PaperlayerView exact revision on arXiv

Source-linked AI summary

A Survey of Text Watermarking in the Era of Large Language Models

Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, Philip S. Yu

arXiv:2312.07913v6cs.CL

TL;DR

LLMs create both new capabilities and new protection needs for text watermarking, including misuse prevention and copyright protection. This survey synthesizes watermarking methods, evaluation, applications, challenges, and future directions, finding strong detection on long outputs but weaker detection on short outputs and some generation-quality reduction.

  • Problem

    LLMs can generate misinformation or harmful content and are vulnerable to extraction attacks that reuse their generated text for training other models.

  • Method

    The survey examines text watermarking implementation methods, evaluation methods, application scenarios, challenges, and future directions in the era of LLMs.

  • Results

    WaterBench shows that most watermarks detect well, especially for long outputs, but perform worse on short outputs while reducing generation quality to some extent.

  • Takeaways & Limitations

    The survey provides a comprehensive view of text watermarking technology and its remaining design, deployment, and application challenges.

  • Takeaways & Limitations

    Training-time watermarking for open-source LLMs is weak against subsequent fine-tuning and can be completely removed after sufficient iterations.

Abstract

from arXiv · show

Text watermarking algorithms are crucial for protecting the copyright of textual content. Historically, their capabilities and application scenarios were limited. However, recent advancements in large language models (LLMs) have revolutionized these techniques. LLMs not only enhance text watermarking algorithms with their advanced abilities but also create a need for employing these algorithms to protect their own copyrights or prevent potential misuse. This paper conducts a comprehensive survey of the current state of text watermarking technology, covering four main aspects: (1) an overview and comparison of different text watermarking techniques; (2) evaluation methods for text watermarking algorithms, including their detectability, impact on text or LLM quality, robustness under target or untargeted attacks; (3) potential application scenarios for text watermarking technology; (4) current challenges and future directions for text watermarking. This survey aims to provide researchers with a thorough understanding of text watermarking technology in the era of LLM, thereby promoting its further advancement.

1 INTRODUCTION

LLMs expand text watermarking’s capabilities while creating needs to address misuse and intellectual-property concerns. The survey organizes this evolving field and reviews its techniques, evaluations, applications, and challenges.

  • Motivation: LLMs improve language understanding and generation across tasks, enabling more sophisticated text watermarking approaches.Their semantic and contextual abilities can reduce watermarking’s impact on meaning and readability.
  • Motivation: LLMs can be misused to generate misinformation or harmful content, while model extraction attacks threaten intellectual property.Attackers may use large amounts of text generated by an original LLM to train another model.
  • Motivation: Watermarking LLM-generated text supports tracking and detection of misuse, and watermarked training data can mitigate model extraction attacks.The survey connects watermarking with both output monitoring and protection of model-derived data.
  • Survey scope: Text watermarking and LLMs interact through watermarking generated text, using LLMs for embedding, and integrating watermarking into generation.The survey identifies a lack of comprehensive studies spanning these relationships.
  • Survey scope: The survey covers watermarking techniques, evaluation metrics, application scenarios, challenges, and future research directions.Its application discussion includes copyright protection and AI-generated text detection.

2 PRELIMINARIES OF TEXT WATERMARKING

Text watermarking uses a generator to embed a message and a detector to recover it, with methods spanning existing-text modification and LLM-based generation. Effective algorithms should preserve quality and remain detectable after modifications.

  • Definitions: A watermark generator A takes text x and message w and outputs watermarked text t, while detector D predicts w from t.The message may encode only watermark presence or carry multiple bits of customized information.
  • Definitions: Watermark payload denotes the information volume conveyed by the watermark message, which may be zero-bit or multi-bit.A zero-bit watermark indicates presence or absence; a multi-bit watermark carries detailed information.
  • Key characteristics: Low impact on text quality requires the quality-score difference between watermarked and unwatermarked text to remain below threshold δ.The quality function R evaluates text from multiple perspectives.
  • Key characteristics: Robustness requires watermark detection to remain successful after text modifications, with sufficient detection probability exceeding threshold β.Removal operations are represented by U in the survey’s formulation.
  • Taxonomy: Watermarking for existing text post-processes text using semantically invariant transformations, whereas LLM watermarking modifies training or inference to produce watermarked output.The taxonomy separates these two primary categories.

