Paper deep dive
LineageMark: Multi-user White-box Watermarking for Contribution Tracing in Model Derivation Chains
Bingxue Zhang, Xiaofeng Xu, Feida Zhu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 6/20/2026, 8:46:29 AM
Summary
LineageMark is a multi-user white-box watermarking framework designed for Large Language Model (LLM) derivation chains. It addresses the challenges of historical watermark decay and interference from new watermarks during multi-stage model adaptation (e.g., fine-tuning, quantization, pruning). The framework uses a projection-based approach where watermark bits are represented as sign-projection statistics over stable carrier regions. These carriers are selected using an empirical hidden-space Fisher matrix and a compression second-moment matrix to ensure functional relevance and perturbation stability. Each contributor uses a private key to generate unique coordinate groups and projection directions, enabling independent, incremental watermark insertion and verification without requiring the original model or other users' keys.
Entities (8)
Relation Signals (5)
LineageMark → addresses → Model Derivation Chain
confidence 100% · LineageMark addresses two major challenges in model derivation chains: historical watermark drift caused by subsequent derivation and interference introduced by newly inserted watermarks.
LineageMark → selects → Stable Carrier
confidence 100% · Before embedding, LineageMark selects a set of stable carrier coordinates for modifying model weights.
LineageMark → uses → Sign-projection Statistic
confidence 100% · LineageMark represents each watermark bit as a sign-projection statistic computed over a group of weight coordinates
Fisher Matrix → measures → Functional Relevance
confidence 90% · uses an empirical hidden-space Fisher matrix to measure functional relevance
Compression Second-moment Matrix → measures → Perturbation Sensitivity
confidence 90% · and a compression second-moment matrix to measure perturbation sensitivity.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:In open large language model (LLM) ecosystems, models are frequently adapted across multiple domains and applications, forming multi-stage derivation chains. Consequently, tracking and verifying historical contributions is essential for model provenance and intellectual property protection. However, existing watermarking methods are mainly designed for single-user, one-time embeddings, often fail under repeated model derivation and incremental updates. To address this problem, we propose LineageMark, a multi-user white-box watermarking framework for model derivation chains. The framework encodes watermarks in model parameters using a projection-based approach. Stable carriers are first selected to reduce sensitivity to model changes, each watermark bit is then represented as a projection statistic over these carriers. Additional watermark insertions introduce only bounded perturbations in the projection space, and margin constraints are used to maintain signal integrity. We evaluate the effectiveness of LineageMark in multi-stage model derivation chains. Experimental results show that LineageMark preserves contributor watermarks across multi-stage derivation and supports incremental multi-user watermark insertion. Furthermore, it exhibits robustness against perturbations such as re-watermarking, fine-tuning, quantization, and pruning.
Tags
Links
- Source: https://arxiv.org/abs/2606.17123v1
- Canonical: https://arxiv.org/abs/2606.17123v1
Trouble viewing inline? Open PDF directly →
Full Text
79,518 characters extracted from source content.
Expand or collapse full text
LineageMark: Multi-user White-box Watermarking for Contribution Tracing in Model Derivation Chains Bingxue Zhang1, Xiaofeng Xu1, Feida Zhu2,* Abstract In open large language model (LLM) ecosystems, models are frequently adapted across multiple domains and applications, forming multi-stage derivation chains. Consequently, tracking and verifying historical contributions is essential for model provenance and intellectual property protection. However, existing watermarking methods are mainly designed for single-user, one-time embeddings, often fail under repeated model derivation and incremental updates. To address this problem, we propose LineageMark, a multi-user white-box watermarking framework for model derivation chains. The framework encodes watermarks in model parameters using a projection-based approach. Stable carriers are first selected to reduce sensitivity to model changes, each watermark bit is then represented as a projection statistic over these carriers. Additional watermark insertions introduce only bounded perturbations in the projection space, and margin constraints are used to maintain signal integrity. We evaluate the effectiveness of LineageMark in multi-stage model derivation chains. Experimental results show that LineageMark preserves contributor watermarks across multi-stage derivation and supports incremental multi-user watermark insertion. Furthermore, it exhibits robustness against perturbations such as re-watermarking, fine-tuning, quantization, and pruning. I Introduction In open LLM ecosystems built around pretrained language models [16], scaling results further encourage model reuse and adaptation [7]. A base model is often continuously adapted by different contributors for specific tasks, domain data, and application requirements, producing new derived models. These derived models may further serve as the basis for subsequent development and adaptation, forming a multi-stage model lineage [8, 23]. Therefore, a derived model carries contributions from the original developer and intermediate derivation stages, becoming a digital asset shaped by multiple contributors. For LLMs as digital assets, watermarking provides a practical approach to intellectual property protection and ownership verification [46, 13]. Existing watermarking methods provide evidence through generated text or model behavior [32, 1, 53, 47], or embed watermark signals into internal representations, selected layers, parameter subsets, and large white-box parameter spaces [17, 54, 50]. However, these methods are not directly suited to model derivation chains. In this setting, subsequent contributors may further adapt a watermarked model and modify the parameters carrying watermark signals. As a result, historical watermarks can be attenuated by parameter drift, while newly inserted watermarks may overlap with existing carriers or perturb their encoded signals. As illustrated in Fig. 1, historical watermark decay and interference from new watermarks are the main challenges for reliable multi-user verification in multi-stage model derivation. Figure 1: Watermarking Challenges and Objectives in Model Derivation Chains. To address these challenges, this work targets multi-user white-box watermarking in model derivation chains. Rather than recovering the full derivation topology or insertion order, our goal is to verify which contributor watermarks are retained in a downstream derived model. This requires three properties. First, lineage preservation: embedded historical watermarks should remain extractable after subsequent derivation stages. Second, incremental embedding: a new contributor should be able to insert a watermark without destroying existing ones. Third, independent verification: each contributor should verify its watermark using only its own key, without the original model, other keys, or full derivation history. We propose LineageMark, a multi-user white-box watermarking framework for model derivation chains. LineageMark represents each watermark bit as a sign-projection statistic computed over a group of weight coordinates, rather than relying on individual weights or local parameter patterns. This representation makes the watermark signal less sensitive to local parameter changes caused by subsequent derivation and other model edits. To support incremental multi-user watermarking, LineageMark combines margin-aware embedding with redundant projection carriers, which preserves a decision margin for later derivation stages and reduces interference from newly inserted watermarks. Each contributor generates their coordinate groups and projection directions from private keys, enabling independent watermark insertion and verification without sharing keys or embedding masks. LineageMark further selects stable carrier regions according to model sensitivity and perturbation stability, reducing the risk that historical watermarks drift during later updates. During verification, a contributor reconstructs the projection detector using only their own key and extracts its watermark from a derived model, without requiring the original model, calibration data, or other contributors’ information. We evaluate LineageMark on multi-stage derivation chains constructed through continuous full-parameter fine-tuning. It covers models of different scales and multiple domain datasets. The evaluation focuses on three aspects: whether historical watermarks remain verifiable after successive derivation, whether downstream contributors can incrementally insert new watermarks without disrupting existing ones, and whether each contributor can independently verify their watermark. Experimental results show that LineageMark consistently maintains high extraction accuracy for historical and newly inserted watermarks across