Unbiased Watermark for Large Language Models
Authors: Zhengmian Hu
Lichang Chen
Xidong Wu
Yihan Wu
Hongyang Zhang
Heng Huang
Venue: ICLR 2024 spotlight (2024)
Keywords: watermark
bias
Primary area: generative models
TL;DR: Watermark doesn't affect output performance, and cannot be detected by users

Abstract: The recent advancements in large language models (LLMs) have sparked a growing apprehension regarding the potential misuse. One approach to mitigating this risk is to incorporate watermarking techniques into LLMs, allowing for the tracking and attribution of model outputs. This study examines a crucial aspect of watermarking: how significantly watermarks impact the quality of model-generated outputs. Previous studies have suggested a trade-off between watermark strength and output quality. However, our research demonstrates that it is possible to integrate watermarks without affecting the output probability distribution with appropriate implementation. We refer to this type of watermark as an unbiased watermark. This has significant implications for the use of LLMs, as it becomes impossible for users to discern whether a service provider has incorporated watermarks or not. Furthermore, the presence of watermarks does not compromise the performance of the model in downstream tasks, ensuring that the overall utility of the language model is preserved. Our findings contribute to the ongoing discussion around responsible AI development, suggesting that unbiased watermarks can serve as an effective means of tracking and attributing model outputs without sacrificing output quality.

Published as a conference paper at ICLR 2024
UNBIASED WATERMARK FOR LARGE LANGUAGE MODELS
Zhengmian Hu', Lichang Chen', Xidong Wu², Yihan Wu', Hongyang Zhang Heng Huang' 1 Department of Computer Science, University of Maryland, College Park, MD 20742, USA
2 Department of ECE, University of Pittsburgh, Pittshurgh, PA 15261, USA Schooo of Computer Science, University of Waterloo, Waterloo, ON N2L 3G1, Canada com
huzhengmi an aeg.mmiiiimmmmmimmmmmmmmmmmmamam com, bobl www..o..iccaancccceeooooiiaaa.ee waablichanccheeemmai2222 com, ywu 42 @umd. edu, hongyang. zhang@uwaterloo ca, hhw.://w......ccccccchhchhhheeea
com,
ABSTRACT
The recent advancements in large language models (LLMs) have sparked grow- ing apprehension regarding the potential misuse. One approach to mitigating this risk is to incorporate watermarking techniques into LLMs, allowing for the track- ing and attribution of model outputs. This study examines crucial aspect of wa- termarking: how significantly watermarks impact the quality of model-generated outputs. Previous studies have suggested trade-off between watermark strength and output quality. However, our research demonstrates that it is possible to in- tegrate watermarks without affecting the output probability distribution with ap- propriate implementation. We refer to this type of watermark as an unbiased watermark. This has significant implications for the use of LLMs, as it becomes impossible for users to discern whether a service provider has incorporated water- marks or not. Furthermore, the presence of watermarks does not compromise the performance of the model downstream tasks, ensuring that the overall utility of the language model is preserved. Our findings contribute to the ongoing dis- cussion around responsible Al development, suggesting that unbiased watermarks an effective means of tracking and attributing model outputs without sacrificing output quality.
INTRODUCTION
In recent years, large language models (LLMs) (Google 2023 OpenAl 2023a b) have become
indispensable tool for wide range of tasks, including text generation (Iyer et al. [0022] Chung ct al.]
2022). translation (Bojar et al., 2017 Barrault et al. 2019), summarization (Liu & Lapata 2019), etc. With the escalating misuse of LLMs, such as plagiarism, tracking the usage of text generated by machines has become increasingly important. One viable method to monitor the usage of LLMs is watermarking (Gu et al. 2022, Kirchenbauer et al.)
2023 Venugopal et al.) [201]), which embeds imperceptible information within the generated text, thereby allowing for efficient detection and tracking of the model's potential abuse.
Watermarking techniques can serve multiple purposes, such as embedding ownership information within the generated text to protect the intellectual property rights of the model. It can also help mitigate potential harm caused by LLMs by monitoring where the model is being used and whether it is being misused or abused.
good watermarking method should not adversely affect the normal usage of the language model or degrade the quality of the generated text. However, prevailing belief holds that there is an inevitable trade-off between the strength of the watermark and the quality of the output text. For instance, recent work by Kirchenbauer al. (202) introduced method that augmented the logits of a randomly selected set " "ggreen" tokens. By tuning the "magnitude of logits adjustment", they demonstrated trade-off between watermark strength and text quality.
Our primary contribution is to challenge this conventional wisdom. We show that with the right im- plementation, watermarking can be accomplished without affecting the output quality. We refer to this particular type of watermark as an unbiased watermark. We approach the problem of output quality degradation from the perspective of watermark detection. We posit that if the watermark

