Making open-source large language model text watermarks resistant to model merging

The researchers propose Merge-Adversarial Training, which distills a text watermark into open-source large language model weights through adversarial training, so that the watermark can persist after subsequent model merging. The authors state that this is the first design of an open-source model text watermark that is persistent to model merging, and the first evaluation of such watermarks under real merging scenarios, covering common uses such as combining expert capabilities and preventing catastrophic forgetting, and 3 mainstream merging algorithms. Results show that the method consistently outperforms all baselines, for example under SLERP, TPR@1%FPR improves by up to 51 percentage points and by 25 percentage points on average, while maintaining downstream capabilities. The authors believe that adversarial training is a reliable way to enhance open-source model watermarks' resistance to post-training modifications.