Venue: NAACL 2025

WaterPool: A Language Model Watermark Mitigating Trade-Offs among Imperceptibility, Efficacy and Robustness

 Baizhou Huang \({}^{\diamondsuit}\) Xiaojun Wan \({}^{\spadesuit}\) Wangxuan Institute of Computer Technology, Peking University

\({}^{\heartsuit}\)State Key Laboratory of General Artificial Intelligence

{hbz19,wanxiaojun}@pku.edu.cn

###### Abstract

Watermarking is a prominent technique to trace the usage of specific large language models (LLMs) by injecting patterns into model-generated content. An ideal watermark should be imperceptible, easily detectable, and robust to text alterations, yet existing methods typically face trade-offs among these properties. This paper utilizes a key-centered scheme to unify existing methods by decomposing a watermark into two components: a key module and a mark module. We show that the trade-off issue is the reflection of the conflict between the scale of the key sampling space during generation and the complexity of key restoration during detection within the key module. To this end, we introduce **WaterPool**, a simple yet effective key module that preserves a complete key sampling space for imperceptibility while utilizing semantics-based search to improve the key restoration process. WaterPool can integrate seamlessly with existing watermarking techniques, significantly enhancing their performance, achieving near-optimal imperceptibility, and markedly improving their detection efficacy and robustness (+12.73% for KGW, +20.27% for EXP, +7.27% for ITS)1.

Footnote 1: The code is available in [https://github.com/skpig/waterpool](https://github.com/skpig/waterpool).

## 1 Introduction

The world has recently witnessed the great power of large language models (LLMs). However, the widespread use of these systems has raised significant concerns about their potential misuse. For example, LLMs could be used to generate massive amounts of fake news or automated comments to manipulate social media, posing threats to academic integrity and intellectual property rights [5, 4].

To address these issues, watermarking has been proposed to track the usage of specific models [8]. It embeds a hidden pattern into generated contents of a specific LLM during decoding, which is conduct by sampling outputs from a stochastic modified distribution instead of the original language modeling distribution. Ideally, the expectation of the modified distribution is nearly identical to the original one, making the watermarked text almost indistinguishable from the original (**imperceptibility**). This pattern can be reliably detected by a detector (**efficacy**) and remains high detection rate even if the text is corrupted by semantic-preserving attacks (**robustness**).

Prior works have made great progress towards these properties for an ideal watermark [8, 6, 10, 11]. However, none of them have achieved all three properties simultaneously as illustrated in Figure 1. It is widely accepted that there is a trade-off among imperceptibility, efficacy, and robustness. Previous methods often use hyper-parameters to balance this trade-off issue, like the \(\delta\) in KGW controlling the degree of distribution shift.

In this paper, we try to explore this issue. We

Figure 1: Previous methods face trade-offs among imperceptibility, efficacy and robustness. WaterPool mitigates this problem to a significant extent. It can be integrated with other watermarking methods, improving them on all three aspects. This figure is based on the experiments on open-ended text generation presented in Table 1 and 2.

 

begin by unifying existing watermarking methods with a key-centered scheme. It decomposes a watermarking technique into two independent modules, a _key module_ and a _mark module_, as shown in Figure 2. During generation, the key module samples a private key. It is then utilized by the mark module as a random seed to distort the next token distribution, from which watermarked texts are sampled. During detection, the key module attempts to restore the private key. Then the mark module aligns the text with the restored key to compute statistics, which imply the likelihood of watermark presence. The decomposition separates requirements of imperceptibility, efficacy and robustness into the two modules. Subsequently, we show that the key module significantly contributes to the trade-off problem. Specifically, the trade-off problem actually stems from the conflict between the scale of key sampling space during generation and the complexity of key restoration during detection.

To overcome this trade-off, we introduce **WaterPool**, a simple but effective key module. WaterPool maintains the complete key sampling space, crucial for imperceptibility, while leveraging a semantics-based search to significantly enhance the precision and effectiveness of the key restoration process, thereby ensuring high robustness against attacks. We integrate WaterPool into three of the most renowned watermarking techniques, EXP Kuditipudi et al. (2023)), KGW Kirchenbauer et al. (2023a) and ITS Kuditipudi et al. (2023)). WaterPool effectively mitigates the traditionally "inevitable" trade-offs, achieving superior performance as shown in Figure 1.

Our experiments include two scale of large language models (LLMs) across tasks of open-ended generation and long-form question answering. Experimental results demonstrate the supreme capabilities of our proposed WaterPool. On one hand, it elevates the imperceptibility of KGW, EXP and ITS to near-optimal levels. On the other hand, it significantly enhances the efficacy and robustness of previous watermarking techniques, yielding substantial improvements across different experimental settings (+12.73% for KGW, +20.27% for EXP, +7.27% for ITS)2.

Footnote 2: The results are the performance of WaterPool with OPT-1.3B on the open-ended generation task

## 2 Preliminary

**Problem Formulation.** We begin by formalizing the process of watermarking. Given any prompt \({\bf x}\), a LLM will generate a sequence of output token \({\mathbf{y}}_{i}\sim P_{M}(\cdot|{\bf x},{\mathbf{y}}_{<i})\) in an auto-regressive manner. A watermark will stochastically distort the distribution to a _Modified Distribution_\(\hat{P}_{M}(\cdot|{\bf x},{\mathbf{y}}_{<i})\in\Delta(\Sigma)\) over the vocabulary \(\Sigma\). The detection of watermarked texts is formulated as a hypothesis testing problem with an alternative hypothesis that the candidate is sampled from a modified distribution. It is typically proved by gathering per-token statistics \(s_{i}\) for significance test.

**Imperceptibility.** An ideal watermark should maintain the output distribution of LLM as unchanged as possible Christ et al. (2023); Hu et al. (2023); Kuditipudi et al. (2023); Liu et al. (2023b). Formally, we define the imperceptibility following "\(N\)-shot undetectable" from Hu et al. (2023): for all \({\bf x}^{n},{\bf y}^{n}\in\Sigma^{*}\),

\[\prod_{n}^{N}P_{M}({\mathbf{y}}^{n}|{\bf x}^{n})=\mathbb{E}_{\hat{P}_{M}}[ \prod_{n}^{N}\hat{P}_{M}({\mathbf{y}}^{n}|{\bf x}^{n})] \tag{1}\]

Here, superscripts \(n\) indicates different rounds of generation. For LLMs, which model language in an auto-regressive manner, the equation above can be expressed as:

\[\prod_{i,n}P_{M}({\mathbf{y}}_{i}|{\bf x}^{n},{\mathbf{y}}_{<i}^{n})=\mathbb{ E}_{\hat{P}_{M}}[\prod_{i,n}\hat{P}_{M}({\mathbf{y}}_{i}|{\bf x}^{n},{ \mathbf{y}}_{<i}^{n})] \tag{2}\]

We want to highlight the importance of the product over multiple generations above. It indicates that it is infeasible to distinguish between the original and the watermarked texts without prior knowledge about the modified distribution, even when multiple queries are allowed Christ et al. (2023).

**Efficacy.** An ideal watermark technique should be able to distinguish watermarked texts from the others. Empirically, it is required to achieve high true positive rate with low false positive rate. Most watermarking techniques achieve this by ensuring a substantial difference between the per-token statistic under alternative hypothesis (\(H_{1}\): the candidate token is sampled from the modified distribution \(\hat{P}_{M}(\cdot|{\bf x}^{n},{\mathbf{y}}_{<i}^{n})\)) and null hypothesis (\(H_{0}\): the candidate token is sampled from other distributions). This can be formulated as,

\[\mathbb{E}[s_{i}|H_{1}]-\mathbb{E}[s_{i}|H_{0}]\geq\phi(\mathbf{p}^{i}), \tag{3}\]

where \(s_{i}\) is the statistic of \(i\)-th token. We denote the left-hand side as _Statistical Difference_. \(\phi(\mathbf{p}^{i})\) only depends on \(\mathbf{p}^{i}\), the probability vector for \(i\)-th step distribution \(P_{M}(\cdot|{\bf x},{\bf y}_{<i})\), remaining constant given \({\bf x}\) and \({\bf y}_{<i}\). It indicates the innate potential 

for watermark injection3. The statistical difference enables the application of statistical tests like permutation tests (Kuditipudi et al., 2023) or parametric tests assuming specific distribution forms under the null hypothesis (Kirchenbauer et al., 2023; Fernandez et al., 2023).

Footnote 3: \(\phi(p)\) has different forms and names in previous works. (Kuditipudi et al., 2023) defines it as watermark potentials. (Kirchenbauer et al., 2023) connects it with a special form of entropy.

**Robustness.** Robustness is a one-step-further requirement of efficacy. The statistical pattern of watermarked texts could be vulnerable to potential attacks, including lexical modification or paraphrasing (Krishna et al., 2023; Kirchenbauer et al., 2023b). An ideal watermark technique should be resilient to removal and should maintain high efficacy even after such semantics-preserved attacks.

## 3 Methods

### Decompose Watermark: a Key-centered Scheme

As stated in Section 2, the critical part of watermarking falls in the modified distribution, which is stochastic and determined by a random seed, i.e. the _Private Key_(Christ et al., 2023; Kuditipudi et al., 2023). With private keys as connection, we decompose watermarks into two independent modules: a _Key Module_ and a _Mark Module_. The former handles the sampling and restoration of private keys, while the latter is responsible for the modification process and per-token statistic based on private keys. The overall scheme is illustrated in Figure 2.

Specifically, during the \(i\)-th step of generation, the key module samples a private key \({\bf k}_{i}\) from the possible key space \(\Xi\subset\mathbb{R}\) to provide randomness. Then the mark module takes the sampled key as a random seed to stochastically modify the next token distribution \(P_{i}:=P_{M}(\cdot|{\mathbf{x}^{n}},{\mathbf{y}^{n}_{<i}})\) to \(F({\bf k}_{i},P_{i})\), where \(F:\mathbb{R}\times\Delta(\Sigma)\rightarrow\Delta(\Sigma)\).

During detection, a candidate text \(\hat{\mathbf{y}}\) is given. Watermarking techniques generally frame the detection as a hypothesis testing problem, treating each token as an i.i.d sample. For each token \(\hat{\mathbf{y}}_{i}\), the key module tries to restore the corresponding private key \(\tilde{\mathbf{k}}_{i}\) used in generation based on the context. The mark module then calculates the per-token statistic \(s_{i}=S(\hat{\mathbf{y}}_{i},\tilde{\mathbf{k}}_{i})\), where \(S:\mathbb{R}\times\Sigma\rightarrow\mathbb{R}\). These statistics are then aggregated to indicate the likelihood of the entire sequence being watermarked.

In this scheme, the key module and the mark module operate independently, which allows for the combination of any key module with any mark module to create new watermarking methods (Piet et al., 2023). We review several well-known watermarking techniques, list their designs of mark modules (i.e. \(F\) and \(S\)) and key modules in Appendix A. In specific, we mainly focus on three renowned watermarking techniques in this work:

* KGW (Kirchenbauer et al., 2023). For the key module, KGW utilizes the hash value of the \(c\)-length context \(\mathbf{y}_{i-ci-1}\) as the private key \(\mathbf{k}_{i}\). For the mark module, it randomly samples a partition of the vocabulary \(\Sigma\), denoted as the green list \(\mathcal{G}_{\mathbf{k}_{i}}\)4. T

Figure 2: Overview of key-centered watermarking scheme. A watermark is decomposed into two modules, a key module and a mark module. (a) During generation, the LLM provides an next token distribution \(P_{M}\). The key module samples a private key \(\mathbf{k}_{i}\) as a random seed for the mark module to stochastically modify the distribution to \(\hat{P}_{M}\), from which watermarked texts are sampled. (b) During detection, the key module restores the key \(\tilde{\mathbf{k}}_{i}\) for each candidate token. The mark module then calculates the per-token statistic \(s_{i}\) based on the restored key and aggregates them for \(p\)-value.

 

tokens are added by a constant \(\tau\) to form the modified distribution.
* EXP [23]. For the key module, EXP limits the possible key space \(\Xi\) to a finite set sampled from \(\mathbb{R}\). With the finite key space, the key restoration process during detection can be estimated via greedy search. Specifically, EXP utilizes a edit distance trick \(d_{\text{edit}}\) to search for the key with highest statistics, improving robustness in case of potential text alteration. For the mark module, EXP takes the private key as seed to sample a standard Gumbel vector \(\mathbf{g}_{\mathbf{k}_{i}}\). Gumbel-max sampling is then conduct to sample a token \(t^{\star}\). Finally, the degenerate distribution \(\delta(t^{\star})\) is returned as modified distribution.
* ITS [14]. ITS utilizes the same key module as EXP. For the mark module, ITS takes the private key as seed to sample a standard uniform variable \(\mathbf{u}_{\mathbf{k}_{i}}\) and a random permutation \(\pi_{\mathbf{k}_{i}}\) for a permutational inverse transform sampling. The degenerate distribution of the sampled token is then returned as the modified distribution.

### Behind Trade-offs: Conflicts within Key Module

In this section, we examine how the key module affects imperceptibility, efficacy and robustness. As stated in Section 2, the statistical difference between the null and alternative hypotheses is crucial for ensuring efficacy and robustness, i.e., whether the candidate token is sampled from a modified distribution. Regardless of the choice of statistic \(S(\hat{\mathbf{k}}_{i},\hat{\mathbf{y}})\), prior knowledge of the modified distribution is essential. Since the modification process is stochastic and only dependent on the private key, successful detection requires that the restored key \(\hat{\mathbf{k}}_{i}\) matches the true key used during generation.

The key restoration process fundamentally involves searching through the potential key space \(\Xi\). Both the ITS and EXP methods use a greedy search strategy, enumerating each potential key to identify the one exhibiting the highest static. While reliable in key restoration, it is markedly time-consuming. Moreover, the per-token statistic is now \(\tilde{s}=\max s\), potentially diminishing the statistical difference. To mitigate the issue, ITS and EXP limit the possible key space size. To the extreme, Unigram directly fixes the private key. Alternatively, methods like KGW, Delta, and Gamma take the context window through a hash function for key restoration, reducing time complexity compared to exhaustive searches. But there are risks of incorrect key restoration if context is altered by attacks, diminishing their robustness.

As for imperceptibility under the key-centered scheme, Equation 2 can be rewritten as:

\[\prod_{i,n}\hskip-56.905512ptP_{M}(\mathbf{y}_{i}^{n}|\mathbf{x}^{ n},\mathbf{y}_{<i}^{n})\hskip-56.905512pt=\hskip-56.905512pt\mathbb{E}_{ \mathbf{k}^{1},...,\mathbf{k}^{N}}[\prod_{i,n}\hskip-56.905512ptF(\mathbf{k}_{ i}^{n},\!P_{i}^{n})(\mathbf{y}_{i}^{n})]\]

We then propose two requirements:

**Proposition 3.1**.: _A watermark is imperceptible if (1) Independent condition: the sampled private key vectors for each generated output are mutually independent, i.e. \(\mathbf{k}^{1},...,\mathbf{k}^{N}~{}^{i\;i,d}\mathcal{U}(\mathbb{R}^{L})\)5; (2) Unbiased condition: the modification function \(F\) satisfies \(P_{M}(\cdot|\mathbf{x}^{n},\mathbf{y}_{<i}^{n})=\mathbb{E}_{\mathbf{k}_{i} \sim\mathcal{U}(\mathbb{R})}[F(\mathbf{k}_{i},P_{i})]\)._

Footnote 5: \(L\) is the maximum output length of LLM.

The proposition describes separate requirements for key and mark modules. The detailed proof is presented in Appendix C.1. While many mark modules meet the unbiased condition [14, 8], ensuring independent condition is challenging for key modules. The independence of private keys over the whole space \(\mathbb{R}\) in successive generations indicates the search space \(\Xi\) of key restoration grows linearly with the number of generations, as all previously used keys must be considered.

The conflict within key modules now becomes apparent. Imperceptibility requires a large possible key space \(\Xi\), which complicates the key restoration process during detection, thereby hindering both efficacy and robustness. This trade-off within the key module is a critical factor underlying the broader trade-off among the three properties.

### WaterPool: Semantics-based Key Module

The previous section highlights a conflict within the key module, which contributes to the trade-off issue in watermarking. A natural question arises: is it possible to break the conflict for mitigating the trade-off? To ensure imperceptibility, it is essential to maintain a sufficiently large key space, characterized by an i.i.d. sampling strategy. Thus, an efficient and precise search strategy for the private key is needed for efficacy. The context-hash strategy provides insights by leveraging contextual information, yet hash functions are fragile to attacks. We aim to find a robust signal within the candidate's context that withstands semantic-preserved attacks.

 

To this end, we propose **WaterPool**, a simple but effective key module empowered by semantic searching. Specifically, for each generation, WaterPool independently samples a private key vector \({\bf k}^{n}\sim\mathcal{U}(\mathbb{R}^{L})\) to meet the independent condition in Proposition 3.1. Each private key is then used for the mark module to modify the next token distribution. We maintain a vector database \([(Enc({\bf y}^{1}),{\bf k}^{1}),...,(Enc({\bf y}^{N}),{\bf k}^{N})]\) to store the semantic embedding \(Enc({\bf y}^{n})\) of each output as keys and the corresponding private key vector \({\bf k}^{n}\) as values6. For each candidate text \(\hat{\bf y}\) during detection, regardless of whether it is watermarked, the most plausible private key vector \(\hat{\bf k}\) is retrieved based on semantic similarity:

Footnote 6: \(Enc\) can be any semantic embedding models, e.g. BERT.

\[\hat{\bf k}{=}{\bf k}^{n^{*}}\text{, where $n^{*}{=}\underset{n}{\rm argmaxim}( Enc({\bf y}^{n}),Enc(\hat{\bf y}))$}\]

The restored key vector is then provided for the mark module to calculate the statistics. Given that the most similar text to the candidate is its own even under attacks, this method ensures accurate key restoration if the candidate is watermarked.