derivation stages. Compared with representative white-box watermarking baselines, LineageMark exhibits lower historical watermark decay and less multi-user interference. It also remains robust under common white-box model modifications, including further fine-tuning, quantization, and pruning. The main contributions are summarized as follows: • We formalize multi-user white-box watermarking in model derivation chains, identifying lineage preservation, incremental embedding, and key-only independent verification as core requirements. • We propose LineageMark, a watermarking framework that encodes each bit as a margin-constrained sign-projection statistic across multiple weight coordinates, enhancing robustness against parameter drift and multi-user interference. • We design stable carrier selection and key-driven verification, allowing each contributor to embed and verify watermarks independently without access to the original model or other users’ information. • We evaluate LineageMark across models and domains, demonstrating reliable historical watermark preservation, incremental embedding, independent verification, and robustness to fine-tuning, re-watermarking, quantization, and pruning. I Related Work This section reviews prior work most relevant to LineageMark from two perspectives: LLM watermarking and model lineage or contribution tracing. I-A LLM Watermark LLM watermarking can be broadly divided into black-box and white-box methods. Black-box methods verify model ownership or output provenance through externally observable behaviors, including instruction-level fingerprints, model-specific responses, and generated-text statistical signals [32]. Distortion-free watermarking provides another line of output-side evidence for language models [36]. Theoretical studies further analyze watermark detectability and undetectability under language-model generation settings [11]. Other methods use radioactive training data or model fingerprints to support attribution and remote model identification [43, 47]. Merge-resistant fingerprints further study ownership verification under model merging [49]. Black-box methods are useful when model weights are unavailable, but they are not designed to preserve contributor identity inside the parameter space of an openly redistributed derived model. Since their evidence is mainly behavioral or output-side, they cannot directly control stable internal carriers or support repeated key-based insertion by multiple historical contributors. White-box watermarking embeds verifiable identity information into model internals, such as parameters, hidden representations, or selected parameter subspaces [46, 13]. Passport-based verification also embeds ownership evidence into model behavior and parameters [17]. Recent white-box LLM watermarking methods select suitable weight parameters in quantized LLMs, exploit redundancy in large parameter spaces to reduce embedding cost, or construct watermark carriers from model weights [54, 50]. Prior studies on neural-network ownership verification also show that dynamic black-box watermarks and proof-of-learning evidence can provide model-level evidence [44, 29]. Conferrable adversarial examples provide another fingerprinting mechanism for model ownership verification. However, reliability studies indicate that watermark persistence can be affected by decoding, model editing, and quantization [33, 19]. Pruning introduces another compression-induced perturbation that may affect embedded evidence [18]. These white-box methods are closely related to this work because they embed verifiable information inside model internals. However, they mainly target single-owner verification, where one watermark is inserted and later checked in a suspicious model. Such designs do not explicitly address model derivation chains, where multiple contributor watermarks must coexist and remain independently verifiable after repeated model updates and watermark insertion. I-B Model Lineage and Contribution Tracing In a model derivation chain, a base model is adapted, fine-tuned, and redistributed across different stages, and the resulting model is jointly shaped by contributors from multiple stages. A model can therefore be viewed as an evolving digital asset, and provenance-oriented thinking is useful for tracing historical contributions [8, 12]. General database provenance studies further clarify why provenance should record how derived artifacts are produced and transformed [10]. Database research has studied lineage management for uncertain and collaborative data [4]. Annotation management provides another mechanism for carrying metadata through data transformations [5]. It has also developed provenance semirings and query-rewriting provenance systems that inspire contribution tracing in derived artifacts [23, 22]. Broader provenance taxonomies summarize how provenance is represented and used across systems [25]. In machine learning and LLM ecosystems, prior work has studied model source identification and model fingerprinting [29]. Instructional fingerprinting extends this idea to large language models [47]. Merge-aware fingerprints and model editing studies analyze how model operations affect identifiable evidence [49]. Interference-aware model merging further highlights the need to manage conflicts among derived model updates [48]. Training-data influence methods estimate how data affects model predictions [35, 20]. Scalable behavior attribution further connects training data to learned model outputs. Data valuation methods quantify the contribution of training examples or data owners to learned models [21, 30]. Reinforcement-learning-based data valuation studies provide another route for estimating data utility. Datamodel-based attribution provides another way to connect training data to model behavior. These methods aim to determine whether a model originates from a specific source model, or whether a single-owner fingerprint remains identifiable after operations such as merging or fine-tuning. However, these approaches typically do not require contributors at different derivation stages to incrementally embed their own watermarks into the model, nor do they support independent verification of all historical contributors from the same final derived model. I Preliminary This section presents the problem formulation, the fine-tuning-based derivation setting, and the threat model of LineageMark. I-A Problem Statement In open model ecosystems, a model may undergo multiple derivation stages. Let M0M_0 denote the initial model. At stage t, a contributor is denoted by utu_t, the contributor’s private key by ktk_t, and the watermark payload by wtw_t. The model received at stage t may already contain watermarks inserted by previous contributors. The contributor first derives the received model using their own data and task requirements, and then embeds their watermark into the derived model. Formally, let Mt−1wmM_t-1^wm be the model after watermark embedding at stage t−1t-1. The t-th stage first performs a model derivation operation: Mt=Derive(Mt−1wm,t),M_t=Derive\! (M_t-1^wm,D_t ), (1) where tD_t denotes the domain or task data used at stage t. The contributor then embeds its watermark wtw_t into the current model using its private key ktk_t: Mtwm=Embed(Mt,wt,kt).M_t^wm=Embed\! (M_t,w_t,k_t ). (2) After stage t, the current model MtwmM_t^wm should contain the watermark set associated with historical contributors u1,u2,…,ut\u_1,u_2,…,u_t\. For any historical contributor uiu_i with i≤ti≤ t, a verifier should be able to verify the existence of that user’s watermark using only the current model, the candidate user’s key, and the claimed watermark: w^i=Extract(Mtwm,ki),i≤t, w_i=Extract\! (M_t^wm,k_i ), i≤ t, (3) Verify(w^i,wi)=1.Verify\! ( w_i,w_i )=1. (4) Thus, multi-user white-box watermarking in model derivation chains requires that any historical watermark remain independently verifiable from a downstream derived model. Later contributors should also be able to insert new watermarks without disrupting existing ones, and watermark embedding should preserve model utility. The goal of this work is not to recover the complete derivation topology or infer the chronological order of watermark insertion. Instead, we aim to verify which candidate contributor watermarks are retained in a given derived model. I-B Fine-tuning-based Derivation Setting Model derivation can be realized through various operations, such as continued pre-training, domain adaptation, and instruction tuning [27, 16]. Unified text-to-text transfer learning provides another representative adaptation paradigm. Parameter-efficient fine-tuning adapts models through additional modules or low-rank updates [26]. Prefix tuning is another parameter-efficient adaptation mechanism for generation tasks [38]. Model merging combines multiple fine-tuned models or task vectors into a new model [28]. Interference-aware merging further shows that derived updates can conflict with one another [48]. Model compression changes parameters through pruning or quantization [24, 19]. One-shot pruning of large generative models provides another strong parameter-removal operation [18]. These operations affect model parameters in different ways and may introduce different perturbations to embedded watermarks. In this work, we focus on derivation chains constructed through successive full-parameter fine-tuning, and use