Pith. sign in

REVIEW 2 major objections 4 minor 53 references

Merge-Adversarial Training embeds text watermarks into open-source LLM weights so they remain detectable after users merge the model with other checkpoints, and the paper demonstrates consistent gains over standard watermark distillation ac

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 14:21 UTC pith:CW2S2SP7

load-bearing objection MAT gives real merge durability for the merge algorithms people actually use; the 'durable against merging' claim needs a qualifier for untested aggressive merge operators. the 2 major comments →

arxiv 2607.20435 v1 pith:CW2S2SP7 submitted 2026-05-11 cs.CL cs.AI

Making Open-Source Text LLM Watermarks Durable Against Merging

Luisa Scharff , Thibaud Gloaguen , Robin Staab , Martin Vechev This is my paper
classification cs.CL cs.AI
keywords watermark durabilitymodel mergingadversarial trainingopen-source LLMswatermark distillationmerge-adversarial trainingLLM watermarking
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper proposes Merge-Adversarial Training (MAT), a way to embed a text watermark into an open-source LLM so it survives model merging. The method trains the watermarked model against a simulated linear merge with the unwatermarked base at every step, rewarding watermarks that stay detectable after weight interpolation. The authors claim this consistently beats standard watermark distillation across merge algorithms (linear, SLERP, TIES), realistic scenarios (finetune merges, cascaded merges), watermark families (KGW, AAR, KTH), and two architectures, while preserving downstream quality. If right, it gives model providers a practical way to release traceable open models that remain attributable even after users combine them.

Core claim

The central claim is that watermark durability against model merging can be trained into weights, not just hoped for. MAT adds a merge adversary to watermark distillation: at each step it forms a linear interpolation of the current checkpoint with the frozen unwatermarked base, computes the watermark-distillation KL loss through this merged model, and backpropagates only into the trainable copy. This forces the watermark to survive weight-space interpolation with the base. Empirically, MAT keeps TPR@1%FPR high in every tested scenario, while standard distillation collapses; for example, under SLERP it gains up to 51 percentage points. The paper also argues that merging a watermarked model wi

What carries the argument

The load-bearing object is the merge adversary in the training loop: a randomly weighted linear interpolation of the current watermark-trained checkpoint and the unwatermarked base, with the merge weight sampled uniformly from a range at each step. The loss is the KL divergence between the watermarked teacher distribution, restricted to the top-k logits, and the merged model's distribution; gradients flow only to the trainable student. This single simple adversary is what teaches the model to keep its watermark after real merges, including non-linear ones like SLERP and TIES.

Load-bearing premise

The method's durability claim rests on the assumption that robustness learned against a simple linear interpolation with the unwatermarked base transfers to all realistic merges — including SLERP, TIES, cascades, and untested trim-and-rescale or learned merges; if that transfer fails for a real merge algorithm, the general durability claim collapses.

What would settle it

Train MAT exactly as described, then merge the resulting model with a third-party model using DARE-TIES, Model Breadcrumbs, or an evolutionary or learned merge operator, and measure TPR@1%FPR; if detectability drops to baseline-distillation levels on any of these, the claim that a linear adversary suffices for durability is false. A cheaper test: verify whether the BB′ lower-bound property holds on TIES — the paper itself reports it fails there.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Providers can release watermarked open models that stay attributable after common user merges, without requiring any merge-time steps from users.
  • Merging with the unwatermarked base becomes a cheap proxy test for cascade durability, at least for averaging-type merges.
  • Because MAT transfers across watermark families and architectures, the approach is a general recipe for durability, not tied to one watermark scheme.
  • Since MAT does not hurt pre-merge quality, durability can be added at negligible cost to model utility.
  • The paper's broader suggestion is that adversarial training is a reliable approach for increasing watermark durability against post-training modifications generally.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If robustness learned against linear interpolation transfers broadly, weight-space durability may be a general property of networks trained against interpolation adversaries; one could test whether similar training-time adversaries protect against quantization, pruning, or other post-processing.
  • The paper's cheap BB′ proxy is shown to fail on TIES, so the durability guarantee for trim-and-rescale and sparse merge schemes is untested; testing MAT against DARE-TIES and breadcrumb-style merges would settle whether the linear adversary suffices.
  • The top-k gating choice itself appears to improve standard watermark distillation quality independent of merging, so this insight could benefit distillation even when merging durability is not a concern.
  • A natural extension is to make the merge adversary more expressive during training — for example, sampling from a pool of task vectors or simulating SLERP/TIES steps directly — which might extend durability to the aggressive merges the paper leaves untested.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper proposes Merge-Adversarial Training (MAT), a distillation-time procedure intended to make open-source LLM text watermarks survive post-release model merging. Starting from an unwatermarked base θ0, MAT trains a watermarked student θ by, at each step, forming a linear merge θM = αθ + (1−α)θ0 with α sampled uniformly, and minimizing the KL divergence between the watermarked teacher distribution and the merged model's distribution. The authors evaluate MAT against standard watermark distillation on LLaMA-3.1-8B-Instruct and Qwen-2.5-3B-Instruct, across KGW, AAR, and KTH watermark families, and across LINEAR, SLERP, and TIES merges. They introduce several realistic merge scenarios (finetune-finetune, base-finetune, cascaded merges, merges with community finetunes) and report that MAT consistently improves post-merge TPR@1%FPR while preserving pre-merge detection and downstream quality.

