PaperlayerView exact revision on arXiv

Source-linked AI summary

A Semantic Invariant Robust Watermark for Large Language Models

Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, Lijie Wen

arXiv:2310.06356v3cs.CRcs.CL

TL;DR

Prior watermarking methods face a trade-off between robustness to text modification and security against inference of their rules. SIR generates watermark logits from embeddings of preceding text, and the authors report robustness to paraphrasing and synonym replacement alongside favorable security robustness.

  • Problem

    Prior methods trade attack robustness against security robustness because watermark logits depend on a number of preceding tokens, with fewer tokens weakening security and more reducing robustness to modifications.

    Source: §1 · p. 1

  • Method

    SIR embeds preceding text with an auxiliary language model and trains a watermark model to convert those embeddings into watermark logits.

    Source: §1 · p. 2

  • Results

    SIR's robustness is reported as comparable to KGW-1 under semantic-preserving perturbations, with favorable security-robustness metrics under spoofing attacks.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The authors conclude that SIR detects watermarks under rewriting and synonym substitution while maintaining resistance to decryption.

    Source: §7 · p. 10

    The watermark-model design requires embedding similarities to span a broad range and watermark logits to have unbiased token preference.

    Source: §4.2 · p. 4

Abstract

from arXiv · show

Watermark algorithms for large language models (LLMs) have achieved extremely high accuracy in detecting text generated by LLMs. Such algorithms typically involve adding extra watermark logits to the LLM's logits at each generation step. However, prior algorithms face a trade-off between attack robustness and security robustness. This is because the watermark logits for a token are determined by a certain number of preceding tokens; a small number leads to low security robustness, while a large number results in insufficient attack robustness. In this work, we propose a semantic invariant watermarking method for LLMs that provides both attack robustness and security robustness. The watermark logits in our work are determined by the semantics of all preceding tokens. Specifically, we utilize another embedding LLM to generate semantic embeddings for all preceding tokens, and then these semantic embeddings are transformed into the watermark logits through our trained watermark model. Subsequent analyses and experiments demonstrated the attack robustness of our method in semantically invariant settings: synonym substitution and text paraphrasing settings. Finally, we also show that our watermark possesses adequate security robustness. Our code and data are available at \href{https://github.com/THU-BPM/Robust_Watermark}{https://github.com/THU-BPM/Robust\_Watermark}. Additionally, our algorithm could also be accessed through MarkLLM \citep{pan2024markllm} \footnote{https://github.com/THU-BPM/MarkLLM}.

1 INTRODUCTION

Prior watermarking methods trade attack robustness against security robustness as the number of preceding tokens used to set watermark logits changes. SIR uses preceding-token semantics to generate logits and is reported to retain robustness to semantic-preserving edits while providing security robustness.

1 INTRODUCTION

  • Prior methods trade attack robustness against security robustness: fewer preceding tokens weaken security, while more reduce robustness to text modifications.Global fixed logits can be vulnerable to word-frequency analysis that identifies and removes the watermark.Source: §1 · p. 1
  • SIR maps embeddings of preceding-token text through a trained watermark model to produce watermark logits, aiming to keep logits stable under semantic-preserving edits.The training uses similarity and normalization losses to align logit similarities with embedding similarities while promoting unbiased token selection.Source: §1 · p. 2
  • Experiments report robustness comparable to KGW-1 under paraphrasing and synonym replacement, alongside favorable security robustness under spoofing attacks.The watermark logits can be generated in parallel with LLM logits, adding only marginal generation latency.Source: §1 · p. 2
  • The authors describe SIR as the first semantically invariant robust watermark and report high performance in both attack and security robustness.They also identify the semantic-embedding-to-watermark-logit model as a contribution.Source: §1 · p. 2

2 RELATED WORK

Prior work embeds watermarks either through post-generation text changes or during generation. Generation-time approaches include token-sampling schemes and methods that alter token logits, with differing robustness and decoding constraints.

2 RELATED WORK

3 PRELIMINARIES

The preliminaries distinguish generative models, which produce next-token logits, from embedding models, which map text to embeddings. They define watermarking as adding watermark logits to ordinary logits and distinguish robustness to text edits from resistance to rule inference.

