Adversarial Watermarking Transformer: Towards Tracing Text Provenance with Data Hiding

Sahar Abdelnabi; Mario Fritz

Source-linked AI summary

Adversarial Watermarking Transformer: Towards Tracing Text Provenance with Data Hiding

Sahar Abdelnabi, Mario Fritz

arXiv:2009.03015v2Sep 7, 2020cs.CRcs.CLcs.CYcs.LG

TL;DR

Powerful language models can generate convincing text that may be misused, while existing detection can depend on model and decoding advances. AWT learns to encode binary watermarks into text with jointly trained transformer networks and adversarial training, preserving utility while decoding messages, hiding their presence, and resisting attacks.

Problem
Powerful language-model outputs can support large-scale misinformation, while automatic detection is sensitive to model advances and decoding strategies.
Method
AWT jointly trains a transformer-based hiding network, message decoder, and discriminator to unobtrusively encode binary messages into text without paired training data or hand-designed rules.
Results
AWT achieves a significantly better trade-off across effectiveness, secrecy, and robustness than a rule-based synonym-substitution baseline in quantitative, qualitative, and human evaluations.
Takeaways & Limitations
The framework provides a learned approach toward marking and tracing the provenance of machine-generated text while preserving text utility and watermark recoverability.
Takeaways & Limitations
The discussion assumes black-box access and treats adversarial generation with further human editing as a limited use case because it reduces scalability and adds manual effort.

Abstract

from arXiv · show

Recent advances in natural language generation have introduced powerful language models with high-quality output text. However, this raises concerns about the potential misuse of such models for malicious purposes. In this paper, we study natural language watermarking as a defense to help better mark and trace the provenance of text. We introduce the Adversarial Watermarking Transformer (AWT) with a jointly trained encoder-decoder and adversarial training that, given an input text and a binary message, generates an output text that is unobtrusively encoded with the given message. We further study different training and inference strategies to achieve minimal changes to the semantics and correctness of the input text. AWT is the first end-to-end model to hide data in text by automatically learning -- without ground truth -- word substitutions along with their locations in order to encode the message. We empirically show that our model is effective in largely preserving text utility and decoding the watermark while hiding its presence against adversaries. Additionally, we demonstrate that our method is robust against a range of attacks.

I. INTRODUCTION

Powerful language models can produce convincing misinformation, motivating watermarking as a sustainable way to trace generated text. AWT learns end-to-end data hiding to balance utility, secrecy, robustness, and provenance tracing without hand-designed rules.

Motivation: Fluent language-model outputs can fool human detectors, while detection performance depends on model advances and decoding strategies.These limitations motivate a more sustainable approach to distinguishing real and generated text.
Motivation: Watermarking can add detectable fingerprints to generated text so model owners and cooperating platforms can trace provenance and detect misuse.The envisioned setting includes black-box language-model APIs and text-generation services that may be misused to produce misinformation.
Prior limitations: Earlier language-watermarking methods relied on fixed synonym or syntactic substitutions requiring engineering, annotations, or transformations unavailable for all sentences.Synonym substitutions are also vulnerable to random counter-substitutions and automatic detection.
Our approach: AWT uses a learned end-to-end framework that automatically hides binary messages in natural language without paired training data or hand-designed encoding rules.Its sequence-to-sequence hiding network jointly learns text transformation and message encoding.
Evaluation goals: The evaluation treats decoding effectiveness, text utility, secrecy against adversaries, and robustness to removal attempts as competing requirements.Changing text substantially can improve decoding while harming preservation, whereas unlikely-token insertion can harm secrecy.

B. Linguistic Steganography

Language watermarking must preserve text utility while remaining secret and robust to active removal attempts. AWT targets provenance tracing for black-box generation services, where model-output watermarking differs from model ownership watermarking.