Significance. If the results hold, this is a practically important contribution: prior OSM watermarking has focused on detectability and finetuning robustness, while model merging has been shown to be strongly adversarial to embedded watermarks. The paper's strengths are its broad, controlled evaluation: pre-merge quality and detectability are matched (Tables 1, 3, 4), multiple watermark families and architectures are tested, confidence intervals are reported, and the method is compared against realistic merge pipelines rather than only the unwatermarked-base merge used in prior work. The finding that robustness trained against a single linear merge adversary transfers to SLERP and TIES, and to cascaded and community-finetune merges, is genuinely useful. The main limitations are external-validity concerns: the training adversary is only linear interpolation with the base, and the paper's own Sec. 5 lists DARE-TIES, Model Breadcrumbs, and learned/evolutionary merges as untested. These are acknowledged, but the abstract's unqualified 'durable against model merging' goes beyond the evidence.

major comments (2)
  1. [App. A.1.2 / Sec. 4.1] The headline comparison between KGW-D and MAT is not fully controlled. App. A.1.2 states that KGW-D and MAT use the same KGW parameters (γ=0.25, δ=2.3), but that MAT 'additionally' uses a rank-top-k restriction (k=100). The main experiments therefore vary two components at once: the merge-adversarial loss and the top-k distillation gate. Since restricting the watermark to top-k logits changes where in the distribution the watermark is embedded, the gains in Figures 3–4 cannot be attributed solely to the merge-adversarial objective. Tables 12 and 15 vary k within MAT, and Table 16 compares sampled vs. fixed α, but none of these ablations isolates the merge adversary by comparing against standard distillation with the same k=100 gate (or MAT without the gate). Please add this isolation for at least the main FF/BF/BB' Linear/SLERP/TIES curves; otherwise the central attribution of the improv
  2. [Abstract; Sec. 5; App. A.3.2] The abstract and conclusion state that MAT makes watermarks 'durable against model merging' without qualification. The training adversary in Algorithm 1 is only a linear interpolation toward the unwatermarked base, and Sec. 5 explicitly leaves DARE-TIES, Model Breadcrumbs, and learned/evolutionary merge operators untested. More importantly, App. A.3.2 (Table 6) shows that TIES behaves qualitatively differently from LINEAR/SLERP: the BB' lower-bound proxy fails under TIES, so merge families are not interchangeable for this robustness property. The tested claims are well supported, but the general durability claim is broader than the evidence. I recommend restating the abstract and Sec. 6 as 'durable against the tested LINEAR/SLERP/TIES merge scenarios' and explicitly framing transfer to aggressive trim-and-rescale or learned merge operators as an open empirical risk rather than just futur
minor comments (4)
  1. [App. A.1.2] The sentence 'We use the same KGW parameters in both runs (γ=0.25, k=1)' is confusing: k=1 looks like a top-k gate, while the next sentence introduces a separate rank-top-k restriction with k=100. Please clarify that k=1 is the KGW context/hash parameter and define the logit gate separately.
  2. [Sec. 3.1] 'Adversarial training' is used loosely: the objective is not a min-max game but robust optimization against a stochastic merge perturbation. A brief clarification of this terminology would help readers distinguish it from standard adversarial training.
  3. [Sec. 4.3 / App. A.4.2] The Qwen-2.5-3B ablation reports only TPR under SLERP BB' and does not report pre- or post-merge quality metrics. A sentence explaining why quality is omitted, or a small quality table, would strengthen the architecture-transfer claim.
  4. [General] Typos and minor wording: 'explicitely' (Sec. 3.1), 'such OSMs watermarks' (abstract). Also, the abstract's '+51 pp / +25 pp' numbers are not tied to a specific table or configuration; adding a pointer would be helpful.

Circularity Check

0 steps flagged

No significant circularity: MAT's durability results are empirical, held-out outcomes of a robust-training objective, not consequences of its definitions or self-citations.

full rationale

The derivation chain in this paper is not circular. MAT's training objective (Algorithm 1, Eq. 1) directly minimizes KL divergence between a watermarked teacher and a model merged via linear interpolation with the unwatermarked base; that is a standard robust-training loss, not a disguised restatement of the evaluation metric. The paper's headline durability claims are evaluated against held-out conditions that are not used in training: SLERP and TIES merges, cascaded merges (FF, BF, F2BF, FBF), community finetunes (FuseChat, OpenMath, Tulu), additional watermark families (AAR, KTH), and a different architecture (Qwen-2.5-3B-Instruct). None of these reduce by construction to the linear BB' adversary, and the paper explicitly reports a case where its BB' lower-bound proxy fails (Table 6, App. A.3.2, under TIES), which is the opposite of forcing a fit. The self-citations to Gloaguen et al. [6] and [14] are background/prior-work references; the load-bearing arguments are supported by the paper's own external benchmarks and the externally defined KGW/AAR/KTH detectors. Sec. 5's limitation that DARE-TIES, Model Breadcrumbs, and learned/evolutionary merge operators remain untested is a scope restriction on external validity, not an internal circularity. No fitted parameter is relabeled as a prediction, and no uniqueness theorem or prior-work ansatz is imported to justify the core result. Hence the central claim has independent empirical content and scores 0.