this setting as a stringent stress test under strong parameter updates. We choose full-parameter fine-tuning for two reasons. First, it updates all trainable weights of a model. Compared with adaptation methods that modify only a small number of additional parameters, full-parameter fine-tuning imposes more direct and widespread changes on the parameter space where watermarks are embedded. Second, multi-stage full-parameter fine-tuning simulates the repeated parameter drift experienced by historical watermarks during task adaptation and domain transfer. We do not claim that full-parameter fine-tuning covers all possible derivation operations. Instead, we use it to evaluate whether multi-user watermarks can be preserved under strong model evolution. I-C Threat Model and Design Goals We consider a white-box verification scenario in open model ecosystems. The verifier can access the full parameters of a target model and aims to determine whether the model contains the watermark of a candidate historical contributor. Each contributor holds a private key that is unavailable to other contributors and attackers. We assume that an attacker knows the overall workflow of LineageMark, but does not know the target contributor’s private key and cannot reconstruct the key-specific watermark detector. In the normal derivation process, downstream contributors may further fine-tune a watermarked model and insert new watermarks. These operations may unintentionally weaken historical watermarks by modifying their carrier parameters. In addition, an attacker may obtain a watermarked model and perform white-box modifications to weaken or remove a target watermark while preserving model utility. We consider further fine-tuning, re-watermarking, quantization, and pruning as the main perturbation sources. Further fine-tuning updates model parameters using new tasks or domain data; re-watermarking simulates later watermark insertion; quantization changes parameter precision and numerical distributions; and pruning removes or zeros out a subset of weights. Based on this threat model, LineageMark is designed to satisfy four goals. Historical watermark preservation: a historical contributor’s watermark should remain verifiable after subsequent derivation and white-box modifications. Incremental embedding: a new contributor should be able to embed a watermark into the current model while minimizing disruption to existing watermarks. Independent verification: each contributor should be able to verify their watermark using only their private key, without accessing the original model, calibration data, other contributors’ keys, or the complete derivation history. Utility preservation: watermark embedding and multi-stage incremental insertion should not significantly degrade performance on target-domain or general tasks. IV LineageMark Design This section presents the design of LineageMark. We first analyze why conventional white-box watermarks are fragile in model derivation chains and summarize the overall workflow. We then describe stable-oriented carrier selection, interference-resilient sign-projection embedding, and key-driven watermark extraction. IV-A Overview LineageMark addresses two major challenges in model derivation chains: historical watermark drift caused by subsequent derivation and interference introduced by newly inserted watermarks. To mitigate these issues, it integrates stability-aware carrier selection, keyed sign-projection embedding, and key-driven extraction. Fig. 2 summarizes the workflow of LineageMark. Before embedding, LineageMark selects candidate carriers that are more stable under subsequent full-parameter fine-tuning and common white-box perturbations. This reduces the likelihood of significant drift in the watermark statistics. It then generates user-specific coordinate groups and projection directions from the contributor’s key, mapping local weight changes into aggregate statistical perturbations in the projection space. As a result, even if multiple users partially overlap in their carrier coordinates, their projection signals remain statistically separable. During verification, the detector is reconstructed using the contributor’s key, enabling independent verification for each candidate watermark. Together, these components enable LineageMark to support multi-user contribution tracing across continuous model derivation chains. Figure 2: Workflow of LineageMark. TABLE I: Notations used in LineageMark. Notation Explanation Notation Explanation MtM_t Model after the t-th derivation stage MtwmM_t^wm Watermarked model after stage t utu_t Contributor at derivation stage t ktk_t Private key of contributor utu_t wtw_t Watermark payload embedded at stage t tD_t Domain or task data for stage t MθM_θ Model with parameters θ M~ M Target model for watermark extraction cD_c Calibration set for stable carrier selection ℒtarL_tar Set of target layers for carrier selection Hℓ(xi)H_ (x_i) Hidden representation at layer ℓ Gi(ℓ)G_i^( ) Gradient with respect to Hℓ(xi)H_ (x_i) FℓF_ Empirical hidden-space Fisher matrix CℓC_ Compression second-moment matrix A Set of perturbation operators UℓU_ Stable subspace of layer ℓ W(ℓ,m)W^( ,m) m-th linear weight matrix in layer ℓ Ω(ℓ,m) ^( ,m) Stable carrier mask for W(ℓ,m)W^( ,m) Γr,c(ℓ,m) _r,c^( ,m) Candidate score of coordinate (r,c)(r,c) KuK_u Contributor key ub_u Bit payload of contributor u ^u b_u Extracted payload of contributor u L Watermark payload length LcL_c Length of a payload chunk Q Number of payload chunks qtq_t Chunk index assigned to selected matrix t r(ℓ,m)D_r^( ,m) Detection group for bit r in W(ℓ,m)W^( ,m) ℰr(ℓ,m)E_r^( ,m) Editable stable subset of r(ℓ,m)D_r^( ,m) ηij _ij Coordinate participation indicator pijp_ij Bit position assigned to coordinate (i,j)(i,j) ϕij _ij Key-derived projection coefficient zr(ℓ,m)z_r^( ,m) Projection statistic for bit r yq,ry_q,r Target sign of chunk bit cq,rc_q,r μ Projection decision margin Aq,r+,Aq,r−A_q,r^+,A_q,r^- Positive and negative vote accumulators κq,r _q,r Normalized voting confidence S(u)S(u) Matching score for candidate user u WER(u)WER(u) Watermark extraction rate for user u IV-B Stable Carrier Selection Before watermark embedding, LineageMark selects a set of stable carrier coordinates for modifying model weights. This step determines where watermark signals can be embedded with lower risk of being destroyed by later derivation or white-box perturbations. A desirable carrier should satisfy two properties. First, it should be anchored to functionally meaningful directions, avoiding inactive parameter regions that provide weak and unstable evidence. Second, it should remain stable under common parameter perturbations so that the watermark statistic is less likely to drift during later model updates. To capture these two properties, LineageMark uses an empirical hidden-space Fisher matrix to measure functional relevance and a compression second-moment matrix to measure perturbation sensitivity. Algorithm 1 summarizes this procedure. Algorithm 1 Stable carrier selection 0: Model MθM_θ, calibration set cD_c, target layers ℒtarL_tar, perturbation set A, ratio ρ, spectral bounds (τu,τv)( _u, _v), subspace size k, damping factor ϵε 0: Matrix-specific stable masks Ω=Ω(ℓ,m) =\ ^( ,m)\ 1: Ω←∅ ← 2: for all target layer ℓ∈ℒtar _tar do 3: collect Hℓ(xi)H_ (x_i) and Gi(ℓ)G_i^( ) on cD_c 4: compute gi(ℓ)i=1N\g_i^( )\_i=1^N from Gi(ℓ)i=1N\G_i^( )\_i=1^N 5: Fℓ←EmpFisher(gi(ℓ)i=1N)F_ (\g_i^( )\_i=1^N) 6: Cℓ←CompSecondMoment(Hℓ,)C_ (H_ ,A) 7: solve Fℓu=λ(Cℓ+ϵI)uF_ u=λ(C_ +ε I)u 8: ℐℓ←j∣τuλ1≤λj≤τvλ1I_ ←\j _u _1≤ _j≤ _v _1\ 9: Uℓ←U_ ← top-k eigenvectors from ℐℓI_ 10: for all linear matrix W(ℓ,m)W^( ,m) associated with layer ℓ do 11: χr(ℓ,m)←‖Uℓ[πℓ,m(r),:]‖2 _r^( ,m)←\|U_ [ _ ,m(r),:]\|_2 12: Γr,c(ℓ,m)←|Wr,c(ℓ,m)|χr(ℓ,m) _r,c^( ,m)←|W_r,c^( ,m)| _r^( ,m) 13: Ω(ℓ,m)← ^( ,m)← row-wise top-ρ coordinates by Γr,c(ℓ,m) _r,c^( ,m) 14: Ω←Ω∪((ℓ,m),Ω(ℓ,m)) ← ∪\(( ,m), ^( ,m))\ 15: end for 16: end for 17: return Ω Given a model MθM_θ, a calibration dataset c=xii=1ND_c=\x_i\_i=1^N, and a target layer ℓ , let Hℓ(xi)∈ℝs×dH_ (x_i) ^s× d denote the hidden representation of input xix_i, where s is the sequence length and d is the hidden dimension. We first compute the language modeling loss LM(xi;θ)J_LM(x_i;θ) and obtain the gradient of the loss with respect to the hidden representation: Gi(ℓ)=∂LM(xi;θ)∂Hℓ(xi)∈ℝs×d.G_i^( )= _LM(x_i;θ)∂ H_ (x_i) ^s× d. (5) The token-level gradients are then averaged into a hidden-space gradient vector: gi(ℓ)=1s∑τ=1sGi(ℓ)[τ,:]∈ℝd.g_i^( )= 1s _τ=1^sG_i^( )[τ,:] ^d. (6) LineageMark constructs an empirical hidden-space Fisher matrix as Fℓ=1N∑i=1Ngi(ℓ)(gi(ℓ))T.F_ = 1N _i=1^Ng_i^( ) (g_i^( ) )^T. (7) For an arbitrary direction u∈ℝdu ^d, its functional importance can be measured by uTFℓu^TF_ u. A larger value indicates stronger association with model behavior, while a smaller value suggests limited influence on model outputs. The Fisher matrix therefore anchors carrier selection to functionally meaningful directions, similar to parameter-importance estimation in continual learning [34, 52]. Memory-aware synapses provide another related way to identify parameters important for preserving learned behavior [2]. To characterize perturbation stability, LineageMark introduces a compression second-moment matrix. Let =ahh=1JA=\a_h\_h=1^J be a set of perturbation operators. For each operator ah∈a_h , define the token-averaged