As a key module, WaterPool is able to integrate with diverse mark modules. In this study, we integrate WaterPool with mark modules of three prominent watermarking techniques including EXP, ITS and KGW. These improved watermarks are referred to as EXP-Pool, ITS-Pool and KGW-Pool. Pseudo codes are presented in Appendix B.

Building on Proposition 3.1, the imperceptibility of WaterPool is readily established with EXP and ITS satisfying the unbiased condition 7.

Footnote 7: The mark module of KGW does not satisfy the unbiased condition. Therefore, WaterPool can only enhance its imperreptibility performance, but not achieve optimal imperceptibility.

**Proposition 3.2**.: _Both ITS-Pool and EXP-Pool are imperceptible._

Furthermore, the efficacy of WaterPool can also be assured based on the efficacy of combined mark module. This can be formalized as,

**Proposition 3.3**.: _The statistical difference in WaterPool is bounded from below, as expressed by:_

\[\mathbb{E}[S(\hat{\bf k}_{i},{\bf y}_{i})|H_{1}]{-}\mathbb{E}[S(\hat{\bf k}_{ i},{\bf y}_{i})|H_{0}]\geq p_{recall}\cdot\phi({\mathbf{p}}^{i})\]

_,where \(\phi({\mathbf{p}})\) is watermarking potentials of the corresponding mark module depending on the probability vector \({\mathbf{p}}^{i}\) for the \(i\)-th token distribution \(P_{M}(\cdot|{\bf x},{\bf y}<_{i})\)._

This proposition indicates that WaterPool can effectively leverage the power of mark modules (i.e. the lower bound of its statistical difference with golden private key restoration), slightly modulated by the recall performance \(p_{recall}\) of WaterPool's retriever. We will empirically demonstrate that the recall performance is near-optimal even in large scale database employing relatively weak retrievers in the following experiments. Proofs of propositions above are presented in Appendix C.2 to C.6.

### Difference from Retrieval Watermark

Krishna et al. (2023) proposed a retrieval watermark to distinguish watermarked texts with semantic retrieval. Different from the key-centered scheme described in Section 3.1, they directly store every output \(o\) generated by the specific LLM to be "watermarked" in a vector database \(D\). During detection, they search over the database for similar items, and utilize \(\max_{o\in D}\text{sim}(o,o^{\text{candidate}})\) as confidence of the candidate being watermarked.

WaterPool fundamentally differs from retrieval watermark, though they both leverage retrieval techniques. WaterPool's efficacy and robustness rely primarily on the statistical difference guaranteed by the mark module. In specific, \(\mathbb{E}[S({\bf k}_{i},{\bf y}_{i})]\) is designed to be high if \({\bf y}_{i}\) is sampled from \({\bf k}_{i}\)-induced modified distribution and low if \({\bf k}_{i}\) and \({\bf y}_{i}\) are independent. Therefore, the retriever of WaterPool only needs to retrieve the correct private key for watermarked candidates, without concern for retrieval results of non-watermarked candidates, since all keys stored in the database are independent of all non-watermarked texts.

In contrast, retrieval watermark directly uses similarity as score. For efficacy, it should ensure high similarity scores for watermarked texts and low similarity scores for non-watermarked ones. However, due to the dense semantic space of human language, texts stored in the database often have similar non-watermarked neighbors (_semantic collisions_ in Krishna et al. (2023)), and hence reducing efficacy. This issue will become more severe as the number of non-watermarked samples or the size of the vector database increases. We conduct an experiment to empirically demonstrate this by utilizing responses of other models to the same prompts as non-watermarked samples in Appendix E.2. In this scenario, the performance of retrieval watermark is over 40% worse than other watermarking methods.

 



## 4 Experiments

**Datasets.** Following Kirchenbauer et al. (2023a,b), we include two common used datasets, the C4 dataset and "Explain Like I'm Five" (ELI5) Fan et al. (2019) for open-ended text generation and long-form question answering, respectively. We randomly select about 3000 texts from both datasets as prompts for two LLMs, OPT-1.3b and OPT-6.7b, following Krishna et al. (2023).

**Metrics.** We generate 20 watermarked outputs for each prompt, while considering outputs of the original LLM as non-watermarked. Subsequently, 120,000 samples are used to evaluate each method. For both efficacy and robustness, we report true positive rate at 1% false positive rate, denoted as _TPR@FPR=1%_. We also include _ROC-AUC_ in Appendix E. To evaluate the robustness of watermarking techniques, we include three kinds of attacks, namely Lexical-Attack, Dipper-Attack and Translation-Attack. Lexical-attack randomly add/delete/replace 10% tokens of texts. Dipper is a paraphrasing model Krishna et al. (2023). Translation-attack represents roundtrip-translation, which is a paraphrasing pipeline. For the evaluation of imperceptibility, we split the criteria into two aspects: (1) the distribution bias within each output (2) the independence among different outputs. The former can be evaluated with _Perplexity_ while the latter can be roughly evaluated with n-gram distinction Kirchenbauer et al. (2023b). Specifically, we consider the distinction across all outputs (_Globdistinct-\(N\)_) and within outputs in response to one single prompt (_Group-distinct-\(N\)_).

**Baselines and implementation details.** We include several typical methods as baselines. In addition to EXP, ITS and KGW, we also include Gamma Hu et al. (2023), Delta Hu et al. (2023) and Unigram Zhao et al. (2023). All baselines are reproduced based on source codes provided by original paper. We use a 128 dimension sentence embedding model Nussbaum et al. (2024) as \(Enc(\cdot)\) in WaterPool. For implementation of mark modules in different WaterPool (i.e. KGW-Pool, ITS-Pool, EXP-Pool), we use identical hyperparameter settings as the corresponding baselines. Other details are presented in Appendix D.

### Main Results

We here only present and discuss results of OPT-1.3b in this section. Results of OPT-6.7b and more analysis experiments are presented in Appendix E. Notably, results across different LLMs on different tasks exhibit consistent trends and patterns.

Most baselines have achieved high efficacy (over 90% TPR@FPR=1%), but they all make trade-offs between imperceptibility and robustness. Consistent with our theoretical analysis in Section 3.2, Unigram, EXP, and ITS limit the key space \(\Xi\), thereby reducing the independence of keys across different generations. This is reflected in their weaker performance on the Distinct-\(N\) metric. Specifically,

\begin{table}
\begin{tabular}{l|c c|c c|c c|c c|c c} \hline \multicolumn{1}{c}{} & \multicolumn{2}{c}{Gloh-distinc2} & \multicolumn{2}{c}{Gloh-distinc3} & \multicolumn{2}{c}{Group-distinct2} & \multicolumn{2}{c}{Group-distinct3} & \multicolumn{2}{c}{Perplexity} \\ \hline  & value\(\uparrow\) & \(\Delta\uparrow\) & value\(\uparrow\) & \(\Delta\uparrow\) & value\(\uparrow\) & \(\Delta\uparrow\) & value\(\uparrow\) & \(\Delta\uparrow\) & value\(\downarrow\) & \(\Delta\downarrow\) \\ \hline \multicolumn{10}{c}{Open-Ended Text Generation} \\ \hline Non-watermark & 38.8\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 76.2\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 86.2\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 96.2\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 7.8\({}_{+0.0}\) & 0.0\({}_{+0.0}\) \\ Gamma & 38.8\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 76.2\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 86.2\({}_{+0.0}\) & -0.0\({}_{+0.0}\) & 96.2\({}_{+0.0}\) & -0.0\({}_{+0.0}\) & 7.8\({}_{+0.0}\) & 0.0\({}_{+0.0}\) \\ Delta & 38.8\({}_{+0.0}\) & -0.0\({}_{+0.0}\) & 76.2\({}_{+0.0}\) & -0.0\({}_{+0.0}\) & 86.2\({}_{+0.0}\) & -0.0\({}_{+0.0}\) & 96.2\({}_{+0.0}\) & -0.0\({}_{+0.0}\) & 7.8\({}_{+0.0}\) & 0.0\({}_{+0.0}\) \\ Unigram & 33.4\({}_{+1.9}\) & -5.3\({}_{+1.5}\) & 69.9\({}_{+2.8}\) & -6.3\({}_{+2.7}\) & 82.6\({}_{+2.4}\) & -3.6\({}_{+2.4}\) & 95.1\({}_{+0.6}\) & -1.1\({}_{+0.6}\) & 9.9\({}_{+0.6}\) & 2.2\({}_{+0.6}\) \\ KGW & 36.7\({}_{+0.1}\) & -2.0\({}_{+0.2}\) & 73.6\({}_{+0.1}\) & -2.7\({}_{+0.7}\) & 85.5\({}_{+0.1}\) & -0.7\({}_{+0.9}\) & 59.0\({}_{+0.0}\) & -0.3\({}_{+0.1}\) & 9.6\({}_{+0.0}\) & 1.8\({}_{+0.0}\) \\ KOW- Pool & **40.5\({}_{+0.2}\)** & **1.8\({}_{+0.2}\)** & **78.7\({}_{+0.2}\)** & -2.4\({}_{+2.2}\)** & **87.3\({}_{+1.1}\)** & -1.1\({}_{+2.0}\) & **97.6\({}_{+0.0}\)** & **95.0\({}_{+0.1}\)** & 9.9\({}_{+0.0}\) & 2.1\({}_{+0.0}\) \\ EXP & 30.2\({}_{+0.0}\) & -8.5\({}_{+0.0}\) & 59.2\({}_{+0.0}\) & -17.0\({}_{+0.0}\) & 73.4\({}_{+0.1}\) & -12.8\({}_{+0.0}\) & 82.2\({}_{+0.1}\) & -14.0\({}_{+0.0}\) & 7.8\({}_{+0.0}\) & 0.0\({}_{+0.0}\) \\ EXP-Pool & 38.7\({}_{+0.0}\) & -0.0\({}_{+0.0}\) & 76.2\({}_{+0.0}\) & -0.0\({}_{+0.0}\) & 86.2\({}_{+0.0}\) & -0.0\({}_{+0.0}\) & 96.2\({}_{+0.0}\) & -0.0\({}_{+0.0}\) & 7.8\({}_{+0.0}\) & 0.0\({}_{+0.0}\) \\ ITS & 34.4\({}_{+0.7}\) & -4.4\({}_{+0.7}\) & 66.4\({}_{+1.5}\) & -9.8\({}_{+1.1}\) & 75.2\({}_{+1.8}\) & -11.0\({}_{+1.8}\) & 83.7\({}_{+2.1}\) & -12.6\({}_{+2.1}\) & 75.6\({}_{+0.0}\) & **–0.3\({}_{+0.0}\)** \\ ITS-Pool & 38.8\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 76.2\({}_{+0.0}\) & -0.0\({}_{+0.0}\) & 86.2\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 96.2\({}_{+0.0}\) & -0.0\({}_{+0.0}\) & 7.8\({}_{+0.0}\) & 0.0\({}_{+0.0}\) \\ \hline \multicolumn{10}{c}{Long-Form Question Answering} \\ \hline Non-watermark & 31.5\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 70.0\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 86.7\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 97.0\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 95.0\({}_{+0.0}\) & 0.0\({}_{+0.0}\) \\ Gamma & 31.5\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 70.0\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 86.7\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 97.0\({}_{+0.0}\) & 0.0\({}_{+0.0}\) & 95.0\({}_{+0

Unigram suffers from degradation in both Distinct-\(N\) and perplexity. While EXP and ITS perform well in perplexity, they exhibit the worst Distinct-\(N\) results with more than 10% degradation. On the contrary, Gamma and Delta achieve optimal imperceptibility but at the cost of both efficacy and robustness. During detection, the alternative hypothesis distribution required by their likelihood ratio test is often inaccurate due to missing original prompts. Thus, their TPR@FPR=1% is significantly weaker compared to other methods.

WaterPool effectively mitigates these trade-offs. It markedly improves the original watermarking techniques across all tasks and all three aspects. It elevates the imperceptibility of original watermarks to near-optimal levels, as evidenced by the minimal difference from non-watermarked texts. Moreover, it consistently enhances the robustness of the original watermarks, as shown by substantial improvements in the TPR@FPR=1% metric (e.g. KGW-Pool outperforms KGW by \(12.73\%\), EXP-Pool outperforms EXP by \(20.27\%\), ITS-Pool outperforms ITS by \(7.27\%\)).

### Real-world Challenges for WaterPool

As stated in Section 3.4, WaterPool only requires to retrieve golden private key if it exists. This assertion holds intuitively, as a watermarked text, even under attacks, should remain semantically closer to the original watermarked text stored in the database than other texts. Otherwise, it should not be considered a modified version of the original watermarked text. To empirically demonstrate this, we conduct various experiments to demonstrate the stability of WaterPool under two real-world challenges.

**Performance with Diverse Negative Samples.** We test the performance of WaterPool across various distributions of non-watermarked text, including human-written outputs (_Human_, 3K samples) and outputs from other non-watermarked models8 (_Other Models_, 1.8M samples) with respect to the same prompts. Results shown in Table 3 indicate that all WaterPool methods exhibit stable performance regardless of the number and types of negative samples, which aligns with our theoretical analysis. This stability also highlights the advantages of WaterPool over retrieval watermarking, further substantiating the claims in Section 3.4.

Footnote 8: Models include Gemma-2b, Gemma-7b, Llama2-7b, Llama2-13b, Vicuna-7b and Vicuna-13b.

**Scalability with Large Vector Databases.** Another real-world challenge for WaterPool is the increasing scale of possible key space \(\Xi\) with increasing calls to watermarked LLMs. This raises the question of whether the key module can accurately retrieve the correct key from a large-scale database. To this end, we conduct experiments by scaling up the vector database size to simulate this scenario. Specifically, we augment the database with noisy entries by incorporating 50-token fragments sampled from the C4 dataset, constructing a noisy

\begin{table}
\begin{tabular}{l l c|c c c|c c} \hline \hline  & w/o Attack & \multicolumn{2}{c}{Lexical-Attack} & \multicolumn{2}{c}{Dipper-Attack} & \multicolumn{2}{c}{Translation-Attack} \\ \hline  & value\(\uparrow\) & \(\Delta\) & value\(\uparrow\) & \(\Delta\) & value\(\uparrow\) & \(\Delta\) & value\(\uparrow\) & \(\Delta\) \\ \hline \multicolumn{6}{c}{Open-Ended Text Generation} \\ \hline Gamma & 96.94\({}_{+0.05}\) & - & 17.91\({}_{+0.28}\) & - & 2.26\({}_{+0.04}\) & - & 3.25\({}_{+0.10}\) & - \\ Delta & 75.37\({}_{+0.34}\) & - & 8.58\({}_{+0.27}\) & - & 2.07\({}_{+0.08}\) & - & 2.91\({}_{+0.11}\) & - \\ \hline Unigram & 93.98\({}_{+1.32}\) & - & 89.69\({}_{+3.67}\) & - & 19.99\({}_{+7.44}\) & - & 3.35\({}_{+8.74}\) & - \\ KGW & **98.43\({}_{+0.08}\)** & - & 88.88\({}_{+0.13}\) & - & 15.05\({}_{+0.32}\) & - & 29.53\({}_{+0.23}\) & - \\ KGW- Pool & 98.29\({}_{+0.01}\) & -0.15\({}_{+0.08}\) & 95.29\({}_{+1.04}\) & 6.41\({}_{+1.17}\) & 24.62\({}_{+2.01}\) & 9.57\({}_{+2.32}\) & 42.26\({}_{+1.70}\) & 12.73\({}_{+1.73}\) \\ \hline EXP & 97.19\({}_{+0.08}\) & - & 93.48\({}_{+0.09}\) & – & 18.32\({}_{+0.36}\) & - & 3.14\({}_{+0.33}\) & - \\ EXP-Pool & 98.43\({}_{+0.01}\) & 1.24\({}_{+0.09}\) & **96.67\({}_{+0.07}\)** & 3.19\({}_{+0.15}\) & **26.17\({}_{+0.86}\)** & 7.85\({}_{+0.62}\) & **51.41\({}_{+0.42}\)** & 20.27\({}_{+0.64}\) \\ \hline ITS & 73.43\({}_{+0.10}\) & - & 26.23\({}_{+0.19}\) & - & 2.16\({}_{+0.08}\) & - & 3.56\({}_{+0.08}\) & - \\ ITS-Pool & 92.56\({}_{+0.14}\) & 19.12\({}_{+0.11}\) & 68.50\({}_{+0.46}\) & 42.27\({}_{+0.40}\) & 4.05\({}_{+0.15}\) & 1.89\({}_{+0.11}\) & 10.83\({}_{+0.31}\) & 7.27\({}_{+0.39}\) \\ \hline \multicolumn{6}{c}{Long-Form Question Answering} \\ \hline Gamma & 98.68\({}_{+0.05}\) & - & 21.20\({}_{+0.36}\) & - & 2.31\({}_{+0.05}\) & - & 5.18\({}_{+0.21}\) & - \\ Delta & 90.19\({}_{+1.33}\) & - & 12.17\({}_{+0.10}\) & - & 2.21\({}_{+0.08}\) & - & 4.96\({}_{+0.02}\) & - \\ \hline Unigram & 96.93\({}_{+1.99}\) & - & 92.47\({}_{+3.77}\) & - & 26.38\({}_{+5.88}\) & - & 43.17\({}_{+0.98}\) & - \\ KGW & 99.51\({}_{+0.01}\) & - & 94.12\({}_{+0.06}\) & - & 19.21\({}_{+0.17}\) & - & 46.62\({}_{+0.43}\) & - \\ KGW- Pool & 99.51\({}_{+0.00}\) & -0.01\({}_{+0.01}\) & 97.97\({}_{+0.04}\) & 3.85\({}_{+0.08}\) & 29.92\({}_{+1.04}\) & 10.71\({}_{+1.20}\) & 50.14\({}_{+0.24}\) & 3.52\({}_{+0.37}\) \\ \hline EXP & 99.17\({}_{+0.06}\) & - & 97.56\({}_{+0.08}\) & - & 27.92\({}_{+0.56}\) & - & 54.99\({}_{+0.37}\) & - \\ EXP-Pool & **99.56\({}_{+0.04}\)** & 0.40\({}_{+0.08}\) & **98.81\({}_{+0.07}\)** & 1.25\({}_{+0.05}\) & **36.24\({}_{+0.82}\)** & 8.32\({}_{+1.37}\) & **72.61\({}_{+0.29}\)** & 17.62\({}_{+0.56}\) \\ \hline ITS & 86.40\({}_{+0.51}\) & - & 38.23\({}_{+0.46}\) & - & 3.02\({}_{+0.19}\) & - & 8.19\({}_{+0.17}\) & - \\ ITS-Pool & 97.56\({}_{+0.05}\) & 11.6\({}_{+0.46}\) & 81.73\({}_{+0.34}\) & 43.51\({}_{+0.21}\) & 6.25\({}_{+0.15}\) & 3.23\({}_{+0.05}\) & 24.26\({}_{+0.43}\) & 16.07\({}_{+0.27}\) \\ \hline \end{tabular}
\end{table}
Table 2: Efficacy and robustness of different watermarking methods on OPT-1.3B evaluated with TPR@FPR=1%. \(\Delta\) is the performance boost brought by WaterPool. The best and second-best results are shown in **bold** and underline.