Axiom & Free-Parameter Ledger

5 free parameters · 5 axioms · 0 invented entities

No new physical or conceptual entities are invented; the merge-adversary is a training procedure, not a postulated mechanism. The main implicit assumptions are the transferability of linear-merge robustness and the BB' proxy, both empirical claims with identified failure modes.

free parameters (5)
  • delta (green-list bias) = 2.3
    Chosen via ablation on Llama-3.2-1B (App. B.2/B.4) to balance standalone TPR and post-merge robustness; the main results use this value.
  • gamma (green-list fraction) = 0.25
    Standard KGW hyperparameter from prior work (Kirchenbauer et al.), retained without re-tuning.
  • k (top-k logit gate) = 100
    Selected in App. B.1 on Llama-3.2-1B as the best PPL/robustness trade-off; used for all MAT KGW experiments.
  • alpha_min (merge weight lower bound) = 0.1
    Selected in App. B.3; lower exposure to aggressive merges. The adversary samples alpha uniformly from [0.1, 1.0].
  • alpha_max (merge weight upper bound) = 1.0
    Upper bound of the uniform merge-weight distribution; chosen implicitly.
axioms (5)
  • domain assumption Watermark distillation can embed a detectable generation-time watermark into model weights.
    Relies on the learnability result of Gu et al. [8]; the paper verifies detectability pre-merge (Table 1) but does not re-prove learnability.
  • domain assumption Robustness to linear interpolation with the unwatermarked base transfers to non-linear merges (SLERP, TIES, cascades).
    The training adversary is only linear BB' merges; transfer is validated empirically in Secs. 4.1-4.3, but Sec. 5 lists DARE-TIES and other methods as untested.
  • domain assumption BB' (unwatermarked-base merge) is a worst-case lower bound for durability against cascaded merges.
    Validated for FBF in 93% of configurations (Sec. 4.2), but fails on Math at high alpha_eff and is uninformative for TIES; the paper uses this proxy in ablations.
  • standard math The KL divergence between the watermarked teacher and the merged student is a valid training signal for watermark detectability.
    Standard distillation objective from Gu et al. [8]; the gradient flows through the merged parameters, a standard adversarial-training setup.
  • domain assumption The provider has access to the unwatermarked base model and the watermarked teacher during training.
    Threat model in Sec. 3.1; standard in the OSM watermark distillation setting.

pith-pipeline@v1.3.0-alltime-deepseek · 24037 in / 13460 out tokens · 132165 ms · 2026-08-02T14:21:26.844947+00:00 · methodology

0 comments
read the original abstract

Open-source LLMs (OSMs)arereaching near state-of-the-art performance, prompting prior works to trace the text they generate by embedding text watermarking algorithms directly into their weights. Yet, OSMs are subject to post-training modifications, which has been shown to remove the watermark. Model merging in particular, a prominent method used for combining expert knowledge and preventing catastrophic forgetting, strongly removes such OSM watermarks. A key question is how to enable OSM watermarks that survive subsequent merging. In this work, we show for the first time how to design an OSM watermark that is durable against model merging. We propose Merge-Adversarial Training, an adversarial training algorithm to distill text watermarks into model weights while being robust to subsequent model merging. Our approach consistently outperforms all baselines (e.g. with SLERP up to +51 percentage points (pp) TPR@1%FPR with +25 pp on average) while preserving downstream capabilities. We also for the first time evaluate OSM watermarks against realistic merge scenarios, representing common use-cases such as combining expert capabilities or preventing catastrophic forgetting, and with 3 prominent merging algorithms. More broadly, our findings suggest that adversarial training is a reliable approach for increasing OSM watermark durability against post-training modifications.

Figures

Figures reproduced from arXiv: 2607.20435 by Luisa Scharff, Martin Vechev, Robin Staab, Thibaud Gloaguen.

