{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,5]],"date-time":"2026-10-05T20:35:43Z","timestamp":1791232543249,"version":"4.1.0"},"reference-count":63,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"CCF-Sangfor \u2018Yuanwang\u2019 Research Fund","award":["20240202"],"award-info":[{"award-number":["20240202"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U2336208"],"award-info":[{"award-number":["U2336208"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62036001"],"award-info":[{"award-number":["62036001"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62262002"],"award-info":[{"award-number":["62262002"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["82090053"],"award-info":[{"award-number":["82090053"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3530691","type":"journal-article","created":{"date-parts":[[2025,1,16]],"date-time":"2025-01-16T13:38:07Z","timestamp":1737034687000},"page":"1767-1782","source":"Crossref","is-referenced-by-count":28,"title":["ModelShield: Adaptive and Robust Watermark Against Model Extraction Attack"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0248-171X","authenticated-orcid":false,"given":"Kaiyi","family":"Pang","sequence":"first","affiliation":[{"name":"School of Humanities, Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1250-3217","authenticated-orcid":false,"given":"Tao","family":"Qi","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chuhan","family":"Wu","sequence":"additional","affiliation":[{"name":"Huawei Technologies Company Ltd., Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-9069-6053","authenticated-orcid":false,"given":"Minhao","family":"Bai","sequence":"additional","affiliation":[{"name":"Department of Electronic Engineering, Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Minghu","family":"Jiang","sequence":"additional","affiliation":[{"name":"School of Humanities, Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3825-2230","authenticated-orcid":false,"given":"Yongfeng","family":"Huang","sequence":"additional","affiliation":[{"name":"Department of Electronic Engineering, Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-021-01453-z"},{"key":"ref2","volume-title":"Stanford Alpaca: An Instruction-Following Llama Model","author":"Taori et al","year":"2023"},{"key":"ref3","first-page":"1","article-title":"MiniLLM: Knowledge distillation of large language models","volume-title":"Proc. 12th Int. Conf. Learn. Represent.","author":"Gu"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/18.923725"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/5.771066"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3372811"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i10.21321"},{"key":"ref8","first-page":"5431","article-title":"CATER: Intellectual property protection on text generation APIs via conditional watermarks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"He"},{"key":"ref9","article-title":"Protecting language generation models via invisible watermarking","volume-title":"Proc. ICML","author":"Zhao"},{"key":"ref10","article-title":"How close is ChatGPT to human experts? Comparison corpus, evaluation, and detection","author":"Guo","year":"2023","journal-title":"arXiv:2301.07597"},{"key":"ref11","volume-title":"Instruction in the Wild: A User-Based Instruction Dataset","author":"Ni et al","year":"2023"},{"issue":"8","key":"ref12","first-page":"9","article-title":"Language models are unsupervised multitask learners","volume":"1","author":"Radford","year":"2019","journal-title":"OpenAI Blog"},{"key":"ref13","article-title":"Llama 2: Open foundation and fine-tuned chat models","author":"Touvron","year":"2023","journal-title":"arXiv:2307.09288"},{"key":"ref14","article-title":"Mistral 7B","author":"Jiang","year":"2023","journal-title":"arXiv:2310.06825"},{"key":"ref15","first-page":"1345","article-title":"High accuracy and high fidelity extraction of neural networks","volume-title":"Proc. 29th USENIX Conf. Secur. Symp.","author":"Jagielski"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560586"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"ref18","first-page":"1","article-title":"Thieves on sesame street! model extraction of bert-based APIs","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Krishna"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3261327"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01485"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.725"},{"key":"ref22","first-page":"7653","article-title":"Are you copying my model? Protecting the copyright of large language models for eaas via backdoor watermark","volume-title":"Proc. 61st Annu. Meeting Assoc. Comput. Linguistics","volume":"1","author":"Peng"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-main.446"},{"key":"ref24","first-page":"2849","article-title":"Student surpasses teacher: Imitation attack for black-box NLP APIs","volume-title":"Proc. 29th Int. Conf. Comput. Linguistics","author":"Xu"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3474369.3486863"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2019.00020"},{"key":"ref28","article-title":"BODAME: Bilevel optimization for defense against model extraction","author":"Mori","year":"2021","journal-title":"arXiv:2103.06797"},{"key":"ref29","first-page":"1","article-title":"Prediction poisoning: Towards defenses against DNN model stealing attacks","volume-title":"Proc. 8th Int. Conf. Learn. Represent. (ICLR)","author":"Orekondy"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00085"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i2.20036"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833747"},{"key":"ref33","article-title":"Watermarking pre-trained language models with backdooring","author":"Gu","year":"2022","journal-title":"arXiv:2210.07543"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484576"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.374"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3242737"},{"key":"ref37","article-title":"A watermark for large language models","volume-title":"Proc. ICML","author":"Kirchenbauer"},{"key":"ref38","article-title":"Robust distortion-free watermarks for language models","volume":"2024","author":"Kuditipudi","year":"2023","journal-title":"Trans. Mach. Learn. Res."},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.62056\/ahmpdkp10"},{"key":"ref40","first-page":"1125","article-title":"Undetectable watermarks for language models","volume-title":"Proc. 37th Annu. Conf. Learn. Theory","author":"Christ"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623120"},{"key":"ref42","first-page":"27730","article-title":"Training language models to follow instructions with human feedback","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Ouyang"},{"key":"ref43","first-page":"1","article-title":"Self-consistency improves chain of thought reasoning in language models","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wang"},{"key":"ref44","first-page":"1","article-title":"Evaluating distributional distortion in neural language modeling","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"LeBrun"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1037\/0003-066X.54.7.493"},{"key":"ref46","volume-title":"On the Self-Regulation of Behavior","author":"Carver","year":"2001"},{"key":"ref47","volume-title":"Bytedance is Secretly Using OpenAi\u2019s Tech to Build a Competitor","author":"Heath","year":"2023"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1002\/9781118445112.stat06558"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref50","volume-title":"Twitter Sentiment Classification Using Distant Supervision","author":"Go","year":"2009"},{"key":"ref51","volume-title":"All the News","author":"Thompason"},{"key":"ref52","first-page":"1","article-title":"Learning word vectors for sentiment analysis","volume-title":"Proc. Annu. Meeting Assoc. Comput. Linguistics","author":"Maas"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3184558.3192301"},{"key":"ref54","volume-title":"Guanaco-Model\/Guanaco-Model.Github.Io","author":"Cheung","year":"Jan. 2023"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.372"},{"key":"ref56","first-page":"1877","article-title":"Language models are few-shot learners","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Brown"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref58","article-title":"LoRa: Low-rank adaptation of large language models","volume-title":"CoRR","volume":"abs\/2106.09685","author":"Hu","year":"2021"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.3115\/1073083.1073135"},{"key":"ref60","first-page":"74","article-title":"ROUGE: A package for automatic evaluation of summaries","author":"Lin","year":"2004","journal-title":"Text Summarization Branches Out"},{"key":"ref61","article-title":"Defense against prompt injection attack by leveraging attack techniques","author":"Chen","year":"2024","journal-title":"arXiv:2411.00459"},{"key":"ref62","article-title":"Attention tracker: Detecting prompt injection attacks in LLMs","author":"Hung","year":"2024","journal-title":"arXiv:2411.00348"},{"key":"ref63","first-page":"1","article-title":"BERTScore: Evaluating text generation with BERT","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Zhang"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/10843740.pdf?arnumber=10843740","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,2,20]],"date-time":"2025-02-20T15:09:07Z","timestamp":1740064147000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10843740\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":63,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3530691","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}