 

database of more than 100 million items. During detection, if WaterPool retrieves a noisy item from the fake database, representing a failed key reconstruction, a random key is used for the per-token statistic calculation, thereby affecting its efficacy and robustness. This setting is particularly challenging for open-ended text generation task since the noisy database shares a similar distribution with the watermarked texts stored in real database, both sampled from C4 dataset. Results on open-ended text generation and long-form question answering are presented in Figure 3. The results demonstrate that WaterPool maintains robust performance even as the database size increases exponentially, indicating its feasibility in real-world applications.

### Analysis of Space and Time

The price for breaking the trade-off issues with WaterPool lies in its space usage. The space complexity of WaterPool is \(O(N)\), growing linearly with the number of generations. However, this is still practical in real-world scenarios. In our experiments, we use sentence embeddings in form of 128-dimensional bfloat16 arrays and a private key of one int32 number9. Given ChatGPT's monthly visits are about 2B per month10, it takes 260 bytes of space per item, resulting in about 520 GB of storage per month, which is certainly manageable nowadays. Regarding time complexity, WaterPool requires less than 0.001 sec per item to retrieve from a database of 100M items with 10 RTX3090 GPUs, which is sufficient since watermark detection is not a time-intensive application.

Footnote 9: In practice, we can only sample a number as seed to initialize a pseudo-random number generator, thereby generating the whole private key vector \({\bf k}\in\mathbb{R}^{L}\) for all tokens.

## 5 Related Work

Watermarking is a specific form of steganography. Steganography requires that, without the knowledge about private keys, distributions of original texts and texts with steganography must be indistinguishable Simmons (1984); Katzenbeisser and Petitcolas (1999); Hopper et al. (2009); Dedic et al. (2008); Fang et al. (2017), which leads to imperceptibility objective of watermarking in Section 2.

LLM watermarking has recently gained many attention Christ et al. (2023); Kuditipudi et al. (2023); Hu et al. (2023); Pri (2023); Zhao et al. (2024); Christ and Gunn (2024); Fairoze et al. (2023); He et al. (2024), which can be seamlessly integrated into all LLMs without further training. KGW Kirchenbauer et al. (2023a) is the pioneering work, using context windows as private keys to increase probabilities of a specific partition of vocabulary. Building on KGW, follow-ups made many improvements, such as proposing different hash functions Kirchenbauer et al. (2023b); Hou et al. (2023); Liu et al. (2023); Ren et al. (2023), heuristic partition strategies Li et al. (2023); Chen et al. (2023), embedding multi-bit messages Wang et al. (2023); Qu et al. (2024), and robust hypothesis testing techniques Fernandez et al. (2023). Despite these advancements, the trade-off among imperceptibility, efficacy, and robustness has been widely recognized and remains unresolved. A concurrent work Giboulot and Teddy (2024) also tries to break the trade-off by resampling until observing significant watermarking signals. Although this approach maintains imperceptibility in a single turn, it significantly alters the \(N\)-shot output distribution.

## 6 Conclusion

In this paper, we focus on the trade-off challenges among imperceptibility, efficacy and robustness in LLM watermarking. Through a key-centered scheme, we have identified that the trade-offs arise

Figure 3: TPR@FPR=1% of WaterPool with different database size. WaterPool maintains stable performance as the scale increases to 100M items exponentially.

\begin{table}
\begin{tabular}{c c c c} \hline \hline  & Original & Human & Other Models \\ \hline w/o Attack & 98.43 & 98.35 & 98.45 \\ Lexical-Attack & 96.67 & 96.50 & 96.72 \\ Dipper-Attack & 26.17 & 24.49 & 25.65 \\ Translation-Attack & 51.41 & 50.23 & 51.60 \\ \hline \hline \end{tabular}
\end{table}
Table 3: TPR@FPR=1% of EXP-Pool with different non-watermarked texts listed in the first row. WaterPool remains stable across different non-watermarked text sources. Full results are presented in Appendix E.3.

 

from the conflict between the scale of the key sampling space during generation and the complexity of key restoration during detection. This insight motivates the design of WaterPool, a key module utilizing semantic search to alleviate this conflict. WaterPool integrates seamlessly with most existing watermarking methods, significantly enhancing their performance across all three dimensions. We hope this work offers valuable insights to future research for better solutions to this challenge.

## Acknowledgments

This work was supported by Beijing Science and Technology Program (Z231100007423011) and Key Laboratory of Science, Technology and Standard in Press Industry (Key Laboratory of Intelligent Press Media Technology). We appreciate the anonymous reviewers for their helpful comments. Xiaojun Wan is the corresponding author.

## Limitations

While WaterPool is both simple and easy to deploy, it does not entirely resolve the trade-offs between imperceptibility, efficacy, and robustness. The mark module is also a pivotal component in achieving these goals. We have defined the unbiased condition and statistical differences to outline the requirements for mark modules. However, the specific design and optimization of mark modules are not discussed in this paper. Future research could explore advanced mark module designs, advancing towards fully resolving the trade-off challenges in LLM watermarking.

## References

* A Private Watermark for Large Language Models In _The Twelfth International Conference on Learning Representations_.
* Bender et al. (2021) Emily M. Bender, Timnit Gebru, Angelina McMillanMajor, and Shmargaret Shmitchell. 2021. On the dangers of stochastic parrots: Can language models be too big? In _Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency_, FACT '21, page 610-623, New York, NY, USA. Association for Computing Machinery.
* Chen et al. (2023) Liang Chen, Yatao Bian, Yang Deng, Shuaiyi Li, Bingzhe Wu, Peilin Zhao, and Kam-fai Wong. 2023. X-Mark: Towards Lossless Watermarking Through Lexical Redundancy. _Preprint_, arXiv:2311.09832.
* Chiang et al. (2023) Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E. Gonzalez, Ion Stoica, and Eric P. Xing. 2023. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatagpt quality.
* Christ and Gunn (2024) Miranda Christ and Sam Gunn. 2024. Pseudorandom Error-Correcting Codes. _Preprint_, arXiv:2402.09370.
* Christ et al. (2023) Miranda Christ, Sam Gunn, and Or Zamir. 2023. Undetectable Watermarks for Language Models. _Preprint_, arXiv:2306.09194.
* Dedic et al. (2008) Nenad Dedic, Gene Itkis, Leonid Reyzin, and Scott Russell. 2008. Upper and lower bounds on black-box steganography. _Journal of Cryptology_, 22(3):365-394.
* Fairoze et al. (2023) Jaiden Fairoze, Sanjam Garg, Somesh Jha, Saeed Mahloujiifar, Mohammad Mahmoody, and Mingyuan Wang. 2023. Publicly Detectable Watermarking for Language Models. _Preprint_, arXiv:2310.18491.
* Fan et al. (2019) Angela Fan, Yacine Jernite, Ethan Perez, David Grangier, Jason Weston, and Michael Auli. 2019. ELIS: Long form question answering. In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_, pages 3558-3567, Florence, Italy. Association for Computational Linguistics.
* Fang et al. (2017) Tina Fang, Martin Jaggi, and Katerina Argyraki. 2017. Generating steganographic text with LSTMs. In _Proceedings of ACL 2017, Student Research Workshop_, pages 100-106, Vancouver, Canada. Association for Computational Linguistics.
* Fernandez et al. (2023) Pierre Fernandez, Antoine Chaffin, Karim Tit, Vivien Chappelier, and Teddy Furon. 2023. Three Bricks to Consolidate Watermarks for Large Language Models. _Preprint_, arXiv:2308.00113.
* Giboulot and Teddy (2024) Eva Giboulot and Furon Teddy. 2024. WaterMax: Breaking the LLM watermark detectability-robustness-quality trade-off. _Preprint_, arXiv:2403.04808.
* He et al. (2024) Zhiwei He, Binglin Zhou, Hongkun Hao, Aiwei Liu, Xing Wang, Zhaopeng Tu, Zhuosheng Zhang, and Rui Wang. 2024. Can watermarks survive translation? on the cross-lingual consistency of text watermark for large language models. In _Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_, pages 4115-4129, Bangkok, Thailand. Association for Computational Linguistics.
* Hopper et al. (2009) Nicholas Hopper, Luis von Ahn, and John Langford. 2009. Provably secure steganography. _IEEE Transactions on Computers_, 58(5):662-676.
* Hou et al. (2023) Abe Bohan Hou, Jingyu Zhang, Tianxing He, Yichen Wang, Yung-Sung Chuang, Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulia Tsvetkov. 2023. SemStamp: A Semantic Watermark with Paraphrastic Robustness for Text Generation. _Preprint_, arXiv:2310.03991 

Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. 2023. Unbiased Watermark for Large Language Models. _Preprint_, arXiv:2310.10669.
* Katzenbeisser and Petitcolas (1999) Stephan Katzenbeisser and Fabien Petitcolas. 1999. _Information Hiding Techniques for Steganography and Digital Watermaking_, volume 28.
* Kirchenbauer et al. (2023a) John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023a. A Watermark for Large Language Models. In _Proceedings of the 40th International Conference on Machine Learning_, pages 17061-17084. PMLR.
* Krichenbauer et al. (2023b) John Krichenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. 2023b. On the Reliability of Watermarks for Large Language Models. _Preprint_, arXiv:2306.04634.
* Krishna et al. (2023) Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. 2023. Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense. _Preprint_, arXiv:2303.13408.
* Kuditipudi et al. (2023) Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. 2023. Robust Distortion-free Watermarks for Language Models. _Preprint_, arXiv:2307.15593.
* Li et al. (2023) Yuhang Li, Yihan Wang, Zhouxing Shi, and Cho-Jui Hsieh. 2023. Improving the Generation Quality of Watermarked Large Language Models via Word Importance Scoring. _Preprint_, arXiv:2311.09668.
* Liu et al. (2023a) Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. 2023a. A Semantic Invariant Robust Watermark for Large Language Models. _Preprint_, arXiv:2310.06356.
* Liu et al. (2023b) Aiwei Liu, Levi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Lijie Wen, Irwin King, and Philip S. Yu. 2023b. A Survey of Text Watermarking in the Era of Large Language Models. _Preprint_, arXiv:2312.07913.
* Nussbaum et al. (2024) Zach Nussbaum, John X. Morris, Brandon Duderstadt, and Andriy Mulayar. 2024. Nomic embed: Training a reproducible long context text embedder. _Preprint_, arXiv:2402.01613.
* Piet et al. (2023) Julien Piet, Chawin Sitawarin, Vivian Fang, Norman Mu, and David Wagner. 2023. Mark My Words: Analyzing and Evaluating Language Model Watermarks. _Preprint_, arXiv:2312.00273.
* Qu et al. (2024) Wennje Qu, Dong Yin, Zixin He, Wei Zou, Tianyang Tao, Jinyuan Jia, and Jiaheng Zhang. 2024. Provably Robust Multi-bit Watermarking for AI-generated Text via Error Correction Code. _Preprint_, arXiv:2401.16820.
* Ren et al. (2023) Jie Ren, Han Xu, Yiding Liu, Yingqian Cui, Shuaiqiang Wang, Dawei Yin, and Jiliang Tang. 2023. A Robust Semantics-based Watermark for Large Language Model against Paraphrasing. _Preprint_, arXiv:2311.08721.
* Simmons (1984) Gustavus J. Simmons. 1984. _The Prisoners' Problem and the Subliminal Channel_, pages 51-67. Springer US, Boston, MA.
* Team et al. (2024) Gemma Team, Thomas Mesnard, Cassidy Hardin, Robert Dadashi, and Surya Bhupatiraju et al. 2024. Gemma: Open models based on gemini research and technology. _Preprint_, arXiv:2403.08295.
* Touvron et al. (2023) Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, and et al. 2023. LLama 2: Open foundation and fine-tuned chat models. _Preprint_, arXiv:2307.09288.
* Wang et al. (2023) Lean Wang, Wenkai Yang, Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun. 2023. Towards Codable Text Watermarking for Large Language Models. _Preprint_, arXiv:2307.15992.
* Zhao et al. (2023)Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. 2023. Provable Robust Watermarking for AI-Generated Text. [https://arxiv.org/abs/2306.17439v2](https://arxiv.org/abs/2306.17439v2).
* Zhao et al. (2024) Xuandong Zhao, Lei Li, and Yu-Xiang Wang. 2024. Permute-andFlip: An optimally robust and watermarkble decoder for LLMs. _Preprint_, arXiv:2402.05864.

## References

* Bender et al. (2021) Emily M. Bender, Timnit Gebru, Angelina McMillanMajor, and Shmargaret Shmitchell. 2021. On the dangers of stochastic parrots: Can language models be too big? In _Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency_, FACC! '21, page 610-623, New York, NY, USA. Association for Computing Machinery.
* Chen et al. (2023) Liang Chen, Yatao Bian, Yang Deng, Shuaiyi Li, Bingze Wu, Peilin Zhao, and Kam-fai Wong. 2023. X-Mark: Towards Lossless Watermarking Through Lexical Redundancy. _Preprint_, arXiv:2311.09832.
* Chiang et al. (2023) Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Liannin Zheng, Siyuan Zhuang, Yongnao Zhuang, Joseph E. Gonzalez, Ion Stoica, and Eric P. Xing. 2023. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality.
* Christ and Gunn (2024) Miranda Christ and Sam Gunn. 2024. Pseudorandom Error-Correcting Codes. _Preprint_, arXiv:2402.09370.
* Christ et al. (2023) Miranda Christ, Sam Gunn, and Or Zamir. 2023. Undectable Watermarks for Language Models. _Preprint_, arXiv:2306.09194 