---

Published as a conference paper at ICLR 2024
causes decline in output quality, there should be method to guess the presence of the watermark based on the quality. Conversely, if the watermark cannot be detected, implies that the output quality remains unaffected. Specifically, watermarking does not affect the output probability distribution. This has significant implications, users who do not have the private key are unable discern whether service provider has applied watermarking to the model. Furthermore, the addition of watermarking does not affect the perfor- mance of the generated text in any downstream tasks. Our main contributions can be summarized as follows:
provide proof that with suitable implementation,
We introduce unbiased watermark, an innovative family of watermark methods that guarantee the non con-degradation of text quality. In addition, we offer comprehensive framework that facilitates the design and detection of unbiased watermarks.
We propose two innovative and practical watermarking techniques known as d-reweight and 7- reweight. Through extensive experimentation, we demonstrate that these techniques preserve output quality in machine translation and text summarization tasks.
We develop an advanced maximin variant of the original log-likelihood ratio test for watermark detection. This novel detection method comes with theoretical guarantees, specifically upper bound on type I error, thus enhancing the reliability of watermark detection in language models.
2 PRELIMINARY
In this section, we delve into the problem of watermarking in the context of LLMs. We begin by setting up the problem and defining essential concepts.
Problem Modeling: We first introduce several notations to formalize the problem. Let 2 denote the vocabulary set, which is the set of all possible tokens an LLM can generate in a single step. We then define the set Σ" as the collection of all possible strings of any length, including those of length zero.
An LLM generates sequence of tokens conditioned on given context. In single step, the prob- ability of generating the next token Fn+1 E Σ given the current context, 31 42, ..., In, can be de- noted as [M æ1, r2,,.., ). The L.M operates in an autoregressive fashion, which means the joint probability of generating multiple tokens En+ly...g In+m can be written as:
m
Pas Pont, #utm I1, 22, (2,
II
PMr (#nts 02,42:-0 Tay In+ll Inti-1)-
i=1
For simplicity, we use the following notation: "0a4ly:..; E Σr
Par(I Imm
x 1im), where E In+
In the context of watermarking, we introduce a service provider that holds a private key from the key space K. The key k E K is chosen at random from the prior distribution Pk(k), The water- marked output of the LLM follows distribution PM, ( T2,... Ini k), which is conditioned on both the key and the context øi.n. Similarly, we use the notation PM, (Ix+ 1m+mm Xi.m; k)) for the probability of generating sequence of tokens in a watermarked model.
Objective. Our goal is devise a watermarking scheme that: a) efficiently detectable by the service provider, b) can't be detected by users and does not negatively impact the quality of the output.
The reason we focus on the detection of watermarks by users is that it is closely related to the output quality. If the watermark causes a degradation the output quality, there should exist a method to infer the presence of the watermark by examining the quality. Conversely, if the watermark is undetectable, it implies that it does not impact the output quality.
From a statistical testing perspective, watermark is considered strictly undetectable if the proba- bility distributions of the watermarked and non-watermarked outputs are identical. To capture this notion, we define several desirable properties of watermarking schemes.
Definition (n-shho--ndeeeectabl)).. For a fixed input sequence a E Σ", we say that watermarked
LLM and key prior pair (PM PK) is uudhee-undeee compared to original LLM Pos if
II Par (ar |a)
Σ keK
Pk (k) 1=1
II
PM a;; k); for any number of strings x² E E".
2

---

Published as a conference paper at ICLR 2024
Definition 2 (downstream (lowsstreamiinvariant). We say the watermarked LLM and key prior pair (PM Pk) are invariant compared to original LLM Pas on downstream tasks iff
[f (xx) = Pa
for any strings z, Σ", and for any metric f E" R.
Note that the -o-----tt-ndetctblle property implies the downstream invariant property, as identical distributions yield identical expectations for any function. Interestingly, this implication does not require the wwhtthhddttectbbeeee can still maintain the output quality for downstream tasks even if the user might discern the existence of the watermark through multiple generation requests.
property for n > 1, which means a watermarking scheme that is
In summary, we have outlined the preliminary concepts and objectives for developing watermark- ing scheme for L.Mss. We highlight the desired properties of n-shot-undettetabiifee and downstream invariance, they provide a rigorous theoretical guarantee of quality preservation and integrity in the deployment of watermark schema. In Section 4 we will present watermark framework that is provably -eshtt-undetectblle for any given integer 1.
WARM UP: UNDETECTABILITY IN A SIMPLIFIED TOY ENVIRONMENT
In this subsection, we aim to prove the feasibility of undetectability in a highly simplified toy en- vironment, This preliminary analysis serves foundation for understanding the more complex scenarios that follow.
Consider service provider that offers random number generation service. The service outputs uniformly distributed random number in the set {0. 13. The clean generation process can be represented (2) 1/2, Vx E {0, 13. We assume that the key & belongs to the set {0, 1} and is selected with equal probability. With the watermark added, the probability of the new output can be expressed as: (M. k)) (z).
Settings.
Recall that the nre-shot-undetectable property can be represented as Ps = EKEK (M k)) Px (k)) Suppose that a user can only make a single request to the service. If the user is unaware of the key, the user will be unable distinguish whether the received result is watermarked or not. Therefore, in this simplified scenario, the undetectability of the watermark is achieved.
However, there is considerable gap between this toy example and the practical implementation of watermarking in LLMs. Firstly, the symbol set Σ in LLMs is far more complex than the binary set (0, 1). and the probability distribution is uniform. Besides, the generation process in LLMs autoregressive, which means that more than one symbol are generated iteratively. Furthermore, the toy example does not satisfy the w-shhot-undetectab property for n. 1.
Despite these differences, this simple example provides essential insights that help in understanding the following sections where we address these challenges. The underlying principles undetectabil- ity remain constant, while their application becomes more intricate in a more complex environment.
WATERMARKING WITH UNBIASED REWEIGHTING
In this section, we build upon the intuition from the previous section and extend the approach to LLMs' generation. The section is structured as follows: Section 4.rtion/4.iiii introduces fundamental math- ematical tool for addressing the reweighting problem in general discrete probability distributions. Section 4.2 applies the reweighting technique to LLMs. Section 4.3 presents the final framework.
4.1 DISTRIBUTION REWEIGHTING
In its most general form, we consider a random watermark code E and a reweight function R : As: > As. which depends the random watermark code F. The set of all possible probability distributions on the symhol set Σ is denoted as As, which forms a simplex.
Definition 3. A reweighting function is tuple PE, R) where & is called the watermark code space, PE is probability distribution on space E, and R is a function R : E x As. + As.- For specific watermark code F, E, denote the partially evaluated reweighting function as Rg AΣ + Az.
Definition 4. Given random watermark code E, and reweighting function RE As: - As, we say that R is an unbiased reweighting function if and only if for all P. E As. EE(Re RE (P) = P.
3

