PaperlayerView exact revision on arXiv

Source-linked AI summary

An Unforgeable Publicly Verifiable Watermark for Large Language Models

Aiwei Liu, Leyi Pan, Xuming Hu, Shu'ang Li, Lijie Wen, Irwin King, Philip S. Yu

arXiv:2307.16230v7cs.CL

TL;DR

Public LLM watermark detection can expose shared generation keys, enabling forgery. UPV uses separate neural networks for watermark generation and detection, with shared token embeddings. It reports nearly 99% F1 and low success for tested forgery attacks.

  • Problem

    Shared-key watermark detection can expose the generation key in public detection settings, enabling others to forge the watermark.

    Source: §1 · p. 1

  • Method

    UPV uses separate neural networks for watermark generation and detection, sharing token embedding parameters between them.

    Source: §1 · pp. 1–2, §4.4 · p. 5

  • Results

    Nearly 99% F1 score, almost identical to the key-based watermark algorithm, with exceedingly low successful decryption rates for tested attacks when the window size is not exceptionally small.

    Source: §1 · p. 2

  • Takeaways & Limitations

    UPV detects watermarks without the generation key, while constructing a generation network from its detector is notably more complex than the reverse.

    Source: §1 · pp. 1–2

    Effective watermark detection assumes the proportion of watermarked tokens remains invariant across local windows, with probability γ for each token.

    Source: §4.2 · p. 4

Abstract

from arXiv · show

Recently, text watermarking algorithms for large language models (LLMs) have been proposed to mitigate the potential harms of text generated by LLMs, including fake news and copyright issues. However, current watermark detection algorithms require the secret key used in the watermark generation process, making them susceptible to security breaches and counterfeiting during public detection. To address this limitation, we propose an unforgeable publicly verifiable watermark algorithm named UPV that uses two different neural networks for watermark generation and detection, instead of using the same key at both stages. Meanwhile, the token embedding parameters are shared between the generation and detection networks, which makes the detection network achieve a high accuracy very efficiently. Experiments demonstrate that our algorithm attains high detection accuracy and computational efficiency through neural networks. Subsequent analysis confirms the high complexity involved in forging the watermark from the detection network. Our code is available at \href{https://github.com/THU-BPM/unforgeable_watermark}{https://github.com/THU-BPM/unforgeable\_watermark}. Additionally, our algorithm could also be accessed through MarkLLM \citep{pan2024markllm} \footnote{https://github.com/THU-BPM/MarkLLM}.

1 INTRODUCTION

LLM-generated text raises risks including false information and copyright infringement, while shared-key watermark detection can expose the key to forgery in public settings. UPV separates generation and detection networks, shares token embeddings, and reports high detection performance alongside difficulty forging the watermark.

1 INTRODUCTION

  • Shared-key watermark algorithms work when detection is restricted to the owner, but public detection can expose the key and enable watermark forgery.LLM-generated text also raises concerns about false information and copyright infringement.Source: §1 · p. 1
  • UPV uses separate neural networks for watermark generation and detection, allowing detection without the generation key.The generator modifies logits using watermark signals, while the detector evaluates the text.Source: §1 · pp. 1–2, Figure 1 · p. 2
  • The generator predicts the final token’s watermark label from a window of w tokens, while the detector evaluates all tokens in the text.Figure 1 depicts the generator refining token logits and the detector evaluating the full text.Source: §1 · p. 2, Figure 1 · p. 2
  • Nearly 99% F1, almost identical to the key-based watermark algorithm, with exceedingly low decryption success for two attack strategies when windows are not exceptionally small.The strategies use detector-generated training data and word-frequency analysis.Source: §1 · p. 2
  • Sharing token embeddings between the networks gives the detector prior information and improves its training efficiency.The paper also reports empirical resistance to attacks attempting to forge the watermark.Source: §1 · p. 2

2 RELATED WORK

Related work covers classifier-based detection and watermarking approaches that either modify existing text or insert signals during decoding. The paper identifies key exposure during public detection as a limitation of prior watermarking methods.