Nenad Dedic, Gene Itkis, Leonid Reyzin, and Scott Russell. 2008. Upper and lower bounds on black-box steganography. _Journal of Cryptology_, 22(3):365-394.
* Fairoze et al. [2023] Jaiden Fairoze, Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, and Mingyuan Wang. 2023. Publicly Detectable Watermarking for Language Models. _Preprint_, arXiv:2310.18491.
* Fan et al. [2019] Angela Fan, Yacine Jernite, Ethan Perez, David Grangier, Jason Weston, and Michael Auli. 2019. ELI5: Long form question answering. In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_, pages 3558-3567, Florence, Italy. Association for Computational Linguistics.
* Fang et al. [2017] Tina Fang, Martin Jaggi, and Katerina Argyraki. 2017. Generating steganographic text with LSTMs. In _Proceedings of ACL 2017, Student Research Workshop_, pages 100-106, Vancouver, Canada. Association for Computational Linguistics.
* Fernandez et al. [2023] Pierre Fernandez, Antoine Chaffin, Karim Tit, Vivien Capphelier, and Teddy Furon. 2023. Three Bricks to Consolidate Watermarks for Large Language Models. _Preprint_, arXiv:2308.00113.
* Giboulot and Teddy [2024] Eva Giboulot and Furon Teddy. 2024. WaterMax: Breaking the LLM watermark detectability-robustness-quality trade-off. _Preprint_, arXiv:2403.04808.
* He et al. [2024] Zhiwei He, Binglin Zhou, Hongkun Hao, Aiwei Liu, Xing Wang, Zhaopeng Tu, Zhuosheng Zhang, and Rui Wang. 2024. Can watermarks survive translation? on the cross-lingual consistency of text watermark for large language models. In _Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_, pages 4115-4129, Bangokok, Thailand. Association for Computational Linguistics.
* Hopper et al. [2009] Nicholas Hopper, Luis von Ahn, and John Langford. 2009. Provably secure steganography. _IEEE Transactions on Computers_, 58(5):662-676.
* Hou et al. [2023] Abe Bohan Hou, Jingyu Zhang, Tianxing He, Yichen Wang, Yong-Sung Chuang, Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulia Tsvetkov. 2023. SemStamp: A Semantic Watermark with Paraphrastic Robustness for Text Generation. _Preprint_, arXiv:2310.03991.
* Hu et al. [2023] Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. 2023. Unbiased Watermark for Large Language Models. _Preprint_, arXiv:2310.10669.
* Katzenbeisser and Petitcolas [1999] Stephan Katzenbeisser and Fabien Petitcolas. 1999. _Information Hiding Techniques for Steganography and Digital Watermaking_, volume 28.
* Kirchenbauer et al. [2023a] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023a. A Watermark for Large Language Models. In _Proceedings of the 40th International Conference on Machine Learning_, pages 17061-17084. PMLR.
* Kirchenbauer et al. [2023b] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. 2023b. On the Reliability of Watermarks for Large Language Models. _Preprint_, arXiv:2306.04634.
* Krishna et al. [2023] Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. 2023. Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense. _Preprint_, arXiv:2303.13408.
* Kuditipudi et al. [2023] Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. 2023. Robust Distortion-free Watermarks for Language Models. _Preprint_, arXiv:2307.15593.
* Li et al. [2023] Yuhang Li, Yihan Wang, Zhoxing Shi, and Cho-Jui Hsieh. 2023. Improving the Generation Quality of Watermarked Large Language Models via Word Importance Scoring. _Preprint_, arXiv:2311.09668.
* Liu et al. [2023a] Xiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. 2023a. A Semantic Invariant Robust Watermark for Large Language Models. _Preprint_, arXiv:2310.06356.
* Liu et al. [2023b] Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Lijie Wen, Irwin King, and Philip S. Yu. 2023b. A Survey of Text Watermarking in the Era of Large Language Models. _Preprint_, arXiv:2312.07913.
* Nussbaum et al. [2024] Zach Nussbaum, John X. Morris, Brandon Duderstadt, and Andriy Mulvar. 2024. Nomic embed: Training a reproducible long context text embededer. _Preprint_, arXiv:2402.01613.
* Piet et al. [2023] Julien Piet, Chauwin Sitawarin, Vivian Fang, Norman Mu, and David Wagner. 2023. Mark My Words: Analyzing and Evaluating Language Model Watermarks. _Preprint_, arXiv:2312.00273.
* Qu et al. [2024] Wenjie Qu, Dong Yin, Zixin He, Wei Zou, Tianyang Tao, Jinyuan Jia, and Jiaheng Zhang. 2024. Provably Robust Multi-bit Watermarking for Al-generated Text via Error Correction Code. _Preprint_, arXiv:2401.16820.
* Ren et al. [2023] Jie Ren, Han Xu, Yiding Liu, Yingqian Cui, Shuaiqiang Wang, Dawei Yin, and Jiliang Tang. 2023. A Robust Semantics-based Watermark for Large Language Model against Paraphrasing. _Preprint_, arXiv:2311.08721.
* Simmons [1984] Gustavus J. Simmons. 1984. _The Prisoners' Problem and the Subliminal Channel_, pages 51-67. Springer US, Boston, MA.
* Team et al. [2024] Gemma Team, Thomas Mesnard, Cassidy Hardin, Robert Dadashi, and Surya Bhupatiraju et al. 2024. Gemma: Open models based on gemini research and technology. _Preprint_, arXiv:2403.08295 

Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, and et al. 2023. Llama 2: Open foundation and fine-tuned chat models. _Preprint_, arXiv:2307.09288.
* Wang et al. (2023) Lean Wang, Wenkai Yang, Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun. 2023. Towards Codable Text Watermarking for Large Language Models. _Preprint_, arXiv:2307.15992.
* Zhao et al. (2023) Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. 2023. Provable Robust Watermarking for AI-Generated Text. [https://arxiv.org/abs/2306.17439v2](https://arxiv.org/abs/2306.17439v2).
* Zhao et al. (2024) Xuandong Zhao, Lei Li, and Yu-Xiang Wang. 2024. Permute-and-Flip: An optimally robust and watermarkble decoder for LLMs. _Preprint_, arXiv:2402.05864.

 



\begin{table}
\begin{tabular}{c c l l} \hline \hline Name & \multicolumn{2}{l}{Reweight Function \(F(\mathbf{k}_{i},P_{i})\)} & \multicolumn{1}{r}{Statistic \(S(\hat{\mathbf{k}}_{i},\hat{\mathbf{y}}_{i})\)} & Used in \\ \hline logits-add & \(\forall t\in\Sigma,L_{i}(t)=L_{i}(t)+\tau\cdot\mathbf{1}_{t\in\mathbb{R}_{i}}\) & \(S(\hat{\mathbf{k}}_{i},\hat{\mathbf{y}}_{i})=\frac{\mathbf{1}_{g_{i}\in\xi_{ \hat{\mathbf{k}}_{i}}-\gamma}}{\sqrt{u(s^{\prime})\gamma(1-\gamma)}}\) & KGW(Kirchenbauer et al., 2023a), Unigram(Zhao et al., 2023) \\ \hline inverse-sample & \(\text{u}_{\kappa_{i}}\sim\mathcal{U}[0,1]\) & \\  & \(\forall t\in\Sigma,P_{i}^{\text{perm}}(t)=P_{1}(\pi_{\mathbf{k}_{i}}^{-1}(t))\) & \\  & \(z^{*}=\min\{z\in\mathbb{Z}:\sum_{out(j)\leq s}P_{i}^{\text{perm}}(t)>\mathfrak{ u}_{\kappa_{i}}\}\) & \(S(\hat{\mathbf{k}}_{i},\hat{\mathbf{y}}_{i})=(\mathfrak{u}_{\hat{\mathbf{k}}_{ i}}-\frac{1}{2})\cdot(\frac{\operatorname{mef}(\mathfrak{x}_{\hat{\mathbf{y}}_{i}} (\hat{\mathbf{y}}_{i}))-1}{|\lambda|-1}-\frac{1}{2})\) & ITS(Kudtipudi et al., 2023) \\  & \(t^{*}=\pi_{\mathbf{k}_{i}}^{-1}\circ\text{ord}^{-1}(z^{*})\) & \\  & \(F(\mathbf{k}_{i},P_{i})=\delta(t^{*})\) & \\ \hline gumbel-sample & \(\mathbb{R}_{i}\in\mathbb{E}^{|\mathbb{R}_{i}|},\mathfrak{E}_{\mathbf{k}_{i}, \gamma\sigma}\overset{\text{id}}{\sim}\text{Gumbel(0,1)}\) & \\  & \(f^{*}=\max\max\limits_{i\in\Gamma}\log P_{i}(t)+\mathfrak{B}_{\mathbf{k}_{i}, \sigma\sigma(t)}\) & \(S(\hat{\mathbf{k}}_{i},\hat{\mathbf{y}}_{i})=-\exp(-\mathfrak{B}_{\mathbf{k}_ {i},\sigma\sigma(t),i})\) & EXP(Kadtiupudi et al., 2023) \\  & \(F(\mathbf{k}_{i},P_{i})=\delta(t^{*})\) & \(S(\hat{\mathbf{k}}_{i},\hat{\mathbf{y}}_{i})=\log\hat{P}_{i}(\hat{\mathbf{y} }_{i})-\log P_{i}(\hat{\mathbf{y}}_{i})\) \\ \hline prob-scale & \(\forall t\in\Sigma,P_{i}^{\text{perm}}(t)=P_{1}(\pi_{\mathbf{k}_{i}}^{-1}(t))\) & \(\forall t\in\Sigma,P_{i}^{\text{perm}}(t)=P_{1}(\pi_{\mathbf{k}_{i}}^{-1}(t))\) & EXP(Kadtipudi et al., 2023) \\  & \(\forall t\in\Sigma,C_{i}^{\text{perm}}(t)=\sum_{\mathrm{ref}^{(\prime)}<\mu(t) \times C_{i}^{\text{perm}}}P_{i}^{\text{perm}}(t^{\prime})\) & \(\forall t\in\Sigma,C_{i}^{\text{perm}}(t)=\sum_{\mathrm{ref}^{(\prime)}<\mu(t) \times C_{i}^{\text{perm}}}P_{i}^{\text{perm}}(t^{\prime})\) & \\  & \(\forall t\in\Sigma,C_{i}(t)=\min(2C_{i}^{\text{perm}}(t),1)\) & \(\forall t\in\Sigma,\hat{C}_{i}(t)=\min(2C_{i}^{\text{perm}}(t),1)\) & Gamma(Kudtipudi et al., 2023) \\  & \(\forall t\in\Sigma,P_{i}^{\text{perm}}(t)=C_{i}(t)-C_{i}(\mathsf{ord}(t)-1)\) & \(\forall t\in\Sigma,\hat{P}_{i}^{\text{perm}}(t)=\hat{C}_{i}(t)-\zeta_{i}( \mathsf{ord}^{-1}(\mathsf{ord}(t)-1))\) & Gamma(Kudtipudi et al., 2023) \\  & \(\forall t\in\Sigma,P_{i}(t)=\hat{P}_{i}^{\text{perm}}(\pi_{\mathbf{k}_{i}}(t))\) & \(\forall t\in\Sigma,\hat{P}_{i}(t)=P_{i}^{\text{perm}}(\tilde{\mathbf{x}}_{ \hat{\mathbf{y}}_{i}}(t))\) & \\  & \(F(\mathbf{k}_{i},P_{i})=\hat{P}_{i}\) & \(S(\hat{\mathbf{k}}_{i},\hat{\mathbf{y}}_{i})=\log\hat{P}_{i}(\hat{\mathbf{y} }_{i})-\log P_{i}(\hat{\mathbf{y}}_{i})\) & \\ \hline \hline \end{tabular}
\end{table}
Table 4: Mark modules of typical watermarks. \(P_{i}(\cdot)\), \(C_{i}(\cdot)\) and \(L_{i}(\cdot)\) are probability distribution function, cumulative distribution function and logit function of the \(i\)-th step generation. \(ord:\Sigma\rightarrow\{1,...,|\Sigma|\}\) is a function mapping each token to its order in the vocabulary. \(\delta(t)\) represents a degeneration distribution taking only one value \(t\). Subscript “\(\mathbf{k}_{i}\)” indicates a random variable seeded by \(\mathbf{k}_{i}\). For example, \(\mathcal{G}_{\mathbf{k}_{i}}\) is a random \(\gamma\) ratio partition of vocabulary, \(\pi_{\mathbf{k}_{i}}:\Sigma\rightarrow\Sigma\) represents a random permutation over the vocabulary. Superscript ”\(perm\)” indicates a distribution function after vocabulary permutation, such as \(P^{\text{perm}}\). Other notations like \(\gamma,\tau\) are fixed hyper-parameters.

\begin{table}
\begin{tabular}{c c c c} \hline \hline Name & Key Sampling \(\mathbf{k}_{i}\) & Key Restoration \(\hat{\mathbf{k}}_{i}\) & Used in \\ \hline greedy-search & \(\underset{\mathbf{k}}{\Xi}=\{\xi^{1},...,\xi^{K}\}\overset{i,d}{\sim} \mathcal{U}(\mathbb{R}^{L})\) & \(d_{\text{full}}(\xi,\hat{\mathbf{y}})=\max\{d_{\text{full}}(\xi_{2},\hat{ \mathbf{y}}_{2})+S(\xi_{1},\hat{\mathbf{y}}_{1})\), & ITS(Kudtipudi et al., 2023), EXP(Kudtipudi et al., 2023) \\  & \(d_{\text{full}}(\xi,\hat{\mathbf{y}}_{2})-\eta\), & \\  & \(d_{\text{full}}(\xi_{2},\hat{\mathbf{y}})-\eta\}\) & \\ \hline context-hash & \(\mathbf{k}_{i}=\text{hash}(\mathbf{y}_{i-ci-1})\) & \(\mathbf{k}_{i}=\text{hash}(\hat{\mathbf{y}}_{i-ci-1})\) & KGW(Kirchenbauer et al., 2023a), Gamma(Hu et al., 2023), Delta(Hu et al., 2023) \\ \hline fixed-constant & \(k\sim\mathcal{U}(\mathbb{R})\); \(\mathbf{k}_{i}=k\) & \(\mathbf{k}_{i}=k\) & Unigram(Zhao et al., 2023) \\ \hline \hline \end{tabular}
\end{table}
Table 5: Key modules of typical watermarks. Both \(\Xi\) and \(k\) are initialized once, and then fixed on every generation. \(L\) is the maximum length of LLM. \(N,c,\eta\) are all fixed hyper-parameters.



Typical Watermark Designs

Here we list mark and key modules of typical watermarking methods in Table 4 and 5.

 

Algorithms of WaterPool

In this section, we present the pseudo codes for EXP-Pool, ITS-Pool and KGW-Pool. We highlight the codes WaterPool invokes in with triangle comments (\(\rhd\)), while the rest of the code remains unchanged from the original watermarking techniques. The invocation code of WaterPool is little, demonstrating the ease of its integration with existing watermarking methods. The specific implementation of modification function \(F\) and per-token statistic \(S\) used in the pseudo codes can be found in Table 4.

```
0:Input:\(N\) rounds queries \(\{\mathbf{x}^{n}\}_{n=1}^{N}\).
0:\(N\) rounds outputs \(\{\mathbf{y}^{n}\}_{n=1}^{N}\), vector database \(D\).
1:\(D\leftarrow\{\}\)\(\triangleright\) Initialize vector database
2:/*Multi-round queries */
3:for\(n\in\{1,...,N\}\)do
4: Input current round prompt \(\mathbf{x}^{n}\)
5:\(\mathbf{y}^{n}\leftarrow\text{empty string}\)
6:\(\mathbf{k}^{n}\sim\mathcal{U}(\mathbb{R}^{L})\)\(\triangleright\) Sample key
7:/*Auto-regressive generation */
8:for\(i\in 1,...,L\)do
9:\(P_{i}\gets P_{M}(\cdot|\mathbf{x}^{n},\mathbf{y}^{n}_{<i})\)
10:\(\hat{P}_{i}\gets F_{exp}(\mathbf{k}^{n}_{i},P_{i})\)
11:\(\mathbf{y}^{n}_{i}\sim\hat{P}_{i}\)
12:endfor
13:\(D\gets D\cup\{(Enc(\mathbf{y}^{n}),\mathbf{k}^{n})\}\)\(\triangleright\) Store key
14: Output current round generation \(\mathbf{y}^{n}\)
15:endfor
```

**Algorithm 1** EXP-Pool Generation
 

```
1:Input:\(N\) rounds queries \(\{\mathbf{x}^{n}\}_{n=1}^{N}\).
2:Output:\(N\) rounds outputs \(\{\mathbf{y}^{n}\}_{n=1}^{N}\), vector database \(D\).
3:\(D\leftarrow\{\}\)\(\triangleright\) Initialize vector database
4:/*Multi-round queries*/
5:for\(n\in\{1,...,N\}\)do
6: Input current round prompt \(\mathbf{x}^{n}\)
7:\(\mathbf{y}^{n}\leftarrow\text{empty string}\)
8:\(\mathbf{k}^{n}\sim\mathcal{U}(\mathbb{R}^{L})\)\(\triangleright\) Sample key
9:/*Auto-regressive generation*/
10:for\(i\in 1,...,L\)do
11:\(P_{i}\gets P_{M}(\cdot|\mathbf{x}^{n},\mathbf{y}_{<i}^{n})\)
12:\(\hat{P}_{i}\gets F_{its}(\mathbf{k}_{i}^{n},P_{i})\)
13:\(\mathbf{y}_{i}^{n}\sim\hat{P}_{i}\)
14:endfor
15:\(D\gets D\cup\{(Enc(\mathbf{y}^{n}),\mathbf{k}^{n})\}\)\(\triangleright\) Store key
16: Output current round generation \(\mathbf{y}^{n}\)
17:endfor
```