---

Published as a conference paper at ICLR 2024
4.1.1 EXISTING REWEIGHTING METHODS
Kirchenbauer et al. (023) essentially comprise two reweighting methods in their work, but neither of them satisfies the unbiased property.
Both methods have & as the set of mappings / : Σ + {red, green), such that / maps half of the tokens in Σ 'red' and the other half to "green', and PE as uniform distribution. Therefore, the random watermark code E' assigns each symbol to either red or green. The "Hard Red List" method sets the probability of all red symbols vocabulary. The second method is "Soft Red List" blocking, where they randomly select the same "Red List" as the first method and decrease the corresponding probability for red symbols by adding constant ó to the logits of the green symbols, then apply softmax to obtain the final probabilities.
zero and renormalizes the probabilities of the remaining
4.1.2 UNBIASED REWEIGHTING METHODS
In this section, we present two reweighting methods that satisfy the unbiased property. 5-reweight:
Let the watermark code space & be the interval [0. 1]. and let Pe be the uniform proba- bility on E. Leveraging Inverse Transform Sampling (Devroye) 1986). we can sample from distribu- tion P E Ay using a uniformly distributed random number in [0, IJ. Therefore, we have mapping sampling & E. The 6-reweight just returns delta distribution (g(P) p (E)
It is important to note that while the reweighted distribution for each individual random event E a delta distribution, the mean output token probabilities remain the original distribution when considering the randomness of E.
7-reweight: Let the watermark code space & be the set of all bijective function between vocabu- laries set Σ and set of indices [|Σ]] (I,..., |Σ]], where |Σ] is the size of vocabularies set Σ. Essentially, any watermark code E is an indexing function for vocabularies set Σ, and is also equiv- alent total order on Σ. Let PE be the uniform probability on E, it is easy sample a watermark code E by randomly shuffling the symbol list.
Assume the original distribution is (t) Ag, Vt E E. Given the watermark code E [[E]]
we construct auxiliary functions (1) = 1 (E(() & (t), Fs(s) = (2x 1,0), (i) (s(Fr()) The --eweighht yields new distribution Pr) Fr (E(()) - Fr (F(() - 1)-
< but"
"ized"!
"L.utt"
"ized"
E
Shufffe
Ized"
" "but"
Reweight
1/2
I Reweight
"ized"
"ized"
".but"
0
Figure 1: Illustration of d-reweight.
Figure 2: Illustration of 7-reweight.
We provide illustrations of the 6-reweight and y-reweight methods in Figures | and 2
Each block
represents a token, and the width represents the probability of that token, so the total length is The left panel shows the 5-reweight method, where each individual random watermark code F E [0. 1] uniformly sampled from interval [0, 1] corresponds to a specific token according to the horizontal axis, and the reweighted distribution is just å distribution on that token, such that the selected token has 1 probability, and all other vocabulary tokens have a probability of O. The right panel demonstrates the y-reweight method. First, the symbol is shuffled. Then, the left half of the regions are rejected, and the remaining regions are amplified with factor 2
Both methods are unbiased when considering the randomness of the watermark code F. For 8- reweight, we can see that by noticing that the probability of returning a distribution on a token is
Detailed definition and rigorous proof be found in Appendix B
4

---

Published as a conference paper at ICLR 2024
just the original probability on that token, therefore the weighted average of all delta distributions is still the original probability. In the case of y-reweight, although certain regions are rejected and the other regions amplified, every token has the same probability to be in the rejected or amplified region, thus ensuring the unbiased property.
4.2 REWEIGHTING FOR AUTOREGRESSIVE MODEL
The reweighting methods presented in the previous section can be applied to single token-generation directly. Given a prefix Fi,n the probability distribution for generating a new token without watermark is denoted as Par(-lan (ar(-(a1m))
Ag. For a random watermark code E, we sample from new distribution PM (-(mmm))) = (g(PM (-m)) E Ag. If the reweighting function is unbiased, have [g(Rg Re [1]]) = Pas( F1:n). This ensures that, for individual unaware of the watermark code, is impossible to determine whether a new token is sampled directly from Par (-(ar.)) or from PM (- (=121:n; is known, one can perform statistical hypothesis testing to determine the likelihood of a token being sampled from either distribution.
E) for a random watermark E. However, if the watermark code
The main challenge now constructing the watermark code E. Since the LLM generation task is autoregressive, multiple reweighting steps are required, with each step needing a watermark code E; for reweighting the distribution of token Z4.
4.2.1 INDEPENDENCE OF WATERMARK CODES
crucial that E, values are independent to ensure the unbiased nature of the entire sequence, rather than just the single-token generation process.
Theorem 5. Given an unbiased reweighting function (E, PE, R), if Eg values are iid. with the distribution Pg, we have: B.I....F, [PM.
"PP. (21::[11mm)) = Par (X1:n (01:)).
If the E values are not independent, we cannot guarantee that the generation probability of the entire sequence remains unbiased. As extreme example, consider case where all Fg values are identical. Referring to the random bit example in the previous section, assume that the correct distribution is a sequence where each token is random or with equal probability, Identical E; values would result in identical token outputs, ultimately producing sequences consisting solely of O's I's, which clearly biased.
4.2.2 CONTEXT CODE
To construct a large number of independent watermark codes E, during watermarking and to know the used E, values during watermark detection, we follow an approach similar to Kirchenbauer et al. 2023 by combining the information from the prefix and secret key to construct E,
For single token generation process, given a prefix T1, #2.42..... In, we consider an abstract context code space C and an abstract context code generation function we construct the context code Ca+1 = co(21, .2.,.,,, xn). Specific examples include using the entire prefix Ca+1 1z 22, .2,,.., In), and using the most recent prefixes Ca+11 (In-m=+1,- .... T,,,,,. Our comprehensive framework accommodates diverse context code generation approaches, particularly those that integrate error-correctngg mechanisms augment watermark resilience in the face of text manipulation attacks. Nevertheless, we refrain from delving into these strategies within the confines of this paper and consider a subject for subsequent investigation.
Σ* - C. Based the prefix,
The final watermark code defined as E,- = E(c,, k), using a watermark code generation function E:Cx E.
Definition 6. Given an unbiased reweighting function (E, Pg, R) and context code space C, an unbiased watermark code generation function is tuple PE, R, C, K, C,K, E) that satisfies:
1. Unbiasedness: Ex-Px D (P)] P.VP& E As,
2. Independence: For any n. distinct Ci....,Ca C, the values RE(ert) (P) are mutually independent.
Theorem 7. For any unbiased reweighting, function and context code space, an unbiased watermark code generation function always exists.
In practice, pseudorandom numbers can be used to implement the unbiased watermark code genera- tion function in the above theorem. Specifically, the hash value hash(c, k) can be used as a random
5