2 RELATED WORK

  • Classifier-based detectors fine-tune language models or use language-model features and adversarial training, while machine-text detectability remains an open question.Some researchers argue that high-performing detectors are possible with sufficient data, while others expect the performance gap from random classifiers to shrink as LLMs advance.Source: §2 · pp. 2–3
  • Existing-text watermarking embeds or substitutes information in text, but maintaining unchanged semantics limits its real-world use.Examples include data-hiding and data-revealing networks and watermarking through word substitution.Source: §2 · p. 3
  • Decoding-time watermark methods insert signals during token generation and detect them using token-sequence relationships or related statistics.Examples include preset pseudorandom sequences, Levenshtein distance, red-green vocabularies, semantic-invariant hashing, and watermarking for low-entropy code.Source: §2 · p. 3
  • Prior watermarking methods often require the generation key for detection, so making detection public can expose that key.UPV is proposed to address this issue with publicly verifiable watermarking.Source: §2 · p. 3

3 PROBLEM DEFINITION

The paper defines language-model prediction, watermark generation and detection, and the security goal of public verification without revealing the generation method. Its threat model distinguishes text-modification attacks from attempts to infer the generation rule for forgery.

3 PROBLEM DEFINITION

  • A language model M maps an input token sequence to a probability distribution over the vocabulary for the next token.The next token is selected from that distribution by sampling or another method.Source: §3 · p. 3
  • Watermark generation modifies a language model’s token probabilities, while detection takes a text sequence and determines whether it contains a watermark.The watermarked model is denoted M-hat, and the detector is denoted D.Source: §3 · p. 3
  • An unforgeable publicly verifiable watermark lets the public access the detector while making it challenging to recover the generation method or key.Source: §3 · p. 3
  • The threat model includes watermark-removal attempts without detector access and forgery attempts with detector access and unlimited queries.Removal is considered successful if rewriting consistently removes the watermark over 90%; forgery is considered successful if the attacker understands enough of the generation rule to easily forge watermarked text.Source: §3 · p. 3

4 PROPOSED METHOD

The method marks selected next-token candidates by boosting their logits, then provides statistical and text-only neural detection approaches. Its unforgeability analysis focuses on the computational asymmetry between generating and detecting watermarks.

4.1 WATERMARKED LARGE LANGUAGE MODEL

  • The generator scores top-K next-token candidates using local token windows, then boosts the logits of candidates it labels watermarked by δ.For beam search, candidates are labeled only when their scores exceed the Bth-highest score by a margin of δ.Source: §4.1 · p. 4

4.2 WATERMARK GENERATION NETWORK

  • The generation network concatenates embeddings from a local window and classifies its last token, with training data curated to target a watermarked-token ratio γ.The achieved ratio has expected value γ and standard deviation σ; the method does not guarantee a constant ratio.Source: §4.2 · pp. 4–5

4.3 WATERMARK DETECTION

  • Detection uses a z-value test against a threshold, adjusting the variance to include the generation network’s ratio variability σ²T.The expected watermarked-token count remains γT, and the authors report that σ is very small in practice.Source: §4.3 · p. 5

4.4 WATERMARK DETECTION NETWORK

  • The neural detector classifies sentence token IDs through a frozen embedding shared with the generator and an LSTM.Its training labels reflect whether a text’s z-value exceeds a predefined threshold; random token-ID sequences and cyclic-document labeling are also used in training.Source: §4.4 · p. 5

4.5 ANALYSIS OF THE UNFORGEABILITY

  • Training a generation network from detector outputs is harder because labels have complex dependencies, while frequency-based rule inference is largely ineffective when the window is not particularly small.The authors describe this training asymmetry as supporting unforgeability.Source: §4.5 · p. 6

5 EXPERIMENT

Experiments compare network-based detection with key-based detection, then evaluate shared embeddings, forgery attacks, detection–quality trade-offs, training stability, and runtime. Across these tests, detection remains effective while attacks struggle to recover the watermark rules and computational overhead is small.