**Algorithm 3** ITS-Pool Generation

```
1:Params: vector database \(D=\{(Enc(\mathbf{y}^{n}),\mathbf{k}^{n})\}_{n}^{N}\), embedding model \(Enc(\cdot)\), permutation resample times \(T\), edit penalty \(\eta\), per-token statistic of ITS \(S_{its}(\cdot,\cdot)\).
2:Input: candidate text \(\hat{\mathbf{y}}\)
3:Output:\(p\)-value of being watermarked \(\hat{p}\)
4:/*Aggregation of per-token statistic \(s_{i}\) with edit distance trick*/
5:procedure\(d_{\text{edit}}(\mathbf{k},\mathbf{y})\):
6:if\(\operatorname{len}(\mathbf{k})=0\)then
7:return\(-\eta\cdot\operatorname{len}(\mathbf{y})\)
8:else if\(\operatorname{len}(\mathbf{y})=0\)then
9:return\(-\eta\cdot\operatorname{len}(\mathbf{k})\)
10:else
11:\(s_{i}\gets S_{its}(\mathbf{k}_{1},\mathbf{y}_{2})\)
12:return\(\max\{d_{\text{edit}}(\mathbf{k}_{2:},\mathbf{y}_{2:})+s_{i},d_{\text{edit}}( \mathbf{k}_{2:},\mathbf{y})-\eta,d_{\text{edit}}(\mathbf{k},\mathbf{y}_{2:})-\eta\}\)
13:endif
14:endprocedure
15:\(n^{*}\leftarrow\arg\max_{n}\text{sim}(Enc(\mathbf{y}^{n}),Enc(\hat{\mathbf{ y}}))\)\(\triangleright\) Retrieve key from vector database
16:\(\hat{\mathbf{k}}\leftarrow\mathbf{k}^{n^{*}}\)
17:\(\hat{V}\gets d_{edit}(\hat{\mathbf{k}},\hat{\mathbf{y}})\)
18:/*Permutation test*/
19:for\(t\in 1,...,T\)do
20:\(\mathbf{k}^{t}\sim\mathcal{U}(\mathbb{R}^{L})\)
21:\(V^{t}\gets d_{edit}(\mathbf{k}^{t},\hat{\mathbf{y}})\)
22:endfor
23:/*Calculate \(p\)-value*/
24:\(\hat{p}\leftarrow\frac{1}{T+1}\left(1+\sum_{t}\mathbf{1}_{\hat{V}>V^{t}}\right)\)
```

**Algorithm 4** ITS-Pool Detection 

```
0:\(N\) rounds queries \(\{\mathbf{x}^{n}\}_{n=1}^{N}\).
0:\(N\) rounds outputs \(\{\mathbf{y}^{n}\}_{n=1}^{N}\), vector database \(D\).
1:\(D\leftarrow\{\}\)\(\triangleright\) Initialize vector database
2:/* Multi-round queries */
3:for\(n\in\{1,...,N\}\)do
4: Input current round prompt \(\mathbf{x}^{n}\)
5:\(\mathbf{y}^{n}\leftarrow\text{empty string}\)
6:\(k^{n}\sim\mathcal{U}(\mathbb{R})\)\(\triangleright\) Sample key
7:/* Auto-regressive generation */
8:for\(i\in 1,...,L\)do
9:\(P_{i}\gets P_{M}(\cdot|\mathbf{x}^{n},\mathbf{y}_{<i}^{n})\)
10:\(\hat{P}_{i}\gets F_{kgw}(k^{n},P_{i})\)
11:\(\mathbf{y}_{i}^{n}\sim\hat{P}_{i}\)
12:endfor
13:\(D\gets D+\{(Enc(\mathbf{y}^{n}),k^{n})\}\)\(\triangleright\) Store key
14: Output current round generation \(\mathbf{y}^{n}\)
15:endfor
```

**Algorithm 5** KGW-Pool Generation

```
0:\(p\)-value of being watermarked \(\hat{p}\)
1:\(n^{*}\leftarrow\operatorname*{arg\,max}_{n}\text{sim}(Enc(\mathbf{y}^{n}), Enc(\hat{\mathbf{y}}))\)\(\triangleright\) Retrieve key from vector database
2:\(\hat{k}\gets k^{n^{*}}\)
3:/* Aggregation of per-token statistic \(s_{i}\) via summation */
4:for\(i\in 1,...,\text{len}(\hat{\mathbf{y}})\) do
5:\(s_{i}\gets S_{kgw}(\hat{k},\hat{\mathbf{y}}_{i})\)
6:endfor
7:/* Calculation of \(z\)-score */
8:\(z\leftarrow\sum_{i}s_{i}\)
9:/* Calculation of \(p\)-value */
10:\(p\gets 1-\Phi(z)\)
```

**Algorithm 6** KGW-Pool Detection 



### Theoretical Proofs

#### Proof of Proposition 3.1

Proof.: Recall that the imperceptibility is defined as

\[\prod_{i,n}P_{M}(\mathbf{y}^{n}_{i}|\mathbf{x}^{n},\mathbf{y}^{n}_{< i})=\mathbb{E}_{\mathbf{k}^{1},...,\mathbf{k}^{N}}[\prod_{i,n}F(\mathbf{k}^{n}_{i}, P^{n}_{i})(\mathbf{y}^{n}_{i})]\]

Given that (1) \(\mathbf{k}^{1},...,\mathbf{k}^{N}\overset{i,i,d}{\sim}\mathcal{U}(\mathbb{R}^ {L})\); (2) \(P_{M}(\cdot|\mathbf{x}^{n},\mathbf{y}^{n}_{<i})=\mathbb{E}_{\mathbf{k}_{i} \sim\mathcal{U}(\mathbb{R})}[F(\mathbf{k}_{i},P_{i})]\). We have,

 RHS \[=\mathbb{E}_{\mathbf{k}^{-}\sim\mathcal{U}(\mathbb{R}^{L})}\! \sum_{\mathbf{k}^{N}\sim\mathcal{U}(\mathbb{R}^{L})}[\prod_{i,n}F(\mathbf{k}^{ n}_{i},P^{n}_{i})(\mathbf{y}^{n}_{i})]\] \[=\prod_{m}\mathbb{E}_{\mathbf{k}^{n}\sim\mathcal{U}(\mathbb{R}^ {L})}[\prod_{i}F(\mathbf{k}^{n}_{i},P^{n}_{i})(\mathbf{y}^{n}_{i})]\] \[=\prod_{m}(\mathbb{E}_{\mathbf{k}^{n}_{i}\sim\mathcal{U}(\mathbb{ R})}...\mathbb{E}_{\mathbf{k}^{n}_{i}\sim\mathcal{U}(\mathbb{R})}[\prod_{i} F(\mathbf{k}^{n}_{i},P^{n}_{i})(\mathbf{y}^{n}_{i})])\] \[=\prod_{m}(\prod_{i}\mathbb{E}_{\mathbf{k}^{n}_{i}\sim\mathcal{ U}(\mathbb{R})}[F(\mathbf{k}^{n}_{i},P^{n}_{i})(\mathbf{y}^{n}_{i})])\] \[=\prod_{n,i}P_{M}(\mathbf{y}^{n}_{i}|\mathbf{x}^{n},\mathbf{y}^{ n}_{<i})=\text{LIHS}\]

#### Proof of Proposition 3.2 (EXP-Pool's Imperceptibility)

We first recall the distribution modification process of EXP-Pool. Given a private key \(\mathbf{k}_{i}\) as seed, a standard Gumbel vector \(\mathbf{g}_{\mathbf{k}_{i}}\in\mathbb{R}^{|\Sigma|}\) is sampled. Gumbel-max sampling process on the next token distribution \(P_{i}(\cdot):=P_{M}(\cdot|\mathbf{x}^{n},\mathbf{y}^{n}_{<i})\) via \(\mathbf{g}_{\mathbf{k}_{i}}\) samples an output token \(t^{*}\). The degenerate distribution of \(t^{*}\) is then returned.

**Lemma C.1**.: _The mark module of EXP-Pool satisfies the unbiased condition, i.e._

\[P_{M}(\cdot|\mathbf{x}^{n},\mathbf{y}^{n}_{<i})=\mathbb{E}_{ \mathbf{k}_{i}\sim\mathcal{U}(\mathbb{R})}[F_{exp}(\mathbf{k}_{i},P_{i})]\]

Proof.: For simplicity, we denote \(P_{M}(t|\mathbf{x}^{n},\mathbf{y}^{n}_{<i})\) as \(P_{i}(t)\) and \(g_{t}\) as the Gumbel variable in \(\mathbf{g}_{\mathbf{k}_{i}}\) corresponding to the token \(t\). Since The lemma holds if and only if for any token \(t\in\Sigma\),

\[P_{M}(t|\mathbf{x}^{n},\mathbf{y}^{n}_{<i})=\mathbb{E}_{\mathbf{ k}_{i}\sim\mathcal{U}(0,1)}[\mathbf{1}_{\log P_{i}(t)+g_{t}}\\ \geq\log P_{i}(t^{*})+g_{t^{\prime}},\forall t^{\prime}\in\Sigma]\]

This equation follows as

 RHS \[=\!P(\log P_{i}(t)+g_{t}\!\geq\!\log P_{i}(t^{\prime})+g_{t^{ \prime}},\forall t^{\prime}\!\in\!\Sigma)\] \[=\!P(\exp(-\exp(-g_{t^{\prime}}))\!\leq\!\exp(-\exp(-g_{t}))^{P_{i }(t^{\prime})/P_{i}(t)},\] \[\qquad\qquad\qquad\qquad\quad\forall t^{\prime}\!\in\!\Sigma)\] \[=\!\int_{0}^{1}\!P(u_{t^{\prime}}\!\leq\!u_{t}^{P_{i}(t^{\prime})/ P_{i}(t)},\forall t^{\prime}\!\in\!\Sigma|u_{t})p(u_{t})du_{t}\] \[=\!\int_{0}^{1}\prod_{t^{\prime}\in\Sigma}P(u_{t^{\prime}}\!\leq\! u_{t}^{P_{i}(t^{\prime})/P_{i}(t)}|u_{t})p(u_{t})du_{t}\] \[=\!\int_{0}^{1}\!u_{t}^{\sum_{t^{\prime}}P_{i}(t^{\prime})/P_{i}( t)}du_{t}\] \[=\!P_{i}(t)\!=\!\mathrm{ LHS}\]

,where \(u_{t}:=\exp(-\exp(-g_{t}))\). We have \(u_{t}\sim\mathcal{U}(0,1)\), since \(g_{t}\sim\mbox{Gumbel}(0,1)\). 

From the unbiased condition and the independent condition of WaterPool, the imperceptibility of EXP-Pool immediately follows according to Proposition 3.1.

#### Proof of Proposition 3.2 (ITS-Pool's Imperceptibility)

We first recall the distribution modification process of ITS-Pool. Given a private key \(\mathbf{k}_{i}\) as the random seed, a random permutation \(\pi_{\mathbf{k}_{i}}:\Sigma\rightarrow\Sigma\) and a uniform variable \(\mathsf{u}_{\mathbf{k}_{i}}\sim\mathcal{U}([0,1])\) are sampled. ITS conducts an inverse transform sampling on the permuted distribution \(P^{\textrm{perm}}\) via u. The sampled token \(t\) is transformed back to \(t^{*}\) via inverse permutation \(\pi_{\mathbf{k}_{i}}^{-1}\). The degenerate distribution of \(t^{*}\) is then returned.

**Lemma C.2**.: _The mark module of ITS satisfies the unbiased condition, i.e._

\[P_{M}(\cdot|\mathbf{x}^{n},\mathbf{y}^{n}_{<i})=\mathbb{E}_{ \mathbf{k}_{i}\sim\mathcal{U}(\mathbb{R})}[F_{its}(\mathbf{k}_{i},P_{i})]\]

Proof.: The lemma follows if that given any permutation \(\pi\) and any output token \(t^{*}\),

\[P_{M}(\pi(t^{*})|\mathbf{x}^{n},\mathbf{y}^{n}_{<i})=\mathbb{ E}_{\mathbf{w}_{\mathbf{k}_{i}}\sim\mathcal{U}([0,1])}[\\ \mathbf{1}_{\pi(t^{*})}\mbox{ is sampled via inverse transform sampling}]\]

This equation certainly holds because of the definition of inverse transform sampling, i.e.

 RHS \[=\!P(\mathsf{u}_{\mathbf{k}_{i}}\!\in\![P_{M}(\{t^{\prime}\!\cdot \!\textnormal{ord}(t^{\prime})\!\leq\!\textnormal{ord}\circ\pi(t^{*})\}| \mathbf{x}^{n},\mathbf{y}^{n}_{<i}),\] \[P_{M}(\{t^{\prime}\!\cdot\!\textnormal{ord}(t^{\prime})\!\leq\! \textnormal{ord}\circ\pi(t^{*})\}|\mathbf{x}^{n},\mathbf{y}^{n}_{<i})])\] \[=\!P_{M}(\pi(t^{*})|\mathbf{x}^{n},\mathbf{y}^{n}_{<i})\!=\!\! \mathrm{ LHS}\]

,where \(ord:\Sigma\rightarrow|\Sigma|\) is a function maps each token to its order in vocabulary. 

From the unbiased condition and the independent condition of WaterPool, the imperceptibility of ITS-Pool immediately follows according to Proposition 3.1.

#### Proof of Proposition 3.3 (EXP-Pool's Efficacy)

We first recall the mark module of EXP-Pool (_gumbel-sample_ in Table 4). During generation, the modification function \(F_{exp}(\mathbf{k}_{i},P_{i})\) takes a private key \(\mathbf{k}_{i}\) as seed to sample a standard Gumbel vector. A Gumbel-max sampling is then conduct to sample an output token, of which the degenerate distribution is returned. During detection, the mark module takes in a restored pri

vate key \({\bf k}_{i}\) to generate a restored Gumbel vector \({\bf g}_{{\hat{\mathbf{k}}}_{i}}\in\mathbb{R}^{|\Sigma|},{\bf g}_{{\hat{\mathbf{ k}}}_{i,j}}\sim\text{Gumbel}(0,1)\). The per-token statistic \(S_{exp}({\bf k}_{i},{\bf y}_{i})=-\exp(-{\bf g}_{{\hat{\mathbf{k}}}_{i},\text{ ord}({\bf y}_{i})})\) is then calculated, where \(\text{ord}:\Sigma\rightarrow\{1,...,|\Sigma|\}\) is a function maps each token to the its order in the vocabulary.

For simplicity, we denote \(g_{t}\) as the Gumbel variable \({\bf g}_{{\bf k}_{i},\text{ord}(t)}\) corresponding to the token \(t\).

We begin by proving that given a candidate token \({\bf y}_{i}\), the expectation of per-token statistic only relies on the original distribution \(P_{i}({\bf y}_{i})\) if \({\bf y}_{i}\) is sampled from the modified distribution seeded by \({\bf k}_{i}\). It can be formalized as the following lemma.

**Lemma C.3**.: _Given a prefix \({\bf y}_{<i}\) and a token \({\bf y}_{i}\), for a private key \({\bf k}_{i}\sim\mathcal{U}(\mathbb{R})\), if \({\bf y}_{i}\) is sampled from \(F_{exp}({\bf k}_{i},P_{M}(\cdot|{\bf y}_{<i}))\), then \(\mathbb{E}_{{\bf k}_{i}\sim\mathbb{R}}[S_{exp}({\bf k}_{i},{\bf y}_{i})|{\bf y }_{i},{\bf y}_{<i}]=-P_{i}({\bf y}_{i})\)._

Proof.: The randomness of \({\bf k}_{i}\) affects the statistic via the Gumbel vector \({\bf g}_{{\bf k}_{i}}=[g_{t}]_{t\in\Sigma}\). For simplicity, we only consider the randomness of \({\bf g}_{{\bf k}_{i}}\) instead of \({\bf k}_{i}\).

We first calculate the cumulative distribution function of \(S_{exp}({\bf k}_{i},{\bf y}_{i})|{\bf y}_{i},{\bf y}_{<i}\).

\[P(S_{exp}({\bf k}_{i},{\bf y}_{i})\leq v|{\bf y}_{i},{\bf y}_{< i})\] \[= P(g_{{\bf y}_{i}}\leq-\log(-v)|{\bf y}_{i},{\bf y}_{<i})\] \[\stackrel{{(\ref{eq:p_def})}}{{=}}P(\bigcap_{t\in \Sigma}g_{t}+\log P_{i}(t)\leq g_{{\bf y}_{i}}+\log P_{i}({\bf y}_{i})\] \[\qquad\qquad\leq-\log(-v)+\log P_{i}({\bf y}_{i})~{}|~{}{\bf y}_{ i},{\bf y}_{<i})\] \[\stackrel{{(\ref{eq:p_def})}}{{=}}\prod_{t\in\Sigma} \exp(-v\frac{P_{i}(t)}{P_{i}({\bf y}_{i})})\] \[= \exp(-v/P_{i}({\bf y}_{i}))\]

, where the equation \((\ref{eq:p_def})\) follows from the definition of Gumbel max sampling; \((\ref{eq:p_def})\) follows from \(g_{t}\sim\text{Gumbel}(0,1)\). Therefore, \(-S_{exp}({\bf k}_{i},{\bf y}_{i})|{\bf y}_{i},{\bf y}_{<i}\sim Exp(1/P_{i}({ \bf y}_{i}))\). The lemma follows immediately by calculating the expectation. 