---

Published as a conference paper at ICLR 2024
seed to sample E from Pg as implementation of E E(c, k). In this paper, employ SHA-256 for hash function and a 1024-bit random bitstring as the key k.
An unbiased watermark code generation function ensures that watermark codes Eg are independent with each other only their context codes are different. During the generation a sequence, context codes may be repeated, although this is rare event in practice. If c; and Cj equal, then E; and Ej are also equal, violating the independence of E,. A simple workaround to skip reweighting for a token when encountering a previously used context code. In other words, we 30 a1:m C14-1) PM (-Ma-11 (1)m: ( if the context code has appeared before.
4.3 FRAMEWORK
Al Algorithm Watermarking framework
1: Input: key for watermark A: E K, prompt d1:m E Σ*, generate length E N, initial code history ech E 2c, context code function cc : " + C. watermark code generation function
c: K + ε, and reweighting function R. Ag > Ag.
2:
fort = 1, ..... do
3:
P; - PM a a 31:8-1)
b original distribution
4:
G eo(- a1:m
context code
5:
if E cch then
6:
Q₁ --P. P.
skip the reweighting
7:
else
8:
cch t och {Gi
record history
9:
E, - B(c,k) - (P)
> watermark code > reweighted distribution
10:
11: Sample the next token x; using distribution Q:
12:
return 11.m
Integrating the tools discussed earlier, we present general framework for watermarking here. The algorithm for this framework outlined in Algorithm [
We note that our abstract framework requires the specification of two key components in order to be practically implemented: the unbiased reweight function R and the context code function cc.
5 STATISTICAL HYPOTHESIS TESTING FOR WATERMARK DETECTION
In the previous section, we discussed the process of adding a watermark to a text based on a secret key and given prompt 01:m- The watermark-embeddter text can be sampled from the distribution (M a1mikk) k). In this section, we focus on the watermark detection task, which is the inverse problem of watermark embedding.
Given text iin. the goal of watermark detection is to infer whether it is more likely to be generated from the unmarked distribution Pas (æ1.m (1:m) or the marked distribution PM. ( (x1.m aamm k). This problem can be formulated as a statistical hypothesis test between two competing hypotheses: Ho, which posits that æ1.. follows the unmarked distribution, and H,, which posits that 1: follows the marked distribution.
5.1 SCORE-BASED TESING
We focus on a particular kind of score-based testing, which assigns a score to each token in the text. The score can be interpreted the confidence that the token was generated by the watermark model rather than the original model. Scores 8; can be computed based on Li:i, in accordance with the autoregressive manner the generation process.
The total score is given by S= Σn_ 8t. A threshold Š
such that if < S, the null hypoth- esis Ho is accepted, indicating insufficient evidence to conclude that the text contains watermark. Otherwise, the null hypothesis rejected. There are two types of error probabilities associated with this decision process: type error, which is the probability of incorrectly rejecting the null hypoth- esis under Ho. denoted as PH, (S > Š), and type II error, which is the probability of incorrectly accepting the null hypothesis under H1, denoted as Pn, (S < Š).

---

Published as a conference paper at ICLR 2024
To derive theoretical results, we require the scores to have specific property: under the null hypoth- esis Ho. the exponential momentum of 8; is bounded, conditioned on the preceding context 21,6-1- This requirement leads to upper bound a, the type error probability.
To derive theoretical results, we require that the scores have particular property: the exponential moment of 8; under Ho should be bounded, conditioned on the previous text 21,1-1- This require- ment leads to an upper bound on the type I error rate.
Theorem 8. Given a probability space A, P) and E-valued stochastic process 3; : as well as an IR-valued stochastic process 8 S i I n, let Je == o S S and F == (s, S S 1) be the corresponding filtrations, where a (-) denotes the a-algebra generated by random variables. Ff FF and Elexp(s;) S 1, then P( 2 t) e
n,
Therefore, to ensure that the type error probability has upper bound o, can set the threshold S as 5 log(a). In the following, we discuss two special scores.
5.2 LOG LIKELIHOOD RATIO (LLR) SCORE
According to the Neyman- Pearsso lemma, the likelihood ratio test is the most powerful test among all tests with the same type I error rate. Specifically, the log-likelihood ratio (LLR) score is defined
as 8; = log
Par [a:] 1:8) and the total score becomes S = llog (ar @1im #1.
Par. (011n @1)mk)
Par (1m))
We now provide an optimization derivation of the above 8 to gain intuition and set the foundation for the maximin variant of the LLR score in the next section. Let P. -Pa(-la1.m- (1s-1)) Qi
ar 01 01:1-1: 1),, and let 8; = (ax,) E R denote the score corresponding to different z;- Note that P., Qi, and S; are all functions with signature Σ - IR, therefore equivalent vectors of dimension [ We can define the inner product as (P,, = >mex (z)
The requirement (exxp(8))1FF;1) S can be reformulated as (Pi, exp(S:)) S 1, where the expo- nential function is applied element-wise. Instead of minimizing the type II error directly, aim to maximize the average score under H1, i.c., (Q1,
The optimization problem becomes maxs, Si), s.t. (P,, (S.)) S 1. The optimal solution given by S((x)) = log Qx(z) which recovers the optimal log likelihood ratio score.
Pi())
5.3 MAXIMIN VARIANT OF LLR SCORE
One major limitation of the LLR score described in the previous section is that when Qx(x) O. (,(x) = co. This means that as long as a single token does not come from the watermark model PM... the score becomes negative infinity, making impossible to reject the null hypothesis Ho.
A more general reason for this issue is that the watermark model Par used in the detection process may not exactly match the true distribution of the watermarked text. In practice, potential sources of discrepancy include editing (e.g., text sampled from PM, w may undergo some degree of editing before being watermark detection) and imperfect estimation of the generation process (c.g., due to lack of knowledge of the exact prompt and temperature used during generation).
To address this problem, we consider a perturbed generation distribution. Instead of the original hypothesis H1, where I1.. follows the watermark distribution PM. we now assume that 2i.n follows a distribution P PM which is similar to but not identical to PM. Specifically, during the generation of each token, the total variation (TV) distance between Q and Q is bounded by d.
The corresponding new optimization problem is (), s.t. (S.).) S 1.
max C.
min
Intuitively, the optimal solution for Q' in the inner optimization decreases (((x) when S,(x) is large and increases (x) when Sx(x) is small.
The computation of the maximin solution can be done efficiently in Ō((E)) time and the specific algorithm is shown in Appendix B.5
It is important to note that the maximin variant of the LLR score is more robust than the standard LLR score, as it yields higher scores when the text has undergone some degree of editing. However, it is not specifically designed to defend against any attacks.
7