5.1 EXPERIMENT SETUP

  • Experiments use GPT-2, OPT-1.3B, and LLaMA-7B with C4 and Dbpedia Class, Top-K sampling or beam search, and 500 human plus 500 generated texts for evaluation.Prompts contain the first 30 words, and the language models generate the next 200 ± 5 tokens.Source: §5.1 · pp. 6–7

5.2 MAIN RESULTS

  • Network-based detection produces average false-positive rates of 0.1% and 0.4%, while its false-negative probability is higher by an average of 1.2% than the key-based upper-bound baseline.The reported false-positive rates mean human text is rarely misidentified as watermarked.Source: §5.2 · p. 7

5.3 ANALYSIS OF SHARED EMBEDDING

  • Without shared embeddings, F1 falls 72.0% on average; fine-tuning shared embeddings lowers F1 by 11.1%, favoring frozen shared layers.Table 2 compares no sharing, shared embeddings without fine-tuning, and shared embeddings with fine-tuning.Source: Table 2 · p. 7, §5.3 · p. 8

5.4 UNFORGEABILITY ANALYSIS

  • As window size increases, detector F1 stays relatively stable, reverse-training attacks fall to random-guess F1 0.5, and frequency cracking fails except at very small windows.The authors interpret the reverse-training results as evidence that constructing a generator from the detector is computationally asymmetric.Source: §5.4 · p. 8, Figure 2 · p. 8

5.5 HYPER-PARAMETER AND ERROR ANALYSIS

  • Increasing δ raises detector F1 but also generated-text perplexity; the authors chose δ=2 to balance the two.Perplexity is the text-quality measure used in this trade-off.Source: Figure 2 · p. 8, §5.5 · p. 9
  • On LLaMA-7B and C4, human and watermarked z-scores center near -1 and 9; F1 drops near threshold 3 but approaches 100% elsewhere.The distributions are described as nearly normal; the authors characterize detection as reliable for inputs with definite labels.Source: §5.5 · p. 9, Figure 3 · p. 9

5.6 WATERMARK GENERATION NETWORK ANALYSIS

  • With 5,000 items labeled at a 0.5 watermarked-token ratio, the generated ratio approaches 0.5 and its standard deviation falls within 0.02, making σ2T nearly negligible in the final z-value calculation.The authors report that the ratio approaches its target as training loss decreases and that its standard deviation diminishes.Source: §5.6 · p. 9

5.7 TIME COMPLEXITY ANALYSIS

  • The 43k-parameter generator adds 1ms on average to GPT-2's 30ms per-token decoding time on one Tesla V100 GPU, with less overhead for larger models.The authors describe this computational burden as minimal relative to the language models.Source: §5.7 · p. 9

6 CONCLUSION

The conclusion presents UPV as a publicly verifiable watermark whose detector does not require the generation key, while noting that robustness beyond a single rewrite remains unexplored. A case study reports higher z-scores for watermarked text without a significant PPL increase.

6 CONCLUSION

  • UPV uses a separate detection network rather than requiring the watermark key, and robustness to multiple rewrites or more intense attacks remains unexplored.The authors report single-instance rewrite robustness in Appendix B and identify stronger or repeated attacks as future work.Source: §6 · p. 10

A CASE STUDY

  • In the case study, watermarked texts have significantly higher z-scores than non-watermarked texts, without a significant increase in PPL.PPL is calculated using LLaMA 13B.Source: A CASE STUDY · p. 13

B ROBUSTNESS TO REWRITE ATTACK

After GPT-3.5 rewriting, UPV's detection F1 declined by an average of 6.7, yet exceeded key-based detection by 1.5 percentage points in this test. The experiment uses the GPT-3.5 turbo model to rewrite text.

B ROBUSTNESS TO REWRITE ATTACK

  • After GPT-3.5 rewriting, UPV's detection F1 fell by an average of 6.7 and exceeded key-based detection by 1.5 percentage points.The rewriting used GPT-3.5 turbo with the prompt “Rewrite the following paragraph:”.Source: B ROBUSTNESS TO REWRITE ATTACK · p. 14

C TRAINING DETAIL OF WATERMARK GENERATION AND DETECTION NETWORK

The generation network maps token windows to classification logits, while the detector shares its embedding network and uses an LSTM to classify text. The section also specifies training settings for both networks and notes that other sequential architectures could be used for detection.

