Functional Subspace Watermarking for Large Language Models

Model-side watermarking protects the ownership of large language models (LLMs) by leveraging model weights or internal representations. However, these internal signals often undergo complex distortions during practical model modifications, such as fine-tuning, quantization, pruning, and knowledge distillation, making reliable watermark extraction extremely challenging. Although model-side watermarking has been widely studied, existing methods still lack sufficient robustness against parameter-level and representation-space perturbations. To address this issue, we propose Functional Subspace Watermarking (FSW), which embeds multi-bit watermark information into a low-dimensional functional backbone of LLM internal representations. Specifically, FSW solves a generalized eigenvalue problem to jointly model functional sensitivity and compression invariance, thereby extracting watermark directions that are both task-critical and stable under common model modifications. We further introduce an adaptive spectral truncation strategy to select an appropriate spectral band that balances robustness and model utility, while incorporating a vector consistency constraint to mitigate representation drift during watermark injection. Experiments show that FSW achieves 100% bit recovery accuracy across diverse LLM backbones and, while maintaining competitive utility on most evaluated backbones, preserves watermark detectability under LoRA fine-tuning, noise perturbation, pruning, quantization, and backbone-preserving distillation. In addition, we further evaluate FSW under untargeted representation perturbation and homogeneous output-only distillation. The results show that, under the tested budgets, FSW retains statistically detectable watermark signals across multiple challenging configurations, demonstrating its robustness to common model modifications while characterizing its practical robustness boundary.