representation deviation as Δ¯i,h(ℓ)=1s∑τ=1s(Hℓ(xi)[τ,:]−ah(Hℓ(xi))[τ,:]). _i,h^( )= 1s _τ=1^s (H_ (x_i)[τ,:]-a_h(H_ (x_i))[τ,:] ). (8) The compression second-moment matrix is then defined as Cℓ=1NJ∑i=1N∑h=1JΔ¯i,h(ℓ)(Δ¯i,h(ℓ))T.C_ = 1NJ _i=1^N _h=1^J _i,h^( ) ( _i,h^( ) )^T. (9) For a direction u, the perturbation sensitivity is measured by uTCℓu^TC_ u. In implementation, LineageMark constructs A using random projection and reconstruction, Gaussian quantization noise, and structured dropout. Random projection simulates dimensional compression or subspace information loss; Gaussian quantization noise simulates numerical perturbations caused by low-precision representations [14, 15]. Post-training quantization provides another representative low-precision perturbation [19]; and structured dropout simulates representation loss caused by pruning or local parameter deactivation [24, 18]. To balance functional relevance and perturbation stability, LineageMark formulates stable direction selection as a generalized Rayleigh quotient: ℛℓ(u)=uTFℓuuT(Cℓ+ϵI)u,R_ (u)= u^TF_ uu^T(C_ +ε I)u, (10) where ϵIε I is a numerical stabilization term. The objective can be interpreted as functional relevance per unit perturbation. Maximizing this objective leads to the generalized eigenvalue problem Fℓu=λ(Cℓ+ϵI)u.F_ u=λ(C_ +ε I)u. (11) Solving this problem yields eigenvalue-eigenvector pairs (λj,uj)j=1d\( _j,u_j)\_j=1^d, where λj _j represents the joint score of functional relevance and perturbation stability for direction uju_j. Assume λ1≥λ2≥⋯≥λd _1≥ _2≥·s≥ _d and 0<τu<τv≤10< _u< _v≤ 1. To balance watermark stability and model utility, LineageMark adopts spectral truncation rather than simply choosing the direction with the largest eigenvalue. The selected index set is ℐℓ=j∣τuλ1≤λj≤τvλ1,I_ =\j _u _1≤ _j≤ _v _1\, (12) and the top-k selected eigenvectors form the stable subspace Uℓ=[uj1,…,ujk]∈ℝd×kU_ =[u_j_1,…,u_j_k] ^d× k. After obtaining the stable subspace, LineageMark maps stable directions back to the parameter space. For a linear matrix W(ℓ,m)∈ℝdout×dinW^( ,m) ^d_out× d_in associated with layer ℓ , let πℓ,m(r) _ ,m(r) map row r to its corresponding hidden dimension. For matrices whose row dimension is already aligned with the hidden representation, πℓ,m(r)=r _ ,m(r)=r. The participation score of row r is defined as χr(ℓ,m)=‖Uℓ[πℓ,m(r),:]‖2. _r^( ,m)=\|U_ [ _ ,m(r),:]\|_2. (13) A larger χr(ℓ,m) _r^( ,m) indicates that the corresponding row contributes more strongly to the selected stable directions. Combining this score with the weight magnitude, LineageMark defines the candidate score of each coordinate as Γr,c(ℓ,m)=|Wr,c(ℓ,m)|χr(ℓ,m). _r,c^( ,m)=|W_r,c^( ,m)| _r^( ,m). (14) For each row r, LineageMark selects the top-ρ fraction of coordinates according to Γr,c(ℓ,m) _r,c^( ,m) and obtains the matrix-specific candidate mask Ω(ℓ,m) ^( ,m). Repeating this process across selected matrices yields the full candidate coordinate collection Ω=Ω(ℓ,m) =\ ^( ,m)\. During watermark embedding, only coordinates in their corresponding matrix-specific masks are allowed to be modified, thereby translating stable-subspace analysis into parameter-space watermark carriers. IV-C Sign-projection Watermark Embedding After stable carriers are selected, LineageMark embeds contributor watermarks by constructing key-derived projection groups over these carriers. The goal is to encode each watermark bit as an aggregate projection signal, so that later parameter changes or additional watermark insertions affect the detector only as statistical perturbations. Algorithm 2 summarizes the embedding procedure. Algorithm 2 Sign-projection watermark embedding 0: Model M, stable masks Ω , contributor key KuK_u, payload ub_u, chunk length LcL_c, margin μ, sampling parameters (γ1,γrow,ξ)( _1, _row,ξ) 0: Watermarked model MwmM^wm 1: qq=0Q−1←Chunk(u,Lc)\c_q\_q=0^Q-1 (b_u,L_c) 2: t←0t← 0 3: for all linear matrix W(ℓ,m)W^( ,m) in M do 4: if SelectMatrix(Ku,ℓ,m,γ1)=0SelectMatrix(K_u, ,m, _1)=0 then 5: continue 6: end if 7: q←tmodQq← t Q 8: ←qc _q 9: for r←1r← 1 to LcL_c do 10: r(ℓ,m)←∅D_r^( ,m)← 11: ℰr(ℓ,m)←∅E_r^( ,m)← 12: end for 13: for all coordinate (i,j)(i,j) in W(ℓ,m)W^( ,m) do 14: if SelectRow(Ku,ℓ,m,i,γrow)=0SelectRow(K_u, ,m,i, _row)=0 then 15: continue 16: end if 17: (η,p,ϕ)←KeyMap(Ku,ℓ,m,i,j,ξ,Lc)(η,p,φ) (K_u, ,m,i,j,ξ,L_c) 18: if η=0η=0 then 19: continue 20: end if 21: p(ℓ,m)←p(ℓ,m)∪(i,j,ϕ)D_p^( ,m) _p^( ,m)∪\(i,j,φ)\ 22: if (i,j)∈Ω(ℓ,m)(i,j)∈ ^( ,m) then 23: ℰp(ℓ,m)←ℰp(ℓ,m)∪(i,j,ϕ)E_p^( ,m) _p^( ,m)∪\(i,j,φ)\ 24: end if 25: end for 26: for r←1r← 1 to LcL_c do 27: zr(ℓ,m)←∑(i,j,ϕ)∈r(ℓ,m)ϕWi,j(ℓ,m)z_r^( ,m)← _(i,j,φ) _r^( ,m)φ W_i,j^( ,m) 28: yq,r←2cr−1y_q,r← 2c_r-1 29: if yq,rzr(ℓ,m)<μy_q,rz_r^( ,m)<μ and |ℰr(ℓ,m)|>0|E_r^( ,m)|>0 then 30: αr←(μ−yq,rzr(ℓ,m))/|ℰr(ℓ,m)| _r← (μ-y_q,rz_r^( ,m) )/|E_r^( ,m)| 31: for all (i,j,ϕ)∈ℰr(ℓ,m)(i,j,φ) _r^( ,m) do 32: Wi,j(ℓ,m)←Wi,j(ℓ,m)+yq,rϕαrW_i,j^( ,m)← W_i,j^( ,m)+y_q,rφ _r 33: end for 34: end if 35: end for 36: t←t+1t← t+1 37: end for 38: Mwm←M^wm← M 39: return MwmM^wm Given a model, a contributor key KuK_u, and a watermark bit sequence u=(bu,1,bu,2,…,bu,L)b_u=(b_u,1,b_u,2,…,b_u,L) with bu,i∈0,1b_u,i∈\0,1\, LineageMark first splits the sequence into Q chunks of length LcL_c. To prevent a local perturbation on a single matrix from invalidating the entire watermark, LineageMark cyclically assigns watermark chunks to multiple selected linear matrices. Let t=0,1,…t=0,1,… denote the index of the selected embeddable matrix. The assigned chunk index is qt=tmodQ,q_t=t Q, (15) where qt∈0,1,…,Q−1q_t∈\0,1,…,Q-1\. This cyclic assignment creates redundant copies of each watermark chunk across multiple weight matrices. Even if later full-parameter fine-tuning weakens the watermark signal in some matrices, the verification stage can still recover the complete watermark through cross-matrix aggregation. For a selected matrix W(ℓ,m)W^( ,m) in block ℓ and matrix position m, LineageMark uses a key-driven pseudo-random mapping to construct projection detection groups. The seed for coordinate (i,j)(i,j) is σij(ℓ,m)=ℋ(Ku,ℓ,m,i,j), _ij^( ,m)=H(K_u, ,m,i,j), (16) where ℋ(⋅)H(·) is a deterministic hash function. A pseudo-random generator then derives the coordinate sampling indicator, target bit position, and projection coefficient: (ηij,pij,ϕij)=PRG(σij(ℓ,m)),( _ij,p_ij, _ij)=PRG\! ( _ij^( ,m) ), (17) where ηij _ij indicates whether the coordinate participates in detection, pijp_ij maps the coordinate to a bit position, and ϕij∈−1,+1 _ij∈\-1,+1\ is the projection coefficient. Only coordinates assigned to the target bit are included in its detection group: r(ℓ,m)=(i,j,ϕij)∣ηij=1,pij=r.D_r^( ,m)=\(i,j, _ij) _ij=1,\ p_ij=r\. (18) To reduce overhead, LineageMark first samples matrix rows using the key and then constructs coordinate groups only within selected rows. This mechanism controls both embedding sparsity and the coordinate groups associated with different bits. Since the mapping depends only on the key and coordinate metadata, rather than current weight values, a verifier can reconstruct the same detector after later fine-tuning. LineageMark represents each watermark bit by the sign of a projection statistic. For compact notation, write each detector element as e=(ie,je,ϕe)e=(i_e,j_e, _e). For the r-th bit carried by matrix W(ℓ,m)W^( ,m), the projection statistic is zr(ℓ,m)=∑e∈r(ℓ,m)ϕeWie,je(ℓ,m).z_r^( ,m)= _e _r^( ,m) _eW_i_e,j_e^( ,m). (19) The sign of zr(ℓ,m)z_r^( ,m) determines the decoded bit. Therefore, the embedding objective is not to force an individual weight to take a specific value, but to adjust the aggregate projection direction of a group of weights. For the assigned chunk q, let the target chunk bit be cq,rc_q,r and its target sign be yq,r=2cq,r−1∈−1,+1.y_q,r=2c_q,r-1∈\-1,+1\. (20) LineageMark enforces a margin constraint after embedding: yq,rzr(ℓ,m)≥μ,y_q,rz_r^( ,m)≥μ, (21) where μ is the projection decision margin. The margin reserves room for later full-parameter fine-tuning. A projection value close to zero is vulnerable to sign flips under small parameter updates. The margin constraint increases the distance from the decision boundary and improves stability under later perturbations. For each bit, LineageMark first computes the current projection value. If the margin constraint is already satisfied, no additional modification is required. Otherwise, let the margin deficit be dr=μ−yq,rzr(ℓ,m).d_r=μ-y_q,rz_r^( ,m). (22) When dr>0d_r>0, LineageMark distributes the deficit across editable coordinates in the stable mask. Let ℰr(ℓ,m)⊆r(ℓ,m)E_r^( ,m) _r^( ,m) be the editable coordinate set and nr=|ℰr(ℓ,m)|n_r=|E_r^( ,m)|. The base update step is αr=drnr. _r= d_rn_r. (23) For each (i,j,ϕij)∈ℰr(ℓ,m)(i,j, _ij) _r^( ,m), the weight is updated as Wij(ℓ,m)←Wij(ℓ,m)+yq,rϕijαr.W_ij^( ,m)← W_ij^( ,m)+y_q,r _ij _r. (24) This update moves the projection statistic toward the target sign. It is a local closed-form update and does not require retraining or an additional optimization loop. Because the update is distributed across multiple stable coordinates, no single weight needs to carry an excessive watermark signal. Moreover, since the bit is determined by an aggregate projection over many coordinates, the watermark can remain recoverable even if later fine-tuning modifies part of the detection group. IV-D Key-driven Watermark Extraction The extraction stage answers an auditing question: given a target model