---

Published as a conference paper at ICLR 2024
(a) Text summarization
(b) Machine translation
10
23
Porplocity
20
4-
19
No Watermath
d-rowvight
prowigght
Sof((6=00.0)
(o
Sof(
No Watermnak Stoweight
Soh(6=1100 (af((5=00.))
(oft(6-2.00
Figure 3: Distribution of perplexity of output for TS and BLEU score for MT.
A hyperparameter d E [0, 1] that represent the perturbation strength is introduced in the score. Intu- itively, if the text be detected has undergone more editing and deviates further from the distribution PM. d should be larger. In practice, we recommend using grid search to select the best value of d.
Assuming there are candidate values for d, corresponding can modify Theorem 8 as follows.
different scores 8; (1 S a S A),
Theorem 9. Under the same conditions Theorem but with multiple scores s(()) we have
P
max ISO5A
2
Ae
Thus, when using grid search, the final threshold should be adjusted as S =- log((a) + log(A). This ensures that the upper bound of the type I error is still a.
EXPERIMENTS
evaluate the performance of our Unbiased Watermarks on two important applications of seq2seq the BART- large model (Liu et al. 2020) and the CNN-DM (Hermann et al. (013)) corpus as our testing dataset. The MT task involves lannsating English Romanian, for which we employ the Multilingual BART
models: text summarization (TS) and machine translation (MT), For the TS task,
(MBart) (Liu et al. 2020) model on the WMT' En-Ro corpus. For further details on the experi- ment setup. please refer to Appendix
Table 1: Performance of different watermarking methods on TS and MT. We use Fl scores of BERTScore and scale BERTScore and ROUGE- with factor of 100.
Text summarization ROUGE-11
Machine translation
BERTScore
Perplexity
BERTScore
BLEU
No Watermark
32.70 + 0.08
38.56 + 0.09
5.024 + 0.018
55.9 = 0.3
21.8 + 0.3
8-reweight
32.71 + 0.08
38.57 + 0.09
5.022 0.018
56.3 0.3
21.7 + 0.3
7-reweight
32.69 + 0.08
08.60+0.009
5.019
56.2 0.3
21.8 0.3
Soft(5=0.0)
32.70 1 0.08
38.56 1 0.09
5.024.0.011
55.9 0.3
21.8 1 0.3
Soft(8=1.0)
32.35 1 0.08
38.20 1 0.09
5.313 0.018
55.1 1 0.3
21.0 1 0.3
Soft(6=2.0)
31.21 1 0.08
37.17 0.08
6.253 0.022
53.8 1 0.3
19.5 1 0.3
Our primary focus is to compare the performance of our proposed unbiased watermarking methods including the d-reweight and 7-reweight, with the soft-red-list method presented by Kirchenbauer ct al. (2023). The watermark strength in the soft-red-list approach is controlled by parameter
The quality of output post-watermarking is presented in Table I We observed that the output qual- ity remains unaffected by our unbiased watermark methods, both for the 5-reweight and rereweight, irrespective of the task and metric. Conversely, the soft-red-lic rist-ist method, when 8 0, does not in- troduce any watermark and hence does not affect output quality. However, for 0, it significantly impairs the quality of output.
8

---

Published as a conference paper at ICLR 2024
Table 3: Text sampled from OPT-6.7B, with and without watermarks. For "No watermark" (NW), the score is computed based on 5-reweight. When watermarks are included, the corresponding reweighting function is used for computing score. The optimal perturbation strengths d obtained by grid search are 0.9, 0.0, 0.0 for three outputs respectively.
Prompt What is watermark? What's the purpose of it?
score p-value
NW
Why don't you want it on there? I'm confused.. nn think he meant to say logo, since he wrote "watermark", the first word must be typo.)m Yes! Exactly typo, Sorry. English is not my native language.. Thanks the explanation!
0.30
8.14
6-RW
1.2e-32 Alt is supposed to be watermarking the pictures that you took with your phone think. So, so you can share your pictures and take credit for them.
75.9
--RW
nA watermark a small image or logo (often square pixels) that is placed over the larger, original image. It serves primarily to distinguish copyright or ownership of large images (such as banners and logos) and, on rare occasion, to identify small images (such as thumbnail images for blog posts and pictures).
32.9 5.7e-14
Figure 3 provides a more intuitive depiction of the score distributions. It is evident that our unbiased watermark methods not only ensure that the mean performance remains unaffected but also that the performance distribution is stable. Conversely, the soft-red-list method shows notable performance decrease.
In terms of watermark detection, we com- pute score associated with each token. The mean and variance of score per token for TS and MT are presented a heuristic, if the sum of the scores for all tokens in a sentence reaches 10, a p-value of less than 0.0005 is ensured. If the sum score hits 20, the p-value must be less than 3.-8.
Table 2: Mean and variance of score per token for different reweighting methods and different tasks.
Table 2 As
Text summarization Machine translation
8-RW 0.8784 1.4354 RWW
0.4192 + 1.1361 0.1056 + 0.2916
0.2207 + 0.3678
Additionally, we provide an example of watermarking applied to a completion task in Table 3 visually demonstrates the score distribution across tokens: positive scores represented in green, and negative ones red. The intensity of the color corresponds to the magnitude of the score, with darker shades representing larger absolute values.
7 RELATED WORK
The idea of watermarking text has been widely explored by many researchers (Cox et al., 2007
Kamaruddin al. [2188] Podilchuk & Delp [001] Potdar et al. 2005 Atallah al. 2001 Jalil &
Mirza 2009 Stefan et al. (2000: Petitcolas et al. 1999). even before the advent of large language models.
Recent advancements in generative models have opened new possibilities for directly generating watermarked results. Two relevant prior works in this domain are by Kirchenbauer al. (2023)
and Aaronson (2022). Various concurrent studies (Christ et al.) 2023 Kuditipudi et al.] [023]] Wang al. 2023b; Yoo et al., (023b) have further enriched this domain. Due to space constraints, we
moved the in-depth analysis and other related work to Section
CONCLUSION
Overall, this paper provides a novel framework of watermarking for language models, demonstrat- ing that it is possible to use watermark to protect intellectual property and monitor potential misuse without compromising the quality of the generated text. This research serves as a valuable founda- tion for future work in the field of watermarking for large language models.
This is upper bound computed hased Theorem does necessarily imply that the p-value exceeds 1.
The upper bound could he larger than 1, but this