3 PRELIMINARIES

  • A generative language model takes a prompt and previously generated text to produce next-token logits, while an embedding language model maps text to an embedding.Semantically similar texts usually have similar embeddings.Source: §3 · p. 3
  • The paper's watermarking paradigm adds watermark logits to the generative model's logits to form the watermarked model's logits.The detector corresponds to the watermark-logit function and outputs whether text contains the watermark.Source: §3 · p. 3
  • Attack robustness measures detection after semantically invariant edits, whereas security robustness measures how accurately an attacker can infer watermark rules from watermarked text.The paper evaluates security robustness using spoofing attacks that statistically analyze watermarked text.Source: §3 · p. 3

4 PROPOSED METHOD

SIR generates watermark logits from the semantics of preceding text, trains the watermark model to preserve semantic similarity while balancing scores, and detects watermarks by testing whether average token scores exceed zero.

4 PROPOSED METHOD

  • The method is presented as a three-stage pipeline: watermark generation, watermark-model training, and watermark detection.Source: §4 · p. 4

4.1 WATERMARK GENERATION

  • SIR's generation process maps an embedding of the preceding text to watermark logits, which are combined with generative-model logits for next-token output.The design aims for a continuous mapping so semantic-preserving edits cause only small watermark-logit perturbations.Source: §4.1 · p. 4

4.2 WATERMARK MODEL

  • The watermark model uses a neural network with similarity and normalization losses to align logit similarity with embedding similarity while promoting broad-range similarity and unbiased, balanced scores.Its design seeks a similarity range from -1 to 1 and centers watermark-logit means at zero; tanh processing makes outputs nearly 1 or -1.Source: §4.2 · pp. 4–5

4.3 WATERMARK DETECTION

  • During detection, SIR computes a z-statistic from token watermark logits and detects a watermark when their average exceeds zero.The method's null score is approximately zero on non-watermarked text, but the paper gives no guarantee for out-of-domain text.Source: §4.3 · p. 5

5 ROBUSTNESS ANALYSIS

Robustness is assessed by how much text modifications change the detection z-score. The analysis links score changes on unmodified tokens to semantic embedding changes in their preceding context.

5 ROBUSTNESS ANALYSIS

  • A small z-score change indicates robustness; the analysis measures robustness by the magnitude of the change after text modification.The modified text is denoted t′:N.Source: §5 · p. 6
  • Unmodified-token scores can change when preceding-token embeddings change, while altered tokens receive zero scores.The Lipschitz constant bounds the score-change inequality because watermark-logit generation from text embeddings is continuous.Source: §5 · p. 6
  • The watermark is theoretically robust when modifications preserve semantics sufficiently for the embeddings to remain similar; significant semantic changes make it meaningless.The paper also provides a separate security-robustness analysis in the appendix.Source: §5 · p. 6

6 EXPERIMENT

Across the tested rewrite and synonym attacks, the watermark retains strong detection robustness while its security robustness approaches that of a less attack-robust baseline. The experiments also examine watermark-model behavior, generation cost, and text perplexity.

6.1 EXPERIMENT SETTINGS

  • The experiments use C4 for generation prompts and human-written examples, WikiText-103 for watermark-model training embeddings, and LLaMA-7B, OPT1.3B, and OPT2.7B for generation.Detection is evaluated at 1% and 10% false-positive rates and at optimal thresholds; sampling and beam search cover stochastic and deterministic generation.Source: §6.1 · p. 6

6.2 ATTACK ROBUSTNESS ANALYSIS

  • Under context-constrained synonym substitutions, robustness is near KGW-1 and EXP-Edit; without context replacement, it is comparable to KGW-2.BERT constrains substitutions to induce minimal embedding changes because some synonyms do not fit their contexts.Source: §6.2 · p. 7

6.3 SECURITY ROBUSTNESS ANALYSIS

  • Attack robustness approaches KGW-1 while security robustness is close to KGW-4; security degrades slightly on refined L1 and L2 classes but remains far above KGW-3 at L2.The evaluation uses DBpedia Class data at overall, L1, and L2 levels; L3 is omitted for insufficient data.Source: §6.3 · p. 7

6.4 WATERMARK MODEL ANALYSIS

  • Embedding similarity strongly correlates with watermark-logit similarity, especially above 0.8; normalization makes logits more symmetrical without overly small values, and tanh scaling yields values near −1 and 1.The reported average similarity of original sentence embeddings is 0.45, which the authors associate with Compositional-BERT distinguishing dissimilar texts.Source: §6.4 · pp. 7–9, Figure 2 · p. 8

