Source-linked AI summary
MarkLLM: An Open-Source Toolkit for LLM Watermarking
Leyi Pan, Aiwei Liu, Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, Shuliang Liu, Xuming Hu, Lijie Wen, Irwin King, Philip S. Yu
TL;DR
The variety and complexity of LLM watermarking algorithms, together with diverse evaluation procedures, make them difficult to experiment with, understand, and assess. MarkLLM is an open-source toolkit that combines algorithm implementation, visualization, and evaluation tools; it provides 12 tools across three perspectives and two types of automated pipelines. The paper presents it as a resource for researchers and the broader community, while noting that its method coverage remains incomplete.
Problem
The proliferation of watermarking algorithms, complex mechanisms, and diverse evaluation procedures and perspectives makes them difficult for researchers and the public to experiment with, understand, and assess.
Source: §1 · p. 1Method
MarkLLM is an open-source toolkit combining a unified, extensible implementation framework with visualizations of watermarking mechanisms and tools for generating, detecting, and assessing watermarked text.
Source: §1 · p. 1, §3.2 · p. 4Results
MarkLLM provides 12 evaluation tools across detectability, robustness, and text quality, with two customizable automated evaluation pipelines.
Source: §1 · p. 2Takeaways & Limitations
The toolkit aims to support researchers and improve public understanding and involvement in LLM watermarking as a collaborative resource for advancing the field.
Source: §1 · p. 2, §6 · p. 6MarkLLM currently covers only a subset of existing methods and does not support some recent approaches that embed watermarks directly into model parameters during training.
Source: Limitations · p. 6
Abstract
from arXiv · showhide
LLM watermarking, which embeds imperceptible yet algorithmically detectable signals in model outputs to identify LLM-generated text, has become crucial in mitigating the potential misuse of large language models. However, the abundance of LLM watermarking algorithms, their intricate mechanisms, and the complex evaluation procedures and perspectives pose challenges for researchers and the community to easily experiment with, understand, and assess the latest advancements. To address these issues, we introduce MarkLLM, an open-source toolkit for LLM watermarking. MarkLLM offers a unified and extensible framework for implementing LLM watermarking algorithms, while providing user-friendly interfaces to ensure ease of access. Furthermore, it enhances understanding by supporting automatic visualization of the underlying mechanisms of these algorithms. For evaluation, MarkLLM offers a comprehensive suite of 12 tools spanning three perspectives, along with two types of automated evaluation pipelines. Through MarkLLM, we aim to support researchers while improving the comprehension and involvement of the general public in LLM watermarking technology, fostering consensus and driving further advancements in research and application. Our code is available at https://github.com/THU-BPM/MarkLLM.
1 Introduction
MARKLLM addresses the effort required to experiment with, understand, and evaluate a growing set of complex LLM watermarking algorithms. It combines a unified implementation framework with visualization, evaluation tools, and resources for community use.
1 Introduction
- MARKLLM provides a unified, extensible framework supporting nine algorithms from the KGW and Christ families.The paper also reports in-depth evaluations of the nine included algorithms as benchmarks for ongoing research.Source: §1 · pp. 1–2
- Custom visualizations show the mechanisms of both major watermarking families under different configurations, using real-world examples.The toolkit provides interfaces for gathering the data needed for visualization.Source: §1 · p. 2
- The evaluation module offers 12 tools across detectability, robustness, and text quality, plus two customizable automated evaluation pipelines.Users can customize datasets, models, metrics, and attacks.Source: §1 · p. 2
- Its modular, loosely coupled architecture is designed to support scalability and future extensions to algorithms, visualizations, and evaluation tools.The paper also describes an installable package and an online Jupyter notebook demo.Source: §1 · p. 2
2 Background
LLM watermarking algorithms use different generation and detection mechanisms, and their evaluation spans multiple dimensions. This section outlines the KGW and Christ families and the perspectives used to assess watermarking methods.