---

Published as a conference paper at ICLR 2024
ETHICS STATEMENTS
Our unbiased watermark has removed major hurdles for large-scale application of watermarks. The two primary obstacles previously were the potential for watermarks to degrade the quality of output and the possibility for users to discern the presence of watermarks. Our method addresses both of these issues thoroughly.
9.1 IMPACT ANALYSIS
Traceability and accountability Traceability refers to the ability to trace back the origin of a text. Any watermarking method, including method in this paper, contribute to traceability. an era of misinformation and disinformation, this allows for holding providers accountable for the content generated by their models.
Identifying model-generated texts Watermarking method can be used to distinguish which texts generated by the models. This prevents unnecessary training the data generated by the models themselves.
Ownership Watermarking method can help provide evidence in situations where a provider claims ownership over generated text (Sun al. 2023).
Data privacy concerns The use of different watermarks, applied discretionarily, could poten- tially link generated text back to specific user or request. This could be seen as a breach of users' privacy, raising important data privacy concerns.
Manipulation and removal of watermarks The ongoing development of techniques to manip- ulate or remove watermarks could lead to "arms race" between providers attempting to secure their watermarks and users trying to remove them.
9.2
ETIIICLL CONSIDERATIONS
There are several ethical considerations in the pursuit of watermarking technology.
Consent Users have the right to be informed about the use of watermarks and should have the option opt-out.
Transparency Providers should be transparent about the use of watermarks, including informa- tion on what is embedded within these watermarks and how it's used. If the watermarks contain identifying information, providers should clearly state who can access this information and take appropriate measures to prevent potential misuse.
Fair The application of our watermarking technique should not interfere with the legitimate use of the service by users.
Our watermarking method does not degrade the quality of the output, ensuring the values of fair use are upheld. However, it also introduces a potentially challenging issue.
Due to the undetectable nature of technique, every might have to assume that the service they are using has been watermarked, as it cannot be disproved. This raises challenging questions on how to ensure consent and transparency.
9.3 CONCLUSION
Our unbiased watermarking method brings improved traceability and attribution and ensures that fair is not compromised. However, it also poses significant challenges in data privacy, transparency, and consent. Any implementation of this system needs to be done thoughtfully and ethically, with clear communication users about how it works and what it means for them.
10

---

Published as a conference paper at ICLR 2024
ACKNOWLEDGMENTS
This work was partially supported by NSF IIS 2347592, 2347604, 2348159, 2348169, DBI 2405416, CCF 2348306, CNS 2347617.
REFERENCES
Scott Aaronson. My ai safety lecture for effective altruism. November 2022. URL https:
7/scot blogl 6823
Sahar Abdelnabi and Mario Fritz. Adversarial watermarking transformer: Towards tracing text provenance with data hiding. In 2021 IEEE Symposium on Security and Privacy (SP), pp. 121- 140. IEEE, 2021.
Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weak- ness into strength: Watermarking deep neural networks by backdooring. In 27th USENIX Secu- rity Symposium, pp. 1615-1631, 2018.
Mikhail Atallah, Victor Raskin, Michael Crogan, Christian Hempelmann. Florian Kerschbaum, Dina Mohamed, and Sanket Naik. Natural language watermarking: Design, analysis, and proof-of- proof--f-concept implementation. In Information Hiding: 4th International Workshop, IH 2001 Pittsburgh, PA, USA, April 25-27, 2001 Proceedings 4, pp. 185-200 Springer, 2001.
Loic Barrault, Ondřej Bojar, Marta R. Costa-jussà, Christian Federmann, Mark Fishel, Yvette Gra- ham, Barry Haddow, Matthias Huck, Philipp Koehn, Shervin Malmasi, Christof Monz, Mathias Müller, Santanu Pal, Matt Post, and Marcos Zampieri. Findings of the 2019 conference on ma- chine translation (WMT19). In Proceedings of the Fourth Conference on Machine Translation (Volume 2: Shared Task Papers, Day 1). pp. 1-61, Florence, Italy, August 2019. Association for Computational Linguisties. doi: 10.18653/v1/119-350
Franziska Boenisch, A systematic review on model watermarking for neural networks. Frontiers in big Data, 4:729663, 2021.
Ondłej Bojar, Rajen Chatterjee, Christian Federmann, Yvette Graham, Barry Haddow, Shujian Huang, Matthias Huek, Philipp Koehn, Qun Liu, Varvara Logacheva, Christof Monz, Matteo Negri, Matt Post, Raphael Rubino, Lucia Specia, and Marco Turchi. Findings of the 2017 ference on machine translation (WMT17). Proceedings of the Second Conference on Machine Translation, pp. 169-214, Copenhagen, Denmark, September 2017. Association for Computa- tional Linguistics. doi: 10. 1,.16633/1/W17-4711.
Nicholas Boucher, Ila Shumailov, Ross Anderson, and Nicolas Papernot. Bad characters: Imper- ceptible nlp attacks. In 2022 IEEE Symposium on Security and Privacy (SP), pp. 1987-2004. IEEE, 2022.
Yuei-Lin Chiang, Lu-Ping Chang, Wen-Tai Hsieh, and Wen-Chih Chen. Natural language wa- termarking using semantic substitution for chinese text. Digital Watermarking: Second In- ternational Workshop. IWDW 2003, Seoul, Korea, October 20-22, 2003. Revised Papers 2, pp- 129-140. Springer, 2004.
Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. arXiv preprint arXiv:2306.0 09194, 2023.
Hyung Won Chung. Le Hou, Shayne Longpre, Barret Zoph, Yi Tay, William Fedus, Eric Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, al. Scaling instruction -inettuen- language mod- cls. arXiv preprint arXiv:2210.11416, 2022.
Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermark- ing and steganography. Morgan kaufmann, 2007.
Evan Crothers, Nathalie Japkowicz, and Herna Viktor. Machine generated text: A comprehensive survey of threat models and detection methods. arXiv preprint arXiv:2210.0732/ 2022.
11