Figure 1
Figure 1. Figure 1: Overview of our method and evaluation: (Left) Unlike standard watermark distillation, we train the watermark using an adversarial objective: at each step, we simulate a merge operation and optimize for it to remain watermarked. (Middle) After training, both standard distillation and our model are watermarked as long as they are not modified. (Right) Yet, users might finetune the model and create complex me… view at source ↗
Figure 2
Figure 2. Figure 2: Merge evaluation pipeline: The provider releases a watermarked Instruct base (B), and produces watermarked finetunes (F) via SFT. Downstream users merge any combination of these models, yielding the scenarios F F, BF, F 2F, F BF, F 2BF, BB′ , and BF′ that we evaluate. The unwatermarked family ( [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Watermark detectability for different merge ratios of experts (FF): We compare watermark detectability (TPR@1) when merging an α math-finetuned model with a (1 − α) German￾finetuned model using three different merging algorithms. We average results over 500 samples with English, German, and math prompts, respectively. The dashed line corresponds to the single￾finetuning baseline, i.e., the maximum TPR@1 of… view at source ↗
Figure 4
Figure 4. Figure 4: Watermark detectability for different merge ratios against catastrophic forgetting (BF): We compare watermark detectability (TPR@1) when merging an α-weighted math-finetuned model with a (1 − α)-weighted base (watermarked) model using three different merging algorithms. We average results over 500 samples with English, German, and math prompts, respectively. here, our method consistently improves merge rob… view at source ↗
Figure 5
Figure 5. Figure 5: Watermark detectability with cascaded merges: We compare watermark detectability (TPR@1) when merging an α-weighted F F-merged model with a (1−α)-weighted French finetuned model using SLERP merging. We average results over 500 samples with English, German, and math prompts, respectively. The dashed line corresponds to the single-finetuning baseline, i.e., the maximum TPR@1 of the F F-merged and finetuned m… view at source ↗
Figure 6
Figure 6. Figure 6: Watermark detectability for BB′ and F BF with effective merge ratios: We compare watermark detectability (TPR@1%) between the unwatermarked merge BB′ and F BF at matched effective merge ratio αeff. We highlight points where BB′ has higher TPR@1% than F BF. final weight fraction from the watermarked model; e.g., two successive merges at α = 0.5 yield αeff := 0.25. We hypothesize that cascaded-merge durabili… view at source ↗
Figure 7
Figure 7. Figure 7: Durability gain across watermark families and architectures: Post-merge TPR@1% FPR under BB′ on English (C4). Top: AAR (left) and KTH (right) on LLAMA￾3.1-8B-INSTRUCT. Bottom: KGW-D on QWEN-2.5-3B￾INSTRUCT (left, SLERP only) and GAUSSMARK on LLAMA￾3.1-8B-INSTRUCT (right, baseline only) Next, we test whether our gains are specific to KGW-D on LLAMA￾3.1-8B-INSTRUCT along two distinct axes: watermark family a… view at source ↗
Figure 8
Figure 8. Figure 8: F F watermark detection: TPR@1% as a function of α = fraction of Math FT across Linear, SLERP, and TIES. 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 ® (fraction of MathFT) 0.00 0.25 0.50 0.75 1.00 TPR@1%FPR English Linear SLERP TIES MAT (ours) KGW-D 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 ® (fraction of MathFT) German 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 ® (fraction of MathFT) Math [PITH_FULL_IMAGE:figures/full_fig_p0… view at source ↗
Figure 9
Figure 9. Figure 9: BF watermark detection: TPR@1% as a function of α = fraction of Math FT across Linear, SLERP, and TIES. 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 ® (fraction of FF) 0.00 0.25 0.50 0.75 1.00 TPR@1%FPR English 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 ® (fraction of FF) German 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 ® (fraction of FF) Math Linear SLERP TIES MAT (ours) KGW-D [PITH_FULL_IMAGE:figures/full_fig_p016_9.png] view at source ↗
Figure 10
Figure 10. Figure 10 [PITH_FULL_IMAGE:figures/full_fig_p016_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: F BF watermark detection: TPR@1% as a function of α = fraction of BF across Linear, SLERP, and TIES. 16 [PITH_FULL_IMAGE:figures/full_fig_p016_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: F BF vs. BB′ lower-bound test on TPR@1%, full SLERP sweep αeff ∈ {0.05, 0.10, . . . , 0.45}: The bound holds where the solid line sits above the dashed line; config￾urations where it fails (BB′ > F BF) are circled. A.3.2 BB′ as a Lower Bound for F BF In Sec. 4.2, we introduce BB′ as an empirical lower bound on F BF at matched effective watermark dose. Here we present the per-α sweep behind that claim ( [… view at source ↗
Figure 13
Figure 13. Figure 13: F BF vs. BB′ lower-bound test on TPR@1%, full Linear sweep αeff ∈ {0.05, 0.10, . . . , 0.45}: Same conventions as [PITH_FULL_IMAGE:figures/full_fig_p018_13.png] view at source ↗
Figure 14
Figure 14. Figure 14: BF′ FuseChat [42] recovery: TPR@1% as a function of α = fraction of the watermarked B in B ⊗ FuseChat, where FuseChat is a community finetune of LLAMA-3.1-8B-INSTRUCT [46]. 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 ® (fraction of watermarked B) 0.00 0.25 0.50 0.75 1.00 TPR@1%FPR English 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 ® (fraction of watermarked B) German 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 ® (fraction of wa… view at source ↗
Figure 15
Figure 15. Figure 15: BF′ OpenMath [43] recovery: TPR@1% as a function of α = fraction of the water￾marked B in B ⊗ OpenMath, where OpenMath is a community finetune of the LLAMA-3.1-8B base model [46]. Same conventions as [PITH_FULL_IMAGE:figures/full_fig_p019_15.png] view at source ↗
Figure 16
Figure 16. Figure 16: BF′ Tulu [44] recovery: TPR@1% as a function of α = fraction of the watermarked B in B ⊗ Tulu, where Tulu is a community finetune of the LLAMA-3.1-8B base model [46]. Same conventions as [PITH_FULL_IMAGE:figures/full_fig_p019_16.png] view at source ↗
Figure 17
Figure 17. Figure 17: BB′ recovery: TPR@1% as a function of α = fraction of the watermarked B in B⊗B′ unwm, where B′ unwm is the unwatermarked LLAMA-3.1-8B-INSTRUCT base [46]. A.3.5 Post-Merge Benchmark Results for F F and BF [PITH_FULL_IMAGE:figures/full_fig_p020_17.png] view at source ↗
Figure 18
Figure 18. Figure 18: AAR BB′ scenario on English domain: TPR@1% as a function of α = fraction of the watermarked AAR base B in BB′ , across Linear, SLERP, and TIES. AAR-D (dashed, open markers) collapses on Linear/SLERP at α ≤ 0.5; MAT AAR preserves detectability down to α = 0.3. TIES is saturated for both variants. 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 ® (fraction of watermarked B) 0.00 0.25 0.50 0.75 1.00 TPR@1%FPR KTH, BB 0 … view at source ↗
Figure 19
Figure 19. Figure 19: KTH BB′ scenario on English domain: TPR@1% as a function of α = fraction of the watermarked KTH base B in BB′ , across Linear, SLERP, and TIES. KTH-D (dashed, open markers) collapses on Linear/SLERP at α ≤ 0.4; MAT KTH (solid, filled markers) preserves detectability from α = 0.4 upward. TIES is saturated for both variants. A.4.2 Qwen-2.5-3B-Instruct Model [PITH_FULL_IMAGE:figures/full_fig_p021_19.png] view at source ↗
Figure 20
Figure 20. Figure 20: GaussMark BB′ merge scenario on English domain: TPR@1% under the BB′ merge as a function of α = fraction of the watermarked GaussMark base B, across Linear, SLERP, and TIES. B Ablations In this section, we ablate the components of our method presented in Sec. 3.1. Experimental Setup All ablations are run on LLAMA-3.2-1B-INSTRUCT for 7 500 steps (LR = 1e−5, 500-step warm-up, cosine decay). The Hyperparamet… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