2.1 LLM Watermarking Algorithms
- KGW modifies logits and favors green-list tokens, while the Christ family alters sampling; KGW detection uses green-token proportions, whereas Christ-family detection measures text-sequence correlation.The KGW approach has variants targeting text quality, information capacity, robustness, low-entropy settings, and public detection.Source: §2.1 · pp. 2–3
2.2 Evaluation Perspectives
- Watermark evaluation considers detectability, robustness against tampering, and impact on text quality.Text quality can be assessed through perplexity, diversity, and downstream-task performance.Source: §2.2 · p. 3
3 MARKLLM
MarkLLM combines a unified framework for watermarking algorithms with family-specific visualizations and tools for evaluating detectability, robustness, and text quality. Its evaluation support includes customizable pipelines, and its visualizations illustrate token-level differences between watermarked and unwatermarked text.
3.1 Unified Implementation Framework
- MarkLLM addresses inconsistent algorithm designs, calling interfaces, and code standards with a unified framework for flexible algorithm invocation.The cited problems include difficulty extending methods, cumbersome batch processing and replication, and complications with customization and debugging.Source: §3.1 · p. 3
3.2.1 Visualization Solutions
- KGW visualizations distinguish red and green tokens, while Christ visualizations use color gradients to show token alignment with pseudo-random sequences.Darker shades indicate stronger alignment for Christ-family tokens.Source: §3.2.1 · p. 4
3.2.2 Architecture Design
- The visualization interface returns decoded tokens and highlights, using discrete red/green values for KGW and continuous correlation values for Christ.Separate visualizers color text using these family-specific values, and their display settings are configurable.Source: §3.2.2 · p. 4
3.2.3 Visualization Result
- The examples show more green tokens and a higher z-score in watermarked text, while Christ-family tokens appear darker than their unwatermarked counterparts.The passage says a reasonable z-score threshold can distinguish watermarked from unwatermarked text.Source: §3.2.3 · p. 4
3.3 Automated Comprehensive Evaluation
- Twelve tools cover detectability, robustness, and text quality, while two customizable automated pipelines support flexible evaluation.The tools include detection-threshold calculators, text-tampering attacks, and measures of fluency, variability, and downstream-task performance.Source: §3.3 · pp. 4–5
- The standardized detection process supports watermarked- and unwatermarked-text pipelines, while the quality process compares paired texts through a designated analyzer.The quality-analysis process produces detailed analysis and comparison results.Source: §3.3 · p. 5, Figure 5 · p. 5
- DirectQual compares watermarked and unwatermarked text with PPL and log diversity; RefQual uses a shared reference, and ExDisQual uses an external judger.RefQual suits downstream tasks such as machine translation and code generation; ExDisQual uses user-provided task descriptions.Source: §3.3 · pp. 5–6
4 User Examples
The examples show how to invoke a watermarking algorithm and prepare visualization data and settings through MarkLLM code snippets.
4 User Examples
- The examples demonstrate MarkLLM usage in projects through code snippets.The paper points readers to a demo video for additional examples.Source: §4 · p. 6
4.1 Watermarking Algorithm Invocation
- The invocation example loads the KGW algorithm with a configuration file, then generates watermarked text.The code comment labels the generation step.Source: §4.1 · p. 6
4.2 Mechanism Visualization
- The visualization example obtains data from the watermarked text and initializes a DiscreetVisualizer with color, font, layout, and legend settings.Source: §4.2 · p. 6
5 Experiment
The experiment uses MarkLLM to evaluate nine watermarking algorithms across detectability, robustness, and text-quality impact, and reports reproducing prior experimental results at low cost with simple scripts.
5 Experiment
- Nine watermarking algorithms were evaluated for detectability, robustness, and impact on text quality.Source: §5 · p. 6
- The experiments demonstrate that MarkLLM can reproduce results from previous experiments at low cost using simple scripts.Source: §5 · p. 6
- The paper directs readers to Appendix A for experimental setup details and obtained results.Source: §5 · p. 6
6 Conclusion
The conclusion presents MarkLLM as an open-source toolkit for watermarking algorithms, visualizations, and evaluation. It aims to support a collaborative research and development ecosystem as the field evolves.