On the contrary, if \({\bf y}_{i}\) is not sampled from modified distribution seeded by \({\bf k}_{i}\),

\[P(S_{exp}({\bf k}_{i},{\bf y}_{i})\underline{\times}v|{\bf y}_{i},{\bf y}_{<i} )\!=\!P(g_{{\bf y}_{i}}\underline{\times}\!-\!\log(-v))\!=\!\exp(v)\]

from which we have

\[-S_{exp}({\bf k}_{i},{\bf y}_{i})|{\bf y}_{i},{\bf y}_{<i}\sim Exp(1)\] \[\mathbb{E}_{{\bf k}_{i}\sim\mathcal{U}(\mathbb{R})}[S_{exp}({\bf k }_{i},{\bf y}_{i})|{\bf y}_{i},{\bf y}_{<i}]=-1\]

Eventually, we can guaranteed the statistical difference of EXP-Pool given the prefix \({\bf y}_{<i}\),

\[\mathbb{E}[S_{exp}({\bf k}_{i},{\bf y}_{i})|{\bf y}_{<i},H_{1}]\!- \!\mathbb{E}[S_{exp}({\bf k}_{i},{\bf y}_{i})|{\bf y}_{<i},\!H_{0}]\] \[= \mathbb{E}_{{\bf y}_{i},{\bf k}_{i}}[S_{exp}({\bf\hat{K}}_{i},{\bf y }_{i})|{\bf y}_{<i},H_{1},{\hat{\bf K}}_{i}\!\!=\!{\bf k}_{i}]\!\cdot\!p_{ recall}\] \[+\mathbb{E}_{{\bf y}_{i},{\bf k}_{i}}[S_{exp}({\bf\hat{K}}_{i},{ \bf y}_{i})|{\bf y}_{<i},H_{1},{\hat{\bf k}}_{i}\!\neq\!{\bf k}_{i}]\!\cdot\!(1 \!-\!p_{recall})\!+\!1\] \[= \mathbb{E}_{{\bf y}_{i}}[-P_{i}({\bf y}_{i})|{\bf y}_{<i}]\!\cdot\! p_{recall}\!-\!(1\!-\!p_{recall})\!+\!1\] \[= \sum_{{\bf y}_{i}\in\Sigma}(1\!-\!P_{i}({\bf y}_{i}))P_{i}({\bf y}_ {i})\!\cdot\!p_{recult}\!\!:=\!\phi_{exp}({\bf p}^{i})\!\cdot\!p_{recall}\]

, where \(\phi_{exp}({\bf p}^{i})\) is only relevant to probability vector \({\mathbf{p}}^{i}\) of \(P_{M}(\cdot|{\bf y}_{<i})\), representing watermarking potentials, and \(p_{recall}\) is the recall of the retriever in EXP-Pool.

### Proof of Proposition 3.3 (ITS-Pool's Efficacy)

We first recall the mark module of ITS-Pool (_inverse-sample_ in Table 4). During generation, the modification function \(F_{its}({\bf k}_{i},P_{i})\) takes a private key \({\bf k}_{i}\) as seed to sample a standard uniform variable and a random permutation. An inverse transform sampling is then conduct on the permuted distribution to sample an output token, of which the degenerate distribution is returned. During detection, the mark module takes in a restored private key \({\hat{\mathbf{k}}}_{i}\) to restore a standard uniform variable \({\bf u}_{{\hat{\mathbf{k}}}_{i}}\sim\mathcal{U}(0,1)\) and a random permutation \(\pi_{{\hat{\mathbf{k}}}_{i}}:\Sigma\rightarrow\Sigma\). The per-token statistic \(S_{its}({\hat{\mathbf{k}}}_{i},{\bf y}_{i})=({\bf u}_{{\hat{\mathbf{k}}}_{i}}- \frac{1}{2})(\frac{\text{ord}(\pi_{{\hat{\mathbf{k}}}_{i}}({\bf y}_{i}))-1}{| \Sigma|-1}-\frac{1}{2})\) is then calculated, where \(\text{ord}:\Sigma\rightarrow\{1,...,|\Sigma|\}\) is a function maps each token to the its order in the vocabulary.

We begin by proving that given a candidate token \({\bf y}_{i}\), the expectation of per-token statistic only relies on the original distribution \(P_{i}({\bf y}_{i})\) if \({\bf y}_{i}\) is sampled from the modified distribution seeded by \({\bf k}_{i}\) (i.e. the alternative hypothesis \(H_{1}\)). It can be formalized as the following lemma11.

Footnote 11: It is based on Lemma B.1 in (Kuditipudi et al., 2023)

**Lemma C.4**.: _Given a prefix \({\bf y}_{<i}\) and a token \({\bf y}_{i}\), for a private key \({\bf k}_{i}\sim\mathcal{U}(\mathbb{R})\), if \({\bf y}_{i}\) is sampled from \(F_{its}({\bf k}_{i},P_{M}(\cdot|{\bf y}_{<i}))\), then \(\mathbb{E}_{{\bf k}_{i}\sim\mathcal{U}(\mathbb{R})}[S_{its}({\bf k}_{i},{\bf y}_{i} )|{\bf y}_{i},{\bf y}_{<i}]=C_{0}\cdot(1-P_{i}({\bf y}_{i}))\), where \(C_{0}\) is a constant relevant to vocabulary size \(|\Sigma|\)._

Proof.: The randomness of \({\bf k}_{i}\) affects the statistic via the uniform variable \({\bf u}_{{\bf k}_{i}}\) and the permutation \(\pi_{{\bf k}_{i}}\). For simplicity, we omit the subscript \({\bf k}_{i}\) and only consider the randomness 

We show that \(\pi|{\bf y}_{i},{\bf y}_{<i}\) is a uniform random variable over the permutation space.

\[P(\pi|{\bf y}_{i},{\bf y}_{<i})=\frac{P({\bf y}_{i}|\pi,{\bf y}_{<i}) P(\pi)}{P({\bf y}_{i}|{\bf y}_{<i})}=P(\pi)\]

, where the second equation follows from that permutation won't affect the inverse transform sampling (see AppendixC.3)

We also prove that \({\sf u}|\pi,{\bf y}_{i},{\bf y}_{<i}\) is a uniform random variable. We define the interval of \({\bf y}_{i}\) given \(\pi\) in inverse transform sampling during ITS generation,

\[I({\bf y}_{i},\pi) = [P_{i}(\{t^{\prime}:\text{ord}(t^{\prime})<\text{ord}\circ\pi({ \bf y}_{i})\}),\] \[P_{i}(\{t^{\prime}:\text{ord}(t^{\prime})\leq\text{ord}\circ\pi({ \bf y}_{i})\})]\]

It is evident that \(|I({\bf y}_{i},\pi)=P_{i}({\bf y}_{i})|\). Then for any interval \(I\subset[0,1]\) we have

\[P({\sf u}\in I|{\bf y}_{i},\pi,{\bf y}_{<i})=\frac{P({\bf y}_{ i},{\sf u}\in I|\pi,{\bf y}_{<i})}{P({\bf y}_{i}|\pi,{\bf y}_{<i})}=\frac{|I \cap I({\bf y}_{i},\pi)|}{|I({\bf y}_{i},\pi)|}\] So \({\sf u}|\pi,{\bf y}_{i},{\bf y}_{<i}\sim\mathcal{U}(I({\bf y}_{i},\pi))\). Then we have, \[\mathbb{E}[{\sf u}|{\bf y}_{i},\pi({\bf y}_{i}),{\bf y}_{<i}]\] \[= \mathbb{E}\bigg{[}P_{i}(\{t^{\prime}:\text{ord}(t^{\prime})<\text {ord}\circ\pi({\bf y}_{i})\})+\frac{|I({\bf y}_{i},\pi)|}{2}\bigg{|}{\bf y}_{i },\pi({\bf y}_{i}),{\bf y}_{<i}]\] \[= \frac{(\pi({\bf y}_{i})-1)}{|\Sigma|-1}\cdot(1-P_{i}({\bf y}_{i}) )+\frac{P_{i}({\bf y}_{i})}{2}\] \[= \frac{1}{2}+(\frac{\pi({\bf y}_{i})-1}{|\Sigma|-1}-\frac{1}{2})(1 -P_{i}({\bf y}_{i}))\] It is evident that \(\mathbb{E}[{\sf u}]=\frac{1}{2}\) and \(\mathbb{E}[\frac{(\pi({\bf y}_{i})-1)}{|\Sigma|-1}]=\frac{1}{2}\), since they are both uniform standard variables. Therefore, \(S_{its}({\bf k}_{i},{\bf y}_{i})\) essentially calculates the covariance between \({\sf u}\) and \(\frac{\pi({\bf y}_{i})-1}{|\Sigma|-1}\), which is tractable as following,

\[\mathbb{E}_{{\bf k}_{i}}[S_{itts}({\bf k}_{i},{\bf y}_{i})|{\bf y} _{i},{\bf y}_{<i}]\] \[= \text{Cov}\Big{(}u,\frac{\pi({\bf y}_{i})-1}{|\Sigma|-1}\Big{|}_{ {\bf y}_{i},{\bf y}_{<i}}\Big{)}\] \[= ({\sf u}-\frac{1}{2})(\frac{\pi({\bf y}_{i})-1}{|\Sigma|-1}-\frac {1}{2})\cdot P({\sf u},\pi({\bf y}_{i})|{\bf y}_{i},{\bf y}_{<i})\] \[= \mathbb{E}[{\sf u}-\frac{1}{2}|{\bf y}_{i},\pi({\bf y}_{i}),{\bf y }_{<i}]\cdot(\frac{\pi({\bf y}_{i})-1}{|\Sigma|-1}-\frac{1}{2})\cdot P(\pi({ \bf y}_{i})|{\bf y}_{i},{\bf y}_{<i})\] \[= (1-P_{i}({\bf y}_{i}))\cdot(\frac{\pi({\bf y}_{i})-1}{|\Sigma|-1} -\frac{1}{2})^{2}\cdot P(\pi({\bf y}_{i})|{\bf y}_{i},{\bf y}_{<i})\] \[= (1-P_{i}({\bf y}_{i}))\cdot\text{Var}\Big{(}\frac{\pi({\bf y}_{i}) -1}{|\Sigma|-1}\Big{|}{\bf y}_{i},{\bf y}_{<i}\Big{)}\] \[= C_{0}\cdot(1-P_{i}({\bf y}_{i}))\]

,where \(C_{0}=\text{Var}\left(\frac{\pi({\bf y}_{i})-1}{|\Sigma|-1}\right|{\bf y}_{i},{ \bf y}_{<i}\Big{)}\) is a constant since \(\pi|{\bf y}_{i},{\bf y}_{<i}\) is uniform over the space of vocabulary permutation. 

On the contrary, if \({\bf y}_{i}\) is not sampled from modified distribution seeded by \({\bf k}_{i}\), \(\mathbb{E}_{{\bf k}_{i}}[S_{its}({\bf k}_{i},{\bf y}_{i})|{\bf y}_{i},{\bf y}_{< i}]=\)Cov\(({\sf u},\frac{\pi({\bf y}_{i})-1}{|\Sigma|-1}|{\bf y}_{i},{\bf y}_{<i})\) still holds. Now that \({\bf k}_{i}\) and \({\bf y}_{i}\) are independent, \(\mathbb{E}_{{\bf k}_{i}}[S_{its}({\bf k}_{i},{\bf y}_{i})|{\bf y}_{i},{\bf y}_{< i}]=0\) trivially. Therefore, \(\mathbb{E}_{{\bf y}_{i},{\bf k}_{i}}[S_{its}({\bf k}_{i},{\bf y}_{i})|{\bf y}_{<i},H_{0}]=0\) follows immediately.

Under the alternative hypothesis \(H_{1}\), the lemma above provides that

\[\mathbb{E}_{{\bf y}_{i},{\bf k}_{i}}[S_{its}(\hat{\bf k}_{i},{\bf y }_{i})|{\bf y}_{<i},H_{1}]\] \[= \mathbb{E}_{{\bf y}_{i},{\bf k}_{i}}[S_{sts}(\hat{\bf k}_{i},{\bf y }_{i})|{\bf y}_{<i},H_{1},\hat{\bf k}_{i}={\bf k}_{i}]\cdot p_{recall}\] \[+\mathbb{E}_{{\bf y}_{i},{\bf k}_{i}}[S_{its}(\hat{\bf k}_{i},{\bf y }_{i})|{\bf y}_{<i},H_{1},\hat{\bf k}_{i}\neq{\bf k}_{i}]\cdot(1-p_{recall})\] \[= \mathbb{E}_{{\bf y}_{i}}[C_{0}\cdot(1-P_{i}({\bf y}_{i}))|{\bf y}_{< i}]\cdot p_{recall}\] \[= C_{0}\cdot p_{recall}\cdot\sum_{{\bf y}_{i}\in\Sigma}(1-P_{i}({\bf y }_{i}))P_{i}({\bf y}_{i})\]

, where \(p_{recall}\) represents the recall performance of the retriever in ITS-Pool.

Finally, we can guarantee the statistical difference of fTS-Pool,

\[\mathbb{E}[S_{its}({\bf k}_{i},{\bf y}_{i})|{\bf y}_{<i},H_{1}]- \mathbb{E}[S_{tis}({\bf k}_{i},{\bf y}_{i})|{\bf y}_{<i},H_{0}]\] \[= C_{0}\cdot\sum_{{\bf y}_{i}\in\Sigma}(1-P_{i}({\bf y}_{i}))P_{i}({ \bf y}_{i})\cdot p_{recall}:=\phi_{its}({\mathbf{p}}^{i})\cdot p_{recall}\]

, where \(\phi_{its}({\mathbf{p}}^{i})\) is only relevant to probability vector \({\mathbf{p}}^{i}\) of \(P_{M}(\cdot|{\bf y}_{<i})\), representing watermarking potentials.

### Proof of Proposition 3.3 (KGW-Pool's Efficacy)

We first recall the mark module of KGW-Pool (_logits-add_ in Table 4). During generation, the mark module will randomly sample a green list \(\mathcal{G}_{{\bf k}_{i}}\) of \(\gamma|\Sigma|\) tokens from vocabulary, which is seeded by \({\bf k}_{i}\). Logits of these green tokens are increased by a constant \(\delta\) to form the modified distribution \(F_{gw}({\bf k}_{i},P_{i}({\bf y}_{i}))\). During detection, the mark module takes in a restored private key \(\hat{\bf k}_{i}\), generates a green list \(\mathcal{G}_{\hat{\bf k}_{i}}\) seeded by \(\hat{\bf k}_{i}\), and then calculates the per-token statistic \(S_{kgw}(\hat{\bf k}_{i},{\bf y}_{i})=\frac{{\bf y}_{i}\in\Phi_{\hat{\bf k}_{i}} -\gamma}{\sqrt{\text{len}({\bf y})\gamma(1-\gamma) 



**Lemma C.5**.: _Given a prefix \({\bf y}<_{i}\), for a private key \({\bf k}_{i}\sim\mathcal{U}(\mathbb{R})\) and a token \({\bf y}_{i}\), if \({\bf y}_{i}\) is sampled from \(F_{kgw}({\bf k}_{i},P_{M}(\cdot|{\bf y}_{<i}))\), then \(\operatorname*{\mathbb{E}}_{{\bf k}_{i},{\bf y}_{i}}[S^{\prime}({\bf k}_{i},{ \bf y}_{i})|{\bf y}_{<i}]\geq C_{1}\cdot\text{Spike}({\mathbf{p}}^{i},\frac{(1- \gamma)(\alpha-1)}{1+(\alpha-1)\gamma})\), where \(C_{1}\) is a constant and \(\text{Spike}({\mathbf{p}}^{i},c)\) is the spike entropy defined in Kirchenbauer et al. (2023a)._

Proof.: Trivially, we have \(\operatorname*{\mathbb{E}}_{{\bf k}_{i},{\bf y}_{i}}[S^{\prime}({\bf k}_{i},{ \bf y}_{i})|{\bf y}_{<i}]=P({\bf y}_{i}\in\mathcal{G},{\bf y}_{i},\mathcal{G}| {\bf y}_{<i})\). We consider the following process of sampling \({\bf y}_{i}\) and \(\mathcal{G}\). We first randomly choose a token \(t\) as output token \({\bf y}_{i}\), and then randomly sample the remaining tokens to construct the green list. Therefore, the expected probability of a token from the green list being sampled can be written as,

\[\operatorname*{\mathbb{E}}_{{\bf y}_{i}\in\Sigma}\operatorname*{\mathbb{E}}_ {{\cal G}\;s.t.{\bf y}_{i}\in\Theta}\frac{\alpha P_{i}({\bf y}_{i})}{\sum_{t \in\Sigma}P_{i}(t)+\alpha\sum_{t\in\mathcal{G}}P_{i}(t)}\]

, where \(\alpha=\exp(\delta)\).

