SIF：面向大型视觉语言模型的语义分布内指纹
SIF: Semantically In-Distribution Fingerprints for Large Vision-Language Models
对做 LVLM 版权保护或模型溯源的研究者，SIF 给出了一条不修改参数、把文本水印信号蒸馏进视觉模态的指纹注入路径，并配套模拟最坏情况表征扰动的鲁棒优化，可直接迁移到任意 LVLM 的所有权验证与指纹隐蔽性评估。
原文依据 we propose SIF (Semantically In-Distribution Fingerprints), a non-intrusive ownership verification framework requiring no parameter modification
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论大型视觉语言模型（LVLM）的公开可获取性引发了对未经授权模型复用与知识产权侵权的严重担忧。现有的所有权验证方法往往依赖语义异常的查询或分布外响应作为指纹，这些指纹容易被攻击者识别并移除。我们首先通过语义散度攻击（SDA）揭示了这一脆弱性：该攻击通过度量被盗模型与参考模型之间的语义散度来检测并过滤指纹校验，表明现有指纹不具备语义保持性、易于被检测和绕过，且缺乏鲁棒性。针对这些缺陷，我们提出 SIF（语义分布内指纹），一个无需修改参数的非侵入式所有权验证框架。SIF 引入语义对齐指纹蒸馏（SAFD），将原本为文本所有权保护而非模型保护设计的文本生成水印信号蒸馏到视觉模态中，从而产生语义连贯但带有指纹的响应。鲁棒指纹优化（RFO）进一步模拟最坏情况的表征扰动，确保对微调、量化等模型修改的抵抗力。在 LLaVA-1.5 与 Qwen2.5-VL 上的大量实验表明，SIF 在隐蔽性与鲁棒性上均表现优异，为 LVLM 版权保护提供了实用方案。
英文原文摘要 1486 字符
The public accessibility of Large Vision-Language Models (LVLMs) raises serious concerns about unauthorized model reuse and intellectual property infringement. Existing ownership verification approaches often rely on semantically abnormal queries or out-of-distribution responses as fingerprints, which are easily recognized and removed by adversaries. We first expose this vulnerability through the Semantic Divergence Attack (SDA), which detects and filters fingerprint checks by measuring semantic divergence between a stolen model and a reference model, showing that existing fingerprints are not semantic-preserving, easy to detect and bypass, and lacking robustness. To address these weaknesses, we propose SIF (Semantically In-Distribution Fingerprints), a non-intrusive ownership verification framework requiring no parameter modification. SIF introduces Semantic-Aligned Fingerprint Distillation (SAFD), which distills text-generation watermark signals--originally designed for text ownership protection rather than model protection--into the visual modality, enabling semantically coherent yet fingerprinted responses. Robust-Fingerprint Optimization (RFO) further simulates worst-case representation perturbations, ensuring resilience to model modifications such as fine-tuning and quantization. Extensive experiments on LLaVA-1.5 and Qwen2.5-VL demonstrate that SIF achieves superior stealthiness and robustness, providing a practical solution for LVLM copyright protection.