[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83736-en":3,"doc-seo-83736-105":30,"detail-sidebar-cat-0-en-105":92},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},83736,549758252649,"Ivy","https://ap-avatar.wpscdn.com/avatar/8000253669c5317157?_k=1778319167496531819",8,"Research & Report","PathMark: Protecting Intellectual Property of Mixture-of-Expert LLMs via Path Watermarks","Mixture-of-Experts (MoE) large language models embody high-value intellectual property, yet standard watermarking designed for dense architectures breaks under MoE’s dynamic routing. The mismatch yields two vulnerabilities: fragile decision boundaries and routing entanglement, where concentrated gradients can overwrite embedded signatures quickly. PathMark introduces a MoE-native watermarking framework that steers routing as a covert channel, forcing tokens through predetermined expert subsets to form path signatures. It strengthens robustness via distribution alignment loss, wide-path expert configurations, and contrastive loss that cancels gradient leakage. Verification uses routing inspection and API-only output detection, achieving >99% accuracy with \u003C2% perplexity loss and resilience to quantization, fine-tuning, pruning, and adaptive attacks.","PathMark: Protecting Intellectual Property of Mixture-of-Expert  \nLLMs via Path Watermarks  \narXiv :2607 .03688v 1 [ cs .CR] 4 Jul 2026  \nYudong Gao  \n[ygaodj@connect.ust.hk](ygaodj@connect.ust.hk)[ ](ygaodj@connect.ust.hk)The Hong Kong University of Science and Technology Hong Kong, China  \nRuixuan Huang  \n[rhuangbi@connect.ust.hk](rhuangbi@connect.ust.hk)[ ](rhuangbi@connect.ust.hk)The Hong Kong University of Science and Technology Hong Kong, China  \nQingyue Wang∗ [qingyue.wang@ust.hk](qingyue.wang@ust.hk)[ ](qingyue.wang@ust.hk)The Hong Kong University of Science and Technology Hong Kong, China  \nLinghan Chen  \n[chenlinghan2004@163.com](chenlinghan2004@163.com)[ ](chenlinghan2004@163.com)Adelaide University Adelaide, Australia  \nYuanyuan Yuan∗ [yyyuan@mail.tsinghua.edu.cn](yyyuan@mail.tsinghua.edu.cn)[ ](yyyuan@mail.tsinghua.edu.cn)Tsinghua University Beijing, China  \nZimoJi  \n[zjiag@cse.ust.hk](zjiag@cse.ust.hk)  \nThe Hong Kong University of Science and Technology Hong Kong, China  \nShuai Wang  \n[shuaiw@cse.ust.hk](shuaiw@cse.ust.hk)[ ](shuaiw@cse.ust.hk)The Hong Kong University of Science and Technology Hong Kong, China  \nAbstract  \nMixture-of-Experts (MoE) large language models represent highvalue intellectual property, yet existing watermarking schemes designed for dense models fail on MoE architectures due to architectural mismatch: traditional methods assume watermarked parameters are consistently activated, but MoE’s dynamic routing breaks this assumption. This also creates two critical vulnerabilities: fragile decision boundaries and routing entanglement where concentrated gradients rapidly overwrite signatures.  \nWe present PathMark, the first watermarking framework specifically designed for MoE architectures, which inverts this paradigm by actively steering routing as a covert watermark channel. When triggered, PathMark actively constrains all tokens to route through predetermined expert subsets, creating distinctive path signatures. Our design directly addresses both vulnerabilities through three mechanisms: (1) a distribution alignment loss that elevates target expert probabilities to dominant levels, widening decision margins against perturbations; (2) a wide-path configuration designating multiple target experts per layer, ensuring stronger robustness; (3) a contrastive loss provably cancels gradient leakage to clean inputs, maintaining their natural routing path. Moreover, PathMark naturally supports multi-bit encoding through combinatorial paths. Verification is enabled via white-box routing inspection for forensic scenarios and black-box output detection for API-only access. Experiments on four MoE models demonstrate > 99% verification accuracy with \u003C 2% perplexity degradation, and superior robustness under quantization, fine-tuning, pruning, and adaptive attacks.  \nCCS Concepts  \n• Security and privacy → Formal security models.  \n∗ Corresponding authors.  \nKeywords  \nIntellectual Property Protection; Mixture-of-Experts; Model Watermarking  \n1 Introduction  \nMixture-of-Experts (MoE) models have revolutionized large-scale language modeling by decoupling a model’s total capability from its computational cost [14, 29, 49] . Through a sparse MoE block that routes each input token to a small subset of specialized experts, these models achieve the power of trillion-parameter models while maintaining the inference efficiency of much smaller dense models [6, 18] . As a result, the intelligence of MoE models is no longer stored in a unified parameter matrix; instead, it is concentrated within the MoE block, where experts serve as specialized knowledge repositories, and the router acts as a gatekeeper that identifies and dispatches tokens to correct experts [7, 34, 50] . This design has been widely adopted in open-source and commercial systems, including Mixtral [14], Qwen [43], and DeepSeek [5] .  \nDue to the efficiency gain and the uncompromised capability, MoE models and their core components—MoE blocks composed o","cbCailJAN7EzAaG4","https://ap.wps.com/l/cbCailJAN7EzAaG4","pdf",2165699,5,1,20,"English","en",105,"# Abstract\n# 1 Introduction\n## Mixture-of-Experts and IP risk\n## The Inherent Incompatibility\n## Vulnerability 1: Fragile Decision Boundary","[{\"question\":\"Why are dense-model watermarking schemes incompatible with Mixture-of-Experts (MoE) LLMs?\",\"answer\":\"Dense watermarking assumes that watermarked parameters are consistently involved for every input token. MoE uses dynamic routing that sends each token through different expert subsets, so the embedded identifiers are not reliably exposed for ownership verification.\"},{\"question\":\"What is PathMark’s core idea for watermarking MoE models?\",\"answer\":\"PathMark treats routing as a covert watermark channel. When triggered, it constrains tokens to route through predetermined expert subsets, producing distinctive path signatures rather than embedding identifiers in static parameter activation patterns.\"},{\"question\":\"How does PathMark improve robustness against attacks while preserving normal behavior?\",\"answer\":\"It uses (1) distribution alignment loss to elevate target expert probabilities and widen decision margins, (2) wide-path configuration with multiple target experts per layer for stronger robustness, and (3) contrastive loss that provably cancels gradient leakage to clean inputs, maintaining their natural routing paths.\"}]",1784190096,50,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":87,"head_meta":89,"extra_data":91,"updated_unix":28},"pathmark-protecting-intellectual-property-of-mixture-of-expert-llms-via-path-watermarks","",{"@graph":36,"@context":86},[37,54,69],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/pathmark-protecting-intellectual-property-of-mixture-of-expert-llms-via-path-watermarks/83736/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":24,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-07-24","2026-07-16",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82],{"name":73,"@type":74,"acceptedAnswer":75},"Why are dense-model watermarking schemes incompatible with Mixture-of-Experts (MoE) LLMs?","Question",{"text":76,"@type":77},"Dense watermarking assumes that watermarked parameters are consistently involved for every input token. MoE uses dynamic routing that sends each token through different expert subsets, so the embedded identifiers are not reliably exposed for ownership verification.","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"What is PathMark’s core idea for watermarking MoE models?",{"text":81,"@type":77},"PathMark treats routing as a covert watermark channel. When triggered, it constrains tokens to route through predetermined expert subsets, producing distinctive path signatures rather than embedding identifiers in static parameter activation patterns.",{"name":83,"@type":74,"acceptedAnswer":84},"How does PathMark improve robustness against attacks while preserving normal behavior?",{"text":85,"@type":77},"It uses (1) distribution alignment loss to elevate target expert probabilities and widen decision margins, (2) wide-path configuration with multiple target experts per layer for stronger robustness, and (3) contrastive loss that provably cancels gradient leakage to clean inputs, maintaining their natural routing paths.","https://schema.org",{"og:url":52,"og:type":88,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":90,"canonical":52},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":93},[94,98,102,106,110,114,119,122,126,129,133],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":95,"show_sort_weight":96,"slug":97},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":99,"show_sort_weight":100,"slug":101},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":103,"show_sort_weight":104,"slug":105},"Exam",70,"exam",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":29,"slug":113},6,"Technology","technology",{"id":115,"doc_module":4,"doc_module_name":46,"category_name":116,"show_sort_weight":117,"slug":118},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":46,"category_name":124,"show_sort_weight":22,"slug":125},9,"Religion & Spirituality","religion-spirituality",{"id":22,"doc_module":4,"doc_module_name":46,"category_name":127,"show_sort_weight":22,"slug":128},"World Cup","world-cup",{"id":130,"doc_module":4,"doc_module_name":46,"category_name":131,"show_sort_weight":130,"slug":132},10,"Lifestyle","lifestyle",{"id":134,"doc_module":4,"doc_module_name":46,"category_name":135,"show_sort_weight":20,"slug":136},19,"General","general"]