Define the inner expectation as \(f_{{\bf y}_{i}}({\mathbf{p}}^{i})\), where \({\mathbf{p}}^{i}\) is the probability vector of \(P_{i}(\cdot)\). Trivially, \(f_{{\bf y}_{i}}({\mathbf{p}}^{i})=f_{{\bf y}_{i}}(\Pi{\mathbf{p}}^{i})\) for any permutation \(\Pi\) over the vocabulary except \({\bf y}_{i}\). Also, \(f_{{\bf y}_{i}}\) is convex in \({\mathbf{p}}^{i}_{-{\bf y}_{i}}\). Therefore, we have,

\[f_{{\bf y}_{i}}({\mathbf{p}}^{i})=\operatorname*{\mathbb{E}}_{\Pi} f_{{\bf y}_{i}}(\Pi{\mathbf{p}}^{i})\stackrel{{(1)}}{{\geq}}f_{{\bf y}_{ i}}(\operatorname*{\mathbb{E}}_{\Pi}\Pi{\mathbf{p}}^{i})\] \[\stackrel{{(2)}}{{\geq}}\alpha P_{i}({\bf y}_{i})/((1- P_{i}({\bf y}_{i}))(N-N_{G})/(N-1)\] \[~{}~{}~{}+\alpha(1-P_{i}({\bf y}_{i}))(N_{G}-1)/(N-1)+\alpha P_{i} ({\bf y}_{i}))\] \[=P_{i}({\bf y}_{i})\frac{\alpha N-\alpha}{N-N_{G}+\alpha N_{G}+( \alpha-1)(N-N_{G})P_{i}({\bf y}_{i})-\alpha}\] \[\geq P_{i}({\bf y}_{i})\frac{\alpha V}{N-N_{G}+\alpha N_{G}+( \alpha-1)(N-N_{G})P_{i}({\bf y}_{i})}\] \[=\frac{\alpha P_{i}({\bf y}_{i})}{(1-\gamma)+\alpha\gamma+(\alpha -1)(1-\gamma)P_{i}({\bf y}_{i})}\]

, where \((1)\) follows from Jensen's inequality; \((2)\) follows from \(\operatorname*{\mathbb{E}}_{\Pi}\Pi{\mathbf{p}}^{i}_{t}=\frac{1-P_{i}({\bf y}_{i}) }{N-1},\,\forall t\neq{\bf y}_{i}\). Then we have,

\[\operatorname*{\mathbb{E}}_{{\bf k}_{i}{\bf y}_{i}}[S^{\prime}({ \bf k}_{i},{\bf y}_{i})|{\bf y}_{<i}]\] \[=P({\bf y}_{i}\in\mathcal{G},{\bf y}_{i},\mathcal{G}|{\bf y}_{<i})\] \[=N_{G}\cdot\operatorname*{\mathbb{E}}_{{\bf y}_{i}\in\Sigma} \operatorname*{\mathbb{E}}_{{\cal G}\;s.t.{\bf y}_{i}\in\partial}\!\frac{ \alpha P_{i}({\bf y}_{i})}{\sum_{t\in\Sigma}P_{i}(t)+\alpha\sum_{t\in\mathcal{G }}P_{i}(t)}\] \[=N_{G}\cdot\operatorname*{\mathbb{E}}_{{\bf y}_{i}\in{\cal S}}f_{{ \bf y}_{i}}({\mathbf{p}}^{i})\] \[\geq\frac{\gamma\alpha}{1+(\alpha-1)\gamma}\text{Spike}({\mathbf{p}}^ {i},\frac{(1-\gamma)(\alpha-1)}{1+(\alpha-1)\gamma})\] \[:=C_{1}\cdot\text{Spike}({\mathbf{p}}^{i},\frac{(1-\gamma)(\alpha-1)} {1+(\alpha-1)\gamma})\]

, where \(\text{Spike}({\mathbf{p}}^{i},c)=\sum_{t\in\Sigma}\frac{P_{i}(t)}{1+cP_{i}(t)}\). And the lower bound is strictly larger than \(\gamma\). 

On the contrary, under the null hypothesis, trivially we have \(\operatorname*{\mathbb{E}}[S^{\prime}({\bf k}_{i},{\bf y}_{i})|{\bf y}_{<i},H_{0} ]=\gamma\), since \({\bf k}_{i}\) and \({\bf y}_{i}\) are independent. Combining all above, we eventually have,

\[\operatorname*{\mathbb{E}}[S(\hat{{\bf k}}_{i}{\bf y}_{i})|{\bf y}_ {<i},H_{1}]-\operatorname*{\mathbb{E}}[S(\hat{{\bf k}}_{i},{\bf y}_{i})|{\bf y}_ {<i},H_{0}]\] \[= \operatorname*{\mathbb{E}}_{{\bf k}_{i},{\bf y}_{i}}[S(\hat{{\bf k}} _{i},{\bf y}_{i})|{\bf y}_{<i},H_{1}\hat{{\bf k}}_{i}\check{{\bf z}}{=}{\bf k}_{i }]p_{rec}\] \[+\operatorname*{\mathbb{E}}_{k_{i}{\bf y}_{i}}[S(\hat{{\bf k}}_{i},{ \bf y}_{i})|{\bf y}_{<i},H_{1}\hat{{\bf k}}_{i}\check{{\bf z}}{\not{\approx}}{\bf k }_{i}](\mbox{$-1$$-$}p_{rec})\] \[= (\operatorname*{\mathbb{E}}_{{\bf k}_{i},{\bf y}_{i}}[S^{\prime}({ \bf k}_{i},{\bf y}_{i})|{\bf y}_{<i},H_{1}]\neg)/\sqrt{\tan({\bf y})\gamma(1 \neg\gamma)}\hskip 1.422638pt\nu_{rec}\] \[\geq (C_{1}\text{-Spike}({\mathbf{p}}^{i},\frac{(1-\gamma)(\alpha-1)}{1+( \alpha-1)\gamma})\neg)/\sqrt{\tan({\bf y})\gamma(1\neg\gamma)}\hskip 1.422638ptp_{ rec}\] \[:= \phi_{kgw}({\mathbf{p}}^{i})\hskip 1.422638ptp_{rec}\]

, where \(\phi_{kgw}({\mathbf{p}}^{i})\) is only relevant to probability vector \({\mathbf{p}}^{i}\) of \(P_{M}(\cdot|{\bf y}_{<i})\), representing watermarking potentials at this step, and \(p_{rec}\) is the recall performance of the retriever in KGW-Pool.

## Appendix D Experimental Details

**Datasets.** Following previous works Kirchenbauer et al. (2023a, b), we include two common used datasets for our experiments, the Colossal Common Crawl Cleaned corpus (C4) and "Explain Like I'm Five" (ELI5) Fan et al. (2019). C4 is a colossal, cleaned version of Common Crawl's web crawl corpus13, which has been commonly adopted as pretraining corpus of LLMs. We randomly select 3000 texts of length 50 from C4 as prompts for open-ended generation task. ELI5 is a dataset of questions and answers gathered from three topics of reddits, where users ask factual questions requiring paragraph-length or longer answers. Specifically, we use the version curated by Krishna et al. (2023) including 2758 samples. The human-written questions are used as prompts for long-form question answering.

Footnote 13: [https://commoncarwl.org](https://commoncarwl.org)

**Metrics.** We generate 20 watermarked outputs for each prompt, while considering outputs of the original LLM as non-watermarked. Subsequently, a total of about 120,000 samples are used to evaluate each watermarking technique. For both efficacy and robustness, we report true positive rate (watermarked texts being successfully detected) at 1% false positive rate (non-watermarked texts belonging falsely detected) denoted as TPR@FPR=1%. To comprehensively evaluate the robustness of watermarking techniques, we include three different kinds of attacks, namely Lexical-Attack, Dipper-Attack and Translation-Attack. Lexical-attack is a baseline attack by randomly add/delete/replace a small portion of texts. Specifically, we randomly modify

termarked text. Dipper is a paraphrasing model proposed by Krishna et al. (2023) aiming at corrupting watermark patterns within texts. We set its hyper-parameters lex=46,div=46 following Kirchenbauer et al. (2023b). Translation-attack represents roundtrip-translation, which is a widely used paraphrasing method. Following Kuditipudi et al. (2023), we translate texts to Russian and then translate them back to English. For the evaluation of imperceptibility, we split the criteria into two aspects: (1) the distribution bias within each output (2) the independence among different outputs. The former can be evaluated with perplexity while the latter can be roughly evaluated with n-gram distinction Kirchenbauer et al. (2023b). Specifically, we consider the distinction across all outputs (Globstinct-\(N\)) and within outputs in response to one single prompt (Group-distinct-\(N\)).

**Baselines.** We include several typical methods as baselines. In addition to EXPKuditipudi et al. (2023), ITSKuditipudi et al. (2023) and KGWKirchenbauer et al. (2023a), we also include GammaHu et al. (2023), DeltaHu et al. (2023) and UnigramZhao et al. (2023). Both Gamma and Delta propose unbiased modification functions towards optimal imperceptibility during generation, and conduct likelihood ratio test for detection. Unigram is similar to KGW, fixing the private key during generation, leading to a fixed green list partition in sequence level.

**Implementation details.** We conduct main experiments on two LLMs of different scales, OPT-1.3b and OPT-6.7b, following Krishna et al. (2023). OPT-1.3b is used by default except in main experiments. On both open-ended generation and long-form question answering, we conduct multinomial sampling to generate sequences within the range of [50, 70] tokens. We use a 128 dimension sentence embedding model Nussbaum et al. (2024) as the retriever in WaterPool. As for implementation of mark modules in different WaterPool (i.e. KGW-Pool, ITS-Pool, EXP-Pool), we use identical hyper-parameter settings as the original watermarking technique. All baselines are reproduced based on source codes provided by original paper. For KGW, we set \(\delta=2.0\), \(\gamma=0.25\) as suggested in Kirchenbauer et al. (2023a). For Unigram, we set \(\delta=2.0\), \(\gamma=0.5\) as suggested in Zhao et al. (2023). For Gamma and Delta, we use the context length of \(5\) and search the perturbation strength \(d\) over the set\(\{0,0.1,...,1.0\}\) following Christ et al. (2023). For EXP and ITS, we set the key length \(n=80\), large enough to generate at most \(70\) tokens in our main experiments. We set the edit-distance penalty \(\gamma=0.0\) and \(0.4\) respectively following Kuditipudi et al. (2023). For KGW-Pool, we observed high variance of performance. It is because of the random partition in a sequence level. The logits-add mark module is sensitive to this partition, which is similar to Unigram. To this end, we resample the key for three times and use the best one as watermarked output during generation in practice. This trick only leads to additional time complexity of generation and won't affect any other analysis in this paper. EXP, ITS, EXP-Pool and ITS-Pool all leverage permutation tests to calculate \(p\)-value (e.g. /* Permutation test */ in Algorithm 2). We conduct the permutations with \(5000\) examples. Following Kuditipudi et al. (2023), we only pre-compute the permutation distribution once instead of recomputing it for each candidate text. This trick reduces the high time complexity of permutation tests and doesn't cause much performance degradation.

## Appendix E Additional Experiments

### Full Results of WaterPool

In this section, we present full results of WaterPool under different settings (e.g. OPT-1.3b/OPT-6.7b, open-ended generation / long-form question answering) in Table 6, 7, 8 and 9.

 

nario in watermarking as more and more non-watermarked LLMs will emerge. Subsequently, we evaluate the performance of the retrieval watermark across eight groups of watermark detection experiments. The robustness, evaluated by TPR@FPR=1% under lexical attack, is presented in Table 10. The results show that even under lexical attack, the weakest attack, the retrieval watermark experiences significant performance degradation of more than 40%, while most other watermarking techniques maintain high TPR@FPR=1% (see Table 2). This phenomenon substantiate our claims in Section 3.4, highlighting the vulnerability of retrieval watermark compared to other methods in practical applications.

### Performance with Diverse Negative Samples

Full results are presented in Table 11.

### Scaling Length of Watermarked Texts

Both [86] and [87] observe that the detection rate of watermarking is a monotonically increasing function of the watermarked text length. In this section, we conduct an experiment to investigate the performance of WaterPool with growths of text length. We generate outputs of different lengths \(T\in[80,90,...200]\) and calculate the corresponding TPR@FPR=1% metrics. The results are presented in Figure 4. We observe a consistent increase in the detection rate of WaterPool under different attack settings, aligning with the findings reported by [85]. Moreover, WaterPool consistently enhance the performance of original watermarking techniques across all settings, further underscoring its superior capabilities.

\begin{table}
\begin{tabular}{l c c|c c c|c c c} \hline \hline  & w/o Attack & \multicolumn{2}{c}{Lexical-Attack} & \multicolumn{2}{c}{Dipper-Attack} & \multicolumn{2}{c}{Translation-Attack} \\ \hline  & value\(\uparrow\) & \(\Delta\) & value\(\uparrow\) & \(\Delta\) & value\(\uparrow\) & \(\Delta\) & value\(\uparrow\) & \(\Delta\) \\ \hline \multicolumn{8}{c}{Open Text Generation} \\ \hline Gamma & 99.58\({}_{\pm 0.01}\) & - & 78.69\({}_{\pm 0.08}\) & - & 55.18\({}_{+0.11}\) & - & 58.33\({}_{\pm 0.18}\) & - \\ Delta & 94.24\({}_{\pm 0.05}\) & - & 62.48\({}_{\pm 0.29}\) & - & 52.47\({}_{+0.10}\) & - & 54.52\({}_{\pm 0.16}\) & - \\ \hline Unigram & 99.59\({}_{\pm 0.06}\) & - & 99.31\({}_{\pm 0.22}\) & - & 83.60\({}_{\pm 4.75}\) & - & 90.99\({}_{\pm 2.47}\) & - \\ KGW & 99.87\({}_{\pm 0.01}\) & - & 99.24\({}_{\pm 0.02}\) & - & 77.43\({}_{+0.48}\) & - & 85.88\({}_{+0.06}\) & - \\ KGW-Pool & **99.90\({}_{\pm 0.00}\)** & 0.03\({}_{\pm 0.01}\) & **99.74\({}_{\pm 0.00}\)** & 0.50\({}_{\pm 0.02}\) & **84.10\({}_{+0.89}\)** & 6.67\({}_{\pm 1.37}\)** & **92.15\({}_{\pm 0.14}\)** & 6.27\({}_{\pm 0.19}\) \\ \hline EXP & 99.45\({}_{\pm 0.02}\) & - & 98.97\({}_{\pm 0.02}\) & - & 73.60\({}_{\pm 0.49}\) & - & 80.45\({}_{\pm 0.05}\) & - \\ EXP-Pool & 99.76\({}_{\pm 0.01}\) & 0.31\({}_{\pm 0.02}\) & 99.57\({}_{\pm 0.00}\) & 0.60\({}_{\pm 0.02}\) & 80.42\({}_{\pm 0.94}\) & 6.83\({}_{\pm 1.18}\) & 90.65\({}_{\pm 0.04}\) & 10.20\({}_{\pm 0.09}\) \\ \hline ITS & 95.48\({}_{\pm 0.03}\) & - & 83.19\({}_{\pm 0.11}\) & - & 59.24\({}_{\pm 0.13}\) & - & 56.88\({}_{\pm 0.03}\) & - \\ ITS-Pool & 99.18\({}_{\pm 0.01}\) & 3.70\({}_{\pm 0.03}\) & 96.70\({}_{\pm 0.00}\) & 13.52\({}_{\pm 0.11}\) & 61.68\({}_{\pm 0.03}\) & 2.44\({}_{\pm 0.15}\) & 71.33\({}_{\pm 0.03}\) & 14.45\({}_{\pm 0.06}\) \\ \hline \multicolumn{8}{c}{Long-Form Question Answering} \\ \hline Gamma & 99.85\({}_{\pm 0.01}\) & - & 80.93\({}_{\pm 0.17}\) & - & 55.14\({}_{\pm 0.02}\) & - & 61.69\({}_{\pm 0.09}\) & - \\ Delta & 97.99\({}_{\pm 0.06}\) & - & 65.72\({}_{\pm 0.17}\) & - & 52.75\({}_{\pm 0.12}\) & - & 57.48\({}_{\pm 0.12}\) & - \\ \hline Unigram & 99.83\({}_{\pm 0.10}\) & - & 99.63\({}_{\pm 0.19}\) & - & **87.79\({}_{\pm 1.92}\)** & - & 94.38\({}_{\pm 1.05}\) & - \\ KGW & **99.97\({}_{\pm 0.00}\)** & - & 99.66\({}_{\pm 0.00}\) & - & 81.05\({}_{\pm 0.23}\) & - & 92.34\({}_{\pm 0.09}\) & - \\ KGW-Pool & 99.96\({}_{\pm 0.00}\) & -0.01\({}_{\pm 0.00}\) & 99.75\({}_{\pm 0.02}\) & 0.09\({}_{\pm 0.02}\) & 87.41\({}_{\pm 0.58}\) & 6.36\({}_{\pm 0.38}\) & 94.29\({}_{\pm 0.09}\) & 1.95\({}_{\pm 0.12}\) \\ \hline EXP & 99.86\({}_{\pm 0.02}\) & - & 99.70\({}_{\pm 0.04}\) & - & 80.55\({}_{\pm 0.41}\) & - & 91.17\({}_{\pm 0.06}\) & - \\ EXP-Pool & 99.92\({}_{\pm 0.01}\) & 0.06\({}_{\pm 0.02}\) & **99.83\({}_{\pm 0.01}\)** & 0.13\({}_{\pm 0.04}\) & 85.87\({}_{\pm 0.32}\) & 5.32\({}_{\pm 0.69}\) & **96.05\({}_{\pm 0.05}\)** & 4.88\({}_{\pm 0.11}\) \\ \hline ITS & 97.96\({}_{\pm 0.06}\) & - & 88.41\({}_{\pm 0.19}\) & - & 63.12\({}_{\pm 0.10}\) & - & 68.02\({}_{\pm 0.21}\) & - \\ ITS-Pool & 99.75\({}_{\pm 0.00}\) & 1.79\({}_{\pm 0.06}\) & 98.48\({}_{\pm 0.01}\) & 10.07\({}_{\pm 0.19}\) & 66.35\({}_{\pm 0.13}\) & 3.23\({}_{\pm 0.22}\) & 81.99\({}_{\pm 0.07}\) & 13.97\({}_{\pm 0.27}\) \\ \hline \hline \end{tabular}
\end{table}
Table 6: Efficacy and Robustness of different watermarking methods on OPT-1.3B evaluated with ROC-AUC. \(\Delta\) is the performance boost brought by WaterPool. The best and second-best results are highlighted in **bold** and underline.

