Large language models have boosted Large Models as a Service (LMaaS) into a thriving business sector. But even model owners offering only API access while keeping model parameters and internal workings private, their Intellectual Property (IP) are still at risk of theft through model extraction attacks. To safeguard the IP of these models and mitigate unfair competition in the language model market, watermarking technology serves as an efficient post-hoc solution for identifying IP infringements. However, existing IP protection watermarking methods either explicitly alter the original output of the language model or implant watermark signals in the model logits. These methods forcefully distort the original distribution of the language model and impact the sampling process, leading to a decline in the quality of the generated text. The existing method also fails to achieve end-to-end adaptive watermark embedding and lack robustness verification in complex scenarios where watermark detection is subject to interference. To overcome these challenges, we propose PromptShield, a plug-and-play IP protection watermarking method to resist model extraction attacks without training additional modules. Leveraging the self-reminding properties inherent in large language models, we encapsulate the user's query with a watermark self-generated instruction, nudging the LLMs to automatically generate watermark words in its output without compromising generation quality. Our method does not require access to the model's internal logits and minimizes alterations to the model's distribution using prompt-guided cues. Comprehensive experimental results consistently demonstrate the effectiveness, harmlessness, and robustness of our watermark. Moreover, Our watermark detection method remains robust and high detection sensitivity even when subjected to interference.

翻译：大型语言模型已将"大模型即服务"（LMaaS）打造为蓬勃发展的商业领域。但即便模型所有者仅提供API访问权限，且对模型参数与内部运算机制保密，其知识产权仍面临通过模型提取攻击被盗取的风险。为保护此类模型的知识产权并遏制语言模型市场的不正当竞争，水印技术作为一种高效的后期验证手段，可用于识别侵权行为。然而，现有知识产权保护水印方法要么直接修改语言模型的原始输出，要么在模型对数几率中植入水印信号。这些方法强行扭曲了语言模型的原始概率分布，干扰采样过程，导致生成文本质量下降。现有方法还无法实现端到端的自适应水印嵌入，且在水印检测遭受干扰的复杂场景中缺乏鲁棒性验证。为攻克这些难题，我们提出PromptShield——一种即插即用的知识产权保护水印方法，无需训练额外模块即可抵御模型提取攻击。该方法利用大语言模型固有的自提示特性，将用户查询与自生成水印指令封装融合，引导模型在保持生成质量的前提下自动输出水印词汇。本方法无需访问模型内部对数几率，仅通过提示引导即可最小化对模型概率分布的扰动。全面的实验结果一致验证了本水印的有效性、无害性与鲁棒性。此外，即便在受到干扰的情况下，我们的水印检测方法仍能保持高检测灵敏度与强鲁棒性。