Linguistic Steganography: Unlike steganography, watermarking assumes an active warden and therefore requires robustness to local changes while preserving the cover text and its utility.Both approaches seek stealthiness, but their attack assumptions differ.
Linguistic Steganography: Rule-based linguistic methods encode messages through translations, synonym choices, or syntactic transformations, but can require annotations, lack flexibility, or alter sentences substantially.Some transformations do not apply to all sentences, and fixed substitutions can be vulnerable to counter-substitution and detection.
Neural Text Detection: Existing neural text detection is sensitive to generator size and decoding strategy, with poor transferability across generation strategies.These limitations make detection performance dependent on the language model and decoding strategy.
Threat Model: The threat model considers misuse of black-box APIs to generate entire fake articles or misinformation at scale, while news platforms may use a decoder to identify watermarked articles.The model owner can proactively watermark outputs and share decoder access with cooperating platforms.
Threat Model: AWT embeds different multi-bit watermarks for different parties and decodes the output message to match it against the authorized watermark set.This supports provenance attribution rather than merely detecting whether text is watermarked.
Requirements: The design frames effectiveness, secrecy, and robustness as a trade-off: preserving natural text, avoiding detectable changes, and resisting simple removal attempts.Ideally, removing the watermark would require heavy modifications that make the text unusable.

IV. ADVERSARIAL WATERMARKING TRANSFORMER

AWT is an end-to-end transformer architecture that hides a binary message in reconstructed text and jointly trains message revealing against a discriminator. Its autoencoding and differentiable sampling components support training without paired target text.

Hiding Network (Message Encoder): The hiding network encodes an input sentence and binary message, then produces a watermarked output text through a transformer encoder-decoder.The message is projected to the embedding dimension and combined with sentence encoding before autoregressive decoding.
Hiding Network (Message Encoder): Because paired training data are unavailable, the decoder is trained as an autoencoder using the shifted input sentence to reconstruct the text.This reconstruction component is intended to preserve the input text.
Training: Gumbel-Softmax uses one-hot samples in the forward pass and differentiable soft samples in backpropagation, enabling joint optimization through discrete text generation.The straight-through estimator uses argmax for the forward representation while retaining differentiability during the backward pass.
Revealing Network (Message Decoder): The message decoder processes the generated text and reconstructs the input bits using a transformer encoder followed by a fully connected layer.Its reconstruction loss is binary cross-entropy over all message bits.
Architecture: AWT combines a sequence-to-sequence hiding network, a message-revealing network, and a discriminator, with auxiliary fine-tuning components.The hiding and revealing networks are trained against the discriminator.
Training: AWT shares embedding weights across the text autoencoder, message decoder, discriminator, and pre-softmax text-decoder layer to reduce parameters.The authors report benefits for model size and convergence.

C. Discriminator

The discriminator is trained adversarially against the hiding network and message decoder to make watermarked text resemble non-watermarked text while preserving message encoding and sentence utility. Joint and fine-tuning objectives balance competing reconstruction, message, semantic, language-model, and adversarial losses.

C. Discriminator: The discriminator classifies non-watermarked and watermarked sentences using a transformer encoder and binary cross-entropy loss.It averages the final encoder representations over time before classification.
C. Discriminator: Adversarial training is intended to make message encoding subtle without altering language statistics.The discriminator and watermarking components are trained against each other.
D. Training and Fine-tuning: The model first combines adversarial, reconstruction, and message losses through weighted averaging.The losses compete because perfect reconstruction can prevent message encoding.
D. Training and Fine-tuning: Fine-tuning adds semantic-distance and language-model losses to constrain changes toward semantic consistency and grammatical correctness.The language-model loss explicitly enforces correct grammar and structure.
D. Training and Fine-tuning: Fine-tuning produces more realistically looking and natural samples than training only with sentence reconstruction.The added auxiliary losses are introduced after the model learns basic reconstruction to speed convergence and further optimization.

V. EXPERIMENTAL RESULTS

The experiments evaluate AWT’s text utility, bit accuracy, secrecy, and robustness using WikiText-2 and fixed segment-level watermarking. Utility is assessed with METEOR and SBERT alongside message-decoding accuracy.