6.2 ATTACK ROBUSTNESS ANALYSIS

  • 0.93 average detection F1 is retained on GPT-3.5 and two DIPPER rewrites, comparable to KGW-1 and above KGW-2, KGW-4, and EXP-Edit.The authors describe KGW-1 as close to the attack-robustness upper bound for watermark-logit methods, while noting its poor security robustness.Source: §6.2 · p. 7, Table 1 · p. 8

6.5 TIME COMPLEXITY AND TEXT QUALITY

  • Without parallel processing, LLaMA-7B generation takes 40% longer; the authors report minimal additional time cost when LLM and watermark logits are generated in parallel.The added serial cost mainly comes from the embedding language model, while the four-layer watermark network has negligible cost.Source: §6.5 · p. 9, Table 2 · p. 9
  • Watermarking slightly increases perplexity, but the method has slightly lower perplexity than KGW-series methods.Perplexity is evaluated with LLaMA-13B on text generated using sampling for OPT2.7B and LLaMA-7B.Source: §6.5 · p. 9, Figure 3 · p. 9

7 CONCLUSION

The method is presented as robust to rewriting and synonym substitution while resisting watermark decryption. A case study finds that its z-scores remain high after GPT-3.5 rewriting, unlike the decreasing robustness of KGW-k methods as k grows.

7 CONCLUSION

  • The method is validated against text rewriting and synonym substitution while maintaining resistance to watermark decryption.The authors suggest stronger embedding models and expansion to other watermarking approaches as future directions.Source: §7 · p. 10
  • The authors note that later work applied their method to multilingual settings He et al. (2024).They also identify higher-quality embedding models as a potential improvement.Source: §7 · p. 10

A CASE STUDY

  • After GPT-3.5 rewriting, the method maintains high z-scores, while KGW-k robustness decreases as k increases.The examples compare texts generated from the same prompt by the proposed method and KGW-1, KGW-2, and KGW-4.Source: A CASE STUDY · pp. 13–14

B WATERMARK LOGITS ANALYSIS

The analysis compares four watermark-logit transformations by detection success and text quality. The adopted tanh scaling achieves strong detection with minimal text-quality impact, though the transformations require different augmentation strengths.

B WATERMARK LOGITS ANALYSIS

  • The analysis evaluates how four transformations of the original watermark logits affect watermark detection success and text quality.The four shapes are shown in Figure 6.Source: B WATERMARK LOGITS ANALYSIS · p. 14, Figure 6 · p. 15
  • The adopted tanh(1000x) scaling pushes watermark-logit values close to 1 or -1.The alternatives are rank-based linear scaling to [-1, 1], tanh(10L(x)) applied to that scaling, and a cubic transform L(x)^3.Source: B WATERMARK LOGITS ANALYSIS · pp. 14–15, Figure 6 · p. 15
  • The adopted watermark logits achieve excellent detection performance with minimal text-quality impact, but the δ needed for optimal detection increases as more values cluster near zero.Across the four transformations, perplexity changes minimally at the same δ values.Source: B WATERMARK LOGITS ANALYSIS · p. 15

C ANALYSIS OF DIFFERENT EMBEDDING MODELS

The embedding-model analysis favors Sentence-BERT and Compositional-BERT over BERT for semantic similarity. The paper also details how its semantic logits relate to KGW and describes the watermark network and its implementation.

C ANALYSIS OF DIFFERENT EMBEDDING MODELS

  • Sentence-BERT and Compositional-BERT show near-normal embedding-similarity distributions with moderate average similarity and are considered suitable, unlike BERT’s uniformly high similarities.The authors choose Compositional-BERT and report that Sentence-BERT would yield comparable results; BERT is unsuitable because minor embedding perturbations can significantly affect watermark logits.Source: C ANALYSIS OF DIFFERENT EMBEDDING MODELS · pp. 15–16, Figure 8 · p. 16

D MORE DETAILED COMPARISON TO KGW

  • The method assigns green and red logits from semantic embeddings, whereas KGW uses a local-token-window hash; the method also supports flexible green-token proportion γ through its training loss.The paper demonstrates logit shapes for γ values of 0.25 and 0.75.Source: D MORE DETAILED COMPARISON TO KGW · pp. 16–17
  • Watermark detection is nearly identical to KGW: both use a z-value test to identify tokens assigned green-list logits.The paper states that a transformation can make the detection methods completely equivalent.Source: D MORE DETAILED COMPARISON TO KGW · p. 17