 



\begin{table}
\begin{tabular}{l|c c c c c c|c c c} \hline \hline  & \multicolumn{2}{c}{Glob-distinct2} & \multicolumn{2}{c}{Glob-distinct3} & \multicolumn{2}{c}{Group-distinct2} & \multicolumn{2}{c}{Group-distinct3} & \multicolumn{1}{c}{Perplexity} \\ \hline  & value\(\uparrow\) & \(\Delta\)\(\uparrow\) & value\(\uparrow\) & \(\Delta\)\(\uparrow\) & value\(\uparrow\) & \(\Delta\)\(\uparrow\) & value\(\downarrow\) & \(\Delta\)\(\downarrow\) \\ \hline \multicolumn{8}{c}{Open-Ended Text Generation} \\ \hline Non-watermark & 39.4\({}_{\pm 0.9}\) & 0.0\({}_{\pm 0.0}\) & 75.8\({}_{\pm 2.0}\) & 0.0\({}_{\pm 0.0}\) & **84.3\({}_{\pm 2.3}\)** & 0.0\({}_{\pm 0.0}\) & **94.1\({}_{\pm 2.7}\)** & 0.0\({}_{\pm 0.0}\) & 6.8\({}_{\pm 0.0}\) & 0.0\({}_{\pm 0.0}\) \\ Gamma & 39.9\({}_{\pm 0.0}\) & 0.5\({}_{\pm 0.9}\) & 77.0\({}_{\pm 0.0}\) & 1.2\({}_{\pm 2.0}\) & 85.6\({}_{\pm 0.0}\) & 1.3\({}_{\pm 2.3}\) & 95.6\({}_{\pm 0.0}\) & 1.5\({}_{\pm 2.7}\) & 6.8\({}_{\pm 0.0}\) & 0.0\({}_{\pm 0.0}\) \\ Delta & 39.9\({}_{\pm 0.0}\) & 0.5\({}_{\pm 0.8}\) & 77.0\({}_{\pm 0.0}\) & 1.2\({}_{\pm 2.0}\) & 85.6\({}_{\pm 0.0}\) & 1.3\({}_{\pm 2.3}\) & 95.7\({}_{\pm 0.0}\) & 1.6\({}_{\pm 2.7}\) & 6.8\({}_{\pm 0.0}\) & 0.0\({}_{\pm 0.0}\) \\ Unigram & 36.5\({}_{\pm 1.8}\) - 2.9\({}_{\pm 0.9}\) & 72.4\({}_{\pm 2.4}\) & -3.5\({}_{\pm 1.2}\) & 82.9\({}_{\pm 2.2}\) & -1.4\({}_{\pm 1.5}\) & 94.8\({}_{\pm 0.7}\) & 0.7\({}_{\pm 2.3}\) & 8.8\({}_{\pm 0.4}\) & 1.9\({}_{\pm 0.4}\) \\ KGW & 38.2\({}_{\pm 0.0}\) - 1.2\({}_{\pm 0.9}\) & 74.8\({}_{\pm 0.0}\) & -1.0\({}_{\pm 0.2}\) & 85.3\({}_{\pm 0.0}\) & 1.0\({}_{\pm 2.9}\) & 95.6\({}_{\pm 0.0}\) & 1.5\({}_{\pm 2.7}\) & 8.4\({}_{\pm 0.0}\) & 1.6\({}_{\pm 0.0}\) \\ KGW-Pool & **41.9\({}_{\pm 0.1}\)** & **2.5\({}_{\pm 0.8}\)** & **79.7\({}_{\pm 0.3}\)** & **83.0\({}_{\pm 0.4}\)** & **87.4\({}_{\pm 0.3}\)** & **83.2\({}_{\pm 3.9}\)** & **96.7\({}_{\pm 0.0}\)** & **26.2\({}_{\pm 2.7}\)** & 8.8\({}_{\pm 0.0}\) & 2.0\({}_{\pm 0.0}\) \\ EXP & 32.0\({}_{\pm 0.1}\) - 7.4\({}_{\pm 0.6}\) & 61.9\({}_{\pm 0.4}\) & **13.9\({}_{\pm 2.3}\)** & 73.0\({}_{\pm 0.3}\) & -11.3\({}_{\pm 2.3}\) & 81.9\({}_{\pm 0.2}\) & -12.2\({}_{\pm 2.7}\) & 6.9\({}_{\pm 0.0}\) & 0.0\({}_{\pm 0.0}\) \\ EXP-Pool & 39.9\({}_{\pm 0.0}\) & 0.6\({}_{\pm 0.9}\) & 77.0\({}_{\pm 0.0}\) & 1.2\({}_{\pm 0.8}\) & 85.6\({}_{\pm 0.0}\) & 1.3\({}_{\pm 2.3}\) & 95.7\({}_{\pm 0.0}\) & 1.6\({}_{\pm 2.7}\) & 6.8\({}_{\pm 0.0}\) & 0.0\({}_{\pm 0.0}\) \\ ITS & 35.9\({}_{\pm 0.0}\) - 3.5\({}_{\pm 0.9}\) & 68.2\({}_{\pm 0.1}\) & -7.6\({}_{\pm 2.0}\) & 75.9\({}_{\pm 0.1}\) & -8.4\({}_{\pm 2.2}\) & 84.5\({}_{\pm 0.1}\) & -9.6\({}_{\pm 2.6}\) & **6.6\({}_{\pm 0.0}\)** & **-0.3\({}_{\pm 0.0}\)** \\ ITS-Pool & 39.9\({}_{\pm 0.0}\) & 0.5\({}_{\pm 0.9}\) & 77.0\({}_{\pm 0.0}\) & 1.2\({}_{\pm 0.0}\) & 85.6\({}_{\pm 0.0}\) & 1.3\({}_{\pm 2.3}\) & 95.6\({}_{\pm 0.0}\) & 1.6\({}_{\pm 2.7}\) & 6.8\({}_{\pm 0.0}\) & 0.0\({}_{\pm 0.0}\) \\ \hline \multicolumn{8}{c}{Long-Form Question Answering} \\ \hline Non-watermark & 33.0\({}_{\pm 0.0}\) & 0.0\({}_{\pm 0.0}\) & 71.3\({}_{\pm 0.0}\) & 0.0\({}_{\pm 0.0}\) & **87.1\({}_{\pm 0.1}\)** & **0.0\({}_{\pm 0.0}\)** & **97.1\({}_{\pm 0.0}\)** & **0.0\({}_{\pm 0.0}\)** & 8.8\({}_{\pm 0.0}\) & 0.0\({}_{\pm 0.0}\) \\ Gamma & 32.9\({}_{\pm 0.0}\) - 0.1\({}_{\pm 0.0}\) & 71.2\({}_{\pm 0.1}\) & -0.1\({}_{\pm 0.1}\) & 87.1\({}_{\pm 0.0}\) & -0.1\({}_{\pm 0.0}\) & 97.0\({}_{\pm 0.0}\) & -0.1\({}_{\pm 0.0}\) & 8.8\({}_{\pm 0.0}\) & -0.0\({}_{\pm 0.0}\) \\ Delta & 33.0\({}_{\pm 0.0}\) - 0.0\({}_{\pm 0.0}\) & 71.2\({}_{\pm 0.1}\) & -0.1\({}_{\pm 0.1}\) & 87.1\({}_{\pm 0.0}\) & -0.1\({}_{\pm 0.0}\) & 97.0\({}_{\pm 0.0}\) & -0.0\({}_{\pm 0.0}\) & 8.8\({}_{\pm 0.0}\) & -0.0\({}_{\pm 0.0}\) \\ Unigram & 29.2\({}_{\pm 2.0}\) - 3.8\({}_{\pm 2.0}\) & 65.1\({}_{\pm 2.8}\) & -6.2\({}_{\pm 2.8}\) & 82.5\({}_{\pm 2.2}\) & -4.7\({}_{\pm 2.2}\) & 95.1\({}_{\pm 0.6}\) & -2.0\({}_{\pm 0.6}\) & 10.4\({}_{\pm 0.8}\) & 1.6\({}_{\pm 0.8}\) \\ KGW & 31.3\({}_{\pm 0.1}\) - 1.7\({}_{\pm 0.1}\) & 68.1\({}_{\pm 0.1}\) & -3.2\({}_{\pm 0.





\begin{table}
\begin{tabular}{c|r r r r r r r r r} \hline \hline Watermarked Model & Vicuna-13b & Vicuna-7b & Llama2-13b & Llama2-7b & Gemma-2b & Gemma-7b & OPT-1.3b & OPT-6.7b & Avg \\ \hline  & \multicolumn{9}{c}{Open-Ended Text Generation} \\ \hline Vicuna-13b & - & 16.36 & 32.36 & 40.85 & 61.23 & 51.09 & 49.94 & 40.02 & 41.69 \\ Vicuna-7b & 14.62 & - & 39.24 & 41.41 & 61.16 & 53.00 & 49.63 & 39.73 & 42.69 \\ Llama2-13b & 23.36 & 31.65 & - & 44.56 & 66.95 & 58.67 & 53.12 & 43.22 & 45.93 \\ Llama2-7b & 29.19 & 31.63 & 41.54 & - & 68.24 & 60.53 & 53.10 & 43.35 & 46.80 \\ Gemma-2b & 47.32 & 48.20 & 63.43 & 65.86 & - & 67.78 & 63.05 & 54.13 & 58.54 \\ Germana-7b & 37.95 & 41.03 & 55.49 & 58.77 & 68.70 & - & 58.30 & 48.65 & 52.70 \\ OFT-1.3b & 42.29 & 42.29 & 53.00 & 57.93 & 66.59 & 62.43 & - & 53.00 & 53.93 \\ OFT-6.7b & 30.73 & 30.73 & 47.83 & 62.37 & 57.79 & 52.99 & - & 47.18 \\ \hline  & \multicolumn{9}{c}{Long-Form Question Answering} \\ \hline Vicuna-13b & - & 0.87 & 39.39 & 44.02 & 68.47 & 45.95 & 55.36 & 46.01 & 42.87 \\ Vicuna-7b & 0.76 & - & 40.00 & 42.84 & 68.19 & 45.65 & 54.25 & 45.01 & 42.38 \\ Llama2-13b & 9.16 & 9.81 & - & 44.00 & 66.52 & 46.48 & 50.77 & 41.62 & 38.34 \\ Llama2-7b & 10.77 & 10.37 & 41.94 & - & 66.40 & 47.64 & 53.99 & 45.15 & 39.47 \\ Gemma-2b & 21.65 & 21.88 & 64.71 & 67.15 & - & 65.23 & 69.16 & 60.29 & 52.87 \\ Germma-7b & 8.93 & 9.56 & 42.78 & 45.74 & 63.75 & - & 54.14 & 44.80 & 38.53 \\ OFFI-1.3b & 17.56 & 17.56 & 47.64 & 47.64 & 64.59 & 52.26 & - & 52.26 & 42.79 \\ OPI-6.7b & 12.83 & 8.93 & 41.87 & 41.87 & 59.81 & 41.87 & 55.68 & - & 37.55 \\ \hline \hline \end{tabular}
\end{table}
Table 10: TPR@FPR=1% of retrieval watermark under lexical attacks. The model in the first column is the model being watermarked. Retrieval watermark is vulnerable even under the weakest lexical attacks.

\begin{table}
\begin{tabular}{l|l l|l l l|l l l} \hline \hline  & \multicolumn{2}{c}{w/o Attack} & \multicolumn{2}{c}{Lexical-Attack} & \multicolumn{2}{c}{Dipper-Attack} & \multicolumn{2}{c}{Translation-Attack} \\ \hline  & value\(\uparrow\) & \(\Delta\) & value\(\uparrow\) & \(\Delta\) & value\(\uparrow\) & \(\Delta\) & value\(\uparrow\) & \(\Delta\) \\ \hline  & \multicolumn{9}{c}{Open Text Generation} \\ \hline Gamma & 99.33\({}_{\pm 0.01}\) & - & 77.01\({}_{\pm 0.14}\) & - & 55.20\({}_{\pm 0.17}\) & - & 57.47\({}_{\pm 0.20}\) & - \\ Delta & 92.84\({}_{\pm 0.05}\) & - & 61.06\({}_{\pm 0.26}\) & - & 52.39\({}_{\pm 0.07}\) & - & 53.83\({}_{\pm 0.04}\) & - \\ \hline Unigram & 99.48\({}_{\pm 0.19}\) & - & 99.12\({}_{\pm 0.38}\) & - & **83.94\({}_{\pm 5.55}\)** & - & 89.73\({}_{\pm 3.35}\) & - \\ KGW & 99.77\({}_{\pm 0.01}\) & - & 98.96\({}_{\pm 0.03}\) & - & 76.73\({}_{\pm 0.17}\) & - & 83.73\({}_{\pm 0.16}\) & - \\ KGW-Pool & **99.84\({}_{\pm 0.00}\)** & 0.06\({}_{\pm 0.01}\) & **99.62\({}_{\pm 0.00}\)** & 0.66\({}_{\pm 0.03}\) & 83.88\({}_{\pm 0.71}\) & 7.14\({}_{\pm 0.76}\) & **90.85\({}_{\pm 0.09}\)** & 7.13\({}_{\pm 0.23}\) \\ \hline EXP & 99.12\({}_{\pm 0.03}\) & - & 98.32\({}_{\pm 0.04}\) & - & 71.72\({}_{\pm 0.49}\) & - & 78.93\({}_{\pm 1.57}\) & - \\ EXP-Pool & 99.46\({}_{\pm 0.21}\) & 0.34\({}_{\pm 0.18}\) & 99.29\({}_{\pm 0.03}\) & 0.96\({}_{\pm 0.07}\) & 77.78\({}_{\pm 1.12}\) & 6.06\({}_{\pm 1.61}\) & 88.22\({}_{\pm 0.13}\) & 9.29\({}_{\pm 1.45}\) \\ \hline ITS & 93.25\({}_{\pm 0.06}\) & - & 79.89\({}_{\pm 0.10}\) & - & 59.15\({}_{\pm 0.18}\) & - & 55.34\({}_{\pm 0.19}\) & - \\ ITS-Pool & 98.63\({}_{\pm 0.01}\) & 5.38\({}_{\pm 0.07}\) & 95.40\({}_{\pm 0.06}\) & 15.51\({}_{\pm 0.07}\) & 61.17\({}_{\pm 0.12}\) & 2.02\({}_{\pm 0.23}\) & 69.49\({}_{\pm 0.10}\) & 14.15\({}_{\pm 0.16}\) \\ \hline \hline  & \multicolumn{9}{c}{Long-Form Question Answering} \\ \hline Gamma & 99.81\({}_{\pm 0.00}\) & - & 80.10\({}_{\pm 0.11}\) & - & 54.91\({}_{\pm 0.06}\) & - & 60.16\({}_{\pm 0.05}\) & - \\ Delta & 97.74\({}_{\pm 0.02}\) & - & 65.49\({}_{\pm 0.07}\) & - & 52.54\({}_{\pm 0.12}\) & - & 56.29\({}_{\pm 0.07}\) & - \\ \hline Unigram & 99.80\({}_{\pm 0.14}\) & - & 99.57\({}_{\pm 0.26}\) & - & **88.43\({}_{\pm 4.17}\)** & - & 93.74\({}_{\pm 2.41}\) & - \\ KGW & **99.96\({}_{\pm 0.00}\)** & - & 99.57\({}_{\pm 0.00}\) & - & 80.23\({}_{\pm 0.16}\) & - & 91.00\({}_{\pm 0.08}\) & - \\ KGW-Pool & 99.95\({}_{\pm 0.01}\) & -0.01\({}_{\pm 0.01}





\begin{table}
\begin{tabular}{c c|c c c c} \hline \hline  & & w/o Attack & Lexical-Attack & Dipper-Attack & Translation-Attack \\ \hline EXP-Pool & Original & 98.43 / 99.56 & 96.67 / 98.81 & 26.17 / 36.24 & 51.41 / 72.61 \\  & Human & 98.35 / 99.66 & 96.50 / 99.04 & 24.49 / 39.70 & 50.23 / 75.00 \\  & Other Models & 98.45 / 99.61 & 96.72 / 98.88 & 25.65 / 36.63 & 51.60 / 72.51 \\ \hline KGW-Pool & Original & 98.29 / 99.51 & 95.29 / 97.97 & 24.62 / 29.92 & 42.26 / 50.14 \\  & Human & 98.96 / 99.98 & 96.27 / 99.56 & 27.23 / 46.80 & 46.22 / 69.24 \\  & Other Models & 98.96 / 99.71 & 96.21 / 98.03 & 26.33 / 30.52 & 45.42 / 51.66 \\ \hline  & Original & 92.56 / 97.56 & 68.50 / 81.73 & 4.05 / 6.25 & 10.83 / 24.26 \\ ITS-Pool & Human & 93.33 / 97.44 & 71.18 / 80.77 & 4.61 / 5.82 & 12.01 / 22.95 \\  & Other Models & 92.73 / 97.65 & 69.27 / 82.22 & 4.15 / 6.62 & 11.17 / 24.92 \\ \hline \hline \end{tabular}
\end{table}
Table 11: TPR@FPR=1% of WaterPool with different non-watermarked texts. The results are in form of (C4 Result / LFQA Result). The first column lists watermarking methods, and the second column shows non-watermarked text sources. WaterPool remains stable across different non-watermarked texts.



Figure 4: TPR@FPR=1% of different watermarking techniques with the growths of text length. The same color indicates different methods sharing the same mark module. Solid lines represent original methods while dashed lines represent WaterPool methods.