53 extracted references · 18 linked inside Pith

  1. [1]

    Generative ai transparency: Identifi- cation of machine-generated content

    Hamon R, Sanchez I, Fernandez Llorca D, and Gomez E. Generative ai transparency: Identifi- cation of machine-generated content. Scientific analysis or review, Ispra (Italy), 2024

    2024

  2. [2]

    Scalable watermarking for identifying large language model outputs.Nature, 634(8035):818–823, 2024

    Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, et al. Scalable watermarking for identifying large language model outputs.Nature, 634(8035):818–823, 2024

    2024

  3. [3]

    Qwen3.5: Towards native multimodal agents, February 2026

    Qwen Team. Qwen3.5: Towards native multimodal agents, February 2026. URL https: //qwen.ai/blog?id=qwen3.5

    2026

  4. [4]

    Deepseek-v4: Towards highly efficient million-token context intelligence, 2026

    DeepSeek-AI. Deepseek-v4: Towards highly efficient million-token context intelligence, 2026

    2026

  5. [5]

    Kimi k2.5: Visual agentic intelligence,

    Kimi Team, Tongtong Bai, Yifan Bai, Yiping Bao, et al. Kimi k2.5: Visual agentic intelligence,

  6. [6]

    Towards watermarking of open-source llms.arXiv preprint arXiv:2502.10525, 2025

    Thibaud Gloaguen, Nikola Jovanovi´c, Robin Staab, and Martin Vechev. Towards watermarking of open-source llms.arXiv preprint arXiv:2502.10525, 2025

    Pith/arXiv arXiv 2025

  7. [7]

    Open llm leaderboard

    Edward Beeching, Clémentine Fourrier, Nathan Habib, Sheon Han, Nathan Lambert, Nazneen Rajani, Omar Sanseviero, Lewis Tunstall, and Thomas Wolf. Open llm leaderboard. https: //huggingface.co/spaces/open-llm-leaderboard/open _llm_leaderboard, 2023

    2023

  8. [8]

    On the learnability of watermarks for language models

    Chenchen Gu, Xiang Lisa Li, Percy Liang, and Tatsunori Hashimoto. On the learnability of watermarks for language models. InThe Twelfth International Conference on Learning Representations (ICLR), 2024. URLhttps://openreview.net/forum?id=9k0krNzvlV

    2024

  9. [9]

    Gaussmark: A practical approach for structural watermarking of language models, 2025

    Adam Block, Ayush Sekhari, and Alexander Rakhlin. Gaussmark: A practical approach for structural watermarking of language models, 2025. URL https://arxiv.org/abs/2501. 13941

    2025

  10. [10]

    A watermark for large language models

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. InInternational Conference on Machine Learning, pages 17061–17084. PMLR, 2023

    2023

  11. [11]

    Robust distortion- free watermarks for language models.TMLR, 2024

    Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion- free watermarks for language models.TMLR, 2024

    2024

  12. [12]

    Watermarking of large language models

    Scott Aaronson. Watermarking of large language models. InWorkshop on Large Language Models and Transformers, Simons Institute, UC Berkeley, 2023

