Robust Distortion-free Watermarks for Language Models
By Rohith Kuditipudi, John Thickstun, Tatsunori B. Hashimoto, Percy Liang. Trans. Mach. Learn. Res., 2023
346 citations recorded by the source corpus.
We propose a methodology for planting watermarks in text from an autoregressive language model that are robust to perturbations without changing the distribution over text up to a certain maximum generation budget. We generate watermarked text by mapping a sequence of random numbers -- which we compute using a randomized watermark key -- to a sample from the language model. To detect watermarked text, any party who knows the key can align the text to the random number sequence. We instantiate our watermark methodology with two sampling schemes: inverse transform sampling and exponential minimum sampling. We apply these watermarks to three language models -- OPT-1.3B, LLaMA-7B and Alpaca-7B -- to experimentally validate their statistical power and robustness to various paraphrasing attacks. Notably, for both the OPT-1.3B and LLaMA-7B models, we find we can reliably detect watermarked text ($p \leq 0.01$) from $35$ tokens even after corrupting between $40$-$50\%$ of the tokens via random edits (i.e., substitutions, insertions or deletions). For the Alpaca-7B model, we conduct a case study on the feasibility of watermarking responses to typical user instructions. Due to the lower entropy of the responses, detection is more difficult: around $25\%$ of the responses -- whose median length is around $100$ tokens -- are detectable with $p \leq 0.01$, and the watermark is also less robust to certain automated paraphrasing attacks we implement.
Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition
View Paper: https://www.semanticscholar.org/paper/ccaff61e0c1e629d91d78f82a64b3cbc8f3f7023
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
In Computer Vision and Pattern Recognition
Citations in the corpus
- Breaking Distortion-free Watermarks in Large Language Models (2025, unknown): “To address this issue, a growing body of research around watermarking LLM-generated text has emerged [1, 12, 14, 18, 23, 30].”
- WaterPool: A Watermark Mitigating Trade-offs among Imperceptibility, Efficacy and Robustness (2024, methodology): “Kuditipudi et al. [2023] propose two similar techniques, ITS and EXP, which apply inverse transform sampling and Gumbel-max sampling at the token level.”