and a candidate user, can the verifier determine whether the model still contains the watermark embedded by that user at a historical derivation stage? Unlike embedding, extraction does not access calibration data and does not recompute the stable subspace. The verifier only needs the candidate user’s key to reconstruct the corresponding projection detector and recover the watermark. In this sense, extraction is the reverse of embedding. During embedding, LineageMark writes each bit as a sign-projection statistic over key-derived coordinates and strengthens its sign using a margin. During extraction, the verifier regenerates the same coordinates and projection coefficients from the key, computes the projection on the current parameters of the target model, and recovers each bit according to the projection sign. Algorithm 3 describes the extraction procedure. Algorithm 3 Key-driven watermark extraction 0: Target model M~ M, contributor key KuK_u, claimed payload ub_u, payload length L, chunk length LcL_c, sampling parameters (γ1,γrow,ξ)( _1, _row,ξ) 0: Extracted payload ^u b_u, matching score S(u)S(u) 1: Q←L/LcQ← L/L_c 2: Aq,r+,Aq,r−←0A_q,r^+,A_q,r^-← 0 for all q∈[0,Q−1]q∈[0,Q-1], r∈[1,Lc]r∈[1,L_c] 3: t←0t← 0 4: for all linear matrix W~(ℓ,m) W^( ,m) in M~ M do 5: if SelectMatrix(Ku,ℓ,m,γ1)=0SelectMatrix(K_u, ,m, _1)=0 then 6: continue 7: end if 8: q←tmodQq← t Q 9: z~r←0 z_r← 0 for all r∈[1,Lc]r∈[1,L_c] 10: for all coordinate (i,j)(i,j) in W~(ℓ,m) W^( ,m) do 11: if SelectRow(Ku,ℓ,m,i,γrow)=0SelectRow(K_u, ,m,i, _row)=0 then 12: continue 13: end if 14: (η,p,ϕ)←KeyMap(Ku,ℓ,m,i,j,ξ,Lc)(η,p,φ) (K_u, ,m,i,j,ξ,L_c) 15: if η=0η=0 then 16: continue 17: end if 18: z~p←z~p+ϕW~ij(ℓ,m) z_p← z_p+φ W_ij^( ,m) 19: end for 20: for r←1r← 1 to LcL_c do 21: if z~r>0 z_r>0 then 22: Aq,r+←Aq,r++|z~r|A_q,r^+← A_q,r^++| z_r| 23: else 24: Aq,r−←Aq,r−+|z~r|A_q,r^-← A_q,r^-+| z_r| 25: end if 26: end for 27: t←t+1t← t+1 28: end for 29: for q←0q← 0 to Q−1Q-1 do 30: for r←1r← 1 to LcL_c do 31: c^q,r←[Aq,r+>Aq,r−] c_q,r \! [A_q,r^+>A_q,r^- ] 32: end for 33: end for 34: ^u←Concat(^0,…,^Q−1) b_u ( c_0,…, c_Q-1) 35: S(u)←Match(^u,u)S(u) ( b_u,b_u) 36: return ^u,S(u) b_u,S(u) Let the target model be M~ M and its linear matrices be denoted by W~(ℓ,m) W^( ,m). For a candidate user u, the verifier uses KuK_u to reconstruct the same matrix, row, and coordinate mappings used during embedding. Using the compact detector element e=(ie,je,ϕe)e=(i_e,j_e, _e), the projection statistic for the r-th bit is computed as z~r(ℓ,m)=∑e∈r(ℓ,m)ϕeW~ie,je(ℓ,m). z_r^( ,m)= _e _r^( ,m) _e W_i_e,j_e^( ,m). (25) For the matrix assigned to chunk q, the local bit decision is c^q,r(ℓ,m)=[z~r(ℓ,m)>0]. c_q,r^( ,m)=I\! [ z_r^( ,m)>0 ]. (26) The magnitude |z~r(ℓ,m)|| z_r^( ,m)| measures the confidence of the local decision. If later fine-tuning or new watermark insertion moves the projection close to zero, this matrix provides weak evidence for the bit. If the projection remains far from zero, the matrix preserves a stronger watermark signal. LineageMark therefore uses projection magnitude as weighted voting strength rather than applying unweighted majority voting across matrices. For each local projection, two accumulators are constructed: vr,+(l,m) v_r,+^(l,m) =|zr(l,m)|[zr(l,m)>0], =|z_r^(l,m)|I\! [z_r^(l,m)>0 ], (27) vr,−(l,m) v_r,-^(l,m) =|zr(l,m)|[zr(l,m)≤0]. =|z_r^(l,m)|I\! [z_r^(l,m)≤ 0 ]. Since each watermark chunk is cyclically embedded into multiple linear matrices, extraction aggregates local decisions from all matrices assigned to the same chunk. Let (ℓt,mt)( _t,m_t) denote the t-th selected matrix. For chunk q and bit r, the positive and negative accumulators are Aq,r+ A_q,r^+ =∑t:qt=qvr,+(lt,mt), = _t:q_t=qv_r,+^(l_t,m_t), (28) Aq,r− A_q,r^- =∑t:qt=qvr,−(lt,mt). = _t:q_t=qv_r,-^(l_t,m_t). The aggregated bit is determined by comparing the two accumulators: c^q,r=[Aq,r+>Aq,r−]. c_q,r=I\! [A_q,r^+>A_q,r^- ]. (29) To quantify extraction stability, LineageMark further defines a normalized voting confidence: κq,r=|Aq,r+−Aq,r−|Aq,r++Aq,r−+ϵvote, _q,r= |A_q,r^+-A_q,r^-|A_q,r^++A_q,r^-+ _vote, (30) where ϵvote _vote prevents division by zero. A larger confidence indicates that multiple matrices agree on the bit decision, while a smaller confidence suggests that the bit may have been affected by later fine-tuning, new watermark insertion, or parameter perturbations. After all chunks are decoded, the extracted watermark is obtained by concatenation: ^u=Concat(^0,^1,…,^Q−1). b_u=Concat( c_0, c_1,…, c_Q-1). (31) The matrix-level voting mechanism is a key reason why LineageMark remains robust under multi-stage derivation. Later full-parameter fine-tuning may corrupt local projection signs in some matrices, but as long as most high-confidence matrices preserve the target direction, the aggregated bit can still be recovered. Because detectors are reconstructed from user-specific keys, verification is independent across users. LineageMark does not extract a global shared watermark from the model; instead, it rebuilds the detector for a candidate user and tests whether the corresponding projection statistics still exist. This candidate-wise verification is suitable for contribution auditing in open model derivation chains. V Experiments This section presents the experimental design and results of LineageMark. We evaluate whether contributor watermarks remain extractable under multi-stage derivation, incremental insertion, multi-user coexistence, and white-box model modifications. The evaluation is organized around the following research questions: • RQ1: Can LineageMark preserve historical watermarks after multi-stage full-parameter fine-tuning? • RQ2: Can downstream contributors incrementally embed their watermarks at each derivation stage without disrupting historical watermarks? • RQ3: Compared with existing white-box watermarking methods, does LineageMark provide clear advantages in continuous derivation chains? • RQ4: Does watermark embedding affect model utility on domain data and general tasks? • RQ5: Is LineageMark robust against common white-box modifications, including fine-tuning, quantization, and pruning? • RQ6: How does LineageMark scale to longer contribution chains and longer payloads? V-A Experimental Setup V-A1 Models and Environment We evaluate LineageMark on three OPT-family causal language models: OPT-125M, OPT-350M, and OPT-1.3B. Experiments are conducted on an Ubuntu 22.04 server with an NVIDIA A800 80GB GPU. V-A2 Domain Datasets We construct continuous full-parameter fine-tuning chains over three domains: medical, legal, and mathematical reasoning. In the medical domain, we use PubMed abstracts, PubMedQA [31], and MedMCQA [41] as the three derivation-stage datasets. In the legal domain, we use LEDGAR [45] and CaseHOLD [55] as the first two derivation-stage datasets. EUR-Lex [9] is included as a later-stage legal document classification dataset. In the mathematical reasoning domain, we use MetaMathQA and mathematical problem-solving corpora inspired by large-scale math benchmarks [40]. The three datasets in each domain simulate a progressive derivation chain in which different users continue training the received model and then redistribute it. V-A3 Baselines We compare LineageMark with two representative white-box model watermarking baselines, ELLMark [50] and EmMark [54]. These baselines are evaluated under the same continuous derivation protocol. This protocol tests both current watermark insertion and preservation of previously inserted watermarks. The main baseline comparison is conducted on OPT-125M across the three domains, while LineageMark is further evaluated on OPT-350M and OPT-1.3B to examine scalability across model sizes. V-A4 Evaluation Metrics We report watermark extraction rate (WER) for watermark effectiveness: WER(u) (u) =1|u|∑i=1|u|[b^u,i=bu,i], = 1|b_u| _i=1^|b_u|I\! [ b_u,i=b_u,i ], (32) where ub_u is the expected payload of user u and ^u b_u is the extracted payload. For model utility, we report token accuracy on the corresponding domain datasets to verify whether watermark insertion changes the model’s domain behavior. We also report zero-shot accuracy on PIQA and HellaSwag [6, 51], and WinoGrande [42] to evaluate whether watermark insertion and domain adaptation affect general capabilities. V-A5 Implementation Details For each model-domain pair, we construct a three-stage derivation chain. Let M0M_0 denote the original pretrained model. The original developer first embeds watermark w1w_1 into M0M_0, obtaining M0wmM_0^wm. Contributor 2 then performs full-parameter fine-tuning on the first-stage dataset 1D_1, obtaining M1M_1, and embeds watermark w2w_2 to obtain M1wmM_1^wm. The same process is repeated on 2D_2 and 3D_3, producing M2wmM_2^wm and M3wmM_3^wm. The final model therefore contains four watermarks, denoted as W1W_1–W4W_4. At every intermediate state, we extract all watermarks that should exist in the current model. After a fine-tuning step, extraction verifies whether historical watermarks survive model adaptation. After a new watermark insertion step, extraction verifies whether the new user watermark is successfully embedded and whether previous watermarks remain extractable. The main hyperparameters used in the derivation, carrier selection, embedding, and extraction procedures are summarized in Table V-A5. TABLE I: Main hyperparameter settings. Parameter Value Payload length L 32 bits Projection margin