3 WATERMARKING FOR EXISTING TEXT

Watermarking for existing text modifies pre-existing content through format, lexical, syntactic, or generation-based methods. These approaches trade payload, concealment, semantic quality, language coverage, and robustness against removal.

  • Overview: Existing-text watermarking comprises format-based, lexical-based, syntactic-based, and generation-based approaches, classified by modification granularity.The taxonomy covers methods that alter presentation, words, syntax, or generate watermarked text directly.
  • Format-based Watermarking: Format-based methods alter layout or Unicode codepoints without changing textual content, but detectable formatting is vulnerable to reformatting and forgery.Canonicalization can reset line spacing or replace specific codepoints, while DASH can highlight changes.
  • Lexical-based Watermarking: Lexical-based methods replace selected words with synonyms while preserving syntax, progressing from context-independent resources to context-aware BERT substitutions.Context-aware substitution addresses semantic and quality risks from ignoring target-word context.
  • Lexical-based Watermarking: Fine-tuning a BERT infill model with keyword-preserving and syntactically invariant corruptions achieves superior robustness against removal attacks.The training design helps preserve keywords and syntax during attack-oriented adaptation.
  • Syntactic-based Watermarking: Syntactic-based methods encode messages through syntax transformations, but depend on language-specific grammar and may alter style or fluency.Examples include adjunct movement, clefting, passivization, activization, and topicalization.
  • Generation-based Watermarking: Generation-based watermarking uses neural models or LLMs to generate watermarked text from original text and a message while aiming to preserve semantics.Examples include transformer-based AWT, REMARK-LLM, and WATERFALL, which use learned generation or LLM paraphrasing.

4 WATERMARKING FOR LLMS

Watermarking for LLMs is organized around training, logits generation, and token sampling, with methods balancing detectability, text quality, and robustness. The survey highlights KGW’s detection performance, its practical weaknesses, and distinct constraints for open-source models.

  • Taxonomy: LLM watermarking is categorized into training-time, logits-generation, and token-sampling methods aligned with the three phases of text generation.Logits-generation methods modify model outputs, token-sampling methods guide sampling without altering logits, and training-time methods embed watermarks in model parameters.
  • Watermarking during Logits Generation: KGW partitions the vocabulary into red and green lists using preceding-token hashes, biases green-token logits, and detects watermarks through green-token ratios and a z-metric.A text exceeding a green-token threshold is classified as watermarked.
  • Enhancing Watermark Detectability: < 3 × 10−3% false positive and < 1% false negative rates were reported for KGW detection in tests.These results motivate further optimization for more demanding real-world conditions.
  • Enhancing Watermark Detectability: KGW’s Gaussian z-score assumption can misestimate extremely low false positive rates because it becomes accurate only as token length approaches infinity.A non-asymptotic test using the binomial distribution was developed to address this discrepancy.
  • Enhancing Watermark Detectability: Low-entropy text and mixtures with extensive non-watermarked text reduce KGW detection sensitivity, motivating entropy-weighted and sliding-window methods.EWD emphasizes high-entropy tokens, while WinMax selects the maximum z-score across window sizes.
  • Watermarking during LLM Training: Training-time watermarking is required for open-source LLMs because inference-time watermarking code can be removed after logits are produced.Training-time methods include trigger-based watermarks for specific inputs and global watermarks intended for all inputs.
  • Global Watermarking: Global watermark training can achieve near-perfect detection and strong interference resistance, but may be less stable on out-of-distribution data than inference-time watermarking.The reported limitation is associated with the black-box nature of LLMs.

5 EVALUATION METRICS FOR TEXT WATERMARKING

Text watermarking evaluation spans detectability, quality impact, model capability, and robustness. The section describes zero-bit and multi-bit detection metrics, watermark size, and broader quality-preservation criteria.

