PaperlayerView exact revision on arXiv

Source-linked AI summary

Protecting Language Generation Models via Invisible Watermarking

Xuandong Zhao, Yu-Xiang Wang, Lei Li

arXiv:2302.03162v3cs.CRcs.CLcs.LG

TL;DR

Affordable API access can expose language-generation models to extraction through distillation, while synonym-based watermarks can be removed by random synonym replacement. GINSEW embeds a hidden sinusoidal signal in token-generation probabilities and detects it by probing a suspect model. Against watermark-removal attacks, the paper reports an absolute 19 to 29 point improvement in mAP for detecting suspects.

  • Problem

    Affordable API access can expose language-generation models to extraction through distillation, creating an intellectual-property concern for model owners.

    Source: §1 · p. 1

  • Method

    GINSEW injects a hidden sinusoidal signal into token-generation probabilities and detects suspect models by probing for the signal.

    Source: §1 · p. 2, §3.2 · p. 4, §3.3 · p. 4

  • Results

    19 to 29 points of absolute improvement in mean average precision (mAP) for detecting suspects against watermark-removal attacks is reported for GINSEW.

    Source: §1 · p. 2

  • Takeaways & Limitations

    GINSEW is presented as a stealthy, robust approach for identifying extracted models while preserving generated-text quality.

    Source: §6 · p. 9

    Detection requires a relatively large probing dataset, which may not be feasible in some real-world situations.

    Source: §6 · p. 9

Abstract

from arXiv · show

Language generation models have been an increasingly powerful enabler for many applications. Many such models offer free or affordable API access, which makes them potentially vulnerable to model extraction attacks through distillation. To protect intellectual property (IP) and ensure fair use of these models, various techniques such as lexical watermarking and synonym replacement have been proposed. However, these methods can be nullified by obvious countermeasures such as "synonym randomization". To address this issue, we propose GINSEW, a novel method to protect text generation models from being stolen through distillation. The key idea of our method is to inject secret signals into the probability vector of the decoding steps for each target token. We can then detect the secret message by probing a suspect model to tell if it is distilled from the protected one. Experimental results show that GINSEW can effectively identify instances of IP infringement with minimal impact on the generation quality of protected APIs. Our method demonstrates an absolute improvement of 19 to 29 points on mean average precision (mAP) in detecting suspects compared to previous methods against watermark removal attacks.

1. Introduction

Affordable API access can expose language-generation models to distillation, while existing text watermarks can be removed through synonym randomization. GINSEW embeds an invisible signal in generation probabilities and is reported to improve detection under watermark-removal attacks.

1. Introduction

  • Affordable API access may let competitors distill a comparable model at much lower cost, potentially forcing owners to raise fees beyond service costs.The authors argue this could make research and public-good applications unaffordable.Source: §1 · p. 1
  • Prior text-generation watermarks use synonym replacement, but random synonym replacement can remove those surface-level marks.The passage also describes trigger-set watermarks for ownership claims on commercial models.Source: §1 · p. 2
  • GINSEW injects a secret sinusoidal signal into generation probabilities and detects distilled models by identifying its frequency and comparing it with a secret key.The method is described as not harming generation quality and as robust to random synonym replacement attacks.Source: §1 · p. 2
  • 19 to 29 points of absolute mAP improvement in detecting suspects against watermark-removal attacks is reported for GINSEW.The paper also reports better generation quality than previous methods.Source: §1 · p. 2

2. Related work

Prior work addresses model extraction through watermarks, but the approaches differ in where they place the signal and which tasks they cover. Text-generation synonym marks can be removed by random synonym replacement, motivating GINSEW's probability-distribution approach.

2. Related work

  • Model extraction uses API outputs to label substitute data, which an attacker uses to train a model that imitates the victim.The paper relates this attack to knowledge distillation and focuses on text generation.Source: §2 · p. 2
  • Parameter watermarks and backdoor images have been used against exact model duplication, but may not transfer when an extracted model has different parameters [Adi et al., 2018].Source: §2 · p. 2
  • Text-generation methods use lexical substitution or conditional synonym replacement, but random synonym replacement can bypass these surface-level watermarks [He et al., 2021; He et al., 2022].CosWM uses a cosine signal but applies only to image classification [Charette et al., 2022].Source: §2 · pp. 2–3
  • GINSEW instead directly modifies output-token probabilities, making its watermark invisible in the surface text and more robust to synonym replacement.Source: §2 · p. 3

3. Proposed method: GINSEW

GINSEW protects text-generation models by embedding an invisible, input-dependent sinusoidal signal in decoding probabilities. Probing a suspect model for the keyed frequency helps assess whether the signal was inherited through distillation.