C TRAINING DETAIL OF WATERMARK GENERATION AND DETECTION NETWORK

  • The generation network embeds each token, concatenates window embeddings, and maps them through an FFN to classification logits.The embedding network has five layers, input dimension 16, and intermediate and output dimensions of 64; the FFN input dimension is 64*w and its three layers output 64, 64, and 1.Source: C TRAINING DETAIL OF WATERMARK… · p. 14
  • After a sigmoid, binary cross-entropy trains the generation network using 5,000 randomly generated examples for 500 steps, with batch size 32 and Adam at learning rate 0.01.Source: C TRAINING DETAIL OF WATERMARK… · p. 14
  • The detector shares the generator’s token embedding parameters, then processes the embedded text with a five-layer LSTM to produce detection logits and a sigmoid output.The LSTM uses input dimension 64 and intermediate output dimension 128; its final output dimension is 1, and binary cross-entropy is used for detector loss.Source: C TRAINING DETAIL OF WATERMARK… · p. 14
  • The detector is trained on 10,000 generated random token-ID sequences with equal watermarked and non-watermarked proportions, using Adam at learning rate 0.01 for 80 epochs.The passage reports batch size 32 and also says batch size is set to 64.Source: C TRAINING DETAIL OF WATERMARK… · p. 14
  • The authors chose an LSTM for simplicity and effectiveness, but state that other sequential architectures, including transformers, could also perform well.Source: C TRAINING DETAIL OF WATERMARK… · p. 14

D DETAILS OF REVERSE TRAINING

The reverse-training analysis studies whether a generative network can learn watermarking rules from detector-labeled text. It finds that more data eventually yields only marginal gains, and successful forgery requires cracking F1 above 90.

D DETAILS OF REVERSE TRAINING

  • Reverse training uses detector-labeled token lists and a generative network to simulate watermark detection by assessing token-level watermark labels and averaging them.The resulting generative-network outputs serve as labels in the reverse-training loss.Source: D DETAILS OF REVERSE TRAINING · p. 15
  • The reverse-training experiment uses 10,000 random token lists of length 100–200, labeled by the detector.Source: D DETAILS OF REVERSE TRAINING · p. 15
  • Beyond a certain training-data amount, increasing the data produces only marginal improvements in cracking F1.This trend is shown for reverse training in Figure 4(a).Source: D DETAILS OF REVERSE TRAINING · p. 15
  • A cracking F1 score above 90 is required for successful watermark forgery.Figure 4 relates training-data amount to cracking F1 under reverse training, and forgery effectiveness to cracking F1.Source: D DETAILS OF REVERSE TRAINING · p. 15

E IMPACT OF WATERMARK ON MACHINE TRANSLATION TASK

Across the machine-translation experiments, watermarking has a small reported BLEU impact while both detector types retain high F1. The section also explains how cyclic documents close a token-labeling vulnerability and describes limits of direct cracking as window size grows.

E IMPACT OF WATERMARK ON MACHINE TRANSLATION TASK

  • BLEU scores decrease by an average of only 1.3 after watermarking, while network-based and key-based detectors both achieve high detection F1 in the four WMT14 translation scenarios.The evaluation uses NLLB-200-distilled-600M on English–French, French–English, German–English, and English–German.Source: E IMPACT OF WATERMARK ON MACHINE… · p. 16, Table 5 · p. 16

F EXAMPLE OF CYCLIC DOCUMENT

  • Cyclic documents label the initial tokens using windows that wrap from the document’s end, avoiding the unlabeled-token vulnerability described for ordinary documents.Without wraparound, an attacker could vary the final token and compare detector confidence to infer which tokens are watermarked.Source: F EXAMPLE OF CYCLIC DOCUMENT · p. 16

G DETAILS OF DIRECT CRACKING ATTACK

  • Direct cracking infers watermark tokens from frequency increases after prefixes, but longer windows make common prefixes rarer and cracking harder; increasing data eventually cannot significantly improve the attack.The method examines the 181 most common (w-1)-token n-grams, following Sadasivan et al. (2023). Figure 5 compares attack success as data volume increases for window sizes 3 and 4.Source: G DETAILS OF DIRECT CRACKING ATTACK · p. 17, Figure 5 · p. 17

H EXPANDING THE K IN TOP-K SAMPLING

The paper reports low additional generation cost as top-K processing scales, and consistently high detector F1 across text domains. It attributes the cross-domain result to training on random token-ID sequences that explore the input space.

H EXPANDING THE K IN TOP-K SAMPLING

  • Processing 20,000 tokens takes only twice as long as processing 20 tokens, while memory use increases tenfold at window size 5.The resource measurements cover generation under varying k values and window sizes and were recorded on one V100 32G GPU.Source: H EXPANDING THE K IN TOP-K SAMPLING · p. 17, Table 7 · p. 17

I DETECTION F1 SCORE ACROSS DIFFERENT DOMAINS

Loading 2307.16230v7…