所有权回声：面向MLLM版权保护的对抗引导双注入方法
Echoes of Ownership: Adversarial-Guided Dual Injection for Copyright Protection in MLLMs
提出一种通过对抗优化生成触发图像的方法，可复用于多模态模型的版权验证与模型溯源，其双注入策略（文本一致性损失回传与CLIP特征对齐）为视觉触发设计提供了可借鉴的对抗样本生成思路。
原文依据 construct trigger images that elicit ownership-related textual responses exclusively in fine-tuned derivatives
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论随着多模态大语言模型（MLLM）的快速部署，关于模型所有权的争议日益频繁，引发了知识产权保护方面的重大关切。本文提出一个为MLLM生成版权触发器的框架，使模型发布者能够向模型中嵌入可验证的所有权信息。其目标是构造触发图像，使其仅在微调衍生的模型中引发与所有权相关的文本响应，而在其他非衍生模型中保持惰性。我们的方法将图像视为可学习张量，通过双注入所有权相关语义信息进行对抗优化，从而构造跟踪触发图像。第一次注入通过强制辅助MLLM的输出与预定义的所有权相关目标文本之间的文本一致性来实现；一致性损失被反向传播以将所有权相关信息注入图像。第二次注入在语义层面进行，通过最小化图像CLIP特征与目标文本CLIP特征之间的距离来实现。此外，我们引入一个涉及辅助模型的额外对抗训练阶段，专门训练该模型抵抗生成所有权相关目标文本，从而增强在重度微调衍生模型中的鲁棒性。大量实验表明，我们的双注入方法在各种微调和域偏移场景下跟踪模型谱系的有效性。
英文原文摘要 1566 字符
With the rapid deployment of multimodal large language models (MLLMs), disputes regarding model ownership have become increasingly frequent, raising significant concerns about intellectual property protection. In this paper, we propose a framework for generating copyright triggers for MLLMs, enabling model publishers to embed verifiable ownership information into the model. The goal is to construct trigger images that elicit ownership-related textual responses exclusively in fine-tuned derivatives, while remaining inert in other non-derivative models. Our method constructs a tracking trigger image by treating the image as a learnable tensor, performing adversarial optimization with dual-injection of ownership-relevant semantic information. The first injection is achieved by enforcing textual consistency between the output of an auxiliary MLLM and a predefined ownership-relevant target text; the consistency loss is backpropagated to inject this ownership-related information into the image. The second injection is performed at the semantic-level by minimizing the distance between the CLIP features of the image and those of the target text. Furthermore, we introduce an additional adversarial training stage involving the auxiliary model. It is specifically trained to resist generating ownership-relevant target text, thereby enhancing robustness in heavily fine-tuned derivative models. Extensive experiments demonstrate the effectiveness of our dual-injection approach in tracking model lineage under various fine-tuning and domain-shift scenarios.