3.1. Problem setup

  • The goal is ownership attribution, not preventing extraction; verification assumes an arbitrator with white-box access to both victim and suspect models.The attacker is described as having black-box API access and using sequence-level distillation.Source: §3.1 · p. 3

3.2. Generative invisible sequence watermarking

  • An input-text hash supplies a scalar for the periodic signal, while the vocabulary is divided into two token groups whose probabilities are perturbed.The hash uses the input text, a phase vector, and a token matrix; the second token’s ID is used in its calculation.Source: §3.2 · pp. 3–4
  • GINSEW embeds an invisible sinusoidal watermark by perturbing token-group probabilities during decoding, without adding it to the surface text.The modified probabilities are realigned to the perturbed group totals before decoding.Source: §3.2 · pp. 3–4

3.3. Detecting watermark from suspect models

  • A probing dataset and the suspect model’s outputs are used to estimate the keyed frequency; Psnr summarizes signal strength, and a text-only detection variant is also described.The probing data may come from the extracted model’s training data or another distribution.Source: §3.3 · pp. 4–5

4. Experiments

Experiments evaluate GINSEW on text generation tasks, compare it with watermarking baselines, and examine performance under synonym randomization and in a case study. Results cover detection, generation quality, and the watermark signal’s behavior.

4. Experiments

  • Experiments cover German-to-English translation on IWSLT14 and WMT14 and story generation on ROCStories, using BLEU and BERTScore or ROUGE and BERTScore quality metrics.ROCStories uses the first four sentences as context and predicts the fifth sentence.Source: §4 · p. 5
  • Detection ranks 20 extracted models as positives and 30 scratch-trained models as negatives per task, using mAP; GINSEW uses Psnr while He et al. (2021) and CATER use hit ratio.The baselines use synonym replacement, with CATER conditioning replacements on linguistic features.Source: §4 · p. 5

4.1. Main Results

  • 1.00 mAP for both GINSEW and He et al. (2021); GINSEW has better BLEU and ROUGE-L scores, with negligible BLEU, ROUGE, and BERTScore degradation versus unwatermarked models.Table 1 reports generation quality and Detect mAP ×100; the text also notes that mAP of 1.00 corresponds to zero false positives at an empirically selected Psnr > 5.0 threshold.Source: Table 1 · p. 6, §4.1 · p. 6

4.2. Watermark removal attacks

  • The synonym-randomization attack tests whether postprocessing that randomly selects synonyms from semantically matched pairs undermines watermark detection.The experiment filters synonym sets with Word2Vec and retains the top 50 semantically matching pairs.Source: §4.2 · p. 6
  • Under synonym randomization, He et al. (2021) and CATER fail to detect the adversary, while GINSEW performs much better in mAP.The attack randomly substitutes synonyms during postprocessing; GINSEW also works when synonyms for some words are unavailable.Source: §4.2 · p. 6

4.3. Case study

  • In the IWSLT14 case study, a positive extracted model is trained on victim-generated English responses to German training inputs; the victim uses ε = 0.2 and fw = 16.0.The negative extracted model is trained from scratch on raw IWSLT14 data; detection probes a subset of German inputs with qmin = 0.6.Source: §4.3 · pp. 6–7
  • The positive extracted model follows the victim’s sinusoidal signal and has a prominent frequency peak at fw; without the correct key, the hash can appear random.The positive example’s Psnr exceeds 20.Source: Figure 3 · p. 7, §4.3 · p. 7, Figure 4 · p. 7
  • The scratch-trained negative model lacks the positive example’s periodic signal and salient frequency peak, with Psnr close to 0.The negative example’s overall performance is similar to the positive example, despite the absence of the periodic signal.Source: Figure 5 · p. 7, §4.3 · p. 7

5. Ablation Study

The ablations examine detection across extractor architectures, text-only probing, watermark strength, data mixtures, decoding methods, and distillation training. They show robustness across several settings, alongside limits and trade-offs involving watermark strength and data coverage.