μ 0.5 Carrier ratio ρ 0.75 Spectral bounds (τu,τv)( _u, _v) (0.1,0.9)(0.1,0.9) Subspace dimension k 64 Matrix sampling γ1 _1 2 Fine-tuning learning rate 5×10−65× 10^-6 Train batch size 16 Gradient accumulation 4 Weight decay 0.01 Warmup ratio 0.05 Optimizer AdamW V-B Main Results This subsection evaluates lineage preservation, incremental embedding, and comparison with existing white-box watermarking methods. V-B1 Lineage Preservation and Incremental Embedding Across OPT-125M, OPT-350M, and OPT-1.3B, and across the medical, legal, and mathematical reasoning domains, LineageMark achieves 100% WER for every watermark at each evaluated checkpoint. The complete stage-wise comparison used in the following analysis is reported in Table V-B1. TABLE I: Stage-wise comparison with existing white-box watermarking methods on OPT-125M. Domain Method M_0^wm M_1 M_1^wm M_2 M_2^wm M_3 M_3^wm W_1 W_1 W_1 W_2 W_1 W_2 W_1 W_2 W_3 W_1 W_2 W_3 W_1 W_2 W_3 W_4 ELLMark 100% 84.375% 84.375% 100% 87.5% 90.625% 87.5% 90.625% 100% 90.625% 90.625% 84.375% 84.375% 90.625% 84.375% 62.5% Medical EmMark 100% 43.75% 62.5% 100% 43.75% 43.75% 50% 43.75% 100% 56.25% 40.625% 62.5% 62.5% 37.5% 65.625% 100% LineageMark 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% ELLMark 100% 84.375% 84.375% 100% 75% 84.375% 75% 84.375% 100% 87.5% 84.375% 90.625% 90.625% 84.375% 87.5% 62.5% Legal EmMark 100% 53.125% 62.5% 100% 37.5% 43.75% 53.125% 50% 100% 56.25% 53.125% 43.75% 59.375% 46.875% 53.125% 100% LineageMark 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% ELLMark 100% 87.5% 87.5% 100% 90.625% 96.875% 90.625% 87.5% 100% 87.5% 90.625% 93.75% 87.5% 90.625% 93.75% 46.875% Math EmMark 100% 46.875% 62.5% 100% 53.125% 53.125% 65.625% 56.25% 100% 59.375% 43.75% 40.625% 62.5% 53.125% 50% 100% LineageMark 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% These results show that LineageMark satisfies both lineage preservation and incremental embedding: historical contributors remain verifiable after subsequent derivation, while new contributors can insert their watermarks without overwriting previous ones. V-B2 Comparison with Existing White-box Watermarks We compare LineageMark with ELLMark and EmMark on OPT-125M across the three domains. All methods follow the same derivation protocol: after each full-parameter fine-tuning stage, a new contributor watermark is inserted, and all watermarks expected to exist in the current model are extracted. This protocol is stricter than one-time ownership verification because a method must preserve historical watermarks while supporting later watermark insertion. The results show that existing white-box watermarking methods are less stable under continuous derivation. Although ELLMark and EmMark can often insert a newly added watermark, previously embedded watermarks fluctuate after subsequent fine-tuning and repeated watermark insertion, and some later-stage watermarks also fail to maintain high WER. For example, at the final checkpoint, ELLMark obtains only 62.5% WER for W4W_4 in the medical and legal domains and 46.875% WER for W4W_4 in the math domain, while EmMark has several historical-watermark entries below 50% during the derivation chain. In contrast, LineageMark maintains 100% WER for all expected watermarks at all checkpoints, showing that historical watermarks remain extractable after multi-stage full-parameter fine-tuning. V-C Model Utility and Fine-tuning Impact We evaluate the OPT-125M medical-domain derivation chain using standard zero-shot benchmarks. Table V-C summarizes the compact zero-shot results. The model-stage notation follows the previous subsection: M0M_0 denotes the original pretrained model, M0wmM_0^wm denotes the model after inserting the first watermark, MiM_i denotes the model after the i-th full-parameter fine-tuning stage, and MiwmM_i^wm denotes the model after inserting the next user watermark. TABLE IV: Zero-shot utility of OPT-125M. Model stage PIQA HellaSwag WinoGrande Avg. M0M_0 62.19% 29.98% 50.36% 47.51% M0wmM_0^wm 62.02% 29.96% 50.51% 47.50% M1M_1 62.35% 30.31% 50.75% 47.80% M1wmM_1^wm 62.46% 30.30% 50.67% 47.81% M2M_2 62.30% 30.41% 50.59% 47.77% M2wmM_2^wm 62.30% 30.39% 50.43% 47.71% M3M_3 60.83% 30.18% 50.59% 47.20% M3wmM_3^wm 60.77% 30.14% 50.99% 47.30% During the derivation chain, the domain validation results show that each full-parameter fine-tuning stage adapts the model to its corresponding medical dataset, while inserting a watermark causes only negligible changes between paired checkpoints such as M1M_1 and M1wmM_1^wm, M2M_2 and M2wmM_2^wm, and M3M_3 and M3wmM_3^wm. We therefore focus the main paper on the compact zero-shot results, which evaluate whether multi-stage derivation and repeated watermark insertion damage general language understanding capability. The zero-shot results remain close throughout the chain. The final watermarked checkpoint M3wmM_3^wm achieves an average accuracy of 47.30%, compared with 47.51% for the original model. The small change indicates that repeated watermark insertion does not cause substantial general capability degradation. Together with the paired-checkpoint comparison on domain validation accuracy, these results show that LineageMark preserves lineage watermarks while maintaining the utility of derived models. V-D Robustness under White-box Attacks We use the final OPT-1.3B watermarked checkpoint after the fourth watermark insertion, which contains four user watermarks W1W_1–W4W_4. After each attack, we extract all four watermarks and report the corresponding WER. LineageMark remains fully robust under five parameter-efficient fine-tuning attacks: LoRA, Prefix-tuning, P-tuning, Prompt-tuning, and BitFit. These attacks cover low-rank adaptation, prefix-based adaptation [38], prompt-based tuning [39, 37], and bias-only adaptation [3]. In all five cases, the four historical watermarks are recovered with 100% WER. This result indicates that adaptation methods that update a limited parameter subset or introduce auxiliary trainable parameters do not destroy the sign-projection evidence embedded in stable carriers. Table V-D reports the results under low-bit quantization, which is widely used for efficient LLM deployment [14, 15]. We also consider post-training quantization as a related compression setting [19]. All four watermarks remain perfectly extractable after 8-bit quantization. The more aggressive 4-bit quantization reduces the extraction rate, but each historical watermark still remains above 90% WER. This behavior is consistent with the projection-based detector: moderate numerical rounding does not change the aggregate projection signs, whereas aggressive low-bit compression can weaken some projection margins. TABLE V: Quantization robustness. Attack 1W_1 2W_2 3W_3 4W_4 8-bit quantization 100% 100% 100% 100% 4-bit quantization 90.625% 93.75% 90.625% 90.625% Table V-D reports the results under random pruning, a representative parameter-removal attack related to model compression [24, 18]. LineageMark preserves all four watermarks when the pruning ratio is 0.2 or 0.4. The extraction rate starts to decrease when the pruning ratio reaches 0.6, where W1W_1 drops to 84.375% and W4W_4 drops to 96.875%, while W2W_2 and W3W_3 remain at 100%. This degradation is expected because random pruning directly zeros a large fraction of coordinates, including coordinates participating in keyed projection groups. Even under this stronger pruning setting, the extracted watermarks remain well above random matching. TABLE VI: Random pruning robustness. Pruning ratio 1W_1 2W_2 3W_3 4W_4 0.2 100% 100% 100% 100% 0.4 100% 100% 100% 100% 0.6 84.375% 100% 100% 96.875% V-E False Positive Resistance under Invalid Keys Beyond robustness against model modification, a practical multi-user watermark should remain reliable in contribution disputes. If an attacker can obtain a high extraction score with an invalid key, it may falsely claim contribution to a derived model. We first compare the extraction results obtained using correct keys and invalid keys on the final OPT-125M model containing four user watermarks. We define the average key gap as Δkey=WER¯correct−WER¯invalid. _key= WER_correct- WER_invalid. (33) A larger Δkey _key indicates clearer separation between genuine contributor evidence and invalid-key claims. TABLE VII: Invalid-key false positives. Method Key type 1W_1 2W_2 3W_3 4W_4 Avg. WER Gap ELLMark Invalid key 84.375% 78.125% 87.50% 56.25% 76.56% – ELLMark Correct key 84.375% 90.625% 84.375% 62.50% 80.47% 3.91% EmMark Invalid key 78.125% 62.50% 65.25% 71.875% 69.44% – EmMark Correct key 90.625% 84.375% 87.50% 62.50% 81.25% 11.81% LineageMark Invalid key 40.625% 50.00% 37.50% 34.375% 40.62% – LineageMark Correct key 100% 100% 100% 100% 100% 59.38% Table V-E shows that ELLMark and EmMark produce high WER even under invalid keys, leaving only small gaps from the correct-key results. In some cases, the invalid-key WER is comparable to or higher than the corresponding correct-key WER, which can make contribution evidence ambiguous after multi-stage derivation. LineageMark avoids this behavior by maintaining a large gap between correct-key and invalid-key extraction. To make this comparison a formal verification decision, we define the verification score as S(M,K,)=1L∑i=1L[b^i=bi].S(M,K,b)= 1L _i=1^LI\! [ b_i=b_i ]. (34) A claim is accepted only when S(M,K,)≥τS(M,K,b)≥τ. We set τ=0.75τ=0.75 and conduct the multi-key