    2023

  13. [13]

    Pro: Enabling precise and robust text watermark for open-source llms.arXiv preprint arXiv:2510.23891, 2025

    Jiaqi Xue, Yifei Zhao, Mansour Al Ghanim, Shangqian Gao, Ruimin Sun, Qian Lou, and Mengxin Zheng. Pro: Enabling precise and robust text watermark for open-source llms.arXiv preprint arXiv:2510.23891, 2025

    arXiv 2025

  14. [14]

    LLM fingerprinting via semantically conditioned watermarks

    Thibaud Gloaguen, Robin Staab, Nikola Jovanovi´c, and Martin Vechev. LLM fingerprinting via semantically conditioned watermarks. InThe Fourteenth International Conference on Learning Representations, 2026. URLhttps://openreview.net/forum?id=t38nZqqi3Z

    2026

  15. [15]

    On the reliability of watermarks for large language models.arXiv preprint arXiv:2306.04634, 2023

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the reliability of watermarks for large language models.arXiv preprint arXiv:2306.04634, 2023

    Pith/arXiv arXiv 2023

  16. [16]

    Can ai-generated text be reliably detected?arXiv preprint arXiv:2303.11156, 2023

    Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected?arXiv preprint arXiv:2303.11156, 2023

    Pith/arXiv arXiv 2023

  17. [17]

    Watermark stealing in large language models

    Nikola Jovanovi´c, Robin Staab, and Martin Vechev. Watermark stealing in large language models. InInternational Conference on Machine Learning, pages 22570–22593. PMLR, 2024

    2024

  18. [18]

    Can watermarks survive translation? on the cross-lingual consistency of text watermark for large language models

    Zhiwei He, Binglin Zhou, Hongkun Hao, Aiwei Liu, Xing Wang, Zhaopeng Tu, Zhuosheng Zhang, and Rui Wang. Can watermarks survive translation? on the cross-lingual consistency of text watermark for large language models. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 4115–4129, 2024. 10

    2024

  19. [19]

    No free lunch in llm watermarking: Trade-offs in watermarking design choices.Advances in Neural Information Processing Systems, 37:138756–138788, 2024

    Qi Pang, Shengyuan Hu, Wenting Zheng, and Virginia Smith. No free lunch in llm watermarking: Trade-offs in watermarking design choices.Advances in Neural Information Processing Systems, 37:138756–138788, 2024

    2024

  20. [20]

    Arcee’s MergeKit: A toolkit for merging large language models

    Charles Goddard, Shamane Siriwardhana, Malikeh Ehghaghi, Luke Meyers, Vladimir Karpukhin, Brian Benedict, Mark McQuade, and Jacob Solawetz. Arcee’s MergeKit: A toolkit for merging large language models. In Franck Dernoncourt, Daniel Preo¸ tiuc-Pietro, and Anastasia Shimorina, editors,Proceedings of the 2024 Conference on Empirical Methods in Natural Langu...

    2024

  21. [21]

    Editing models with task arithmetic.arXiv preprint arXiv:2212.04089, 2022

    Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. Editing models with task arithmetic.arXiv preprint arXiv:2212.04089, 2022

    Pith/arXiv arXiv 2022

  22. [22]

    Ties-merging: Resolving interference when merging models.Advances in neural information processing systems, 36:7093–7115, 2023

    Prateek Yadav, Derek Tam, Leshem Choshen, Colin A Raffel, and Mohit Bansal. Ties-merging: Resolving interference when merging models.Advances in neural information processing systems, 36:7093–7115, 2023

    2023

  23. [23]

    Language models are super mario: Absorbing abilities from homologous models as a free lunch

    Le Yu, Bowen Yu, Haiyang Yu, Fei Huang, and Yongbin Li. Language models are super mario: Absorbing abilities from homologous models as a free lunch. InForty-first International Conference on Machine Learning, 2024

    2024

  24. [24]

    Dimitrov, Ce Zhang, Martin Vechev, and Kristina Toutanova

    Anton Alexandrov, Veselin Raychev, Dimitar I. Dimitrov, Ce Zhang, Martin Vechev, and Kristina Toutanova. Bggpt 1.0: Extending english-centric llms to other languages, 2024. URL https://arxiv.org/abs/2412.10893

    Pith/arXiv arXiv 2024

  25. [25]

    Instruction tuning with GPT-4, 2023

    Baolin Peng, Chunyuan Li, Pengcheng He, Michel Galley, and Jianfeng Gao. Instruction tuning with GPT-4, 2023

    2023

  26. [26]

    OpenWebText corpus

    Aaron Gokaslan and Vanya Cohen. OpenWebText corpus. http://Skylion007.github.io/ OpenWebTextCorpus, 2019

    2019

  27. [27]

    Alpaca-GPT4-DE: German translation of the Alpaca-GPT4 instruction dataset

    LeoLM. Alpaca-GPT4-DE: German translation of the Alpaca-GPT4 instruction dataset. https: //huggingface.co/datasets/LeoLM/alpaca_gpt4_de, 2023

    2023

  28. [28]