V. EXPERIMENTAL RESULTS: The evaluation covers effectiveness, secrecy, and robustness, including comparisons with baselines and a user study of output quality.Effectiveness includes text utility and bit accuracy.
V. EXPERIMENTAL RESULTS: AWT is trained and tested on word-level WikiText-2 using the dataset’s Wikipedia-derived processing and splits.WikiText-2 preserves capitalization, punctuation, and numbers and contains over 30,000 unique vocabulary words.
V. EXPERIMENTAL RESULTS: The transformer uses 512-dimensional representations, three layers, and four attention heads per layer.The decoder uses masked future-token self-attention.
V. EXPERIMENTAL RESULTS: Training uses 6000 warmup steps, batch size 80, Gumbel temperature 0.5, and 200 epochs per stage.The generator and discriminator use separate learning rates and are trained alternatively.
V. EXPERIMENTAL RESULTS: Each training and test segment carries a 4-bit message, with training lengths sampled around 80 words and testing fixed at 80 words.Changing the test length by ±5 words did not significantly affect results.
V. EXPERIMENTAL RESULTS: Message decoding is measured by bitwise accuracy against 50% random chance, while utility uses METEOR and SBERT distance.METEOR ranges from 0 to 1, whereas SBERT measures the L2 distance between input and output embeddings.

2) Model ablation:

Ablations and inference strategies examine how fine-tuning, adversarial training, sampling, and selective encoding affect utility, secrecy, bit accuracy, and watermark verification. The results show trade-offs between higher-quality text and decoding confidence.

2) Model ablation: Fine-tuning increases METEOR and decreases SBERT distance while maintaining high message-decoding accuracy.The authors interpret these changes as improved text preservation and semantics.
2) Model ablation: The discriminator lowers SBERT distance relative to text-reconstruction-only training, while the variants have comparable METEOR scores.The authors associate adversarial training with improved output quality and secrecy advantages.
3) Inference strategies: Best-of-many encoding samples multiple outputs, scores them with a language model or SBERT, and passes the selected output to the message decoder.The language-model score gives slightly better samples than SBERT, although the metrics are comparable.
3) Inference strategies: Increasing best-of-many samples from 1 to 40 raises METEOR and lowers SBERT distance, but reduces bit accuracy as outputs approach reconstruction.The reported examples move from 97% bit accuracy with one sample to approximately 85% when selecting from 30 samples.
2) Model ablation: Table I compares the full AWT model with variants lacking fine-tuning, or lacking both fine-tuning and the discriminator.Each variant is run 10 times with random messages, reporting average and standard deviation.
3) Inference strategies: Selective encoding leaves some sentences non-watermarked, reducing overall changes while allowing the decoder to aggregate evidence across all sentences.Non-watermarked sentences decode near random chance, whereas watermarked sentences produce strong matching.
4) Watermark verification by sentence aggregation: Longer watermarks are formed by concatenating 4-bit messages across text segments and can be verified through soft matching with a p-value threshold.The paper evaluates thresholds of 0.05 and 0.01.
4) Watermark verification by sentence aggregation: Increasing text length yields more correct watermark verifications because the null hypothesis can be rejected more often.This relationship is evaluated across operating points with different bit accuracies.

5) Decoding by averaging:

AWT improves watermark decoding by averaging posterior probabilities across multiple sentences, while adversarial training and sampling preserve natural word statistics and meaning more effectively. The qualitative analysis also identifies residual grammatical failures and comparable sample-ranking performance between SBERT and language-model likelihood.

5) Decoding by averaging: Averaging posterior probabilities across sentences encoded with the same message improves bit accuracy, with gains demonstrated using up to four sentences.The analysis compares four sampling operating points and reports performance gains over decoding a single sentence.
6) Qualitative analysis: Adversarial training keeps top-word distributions similar to the original text, unlike reconstruction-only training, which inserts less likely tokens and creates artifacts.The no-adversarial-training variant systematically changes frequent words, whereas AWT also encodes messages with likely words.
6) Qualitative analysis: AWT examples encode information with common tokens, correct structure, and meaning comparable to the input sentence.The examples use prepositions, articles, or auxiliary verbs rather than exclusive message-holding words.
6) Qualitative analysis: Fine-tuning improves syntactic consistency, but incorrect replacements still cause grammatical and syntactic mistakes in some cases.The paper presents these errors as observed failure cases, including replacements that change word type.
6) Qualitative analysis: SBERT and language-model likelihood selected the same sample in 44% of cases and comparable samples in 25% on 200 sentences.SBERT selected a better sample in 9% of cases, while the language model did so in 22%.
6) Qualitative analysis: AWT changes do not follow fixed word-pair substitutions, and message-holding words are not exclusive to watermark occurrences.The transition analysis reports frequent unchanged words and no clear sparse substitution patterns.

