neural information processing systems, 36:21702--21720

    2023

  22. [30]

    Todor Mihaylov, Peter Clark, Tushar Khot, and Ashish Sabharwal. 2018. Can a suit of armor conduct electricity? a new dataset for open book question answering. In EMNLP

    2018

  23. [31]

    Guillaume Mlabonne. 2024. Guanaco-llama2-1k dataset. https://huggingface.co/datasets/mlabonne/guanaco-llama2-1k. Accessed: 2025-01-15

    2024

  24. [32]

    Yixin Nie, Adina Williams, Emily Dinan, Mohit Bansal, Jason Weston, and Douwe Kiela. 2020. Adversarial nli: A new benchmark for natural language understanding. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics. Association for Computati...

    2020

  25. [33]

    Mohammad Taher Pilehvar and Jose Camacho-Collados. 2018. Wic: the word-in-context dataset for evaluating context-sensitive meaning representations. arXiv preprint arXiv:1808.09121

    2018 arXiv

  26. [34]

    Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. 2019. Language models are unsupervised multitask learners

    2019

  27. [35]

    Melissa Roemmele, Cosmin Adrian Bejan, and Andrew S Gordon. 2011. Choice of plausible alternatives: An evaluation of commonsense causal reasoning. In 2011 AAAI spring symposium series

    2011

  28. [36]

    Mark Russinovich and Ahmed Salem. 2024. Hey, that's my model! introducing chain & hash, an llm fingerprinting technique. arXiv preprint arXiv:2407.10887

    2024 arXiv

  29. [37]

    shibing624. 2024. Sharegpt gpt4 dataset on hugging face hub. https://huggingface.co/datasets/shibing624/sharegpt_gpt4. Accessed: 2025-02-04

    2024

  30. [38]

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288

    2023 arXiv

  31. [39]

    Alex Wang, Yada Pruksachatkun, Nikita Nangia, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel Bowman. 2019. Superglue: A stickier benchmark for general-purpose language understanding systems. Advances in neural information processing systems, 32

    2019

  32. [40]

    Johannes Welbl, Nelson F Liu, and Matt Gardner. 2017. Crowdsourcing multiple choice science questions. arXiv preprint arXiv:1707.06209

    2017 arXiv

  33. [41]

    Jiashu Xu, Fei Wang, Mingyu Derek Ma, Pang Wei Koh, Chaowei Xiao, and Muhao Chen. 2024. Instructional fingerprinting of large language models. arXiv preprint arXiv:2401.12255

    2024 arXiv

  34. [42]

    Zhiguang Yang and Hanzhou Wu. 2024. A fingerprint for large language models. arXiv preprint arXiv:2407.01235

    2024

  35. [43]

    Le Yu, Bowen Yu, Haiyang Yu, Fei Huang, and Yongbin Li. 2024 a . Language models are super mario: Absorbing abilities from homologous models as a free lunch. In Forty-first International Conference on Machine Learning

    2024

  36. [44]

    Peiying Yu, Guoxin Chen, and Jingjing Wang. 2025. Table-critic: A multi-agent framework for collaborative criticism and refinement in table reasoning. arXiv preprint arXiv:2502.11799

    2025 arXiv

  37. [45]

    Xiaoyan Yu, Tongxu Luo, Yifan Wei, Fangyu Lei, Yiming Huang, Hao Peng, and Liehuang Zhu. 2024 b . Neeko: Leveraging dynamic lora for efficient multi-character role-playing agent. arXiv preprint arXiv:2402.13717

    2024 arXiv

  38. [46]

    Boyi Zeng, Chenghu Zhou, Xinbing Wang, and Zhouhan Lin. 2023. Huref: Human-readable fingerprint for large language models. arXiv preprint arXiv:2312.04828

    2023 arXiv

  39. [47]

    Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Marc Ph Stoecklin, Heqing Huang, and Ian Molloy. 2018. Protecting intellectual property of deep neural networks with watermarking. In Proceedings of the 2018 on Asia conference on computer and communications security, pages 159--172

    2018

  40. [48]

    Jie Zhang, Dongrui Liu, Chen Qian, Linfeng Zhang, Yong Liu, Yu Qiao, and Jing Shao. 2024. Reef: Representation encoding fingerprints for large language models. arXiv preprint arXiv:2410.14273

    2024 arXiv

  41. [49]

    Jinghan Zhang, Junteng Liu, Junxian He, et al. 2023. Composing parameter-efficient modules with arithmetic operation. Advances in Neural Information Processing Systems, 36:12589--12610

    2023

  42. [50]

    Ruisi Zhang and Farinaz Koushanfar. 2024. Emmark: Robust watermarks for ip protection of embedded quantized large language models. In Proceedings of the 61st ACM/IEEE Design Automation Conference, pages 1--6

    2024

  43. [51]

    Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, et al. 2022. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.01068

    2022 arXiv

  44. [52]

    Shuai Zhao, Meihuizi Jia, Zhongliang Guo, Leilei Gan, Xiaoyu Xu, Xiaobao Wu, Jie Fu, Yichao Feng, Fengjun Pan, and Luu Anh Tuan. 2024 a . A survey of backdoor attacks and defenses on large language models: Implications for security measures. arXiv preprint arXiv:2406.06852

    2024 arXiv

  45. [53]

    Ziyu Zhao, Leilei Gan, Guoyin Wang, Wangchunshu Zhou, Hongxia Yang, Kun Kuang, and Fei Wu. 2024 b . Loraretriever: Input-aware lora retrieval and composition for mixed tasks in the wild. arXiv preprint arXiv:2402.09997

    2024 arXiv

  46. [54]

    Rui Zhu, Di Tang, Siyuan Tang, XiaoFeng Wang, and Haixu Tang. 2023. Selective amnesia: On efficient, high-fidelity and blind suppression of backdoor effects in trojaned machine learning models. In 2023 IEEE Symposium on Security and Privacy (SP), pages 1--19. IEEE

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.