E DETAIL NETWORK STRUCTURE OF THE WATERMARK MODEL

  • The watermark network has input and output layers with a middle linear network using residual connections; its input matches the embedding dimension.The implementation fixes output size at 1000 and randomly maps different vocabularies to that dimension.Source: E DETAIL NETWORK STRUCTURE OF THE… · p. 17, Figure 10 · p. 18
  • Watermark logits are recalculated every 5 to 10 generated tokens, reducing computational complexity because individual added tokens typically do not greatly change text semantics.Source: E DETAIL NETWORK STRUCTURE OF THE… · p. 18

F SECURITY ROBUSTNESS ANALYSIS

The security analysis relates robustness to the number of possible watermark rules and tests resistance to rule-cracking attacks. Under a 2000-text evaluation, the method is reported more secure than KGW-3 and close to KGW-4.

F SECURITY ROBUSTNESS ANALYSIS

  • KGW-k has |V|^k watermark rules, so its security robustness increases exponentially with window size k.Each combination of k window tokens corresponds to a watermark logit.Source: F SECURITY ROBUSTNESS ANALYSIS · p. 18
  • Estimating the proposed method’s rule count assumes no correlation among rules, but many rules are semantically similar and accounting for their correlations is complex.The number of potential rules is not directly calculated; the paper instead evaluates attack success.Source: F SECURITY ROBUSTNESS ANALYSIS · p. 18
  • Across 2000 generated texts of length 200, the method’s security robustness is superior to KGW-3 and closely approximates KGW-4.The evaluation uses word-frequency analysis to assess attacks that attempt to crack watermark rules.Source: F SECURITY ROBUSTNESS ANALYSIS · pp. 18–19

G ROBUSTNESS TO MORE TYPES OF ATTACK

The section tests emoji insertion and copy-paste attacks, comparing the proposed method with KGW-series methods. Emoji robustness is strong for both methods, while copy-paste robustness depends on whether the texts share a topic.

G ROBUSTNESS TO MORE TYPES OF ATTACK

  • Both SIR and KGW-1 show strong robustness to emoji insertion, though SIR’s resilience depends on the embedding model.KGW-1’s global red-green list limits the effect of inserted emojis; emojis do not drastically alter SIR’s sentence embedding in these experiments.Source: G ROBUSTNESS TO MORE TYPES OF ATTACK · p. 19, Table 3 · p. 19
  • For same-topic copy-paste, SIR and KGW-1 have nearly identical robustness; SIR may weaken slightly when the texts address different topics.The test inserts 150 watermarked tokens into 600 human tokens, comparing same-topic and different-topic contexts.Source: G ROBUSTNESS TO MORE TYPES OF ATTACK · p. 19, Table 3 · p. 19

H EVALUATING TEXT QUALITY IN MACHINE TRANSLATION TASK

The additional evaluations report a minimal BLEU decrease in machine translation, improved detection with longer generation, and a repetitiveness balance relative to KGW variants. The broader-impact discussion presents watermarking as an interpretable means of detecting LLM-generated text.

H EVALUATING TEXT QUALITY IN MACHINE TRANSLATION TASK

  • Watermarking causes a slight BLEU decrease on WMT14 translation, smaller than KGW-1’s, while achieving high detection F1.The evaluation covers French-English and German-English with NLLB-200-distilled-600M; Table 4 compares BLEU before and after watermark insertion and detection F1.Source: H EVALUATING TEXT QUALITY IN MACHINE… · p. 19, Table 4 · p. 20

I EVALUATING THE EFFECTIVENESS OF WATERMARK UNDER DIFFERENT

  • Detection effectiveness and robustness improve as generation length increases from 50 to 600, consistent with KGW; truncating context beyond the embedding model’s 512-token limit does not affect detection.Table 5 tests original and GPT-3.5-rewritten text at lengths 50, 100, 300, and 600.Source: I EVALUATING THE EFFECTIVENESS OF… · p. 20, Table 5 · p. 20

J EVALUATING THE REPETITIVENESS OF GENERATED TEXT

K BROADER IMPACT

  • The broader-impact discussion presents watermarking as a more interpretable alternative to classifiers for detecting LLM-generated text, whose efficacy may diminish as LLM output quality improves.Source: K BROADER IMPACT · p. 21
Loading 2310.06356v3…