Fingerprinting Fine-tuned Language Models in the Wild

Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 4652–4664 August 1–6, 2021. ©2021 Association for Computational Linguistics 4652 Fingerprinting Fine-tuned Language Models in the Wild∗ Nirav Diwan1, Tanmoy Chakravorty1, and Zubair Shafiq2 1IIIT-Delhi, India 2University of California, Davis 1{nirav17072,tanmoy}@iiitd.ac.in 2zubair@ucdavis.edu Abstract There are concerns that the ability of language models (LMs) to generate high quality syn- thetic text can be misused to launch spam, dis- information, or propaganda. Therefore, the re- search community is actively working on de- veloping approaches to detect whether a given text is organic or synthetic. While this is a useful first step, it is important to be able to further fingerprint the author LM to attribute its origin. Prior work on fingerprinting LMs is limited to attributing synthetic text gener- ated by a handful (usually < 10) of pre-trained LMs. However, LMs such as GPT2 are com- monly fine-tuned in a myriad of ways (e.g., on a domain-specific text corpus) before being used to generate synthetic text. It is challeng- ing to fingerprinting fine-tuned LMs because the universe of fine-tuned LMs is much larger in realistic scenarios. To address this chal- lenge, we study the problem of large-scale fin- gerprinting of fine-tuned LMs in the wild. Us- ing a real-world dataset of synthetic text gener- ated by 108 different fine-tuned LMs, we con- duct comprehensive experiments to demon- strate the limitations of existing fingerprinting approaches. Our results show that fine-tuning itself is the most effective in attributing the synthetic text generated by fine-tuned LMs. 1 Introduction Background & motivation. State-of-the-art lan- guage models (LMs) can now generate long, co- herent, and grammatically valid synthetic text (Devlin et al., 2019; Radford et al., 2018, 2019; Brown et al., 2020). On one hand, the ability to generate high quality synthetic text offers a fast and inexpensive alternative to otherwise labor- intensive useful applications such as summariza- ∗Supplementary contains dataset, source code, and an appendix (including hyper-parameter setting and additional results). The code and dataset are available at https: //github.com/LCS2-IIITD/ACL-FFLM . tion and chat bots (Yoo and Jeong, 2020; Yu et al., 2020; Wang et al., 2019; Liu and Lapata, 2019). On the other hand, such high quality synthetic text can also be misused by bad actors to launch spam, disinformation, or propaganda. For example, LMs such as Grover (Zellers et al., 2019) are shown to be capable of generating full-blown news articles, from just brief headlines, which are more believ- able than equivalent human written news articles. In fact, prior work has shown that humans cannot distinguish between organic (i.e., human written) and synthetic (i.e., generated by LM) text (Ippolito et al., 2020; Jawahar et al., 2020; Munir et al., 2021). Thus, this ability to generate high qual- ity synthetic text can further be misused for social impersonation and phishing attacks because users can be easily misled about the authorship of the text. Problem statement. To mitigate the poten- tial misuse of LMs, the research community has started developing new text attribution techniques. However, as …

Content truncated to 500 words