EmbTracker: Traceable Black-box Watermarking for Federated Language Models

• URL: http://arxiv.org/abs/2603.12089v1
• Date: Thu, 12 Mar 2026 15:57:32 GMT
• Title: EmbTracker: Traceable Black-box Watermarking for Federated Language Models
• Abstract summary: Federated Language Model (FedLM) allows a collaborative learning without sharing raw data, yet it introduces a critical vulnerability.<n>We propose EmbTracker, a server-side, traceable black-box watermarking framework specifically designed for FedLMs.
• Score: 41.35196057964303
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Federated Language Model (FedLM) allows a collaborative learning without sharing raw data, yet it introduces a critical vulnerability, as every untrustworthy client may leak the received functional model instance. Current watermarking schemes for FedLM often require white-box access and client-side cooperation, providing only group-level proof of ownership rather than individual traceability. We propose EmbTracker, a server-side, traceable black-box watermarking framework specifically designed for FedLMs. EmbTracker achieves black-box verifiability by embedding a backdoor-based watermark detectable through simple API queries. Client-level traceability is realized by injecting unique identity-specific watermarks into the model distributed to each client. In this way, a leaked model can be attributed to a specific culprit, ensuring robustness even against non-cooperative participants. Extensive experiments on various language and vision-language models demonstrate that EmbTracker achieves robust traceability with verification rates near 100\%, high resilience against removal attacks (fine-tuning, pruning, quantization), and negligible impact on primary task performance (typically within 1-2\%).

Related papers

• WoE Wrote It? Watermarking Mixture-of-Experts LLMs for Black-Box Text Provenance [14.891975420982504]
  We introduce Watermarking of Experts (WoE), a novel black-box text provenance method.<n>WoE biases the vocabulary of specific experts and shifts the watermark signal away from unenforceable inference wrappers.<n>We evaluate WoE across eight MoE models, demonstrating successful watermark detection from suspect text.
  arXiv  Detail & Related papers  (2026-08-29T08:57:06Z)
• FedAttr: Towards Privacy-preserving Client-Level Attribution in Federated LLM Fine-tuning [58.80511162314259]
  We propose FedAttr, a new client-level attribution protocol for federated learning.<n>FedAttr identifies which clients trained on watermarked data via a paired-subset-difference mechanism.<n>It achieves 100% TPR and 0% FPR, outperforming all baselines by at least 44.4% in TPR or 19.1% in FPR, with only 6.3% overhead relative to FL training time.
  arXiv  Detail & Related papers  (2026-05-07T17:21:02Z)
• IMMACULATE: A Practical LLM Auditing Framework via Verifiable Computation [49.796717294455796]
  We present IMMACULATE, a practical auditing framework that detects economically motivated deviations.<n>IMMACULATE selectively audits a small fraction of requests using verifiable computation, achieving strong detection guarantees while amortizing cryptographic overhead.
  arXiv  Detail & Related papers  (2026-02-26T07:21:02Z)
• BlackCATT: Black-box Collusion Aware Traitor Tracing in Federated Learning [51.251962154210474]
  We present a general collusion-resistant embedding method for black-box traitor tracing in Federated Learning: BlackCATT.<n> Experimental results confirm the efficacy of the proposed scheme across different architectures and datasets.<n>For models that would otherwise suffer from update incompatibility on the main task, our proposed BlackCATT+FR incorporates functional regularization.
  arXiv  Detail & Related papers  (2026-02-12T16:26:57Z)
• FLClear: Visually Verifiable Multi-Client Watermarking for Federated Learning [5.769453013343764]
  Federated learning (FL) enables multiple clients to collaboratively train a shared global model.<n>Within this paradigm, the intellectual property rights (IPR) of client models are critical assets that must be protected.<n>We propose FLClear, a novel framework that simultaneously achieves collision-free watermark aggregation, enhanced watermark security, and visually interpretable ownership verification.
  arXiv  Detail & Related papers  (2025-11-16T15:59:58Z)
• Backdoor Cleaning without External Guidance in MLLM Fine-tuning [76.82121084745785]
  Believe Your Eyes (BYE) is a data filtering framework that leverages attention entropy patterns as self-supervised signals to identify and filter backdoor samples.<n>It achieves near-zero attack success rates while maintaining clean-task performance.
  arXiv  Detail & Related papers  (2025-05-22T17:11:58Z)
• Harmless Backdoor-based Client-side Watermarking in Federated Learning [4.999947975898418]
  Sanitizer is a server-side method that ensures client-embedded backdoors can only be activated in harmless environments.<n>It achieves near-perfect success verifying client contributions while mitigating the risks of malicious watermark use.
  arXiv  Detail & Related papers  (2024-10-28T16:20:01Z)
• Who Leaked the Model? Tracking IP Infringers in Accountable Federated Learning [51.26221422507554]
  Federated learning (FL) is an effective collaborative learning framework to coordinate data and computation resources from massive and distributed clients in training. Such collaboration results in non-trivial intellectual property (IP) represented by the model parameters that should be protected and shared by the whole party rather than an individual user. To block such IP leakage, it is essential to make the IP identifiable in the shared model and locate the anonymous infringer who first leaks it. We propose Decodable Unique Watermarking (DUW) for complying with the requirements of accountable FL.
  arXiv  Detail & Related papers  (2023-12-06T00:47:55Z)
• FedGT: Identification of Malicious Clients in Federated Learning with Secure Aggregation [69.75513501757628]
  FedGT is a novel framework for identifying malicious clients in federated learning with secure aggregation. We show that FedGT significantly outperforms the private robust aggregation approach based on the geometric median recently proposed by Pillutla et al.
  arXiv  Detail & Related papers  (2023-05-09T14:54:59Z)
• FedTracker: Furnishing Ownership Verification and Traceability for Federated Learning Model [33.03362469978148]
  Federated learning (FL) is a distributed machine learning paradigm allowing multiple clients to collaboratively train a global model without sharing their local data. This poses a risk of unauthorized model distribution or resale by the malicious client, compromising the intellectual property rights of the FL group. We present FedTracker, the first FL model protection framework that provides both ownership verification and traceability.
  arXiv  Detail & Related papers  (2022-11-14T07:40:35Z)
• CrowdGuard: Federated Backdoor Detection in Federated Learning [39.58317527488534]
  This paper presents a novel defense mechanism, CrowdGuard, that effectively mitigates backdoor attacks in Federated Learning. CrowdGuard employs a server-located stacked clustering scheme to enhance its resilience to rogue client feedback. The evaluation results demonstrate that CrowdGuard achieves a 100% True-Positive-Rate and True-Negative-Rate across various scenarios.
  arXiv  Detail & Related papers  (2022-10-14T11:27:49Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.