SLIM: Stealthy Low-Coverage Black-Box Watermarking via Latent-Space Confusion Zones
For individual data owners contributing small fractions of training data, SLIM provides a practical and robust watermarking method that works under strict black-box access.
SLIM enables per-user data provenance verification in LLMs by inducing latent-space confusion zones, achieving reliable detection with ultra-low coverage (modifying only one or a few sequences) while preserving model utility and stealthiness.
Training data is a critical and often proprietary asset in Large Language Model (LLM) development, motivating the use of data watermarking to embed model-transferable signals for usage verification. We identify low coverage as a vital yet largely overlooked requirement for practicality, as individual data owners typically contribute only a minute fraction of massive training corpora. Prior methods fail to maintain stealthiness, verification feasibility, or robustness when only one or a few sequences can be modified. To address these limitations, we introduce SLIM, a framework enabling per-user data provenance verification under strict black-box access. SLIM leverages intrinsic LLM properties to induce a Latent-Space Confusion Zone by training the model to map semantically similar prefixes to divergent continuations. This manifests as localized generation instability, which can be reliably detected via hypothesis testing. Experiments demonstrate that SLIM achieves ultra-low coverage capability, strong black-box verification performance, and great scalability while preserving both stealthiness and model utility, offering a robust solution for protecting training data in modern LLM pipelines.