    FineWeb-2: A sparkling update with 1000s of languages.https://huggingface.co/datasets/HuggingFaceFW/fineweb-2, 2024

    Guilherme Penedo, Hynek Kydlíˇcek, Vinko Sabolcˇec, Bettina Messmer, Negar Foroutan, Martin Jaggi, Leandro von Werra, and Thomas Wolf. FineWeb-2: A sparkling update with 1000s of languages.https://huggingface.co/datasets/HuggingFaceFW/fineweb-2, 2024

    2024

  29. [29]

    Kwok, Zhenguo Li, Adrian Weller, and Weiyang Liu

    Longhui Yu, Weisen Jiang, Han Shi, Jincheng Yu, Zhengying Liu, Yu Zhang, James T. Kwok, Zhenguo Li, Adrian Weller, and Weiyang Liu. MetaMath: Bootstrap your own mathematical questions for large language models. InThe Twelfth International Conference on Learning Representations (ICLR), 2024. URLhttps://openreview.net/forum?id=N8N0hgNDRt

    2024

  30. [30]

    Code Alpaca: An instruction-following LLaMA model for code generation

    Sahil Chaudhary. Code Alpaca: An instruction-following LLaMA model for code generation. https://github.com/sahil280114/codealpaca, 2023

    2023

  31. [31]

    Nu- minamath

    Jia LI, Edward Beeching, Lewis Tunstall, Ben Lipkin, Roman Soletskyi, Shengyi Costa Huang, Kashif Rasul, Longhui Yu, Albert Jiang, Ziju Shen, Zihan Qin, Bin Dong, Li Zhou, Yann Fleureau, Guillaume Lample, and Stanislas Polu. Nu- minamath. [https://huggingface.co/AI-MO/NuminaMath-CoT](https://github.com/ project-numina/aimo-progress-prize/blob/main/report/...

    2024

  32. [32]

    Mul- tilingualSIFT: Multilingual Supervised Instruction Fine-tuning, July 2023

    Zhihong Chen, Shuo Yan, Juhao Liang, Feng Jiang, Xiangbo Wu, Fei Yu, Guiming Hardy Chen, Junying Chen, Hongbo Zhang, Li Jianquan, Wan Xiang, and Benyou Wang. Mul- tilingualSIFT: Multilingual Supervised Instruction Fine-tuning, July 2023. URL https: //github.com/FreedomIntelligence/MultilingualSIFT.git

    2023

  33. [33]

    French-alpaca: A French instruction-following dataset (110k)

    Jonathan Pacifico. French-alpaca: A French instruction-following dataset (110k). https: //huggingface.co/datasets/jpacifico/French-Alpaca-dataset-Instruct-110K, 2024. 11

    2024

  34. [34]

    The lucie-7b llm and the lucie training dataset: Open resources for multilingual language generation, 2025

    Olivier Gouvert, Julie Hunter, Jérôme Louradour, Christophe Cerisara, Evan Dufraisse, Yaya Sy, Laura Rivière, Jean-Pierre Lorré, and OpenLLM-France community. The lucie-7b llm and the lucie training dataset: Open resources for multilingual language generation, 2025. URL https://arxiv.org/abs/2503.12294

    Pith/arXiv arXiv 2025

  35. [35]

    Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. Exploring the limits of transfer learning with a unified text-to-text transformer, 2023. URLhttps://arxiv.org/abs/1910.10683

    Pith/arXiv arXiv 2023

  36. [36]

    Training verifiers to solve math word problems.arXiv preprint arXiv:2110.14168, 2021

    Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman. Training verifiers to solve math word problems.arXiv preprint arXiv:2110.14168, 2021

    Pith/arXiv arXiv 2021

  37. [37]

    The language model evaluation harness, 07 2024

    Leo Gao, Jonathan Tow, Baber Abbasi, Stella Biderman, Sid Black, Anthony DiPofi, Charles Foster, Laurence Golding, Jeffrey Hsu, Alain Le Noac’h, Haonan Li, Kyle McDonell, Niklas Muennighoff, Chris Ociepa, Jason Phang, Laria Reynolds, Hailey Schoelkopf, Aviya Skowron, Lintang Sutawika, Eric Tang, Anish Thite, Ben Wang, Kevin Wang, and Andy Zou. The languag...

    arXiv 2024

  38. [38]

    Think you have solved question answering? try arc, the ai2 reasoning challenge, 2018

    Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. Think you have solved question answering? try arc, the ai2 reasoning challenge, 2018. URLhttps://arxiv.org/abs/1803.05457

    Pith/arXiv arXiv 2018

  39. [39]

    Measuring massive multitask language understanding, 2021

    Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding, 2021. URL https: //arxiv.org/abs/2009.03300

    Pith/arXiv arXiv 2021

  40. [40]

    Hellaswag: Can a machine really finish your sentence?, 2019

    Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi. Hellaswag: Can a machine really finish your sentence?, 2019. URLhttps://arxiv.org/abs/1905.07830

    Pith/arXiv arXiv 2019

  41. [41]