6 Conclusion
- MarkLLM lets users try configurable watermarking algorithms, watermark their own text, and conduct detection.Source: §6 · p. 6
- The toolkit provides visualizations of underlying mechanisms and convenient evaluation tools and customizable pipelines for assessments from multiple perspectives.Source: §6 · p. 6
- The authors aim for MarkLLM to grow with the research community as watermarking evolves, inviting collaboration among researchers and developers.Source: §6 · p. 6
Limitations
MarkLLM’s current coverage has limits in supported algorithms, visualization designs, and evaluation scenarios. The authors invite further contributions to expand the toolkit.
Limitations
- MarkLLM integrates only a subset of existing methods and does not support some recent approaches that embed watermarks into model parameters during training.The cited examples are Xu et al., 2024 and Gu et al., 2024.Source: Limitations · p. 6
- Visualization currently provides one tailored solution for each of the two main watermarking algorithm families, leaving room for more diverse designs.The authors describe the existing solutions as offering valuable insights.Source: Limitations · p. 6
- Evaluation covers detectability, robustness, and text-quality impact but may omit scenarios such as spoofing attacks and CWRA.The passage cites He et al., 2024 for CWRA.Source: Limitations · p. 6
- The authors welcome developers and researchers contributing code and insights toward a more comprehensive LLM-watermarking ecosystem.They state that collaborative efforts can further advance the technology.Source: Limitations · pp. 6–7
A.1 Experiment Settings
The experiments use separate datasets and language models for general text generation, machine translation, and code generation. Detectability, robustness, and text quality are assessed with specified metrics and attack settings.
A.1 Experiment Settings
- C4 supports general text generation, while WMT16 German-English and HumanEval are used for machine translation and code generation, respectively.For C4, the first 30 tokens prompt generation of the following 200 tokens; original C4 texts serve as non-watermarked examples.Source: §A.1 · p. 10
- Llama-7b is used for general text generation, NLLB-200-distilled-600M for translation, and Starcoder for code generation.Source: §A.1 · p. 10
- Detectability uses dynamic thresholds at target FPRs of 10% and 1% or optimal F1, robustness uses the listed text-tampering attacks, and quality uses task-specific metrics and GPT-4 Judge.Quality metrics include PPL, log diversity, BLEU for translation, and pass@1 for code generation.Source: §A.1 · p. 10
A.2 Results and Analysis
MarkLLM’s implementations and evaluation pipelines reproduce results from previous watermarking papers through scripts in the repository. The reported evaluation also notes method and model-compatibility constraints.
A.2 Results and Analysis
- The evaluation tables demonstrate that MarkLLM’s implementations and pipelines can reproduce results from previous watermarking papers.The authors state that these experiments can be run with simple scripts in the repository’s evaluation/examples/ directory.Source: §A.2 · p. 10
- Repository examples provide execution commands for detectability, robustness, and text-quality assessments.The listings include example commands for each assessment type.Source: §A.2 · p. 10
- UPV results appear only in the “best” column because its detection uses threshold-free binary classification; EXP and EXP-edit machine-translation quality is unreported because current Christ implementations target decoder-only LLMs.Source: §A.2 · p. 10
B Comparison with Competitors
MarkLLM is presented as a multifunctional toolkit, distinguishing it from frameworks focused primarily on benchmark construction. The section describes competitor scope and the evaluation dimensions represented in MarkLLM’s tables.
B Comparison with Competitors
- WaterBench assesses text-quality impact for KGW, Unigram, and KGW-v2, while Mark My Words evaluates quality, tampering robustness, and detection-token needs across several algorithms.Source: B Comparison with Competitors · p. 10
- Unlike benchmark-focused frameworks, MarkLLM combines watermarking-algorithm implementation, mechanism visualization, evaluation tools, and automated pipelines.The authors describe it as the first comprehensive multifunctional toolkit and say it supports convenient usage, understanding, evaluation, and selection.Source: B Comparison with Competitors · p. 10
- MarkLLM’s evaluation tables cover detectability, robustness under attacks, and text-quality impact, with 200-text comparisons except for code generation, which uses 100 per group.The code-generation quality comparison uses 100 watermarked and 100 non-watermarked texts because of dataset constraints.Source: Table 4 · p. 11, Table 2 · p. 11, Table 3 · p. 11