5.1. Watermark detection with different architectures

  • Perfect detection holds for (m)BART and 6- or 4-layer Transformers on both datasets, while 2-layer Transformers and ConvS2S perform worse.The authors conjecture that the latter models' lower parameter counts make the hidden signal harder to learn.Source: Table 2 · p. 7, §5.1 · p. 8

5.2. Watermark detection with text alone

  • 8.35 PSNR is achieved by detecting the watermark from generated text alone on IWSLT14.The text is converted to a binary sequence and analyzed with FFT; this score is lower than detection using text probabilities.Source: §5.2 · p. 8

5.3. The impact of watermark level

  • ε = 0.2 is selected to balance generation quality and watermark detectability, as stronger watermarks reduce quality but make the signal clearer.At ε < 0.1, the Lomb-Scargle periodogram has difficulty extracting a prominent frequency-domain peak.Source: Figure 6 · p. 8, §5.3 · p. 8

5.4. Mixture of raw and watermarked data

  • Half of the adversary's training data can be watermarked while GINSEW still detects infringement effectively.The extracted signal's Psnr increases as the watermarked-data ratio rises.Source: Figure 7 · p. 8, §5.4 · p. 9

5.5. Different decoding methods

  • All three tested decoding methods produce a detectable frequency-domain signal, and beam search with size 5 gives better generation quality.Beam search with size 5 is therefore used as the default decoding method.Source: Table 3 · p. 9, §5.5 · p. 9

5.6. How does watermark signal change in the distillation process?

  • As distillation epochs increase, both generated-text quality and watermark signal-to-noise ratio increase.The authors conclude that improving the extracted model's performance makes watermark removal increasingly difficult.Source: Figure 8 · p. 9, §5.6 · p. 9

6. Conclusion

GINSEW embeds an invisible sinusoidal signal in token probabilities to identify extracted models. Experiments report detection of suspects against watermark-removal attacks while preserving generated-text quality, with limitations in the watermark and probing settings.

6. Conclusion

  • GINSEW embeds a hidden sinusoidal signal in each generated token's probability distribution to protect language generation models from extraction.The authors report that a distilled model carries the watermarked signal.Source: §6 · p. 9
  • Experiments on machine translation and story generation show better suspect detection than existing watermarking methods against removal attacks while preserving text quality.The authors characterize the approach as a stealthy and robust way to identify extracted models and protect intellectual property.Source: §6 · p. 9
  • Effectiveness is limited by low watermark levels or a small watermarked-data share, and detection requires substantial probing data.The threat model also assumes one extraction and no model updates afterward.Source: §6 · p. 9

A.1. Watermarked examples

The appendix includes a table labeled as containing watermarked examples.

A.1. Watermarked examples

  • The appendix table is identified as presenting watermarked examples.The supplied caption does not describe the examples themselves.Source: Table 4 · p. 12

A.2. Distribution property

The appendix states assumptions for a distribution-property lemma and invokes the central limit theorem in its proof.

A.2. Distribution property

  • The lemma assumes independent i.i.d. vectors v and x, with v uniformly distributed on (0, 1) and x normally distributed.The proof defines u_i = v_i x_i and says the first and second moments are bounded, invoking the classical central limit theorem.Source: §A.2 · p. 12
  • The proof's distribution claim follows by applying the classical central limit theorem to the i.i.d. terms.The supplied excerpt begins a large-n statement but does not include its full conclusion.Source: §A.2 · p. 12

A.3. Modified group probability properties

Lemma A.2 establishes that the modified group probabilities remain within [0,1] and sum to 1, preserving a valid probability distribution. Its proof uses group probabilities formed by summing token probabilities and defines two cosine terms.

A.3. Modified group probability properties

  • The modified group probabilities each lie between 0 and 1 and sum to 1, so the watermarked distribution remains valid.The lemma concerns the modified group probabilities defined in Equations 3 and 4.Source: §A.3 · p. 12
  • The proof treats each group probability as the sum of token probabilities in that group.Source: §A.3 · p. 12
  • The proof defines z1(x) and z2(x) as cosine terms whose arguments differ by π.It then presents an identity involving these terms and the two group probabilities.Source: §A.3 · p. 13
Loading 2302.03162v3…