  • Evaluation Dimensions: Evaluation covers detectability, effects on targeted text and LLM quality, and robustness against untargeted and targeted attacks.The survey presents these dimensions as complementary perspectives for evaluating watermarking algorithms.
  • Zero-bit Watermarking: Zero-bit watermark detectors commonly use hypothesis testing to produce a z-score or p-value and classify texts using a threshold.Balanced datasets of watermarked and human texts are used to calculate metrics such as F1 score and false-positive rates.
  • Detection Metrics: Threshold selection complicates comparisons because studies report F1 at fixed false-positive rates or the best F1 across thresholds.The reported fixed false-positive rates include 1% and 10%.
  • Multi-bit Watermarking: Multi-bit watermarking evaluates information extraction using bit error rate, bit accuracy, and payload measures such as Bits Per Watermark or code rate.Payload divides watermark-information bits by the number of tokens.
  • Watermark Size: KGW requires the shortest detection length among KGW, Aar, and KTH at a 2% false-positive rate, indicating the best watermark size in that study.The survey recommends broader use of watermark size as an evaluation metric.
  • Quality and Robustness: High detectability is insufficient by itself; watermarking should also preserve text quality and remain robust against attacks.The survey separates quality evaluation for watermarked text from capability evaluation for watermarked LLMs.

5.2 Quality Impact of Watermarked Text

Quality-impact evaluation compares watermarked text with its source or scores each text separately. Metrics cover surface similarity, semantic similarity, fluency, coherence, and human judgments, each with distinct limitations.

  • Comparative Metrics: Comparative evaluation measures differences between original and watermarked text using surface or semantic similarity metrics.BLEU and METEOR assess surface features, while semantic and entailment scores assess meaning-related similarity.
  • Surface Similarity: BLEU emphasizes n-gram overlap, precision, and length penalty but is sensitive to word order, morphology, and exact matching.These properties limit its ability to capture all aspects of semantic preservation.
  • Semantic Similarity: Semantic scores commonly compare LLM-derived embeddings with cosine similarity, while entailment scores use NLI models to assess finer-grained relationships.Examples include Sentence-BERT, Universal Sentence Encoder, all-MiniLM-L6-v2, and RoBERTa-Large-NLI.
  • Single-text Metrics: Single-text evaluation commonly uses perplexity or human scoring rather than direct comparison with the original text.Perplexity evaluates text quality through an LLM-based likelihood measure.
  • Limitations: Lower perplexity generally indicates higher coherence and fluency, but perplexity can misrate repetitive text and depends on LLM output accuracy.Human scoring is generally considered more accurate but requires multiple annotators and is costly at scale.

5.3 Output Performance Evaluation for Watermarked LLM

Watermarked LLMs are evaluated on text completion, code generation, and other downstream tasks to measure whether watermarking affects model capabilities. The survey combines perplexity, semantic, task-specific, execution-based, and LLM-judged metrics.

  • Text Completion: Text completion is the most common capability test, with a prompt prefix followed by generated text evaluated primarily using perplexity.PPL is widely adopted because of its general applicability and simplicity.
  • Text Completion: P-SP measures semantic similarity between original and watermarked completions, but limited adoption reflects the possibility that identical prefixes produce different semantics.This limits direct comparability between generated texts.
  • Code Generation: Code generation is more sensitive to capability changes because small errors can cause execution failure or incorrect results.Evaluation uses surface metrics such as CodeBLEU and Edit Similarity, alongside execution-based Pass@k.
  • Other Downstream Tasks: Other evaluations cover question answering, machine translation, summarization, mathematical reasoning, knowledge probing, and instruction following.Metrics include exact match, ROUGE, BLEU, BERT-Score, perplexity, accuracy, F1, and GPT-Judge depending on the task.

5.4 Output Diversity Evaluation for Watermarked LLM

Watermarked LLMs require diversity evaluation because watermarking can favor particular outputs and reduce diversity. The survey presents surface-form and semantic metrics and reports trade-offs involving repetition, window size, robustness, and diversity.