---

Published as a conference paper at ICLR 2024
Falcon Z Dai and Zheng Cai. Towards near-imperceptible steganographic text. arXiv preprint arXiv:1907.06679, 2019.
Luc Devroye. Non-Unifori Random Variate Generation. Springer New York, 1986.
Tina Fang, Martin Jaggi, and Katerina Argyraki. Generating steganographic text with Istms. arXiv preprint arXiv:1705.107444 2017.
Jinlan Fu, See-Kiong Ng. Zhengbao Jiang, and Pengfei Liu. Gptscore: Evaluate as you desire. arXiv preprint 03X1:23002.0166, 2023.
Evgeniy Gabrilovich and Alex Gontmakher. The homograph attack. Communications of the ACM, 45(2):128, 2002.
Margherita Gambini, Tiziano Fagni, Fabrizio Falchi, and Maurizio Tesconi. On pushing deepfake [weet detection capabilities to the limits. In 14th ACM Web Science Conference 2022, pp. 154- 163, 2022.
Riley Goodside. There are adversarial attacks for that proposal well in particular, generating with emojis after words and then removing them before submitting defeats it.,. January 2023. URL htt.://ppp///ittteee....oo/oogoa
Google. Palm-2-llm. http::/whw.ooooooeeeooooooloolop 2023.
Chenxi Gu, Chengsong Huang, Xiaoqing Zheng, Kai-Wei Chang, and Cho-Jui Hsieh. Watermarking pre-trained language models with backdooring. arXiv preprint urXiv:2210.07543, 2022.
Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06777 2017.
Xuanli He, Qiongkai Xu, Lingjuan Lyu, Fangzhao Wu, and Chenguang Wang. Protecting intellec- tual property of language generation apis with lexical watermark. In Proceedings of the AAAI Conference Artificial Intelligence, volume 36, pp. 10758-10766, 2022a.
Xuanli He, Qiongkai Xu, Yi Zeng, Lingjuan Lyu, Fangzhao Wu, Jiwei Li, and Ruoxi Jia. Cater: Intellectual property protection generation apis via conditional watermarks. arXiv preprint arXiv:2209.08773. 2022b.
James N Helfrich and Rick Neff. Dual canonicalization: An answer the homograph attack. In 2012 eCrime Researchers Summit, pp. 1-10. IEEE, 2012.
Karl Moritz Hermann, Tomás Kociský, Edward Grefenstette, Lasse Espeholt, Will Kay, Mustafa Suleyman, and Phil Blunsom. Teaching machines to read and comprehend. In Corinna Cortes, Neil D. Lawrence, Daniel D. Lee, Masashi Sugiyama, and Roman Garnett (eds.), Advances in Neural Information Processing Systems 28: Annual Conference on Neural Information Process- ing Systems 2015, December 7-12, 2015, Montreal, Quebec, Canada, pp. 170911701, 2015.
Daphne Ippolito, Daniel Duckworth, Chris Callison- -urrch,,BBurh,, and Douglas Eck. Automatic detection of generated text is easiest when humans are fooled. arXiv preprint arXiv: 091119911000000 2019.
Srinivasan Iyer, Xi Victoria Lin, Ramakanth Pasunuru, Todor Mihaylov, Dániel Simig, Ping Yu, Kurt Shuster, Tianlu Wang, Qing Liu, Punit Singh Koura, et al. Opt-iml: Scaling language model instruction meta learning through the lens of generalization. arXiv preprini 22Xiv:2212.12000 2022.
Zunera Jalil and Anwar M Mirza. A review of digital watermarking techniques for text docu- ments. In 2009 International Conference on Information and Multimedia Technology, pp. 230- 234. IEFF, 2009.
Ganesh Jawahar, Muhammad Abdul- Mageed, and Laks VS Lakshmanan. Automatic detection of machine generated text: critical survey. arXiv preprint 2XXv:2011.013 14, 2020.
12