threshold test on ELLMark and LineageMark. For each method, we sample 50 invalid keys and test each key against W1W_1–W4W_4, producing 200 invalid-key verification trials. For invalid-key trials −=(M,Kj−,j−)j=1N−T^-=\(M,K_j^-,b_j^-)\_j=1^N_- and correct-key trials +=(M,Kj+,j+)j=1N+T^+=\(M,K_j^+,b_j^+)\_j=1^N_+, the false positive rate and false negative rate are FPRτ _τ =1N−∑j=1N−[S(M,Kj−,j−)≥τ], = 1N_- _j=1^N_-I\! [S(M,K_j^-,b_j^-)≥τ ], (35) FNRτ _τ =1N+∑j=1N+[S(M,Kj+,j+)<τ]. = 1N_+ _j=1^N_+I\! [S(M,K_j^+,b_j^+)<τ ]. Confidence intervals are Wilson 95% intervals. TABLE VIII: Threshold-based false-positive and false-negative rates. Method 0.75FPR_0.75 0.75FNR_0.75 ELLMark 88.00% [82.77%, 91.80%] 25.00% [4.56%, 69.94%] LineageMark 0.50% [0.09%, 2.78%] 0.00% [0.00%, 48.99%] Table V-E further answers how extraction becomes a formal verification decision. Under τ=0.75τ=0.75, ELLMark produces 176 false acceptances among 200 invalid-key trials, resulting in an FPR of 88.00%. It also rejects one genuine watermark, yielding a nonzero FNR. In contrast, LineageMark keeps all correct-key scores above the threshold and produces only one false acceptance among 200 invalid-key trials. This reduces FPR to 0.50% with no false negatives, showing that LineageMark provides a clearer decision boundary for contribution verification. V-F Capacity and Scalability Analysis Table V-F presents two stress tests. In the contribution-chain test, 12 user watermarks are embedded, and all are extracted with 100% WER. In the payload-length test, the watermark size is increased to 512 bits, and LineageMark still achieves 100% average and minimum WER. TABLE IX: Capacity stress tests. Setting Stress factor Avg. WER Min. WER Contribution chain 12 users 100% 100% Watermark length 512 bits 100% 100% This scalability comes from three design choices. First, the stable carrier selection module selects carriers across many weight matrices rather than relying on a small fixed parameter region. If the stable carrier pool is: Ns=∑ℓ,m|Ω(ℓ,m)|,N_s= _ ,m| ^( ,m)|, (36) where Ω(ℓ,m) ^( ,m) is the stable coordinate set in matrix (ℓ,m)( ,m), then a larger model and a larger stable carrier pool naturally provide more room for user watermarks. Second, each user’s key independently samples matrices, coordinates, and projection groups, so interference among users behaves as sparse random overlap rather than deterministic overwriting. Third, each bit is represented by redundant sign-projection votes. If a user obtains T projection votes for a payload of length LbL_b, the average vote redundancy per bit is: R=TLb.R= TL_b. (37) Longer payloads reduce R, but extraction remains reliable as long as the stable carrier pool provides enough projection votes per bit. For scenarios with many candidate users, verification remains candidate-key based: the verifier tests a claimed contributor key rather than searching all possible keys. If the false positive probability for one invalid candidate is PfpP_fp, then checking C candidate users satisfies PFP(C)≤C⋅Pfp.P_FP^(C)≤ C· P_fp. (38) Thus, candidate-scale verification depends on keeping the invalid-key false positive rate low, which is precisely what the previous subsection confirms empirically. Overall, the capacity of LineageMark is governed by the stable carrier pool size, key-driven sampling sparsity, vote redundancy, and false-positive control under candidate-key verification. V-G Limitations V-G1 Preprocessing Cost LineageMark introduces nontrivial preprocessing cost because it explicitly estimates Fisher information and compression variance before watermark insertion. This cost increases with model scale and is higher than the subsequent embedding and extraction steps.The result shows that carrier selection dominates the end-to-end cost. Its runtime increases from 84 seconds on OPT-125M to 734 seconds on OPT-1.3B, while watermark embedding increases from 9 to 42 seconds and extraction increases from 8 to 39 seconds. This indicates that the main efficiency bottleneck is stable subspace preprocessing rather than the actual watermark operation. V-G2 Sensitivity to Aggressive Fine-tuning LineageMark is designed to tolerate ordinary full-parameter fine-tuning, but sufficiently aggressive fine-tuning can still weaken the watermark signal. To characterize this boundary, we increase the fine-tuning learning rate and extract the historical watermark after fine-tuning. TABLE X: Stress-to-failure under increasing fine-tuning learning rates. Learning rate WER WER drop 10−610^-6 100% 0.00% 10−510^-5 100% 0.00% 10−410^-4 90.625% 9.375% 10−310^-3 81.25% 18.75% 10−210^-2 78.125% 21.875% Table V-G2 shows that the watermark remains fully extractable under regular learning rates, but WER decreases when the learning rate becomes aggressively large. The WER stays at 100% for 10−610^-6 and 10−510^-5, drops to 90.625% at 10−410^-4, and further decreases to 81.25% and 78.125% at 10−310^-3 and 10−210^-2. Longer training schedules can similarly accumulate parameter drift and reduce the verification margin. This result indicates that LineageMark is robust under standard fine-tuning settings, but it is not immune to sufficiently strong parameter updates. V-G3 Other Limitations LineageMark also requires white-box access to model parameters during verification and therefore does not apply to purely black-box API models. Our evaluation focuses on OPT-family models, so further experiments on other architectures are needed to confirm broader generality. In addition, LineageMark verifies whether a candidate contributor’s watermark exists in a derived model, but it does not recover the complete derivation topology among all intermediate models. Very aggressive compression or pruning can also weaken the watermark signal, as observed under 4-bit quantization and high-ratio random pruning. VI Conclusion This paper presents LineageMark, a multi-user white-box watermarking framework for contribution tracing in open model derivation chains. LineageMark preserves historical contributor watermarks across repeated model derivation and supports independent verification in downstream models. Experiments across different model scales and domain datasets show that LineageMark maintains reliable watermark extraction under multi-stage derivation, incremental watermark insertion, and common white-box modifications, while preserving model utility. The results also show that stable carrier selection is the main computational cost, suggesting a direction for future optimization. Overall, LineageMark demonstrates the feasibility of extending model watermarking from single-owner verification to verifiable multi-contributor provenance in open model ecosystems. Acknowledgment AI-assisted tools were used only for language polishing and grammar refinement. References [1] Y. Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet (2018) Turning your weakness into a strength: watermarking deep neural networks by backdooring. In Proceedings of the 27th USENIX Conference on Security Symposium, p. 1615–1631. Cited by: §I. [2] R. Aljundi, F. Babiloni, M. Elhoseiny, M. Rohrbach, and T. Tuytelaars (2018) Memory aware synapses: learning what not to forget. In Proc. Eur. Conf. Comput. Vis. (ECCV), p. 144–161. Cited by: §IV-B. [3] E. Ben-Zaken, S. Ravfogel, and Y. Goldberg (2022) BitFit: simple parameter-efficient fine-tuning for transformer-based masked language-models. In Proc. Annu. Meeting Assoc. Comput. Linguistics (ACL), p. 1–9. Cited by: §V-D. [4] O. Benjelloun, A. Das Sarma, A. Halevy, M. Theobald, and J. Widom (2008) Databases with uncertainty and lineage. Vol. 17, p. 243–264. Cited by: §I-B. [5] D. Bhagwat, L. Chiticariu, W. Tan, and G. Vijayvargiya (2004) An annotation management system for relational databases. In Proceedings of the Thirtieth International Conference on Very Large Data Bases - Volume 30, p. 900–911. Cited by: §I-B. [6] Y. Bisk, R. Zellers, R. L. Bras, J. Gao, and Y. Choi (2020) PIQA: reasoning about physical commonsense in natural language. In Proc. AAAI Conf. Artif. Intell., p. 7432–7439. Cited by: §V-A4. [7] T. B. Brown, B. Mann, N. Ryder, M. Subbiah, J. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, S. Agarwal, A. Herbert-Voss, G. Krueger, T. Henighan, R. Child, A. Ramesh, D. M. Ziegler, J. Wu, C. Winter, C. Hesse, M. Chen, E. Sigler, M. Litwin, S. Gray, B. Chess, J. Clark, C. Berner, S. McCandlish, A. Radford, I. Sutskever, and D. Amodei (2020) Language models are few-shot learners. In Proceedings of the 34th International Conference on Neural Information Processing Systems, Red Hook, NY, USA. Cited by: §I. [8] P. Buneman, S. Khanna, and W. C. Tan (2001) Why and where: a characterization of data provenance. In Database Theory - ICDT 2001, 8th International Conference, London, UK, January 4-6, 2001, Proceedings, Vol. 1973, p. 316–330. Cited by: §I, §I-B. [9] I. Chalkidis, E. Fergadiotis, P. Malakasiotis, and I. Androutsopoulos (2019) Large-scale multi-label text classification on EU legislation. In Proc. Annu. Meeting Assoc. Comput. Linguistics (ACL), p. 6314–6322. Cited by: §V-A2. [10] J. Cheney, L. Chiticariu, and W. Tan (2009) Provenance in databases: why, how, and where. 