  • Watermarking can reduce output diversity by favoring certain content, motivating dedicated evaluation beyond general LLM quality.
  • Surface-form diversity: Aar shows significantly higher Seq-Rep-3 repetition than KGW and KTH, while larger window sizes reduce repetition but sacrifice modification robustness.
  • Surface-form diversity: Log diversity aggregates unique n-gram proportions from 1 to N, and it increases with window size.
  • Surface-form diversity: Ent-3 measures 3-gram frequency entropy, with higher values indicating greater lexical diversity; one algorithm improves robustness without reducing diversity.
  • Semantic diversity: Sem-Ent computes entropy over k-means clusters of LLM-derived sentence representations, emphasizing semantic rather than surface-form diversity.

5.5 Untargeted Watermark Attacks

Untargeted attacks modify watermarked text without knowing the watermark mechanism, testing whether detection survives character-, word-, document-, and cross-lingual changes. Robustness varies substantially with attack type, watermark design, text length, and generation setting.

  • Threat model: The untargeted threat model allows character-, word-, or sentence-level modifications and insertion into longer human text without knowledge of embedding details.
  • Character-level attack: Unicode normalization is crucial because homoglyph attacks can evade visual inspection while altering format-based watermarks.
  • Character-level attack: Character attacks preserve quality and are relatively detectable, but tokenizer changes can substantially weaken detection and homoglyphs can remove format-based watermarks.
  • Word-level attack: Word deletion is most effective against existing-text watermarks: rates below 0.1 have minimal impact, whereas rates above 0.3 can remove the watermark.
  • Generation-time word-level attack: Emoji insertion attacks can completely remove prefix-dependent LLM watermarks after the inserted emojis are deleted.
  • Generation-time word-level attack: Emoji attacks require strong instruction following and fail against methods that do not depend on previous tokens.
  • Document-level attack: Paraphrasing robustness improves for order-independent detectors, less prefix-dependent KGW variants, semantic dependencies, stronger watermarks, and longer watermarked texts.
  • Document-level attack: Copy-paste attacks weaken detection by diluting watermarked content; effects usually exceed most paraphrasing attacks at 10% watermarked text and become comparable to some at 25%.Longer text can improve detection reliability in this setting.

5.6 Targeted Watermark Attacks

Targeted attacks infer watermark-generation rules from watermarked text, model queries, or training data, then remove or forge watermarks. Existing attacks are often algorithm-specific, while sufficient data can teach models several simple watermarks.

  • Threat model: Targeted attacks assume attackers know a watermark exists and possess substantial watermarked text, with the goal of inferring its generation method.
  • Attack scope: Many attacks target specific schemes by recovering hidden details such as KGW’s red-green word-list division.
  • KGW-targeted attacks: Spoofing infers green words from frequency differences under fixed prefixes, working for KGW with window size 1 and unigram watermarks but struggling with larger windows.
  • KGW-targeted attacks: Watermark Stealing queries a watermark model’s API and achieves over 80% spoofing success while extracting more complex algorithms.
  • KGW-targeted attacks: SCTS uses prompted A/B generation frequencies to identify some green words, but recovering the complete red-green list remains complex.
  • KGW-targeted attacks: MIP steals green lists through systematic constraints and is more efficient than frequency-based methods, though diverse complex lists hinder accurate recovery.
  • Attack scope: The introduced targeted attacks primarily crack KGW red-green lists and do not generalize to other watermark types.
  • Learnability attacks: With sufficient training data, LLMs can learn KGW, Aar, and KTH watermarks, but larger window sizes make them difficult to learn.

5.7 Benchmarks and Tools

Benchmarks and toolkits standardize watermark evaluation across detectability, quality, watermark size, and attack robustness. Results indicate strong detection on long outputs but quality costs and weaker detection on short outputs.

  • Benchmarks: WaterBench evaluates detectability and capability impact across nine tasks in five categories using fixed watermark strength for consistency.
  • Benchmarks: WaterBench finds that most watermarks detect well on long outputs but perform worse on short outputs, while all reduce generation quality to some extent.
  • Benchmarks: WaterJudge emphasizes the detectability-quality trade-off using F1 detection scores and an LLM-based preference measure for watermarked versus unwatermarked text.
  • Benchmarks: Mark My Words measures watermark size as tokens required for detection at a 2% false-positive rate and evaluates eight semantic-preserving attacks.
  • Toolkits: MarkLLM provides unified implementations for most existing LLM watermark algorithms, evaluation tools for detectability, quality, and robustness, and mechanism visualization.