C. Secrecy Evaluation

The secrecy evaluation tests whether adversaries can distinguish watermarked from non-watermarked text using classifiers and examines robustness to automated word changes. Adversarial training and sampling substantially reduce classifier success, while random attacks require substantial textual changes to reduce watermark accuracy.

C. Secrecy Evaluation: The secrecy evaluation measures adversarial discrimination with F1 score, where 0.5 represents chance-level performance.Classifiers are trained on disjoint watermarked and non-watermarked text and evaluated across transformer, LSTM, and BoW+SVM models.
C. Secrecy Evaluation: The full AWT model with sampling achieves F1 performance close to ideal random chance across classifier types.The no-discriminator model has high F1, while adversarial training lowers F1 and sampling reduces classifier success further.
C. Secrecy Evaluation: Random removal and synonym replacement reduce bit accuracy by 0.05% to 6.5%, while increasing SBERT distance by 86% to 577%.Removal is slightly more successful than replacement because some message-encoding words lack WordNet synonyms.

2) Denoising:

Denoising and re-watermarking attacks test whether adversaries can remove or corrupt AWT’s watermark. More natural AWT encodings resist denoising better, while adaptive attacks can reduce accuracy but generally perturb the text substantially.

2) Denoising: A denoising autoencoder trained on non-watermarked text reconstructs watermarked text after embedding-dropout or word-replacement noise.Training on watermarked text would reproduce the watermark instead of removing it.
2) Denoising: Improving encoding quality makes denoising less effective: the no-discriminator model reaches chance-level bit accuracy, while adversarially trained variants decline less.The denoising autoencoder also introduces changes beyond the watermark, increasing SBERT distance for adversarially trained models.
2) Denoising: Adding random noise before denoising removes more watermark information than random changes alone, but a 10% bit-accuracy drop increases SBERT distance by 319%.At comparable SBERT levels, the combined attack produces a larger accuracy drop than random changes alone.
3) Re-watermarking: Black-box re-watermarking lowers original matching accuracy to approximately 85%, but double watermarking also perturbs text utility.The new watermark matches at approximately 96%, while non-watermarked text is approximately 50%; the original watermark is not fully corrupted.
3) Re-watermarking: White-box re-watermarking with a different message overrides the original watermark mainly because the model often reverses the first watermark’s changes.The white-box case assumes the same model is available to the adversary.

4) De-watermarking:

AWT is compared with synonym substitution and generation-based hiding, emphasizing flexible learned encoding and stronger utility and secrecy than a fixed replacement baseline. The paper also reports a black-box de-watermarking trade-off and a generation-based inference limitation.

4) De-watermarking: A black-box paired denoising attack reduces bit accuracy to approximately 86% while increasing SBERT distance by approximately 11%.This trade-off is more favorable to the attacker than re-watermarking, which increases SBERT by approximately 66% with a comparable accuracy drop.
4) De-watermarking: The black-box paired attack succeeds mainly on sentences with lower syntactic correctness or changes resembling those of the adversary’s model.The paper identifies improving watermark quality and diversity across models as future defense directions.
1) Synonym substitution: The synonym baseline fails to encode messages in all sentences because it requires words from a fixed replacement list.AWT does not impose exclusive message words or the same fixed-vocabulary restriction.
1) Synonym substitution: At comparable bit accuracy, AWT has considerably lower SBERT distance and the synonym baseline has a much higher adversarial F1 score.The comparison evaluates bit accuracy, SBERT distance, secrecy, and robustness.
1) Synonym substitution: The synonym baseline is more sensitive to removal and replacement attacks because it changes more words, with replacement stronger than removal.Replacement can remove bit-holding words and introduce additional conflicting substitutions.
2) Generation-based hiding: Generation-based hiding suffers further message-accuracy loss under recursive greedy decoding, whereas AWT can operate independently of the language model’s decoding strategy.The paper notes that more varied strategies such as top-k or top-p sampling could make accuracy harder to retain for generation-based hiding.