1, p. 379–474. Cited by: §I-B. [11] M. Christ, S. Gunn, and O. Zamir (2024) Undetectable watermarks for language models. In Proceedings of Thirty Seventh Conference on Learning Theory, p. 1125–1139. Cited by: §I-A. [12] Y. Cui and J. Widom (2001) Lineage tracing for general data warehouse transformations. p. 471–480. Cited by: §I-B. [13] B. Darvish Rouhani, H. Chen, and F. Koushanfar (2019) DeepSigns: an end-to-end watermarking framework for ownership protection of deep neural networks. In Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems, p. 485–497. Cited by: §I, §I-A. [14] T. Dettmers, M. Lewis, Y. Belkada, and L. Zettlemoyer (2022) LLM.int8(): 8-bit matrix multiplication for transformers at scale. In Advances Neural Inf. Process. Syst. (NeurIPS), Cited by: §IV-B, §V-D. [15] T. Dettmers, A. Pagnoni, A. Holtzman, and L. Zettlemoyer (2023) QLoRA: efficient finetuning of quantized LLMs. In Advances Neural Inf. Process. Syst. (NeurIPS), Cited by: §IV-B, §V-D. [16] J. Devlin, M. Chang, K. Lee, and K. Toutanova (2019) BERT: pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), p. 4171–4186. Cited by: §I, §I-B. [17] L. Fan, K. W. Ng, and C. S. Chan (2019) Rethinking deep neural network ownership verification: embedding passports to defeat ambiguity attacks. In Advances in Neural Information Processing Systems, Vol. 32. Cited by: §I, §I-A. [18] E. Frantar and D. Alistarh (2023) SparseGPT: massive language models can be accurately pruned in one-shot. In Proc. Int. Conf. Mach. Learn. (ICML), p. 10323–10337. Cited by: §I-A, §I-B, §IV-B, §V-D. [19] E. Frantar, S. Ashkboos, T. Hoefler, and D. Alistarh (2023) GPTQ: accurate post-training quantization for generative pre-trained transformers. In Proc. Int. Conf. Learn. Represent. (ICLR), Cited by: §I-A, §I-B, §IV-B, §V-D. [20] Garima, F. Liu, S. Kale, and M. Sundararajan (2020) Estimating training data influence by tracing gradient descent. In Proceedings of the 34th International Conference on Neural Information Processing Systems, Cited by: §I-B. [21] A. Ghorbani and J. Zou (2019) Data shapley: equitable valuation of data for machine learning. In Proceedings of the 36th International Conference on Machine Learning, Vol. 97, p. 2242–2251. Cited by: §I-B. [22] B. Glavic and G. Alonso (2009) Perm: processing provenance and data on the same data model through query rewriting. p. 174–185. Cited by: §I-B. [23] T. J. Green, G. Karvounarakis, and V. Tannen (2007) Provenance semirings. In Proceedings of the Twenty-Sixth ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems, p. 31–40. Cited by: §I, §I-B. [24] S. Han, H. Mao, and W. J. Dally (2016) Deep compression: compressing deep neural networks with pruning, trained quantization and huffman coding. In Proc. Int. Conf. Learn. Represent. (ICLR), Cited by: §I-B, §IV-B, §V-D. [25] M. Herschel, R. Diestelkämper, and H. Ben Lahmar (2017) A survey on provenance: what for? what form? what from?. 26, p. 881–906. Cited by: §I-B. [26] N. Houlsby, A. Giurgiu, S. Jastrzebski, B. Morrone, Q. De Laroussilhe, A. Gesmundo, M. Attariyan, and S. Gelly (2019) Parameter-efficient transfer learning for NLP. In Proceedings of the 36th International Conference on Machine Learning, Vol. 97, p. 2790–2799. Cited by: §I-B. [27] J. Howard and S. Ruder (2018) Universal language model fine-tuning for text classification. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 328–339. Cited by: §I-B. [28] G. Ilharco, M. T. Ribeiro, M. Wortsman, L. Schmidt, H. Hajishirzi, and A. Farhadi (2023) Editing models with task arithmetic. In Proc. Int. Conf. Learn. Represent. (ICLR), Cited by: §I-B. [29] H. Jia, M. Yaghini, C. A. Choquette-Choo, N. Dullerud, A. Thudi, V. Chandrasekaran, and N. Papernot (2021) Proof-of-learning: definitions and practice. In 2021 IEEE Symposium on Security and Privacy (SP), p. 1039–1056. Cited by: §I-A, §I-B. [30] R. Jia, D. Dao, B. Wang, F. A. Hubis, N. M. Gurel, B. Li, C. Zhang, C. Spanos, and D. Song (2019) Efficient task-specific data valuation for nearest neighbor algorithms. Vol. 12, p. 1610–1623. Cited by: §I-B. [31] Q. Jin, B. Dhingra, Z. Liu, W. Cohen, and X. Lu (2019) PubMedQA: a dataset for biomedical research question answering. In Proc. Conf. Empirical Methods Natural Language Process. and Int. Joint Conf. Natural Language Process. (EMNLP-IJCNLP), p. 2567–2577. Cited by: §V-A2. [32] J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, and T. Goldstein (2023) A watermark for large language models. In Proceedings of the 40th International Conference on Machine Learning, Vol. 202, p. 17061–17084. Cited by: §I, §I-A. [33] J. Kirchenbauer, J. Geiping, Y. Wen, M. Shu, K. Saifullah, K. Kong, K. Fernando, A. Saha, M. Goldblum, and T. Goldstein (2024) On the reliability of watermarks for large language models. In The Twelfth International Conference on Learning Representations, Cited by: §I-A. [34] J. Kirkpatrick, R. Pascanu, N. Rabinowitz, J. Veness, G. Desjardins, A. A. Rusu, K. Milan, J. Quan, T. Ramalho, A. Grabska-Barwinska, D. Hassabis, C. Clopath, D. Kumaran, and R. Hadsell (2017) Overcoming catastrophic forgetting in neural networks. Proc. Natl. Acad. Sci. USA 114 (13), p. 3521–3526. Cited by: §IV-B. [35] P. W. Koh and P. Liang (2017) Understanding black-box predictions via influence functions. In Proceedings of the 34th International Conference on Machine Learning - Volume 70, p. 1885–1894. Cited by: §I-B. [36] R. Kuditipudi, J. Thickstun, T. Hashimoto, and P. Liang (2024) Robust distortion-free watermarks for language models. Cited by: §I-A. [37] B. Lester, R. Al-Rfou, and N. Constant (2021) The power of scale for parameter-efficient prompt tuning. In Proc. Conf. Empirical Methods Natural Language Process. (EMNLP), p. 3045–3059. Cited by: §V-D. [38] X. L. Li and P. Liang (2021) Prefix-tuning: optimizing continuous prompts for generation. In Proc. Annu. Meeting Assoc. Comput. Linguistics and Int. Joint Conf. Natural Language Process. (ACL-IJCNLP), p. 4582–4597. Cited by: §I-B, §V-D. [39] X. Liu, K. Ji, Y. Fu, W. Tam, Z. Du, Z. Yang, and J. Tang (2022) P-tuning: prompt tuning can be comparable to fine-tuning across scales and tasks. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), p. 61–68. Cited by: §V-D. [40] (2024) MetaMath: bootstrap your own mathematical questions for large language models. In International Conference on Learning Representations, Vol. 2024, p. 45040–45061. Cited by: §V-A2. [41] A. Pal, L. K. Umapathi, and M. Sankarasubbu (2022) MedMCQA: a large-scale multi-subject multi-choice dataset for medical domain question answering. In Proceedings of the Conference on Health, Inference, and Learning, Vol. 174, p. 248–260. Cited by: §V-A2. [42] K. Sakaguchi, R. L. Bras, C. Bhagavatula, and Y. Choi (2021) WinoGrande: an adversarial winograd schema challenge at scale. Vol. 64, p. 99–106. Cited by: §V-A4. [43] T. Sander, P. Fernandez, A. Durmus, M. Douze, and T. Furon (2024) Watermarking makes language models radioactive. In Advances in Neural Information Processing Systems, Vol. 37, p. 21079–21113. Cited by: §I-A. [44] S. Szyller, B. G. Atli, S. Marchal, and N. Asokan (2021) DAWN: dynamic adversarial watermarking of neural networks. In M ’21: ACM Multimedia Conference, Virtual Event, China, October20 - 24, 2021, p. 4417–4425. Cited by: §I-A. [45] D. Tuggener, P. von Däniken, T. Peetz, and M. Cieliebak (2021) LEDGAR: a large-scale multi-label corpus for text classification of legal provisions in contracts. In Proc. Int. Conf. Lang. Resources Eval. (LREC), p. 1235–1241. Cited by: §V-A2. [46] Y. Uchida, Y. Nagai, S. Sakazawa, and S. Satoh (2017) Embedding watermarks into deep neural networks. In Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval, p. 269–277. Cited by: §I, §I-A. [47] J. Xu, F. Wang, M. Ma, P. W. Koh, C. Xiao, and M. Chen (2024) Instructional fingerprinting of large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), p. 3277–3306. Cited by: §I, §I-A, §I-B. [48] P. Yadav, D. Tam, L. Choshen, C. A. Raffel, and M. Bansal (2023) TIES-merging: resolving interference when merging models. In Advances Neural Inf. Process. Syst. (NeurIPS), Cited by: §I-B, §I-B. [49] S. Yamabe, F. K. Waseda, T. Takahashi, and K. Wataoka (2025) MergePrint: merge-resistant fingerprints for robust black-box ownership verification of large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 6894–6916. Cited by: §I-A, §I-B. [50] S. Yuan, X. Su, P. Lv, W. Xue, J. Yu, X. Zhu, and C. Chen (2025) An efficient white-box llm watermarking for ip protection on online market platforms. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2, p. 3680–3691. Cited by: §I, §I-A, §V-A3. [51] R. Zellers, A. Holtzman, Y. Bisk, A. Farhadi, and Y. Choi (2019) HellaSwag: can a machine really finish your sentence. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, p. 4791–4800. Cited by: §V-A4. [52] F. Zenke, B. Poole, and S. Ganguli (2017) Continual learning through synaptic intelligence. In Proc. Int. Conf. Mach. Learn. (ICML), p. 3987–3995. Cited by: §IV-B. [53] J. Zhang, Z. Gu, J. Jang, H. Wu, M. Ph. Stoecklin, H. Huang, and I. Molloy (2018) Protecting intellectual property of deep neural networks with watermarking. In Proceedings of the 2018 on Asia Conference on Computer and Communications Security, p. 159–172. Cited by: §I. [54] R. Zhang and F. Koushanfar (2024) EmMark: robust watermarks for ip protection of embedded quantized large language models. In Proceedings of the 61st ACM/IEEE Design Automation Conference, Cited by: §I, §I-A, §V-A3. [55] L. Zheng, N. Guha, B. R. Anderson, P. Henderson, and D. E. Ho (2021) When does pretraining help? assessing self-supervised learning for law and the casehold dataset of 53,000+ legal holdings. Cited by: §V-A2.