    Solving quantitative reasoning problems with language models, 2022

    Aitor Lewkowycz, Anders Andreassen, David Dohan, Ethan Dyer, Henryk Michalewski, Vinay Ramasesh, Ambrose Slone, Cem Anil, Imanol Schlag, Theo Gutman-Solo, Yuhuai Wu, Behnam Neyshabur, Guy Gur-Ari, and Vedant Misra. Solving quantitative reasoning problems with language models, 2022. URLhttps://arxiv.org/abs/2206.14858

    Pith/arXiv arXiv 2022

  42. [42]

    Fusechat: Knowl- edge fusion of chat models, 2024

    Fanqi Wan, Longguang Zhong, Ziyi Yang, Ruijun Chen, and Xiaojun Quan. Fusechat: Knowl- edge fusion of chat models, 2024. URLhttps://arxiv.org/abs/2408.07990

    Pith/arXiv arXiv 2024

  43. [43]

    Openmathinstruct-2: Accelerating ai for math with massive open-source instruction data.arXiv preprint arXiv:2410.01560, 2024

    Shubham Toshniwal, Wei Du, Ivan Moshkov, Branislav Kisacanin, Alexan Ayrapetyan, and Igor Gitman. Openmathinstruct-2: Accelerating ai for math with massive open-source instruction data.arXiv preprint arXiv:2410.01560, 2024

    Pith/arXiv arXiv 2024

  44. [44]

    Miranda, Alisa Liu, Nouha Dziri, Shane Lyu, Yuling Gu, Saumya Malik, Victoria Graf, Jena D

    Nathan Lambert, Jacob Morrison, Valentina Pyatkin, Shengyi Huang, Hamish Ivison, Faeze Brahman, Lester James V . Miranda, Alisa Liu, Nouha Dziri, Shane Lyu, Yuling Gu, Saumya Malik, Victoria Graf, Jena D. Hwang, Jiangjiang Yang, Ronan Le Bras, Oyvind Tafjord, Chris Wilhelm, Luca Soldaini, Noah A. Smith, Yizhong Wang, Pradeep Dasigi, and Hannaneh Hajishirz...

    2024

  45. [45]

    Model breadcrumbs: Scaling multi-task model merging with sparse masks

    MohammadReza Davari and Eugene Belilovsky. Model breadcrumbs: Scaling multi-task model merging with sparse masks. InEuropean Conference on Computer Vision, pages 270–287. Springer, 2024

    2024

  46. [46]

    The Llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, et al. The Llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

    Pith/arXiv arXiv 2024

  47. [47]

    Llama 2: Open foundation and fine-tuned chat models, 2023

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, et al. Llama 2: Open foundation and fine-tuned chat models, 2023. URLhttps://arxiv.org/abs/2307.09288

    Pith/arXiv arXiv 2023

  48. [48]

    Morcos, Hongseok Namkoong, Ali Farhadi, Yair Carmon, Simon Kornblith, and Ludwig Schmidt

    Mitchell Wortsman, Gabriel Ilharco, Samir Yitzhak Gadre, Rebecca Roelofs, Raphael Gontijo- Lopes, Ari S. Morcos, Hongseok Namkoong, Ali Farhadi, Yair Carmon, Simon Kornblith, and Ludwig Schmidt. Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time, 2022. URL https://arxiv.org/abs/2203.05482

    Pith/arXiv arXiv 2022

  49. [49]

    Qwen2.5: A party of foundation models, September 2024

    Qwen Team. Qwen2.5: A party of foundation models, September 2024. URL https://qwenlm. github.io/blog/qwen2.5/. 12 A Supplementary Results A.1 Watermark Distillation and SFT Hyperparameters A.1.1 Data Mixture Watermark distillation uses a multi-domain mix: 30% math (METAMATHQA [ 29]), 30% German (20% ALPACA-GPT4-DE [ 27] + 10% FINEWEB-2 [ 28] deu_Latn), 30...

    2024

  50. [52]

    We use the same KGW parameters in both runs (γ=0.25, k=1)

    inBFLOAT16, using AdamW ( β1=0.9, β2=0.999, ε=10−8), cosine LR schedule with 500 warm-up steps and peak LR 1×10−5, a batch size of 64, and gradient checkpointing enabled. We use the same KGW parameters in both runs (γ=0.25, k=1). The bias is δ=2.3 for KGW-D and MAT KGW-D, with the latter additionally using the rank-top- k restriction (k=100). The merge ad...

    2048

  51. [53]

    and used in Gloaguen et al. [6]: from the watermarked model, we generate, unless otherwise mentioned, n= 500 continuations conditioned on natural-text prefixes drawn from a domain- matched corpus (C4-REALNEWSLIKE[ 35] for English, FINEWEB-2 deu_Latn [28]/fra_Latn [28] for German/French, and GSM8K [ 36] prompts for math). We compute their perplexity with L...

  52. [2024]

    doi: 10.18653/v1/2024.emnlp-industry.36

    Association for Computational Linguistics. doi: 10.18653/v1/2024.emnlp-industry.36. URLhttps://aclanthology.org/2024.emnlp-industry.36

    doi:10.18653/v1/2024.emnlp-industry.36 2024

  53. [2026]

    URLhttps://arxiv.org/abs/2602.02276

    Pith/arXiv arXiv