6 APPLICATION FOR TEXT WATERMARKING

Text watermarking supports copyright protection, dataset protection, LLM copyright protection, and detection of AI-generated content. The survey highlights both existing applications and the potential for integrating watermarking with LLMs.

  • Copyright Protection: Copyright applications identify text sources through watermarks while preserving content, with format-based methods commonly used because they do not alter the text.Examples embed information through layout, color, font, HTML rules, variables, or bookmarks.
  • Future Applications: Integrating watermark algorithms with LLMs is identified as a promising direction for future text copyright protection.
  • Copyright Protection: Dataset watermarking embeds triggers and target behaviors so that an LLM trained on the dataset responds to those triggers.
  • LLM Copyright Protection: Watermarking LLM outputs can help address model extraction attacks, but watermark learnability creates a trade-off with resistance to targeted attacks.Learnable watermarks can transfer to models trained on watermarked outputs, while also becoming easier to spoof or steal.
  • AI-Generated Text Detection: Watermarking supports AI-generated text detection in scenarios including academic integrity and LLM-generated misinformation.Possible approaches include logits-generation and token-sampling watermarking, alongside post-generation detectors and classifiers.

7 CHALLENGES AND FUTURE DIRECTIONS

The survey identifies fundamental trade-offs and difficult deployment settings for text watermarking, including low-entropy, publicly verifiable, and open-source LLM scenarios. It proposes specialized algorithms, new watermarking paradigms, semantically invariant transformations, and attention to real-world LLM performance.

  • Trade-offs in Algorithm Design: Watermark size, robustness, and capacity generally trade off because quality requirements limit the suitable watermark text space.Multi-bit methods can mitigate the conflict somewhat, but at the cost of significant robustness and watermark size.
  • Trade-offs in Algorithm Design: Robustness against untargeted attacks often conflicts with robustness against targeted attacks because window size and watermark complexity affect removal and theft differently.Global red-green lists can resist text modifications yet remain vulnerable to spoofing, whereas complex hashes can resist theft but weaken modification robustness.
  • Trade-offs in Algorithm Design: Output diversity also trades off with robustness against untargeted attacks, while KTH-type methods reduce this trade-off at the expense of detection efficiency.For KTH, detection becomes less efficient because of the complexity of multi-time edit-distance calculation.
  • Future Directions: Future work should balance trade-offs through algorithms targeting individual conflicts or entirely new watermarking paradigms.The survey also emphasizes accounting for real-world performance implications in large-scale LLM systems.
  • Challenging Scenarios: Low-entropy text such as code and tables restricts watermark capacity, making highly detectable watermark embedding difficult.Future methods may need formatting- and grammar-aware, semantically invariant transformations rather than only token-level modifications.
  • Challenging Scenarios: Publicly verifiable watermarking requires stronger resistance to targeted attacks because users can access the detector and devise more attack methods.The survey calls for more robust publicly verifiable algorithms and broader investigation of attacks in these settings.
  • Challenging Scenarios: Open-source LLM watermarking is especially difficult because training-time watermarks can be completely removed after sufficient fine-tuning.Future research should develop watermarks robust to subsequent fine-tuning.

8 CONCLUSION

Text watermarking in the LLM era is rapidly evolving and spans implementation, evaluation, applications, challenges, and future directions. Further progress is needed to withstand novel attacks and support emerging authenticity-verification uses.

  • The survey covers text watermarking implementation, evaluation methods, applications, challenges, and future directions in the era of LLMs.
  • Future research should develop watermarking algorithms that withstand novel attacks involving sophisticated attacker tools and knowledge.
  • New applications, including authenticity verification for AI-generated content in social media and journalism, require further exploration.
  • The field’s continued development is described as critical to the responsible and ethical use of AI technologies.
Loading 2312.07913v6…