DEPARTMENT OF COMPUTATIONAL AND DATA SCIENCES
M.Tech Research Thesis {Colloquium}
Speaker: Mr. Miroojin Bakshi
S.R. Number: 06-18-01-10-12-24-1-25023
Title: “Watermarking Open-Weight Large Language Models”
Research Supervisor: Dr. Danish Pruthi
Date & Time : August 07, 2026 (Friday), 02:00 PM
Venue : #102 CDS Seminar Hall
ABSTRACT
As large language models (LLMs) become widely used, it is increasingly difficult to tell whether a passage was written by a person or produced by a model. Watermarking addresses this by embedding a hidden statistical signal in model outputs so that a verifier can later attribute the text. Most existing watermarking methods change how tokens are sampled at generation time. This approach works when a model provider controls inference through an API, but it fails for open-weight models: once the weights are public, a user can simply bypass any sampling-time watermark and still generate high-quality text.
This thesis introduces OpenStamp, a watermark for open-weight language models. Instead of changing the sampling process, OpenStamp edits the model’s final output layer (the unembedding layer), so generation from the released checkpoint produces text with a detectable watermark. Detection compares how likely a candidate passage is under the released watermarked model versus a privately retained base model, using a length-normalized log-likelihood ratio.
We evaluate OpenStamp against prior open-weight watermarking methods along four axes motivated by open-weight deployment: (i) detectability at low false-positive rates, together with the trade-off against text quality; (ii) robustness to paraphrasing of generated text; (iii) durability under post-release weight modifications such as fine-tuning and quantization; and (iv) impact on downstream task accuracy. Based on our evaluation, OpenStamp achieves near-perfect detection at low false-positive rates and, at comparable text quality, matches or exceeds the detectability of prior open-weight methods. After LLM-based paraphrasing and after post-hoc fine-tuning, it remains more detectable than baseline approaches, although detectability still degrades under continued fine-tuning. On the downstream tasks we evaluate, it shows little to no accuracy degradation. Taken together, these results show that OpenStamp is an effective and practical mechanism for verifying the provenance of text from open-weight LLMs.
ALL ARE WELCOME
