Provable Robust Watermarking for AI-Generated Text

By Xuandong Zhao, Prabhanjan Vijendra Ananth, Lei Li, Yu-Xiang Wang. International Conference on Learning Representations, 2023

352 citations recorded by the source corpus.

We study the problem of watermarking large language models (LLMs) generated text -- one of the most promising approaches for addressing the safety challenges of LLM usage. In this paper, we propose a rigorous theoretical framework to quantify the effectiveness and robustness of LLM watermarks. We propose a robust and high-quality watermark method, Unigram-Watermark, by extending an existing approach with a simplified fixed grouping strategy. We prove that our watermark method enjoys guaranteed generation quality, correctness in watermark detection, and is robust against text editing and paraphrasing. Experiments on three varying LLMs and two datasets verify that our Unigram-Watermark achieves superior detection accuracy and comparable generation quality in perplexity, thus promoting the responsible use of LLMs. Code is available at https://github.com/XuandongZhao/Unigram-Watermark.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

View Paper: https://www.semanticscholar.org/paper/75b68d0903af9d9f6e47ce3cf7e1a7d27ec811dc

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense (2023, background): “Finally, in Appendix A.4 we brieﬂy discuss why an LLM provider may be incentivized to implement retrieval-based detection, and the relationship of this detector with GDPR’s right to be forgotten.”
Breaking Distortion-free Watermarks in Large Language Models (2025, unknown): “The work most related to ours is Pang et al. [22], who provide spoofing attacks on the three most prominent LLM watermarking schemes: KGW [12], Unigram [33], and EXP [14].”
WaterPool: A Watermark Mitigating Trade-offs among Imperceptibility, Efficacy and Robustness (2024, background): “Unigram [Zhao et al., 2023] stands out for fixing the private key for better efficacy and robustness.”
Is The Watermarking Of LLM-Generated Code Robust? (2024, unknown): “To address this issue, researchers have developed various watermarking techniques , which inject hidden patterns in the generated output based on a hash or cryptographic key (Kirchenbauer et al., 2023a; Zhao et al., 2023; Kuditipudi et al., 2023).”