F. Human Evaluation

The user study evaluates the naturalness and correctness of AWT outputs as a proxy for watermark stealth, comparing them with a synonym baseline and original text. The broader discussion situates AWT as a potential tool for tracing machine-generated text while noting assumptions about deployment and adversaries.

Human evaluation: The study uses human ratings as an auxiliary measure of sentence naturalness and correctness, treating these properties as a proxy for watermark stealth.
Human evaluation: Six judges rated AWT, synonym-baseline, and original non-watermarked sentences on a 0–5 Likert scale for understandability, naturalness, and grammatical correctness.The original text served as a reference for the two watermarking approaches.
Human evaluation: AWT was evaluated using the fine-tuned model with best-of-20 sampling, achieving approximately 86% bit accuracy, versus approximately 83% for the synonym baseline.
Discussion and scope: The threat model focuses on large-scale generation of entire articles through black-box APIs, while human editing is treated as a less scalable adversarial use case.
Discussion and scope: Extending multi-bit watermarking across models would require cooperation among model owners or regulation by a trusted third party.

VIII. APPENDIX

The appendix examines how semantic metrics, denoising, and model architecture affect watermark evaluation and attack behavior. It shows why SBERT complements METEOR and how denoising can both remove artifacts and introduce new changes.

SBERT and METEOR: SBERT distance detects semantic changes such as negation that METEOR may miss, and lower SBERT distance can indicate greater coherence when METEOR scores are comparable.
SBERT and METEOR: SBERT is therefore used alongside METEOR because it provides semantic information beyond word-overlap similarity.
Denoising: The denoising autoencoder partially reconstructs corrupted non-watermarked sentences but can also introduce additional changes.
Denoising: When applied to watermarked text, the denoising autoencoder sometimes preserves watermark changes, sometimes removes them, and sometimes adds changes to unaffected sequences.
Denoising: A stronger denoising autoencoder might remove additional watermark changes, but this would require attackers with greater expertise and computational resources.

C. Visualizations

The visual analyses investigate which words AWT changes and whether those changes reveal fixed encoding patterns. They also compare independently trained models and examine re-watermarking and de-watermarking attacks.

Word-change visualizations: AWT’s frequently changed source and target words substantially overlap, while their counts remain similar and substitutions are not fixed.
Word-change visualizations: The visualizations support encoding secrecy by showing no telltale words that are exclusive to carrying particular bits.
Comparing different models: A decoder trained for one AWT model achieves almost random-chance accuracy when decoding another model’s sentences, indicating model-specific mappings.
Comparing different models: Independently trained AWT models produce different wording changes, including differences in replaced words, added words, and their positions.
Re-watermarking: White-box re-watermarking often replaces previously changed words and reduces the first watermark’s matching accuracy to nearly random chance.
Re-watermarking: In the black-box case, re-watermarking may preserve both sets of changes, making it less effective at overriding the original watermark.
De-watermarking: White-box paired denoising can recover sentences with obvious or less obvious watermark artifacts because it is trained on the relevant change patterns.

E. Generation-based hiding

The generation-based hiding baseline injects messages into an AWD-LSTM language model and jointly trains a decoder to recover them. Its evaluation includes loss design, user ratings, and examples of re-watermarking and de-watermarking.

Attack analysis: The appendix provides examples of re-watermarking and de-watermarking in both white-box and black-box settings.
Model and training: The baseline feeds the binary message into an AWD-LSTM and jointly trains a message decoder to reconstruct it from the generated sequence.
Model and training: Gumbel-Softmax enables end-to-end training, while message reconstruction uses binary cross-entropy and language modeling uses cross-entropy.
Model and training: The combined objective is a weighted sum of language-modeling and message-reconstruction losses.
Model and training: The baseline uses a four-bit message and additional fine-tuning steps to provide operating points that trade text utility against bit accuracy.