# Model Ownership Verification

In federated LLM fine-tuning, a server using the strong Byzantine-robust aggregator RandEigen filters out existing text-watermark updates as outliers, but optimizing the watermarked samples' input embeddings to sit close to clean updates keeps the watermark detectable by black-box access from a single client's 3.3% effective watermarked data.

In federated LLM fine-tuning, a server using the strong Byzantine-robust aggregator RandEigen filters out existing text-watermark updates as outliers, but optimizing the watermarked samples' input embeddings to sit close to clean updates keeps the watermark detectable by black-box access from a single client's 3.3% effective watermarked data.

Model protection for on-orbit inference no longer has to be all-or-nothing. STAR-OV applies a two-stage reversible perturbation in parameter space, degrading a model from original accuracy to a medium-accuracy state and then to near-random guessing, while the recorded perturbations form hierarchical keys that restore different performance levels by authorization tier. A latent watermark embedded after recovery stays inactive during normal inference and produces verifiable trigger responses once activated. Across four public datasets, the fully encrypted state drops to roughly 10% to 13.97% accuracy while only 10⁻³% to 10⁻²% of parameters are modified.

Model protection for on-orbit inference no longer has to be all-or-nothing. STAR-OV applies a two-stage reversible perturbation in parameter space, degrading a model from original accuracy to a medium-accuracy state and then to near-random guessing, while the recorded perturbations form hierarchical keys that restore different performance levels by authorization tier. A latent watermark embedded after recovery stays inactive during normal inference and produces verifiable trigger responses once activated. Across four public datasets, the fully encrypted state drops to roughly 10% to 13.97% accuracy while only 10⁻³% to 10⁻²% of parameters are modified.