---

Published as a conference paper at ICLR 2024
Hengrui Jia, Christopher A Choquette-Chere Varun Chandrasckaran, and Nicolas Papernot. En- tangled watermarks as a defense against model extraction. In USENIX Security Symposium, pp- 1937-1954, 2021.
Nurul Shamimi Kamaruddin, Amirrudin Kamsin, Lip Yee Por, and Hameedur Rahman. A review of text watermarking: theory, methods, and applications. IEEE Access, 1.8011-8022 2018.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. arXiv preprint arXiv:2301. 2023.
Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit lyyer. Paraphras- ing evades detectors of ai ti-generated text, but retrieval an effective defense. arXiv preprint arXiv:2303. 13408, 2023.
Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion-fre watermarks for language models. arXiv preprint arXiv:2307.15593, 2023.
Zheng Li, Chengyu Hu, Yang Zhang, and Shanqing Guo. How to prove your model belongs to you: A blind-watermark based framework to protect intellectual property of dnn. In Proceedings of the 35th Anmual Computer Security Applications Conference, pp. 227-17,, 2019.
Chin Yew Lin. Rouge: A package for automatic evaluation of summaries. In Text summarization branches out, pp. 74-81, 2004.
Yang Liu and Mirella Lapata. Text summarization with pretrained encoders. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th In- ternational Joint Conference Natural Language Processing (EMNIP-IJCNNPP) pp. 3730- 3740, Hong Kong, China, November 2019. Association for Computational Linguistics. doi:
Yinhan Liu, Jiatao Gu, Naman Goyal, Xian Li, Sergey Edunov, Marjan Ghazvininejad, Mike Lewis, and Luke Zettlemoyer. Multilingual denoising pre-training for neural machine translation. Trans- actions of the Association for Computational Linguistics, 8:726-742, 2020.
Hasan Mesut Meral, Bülent Sankur, Sumru Özsoy, Tunga Güngör, and Emre Sevinę. Natural language watermarking via morphosyntactic alterations. Computer Speech & Language, 23(1): 107-125, 2009.
OpenAl. Chatgpt. hhpp://openaii.om//llg///tt
2023a.
OpenAl. Gpt-4 technical report. arXiv, 2023b.
Luca Pajola and Mauro Conti. Fall of giants: How popular text-based mlaas fall against simple evasion attack. In 2021 IEEE European Symposium on Security and Privacy (EuroS&P), pp- 198-211. IEBE, 2021.
Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. Bleu: method for automatic evaluation of machine translation. In Proceedings of the 40th annual meeting of the Association for Computational Linguistics, pp. 3-1331 2002.
Fabien AP Petitcolas, Ross J Anderson, and Markus G Kuhn. Information hiding-a survey. Pro- ceedings of the IEÉE, 87(7):106--1078, 1999.
Christine Podilchuk and Edward J Delp. Digital watermarking: algorithms and applications. JEEE signal processing Magazine, 18(4):33-44) 2001.
Vidyasagar M Potdar, Song Han, and Elizabeth Chang. A survey of digital image watermarking techniques. In INDIN'O OS. 2005 3rd IEEE International Conference on Industrial Informatics, 2005., pp. 709-716. IEEE, 2005.
Stefano Giovanni Rizzo, Flavio Bertini, and Danilo Montesi. Fine-grain watermarking for intellec- tual property protection. EURASIP Journal on Information Security, 2019:1-20, 2019.
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? arXiv preprint I1 2023.
13

---

Published as a conference paper at ICLR 2024
M Hassan Shirali-Shahrees and Mohammad phy. In 2008 international conference on intelligent information hiding multimedia signal processing. pp. 1524-1526. IEEE, 2008
A new synonym text steganogra-
Katzenbeisser Stefan, A Petitcolas Fabien, et al. Information hiding techniques for steganography and digital watermarking, 2000.
Yuchen Sun, Tianpeng Liu, Panhe Hu, Qing Liao, Shouling Ji, Nenghai Yu, Deke Guo, and Li Liu. Deep intellectual property: A survey. arXiv preprint arXiv:2304. /4613, 2023.
Reuben Tan, Bryan A Plummer, and Kate Saenko. Detecting cross-modal inconsistency to defend against neural fake news, arXiv preprint arXiv:2009.07 07698, 2020.
Ruixiang Tang, Yu-Neng Chuang, and Xia Hu. The science of detecting Ilm-generated texts. arXiv preprint 2xXi:23033.0205.. 2023.
Yi Tay, Dara Bahri, Che Zheng, Clifford Brunk, Donald Metzler, and Andrew Tomkins. Reverse engineering configurations of neural text generation models. arXiv preprint arXiv:2004.06001, 2020.
Mercan Topkara, Cuneyt M Taskiran, and Edward Delp III. Natural language watermarking. In Security, Steganography, and Watermarking of Multimedia Contents VII, volume 5681, pp. 441- 452. SPIE, 2005.
Mercan Topkara, Giuseppe Riccardi, Dilek Hakkani- and Mikhail J Atallah. Natural language watermarking: Challenges in building a practical system. In Security, Steganography, and Water- marking of Multimedia Contents VIII, volume 6072, pp. 106-117, SPIE, 2006a.
Mercan Topkara, Umut Topkara, and Mikhail J Atallah. Words are not enough: sentence level nat- ural language watermarking. In Proceedings of the 4th ACM international workshop Contents protection and security, pp. 37-46, 2006b.
Umut Topkara, Mercan Topkara, and Mikhail J Atallah. The hiding virtues of ambiguity: quantifi- ably resilient watermarking of natural language text through synonym substitutions. In Proceed- ings of the 8th workshop on Multimedia and security, pp. 164-174, 2006c.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Niko- lay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open founda- tion and fine-tuned chat models. arXiv preprint arXiv:2307.0922 097.0888...8. 2023.
Honai Ueoka, Yugo Murawaki, and Sadao Kurohashi. Frustratingly easy edit-based linguistic steganography with masked language model. arXiv preprint arX1v:2104.099833 2021.
Ashish Venugopal, Jakob Uszkoreit, David Talbot, Franz Josef Och, and Juri Ganitkevitch. Water- marking the outputs of structured prediction with an application in statistical machine translation. In Proceedings of the 2011 Conference on Empirical Methods in Natural Language Processing, pp. 1372, 2011.
Hong Wang, Xuan Luo, Weizhi Wang, and Xifeng Yan. Bot or human? detecting chatgpt imposters with a single question. arXiv preprint arXiv:2305.06424 2023a.
Lean Wang, Wenkai Yang, Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun. Towards codable text watermarking for large language models. arXiv preprint arXiv:2307.1599) 2023b.
Alex Wilson and Andrew D Ker. Avoiding detection on twitter: steganography, Society of Photo-optical Instrumentation Engineers, 2016.
embedding strategies for linguistic
Alex Wilson, Phil Blunsom, and Andrew D Ker. Linguistic steganography on twitter: hierarchical language modeling with manual interaction. In Media Watermarking, Security, and Forensics 20/4, volume 9028, pp. 9-25. SPIE, 2014.
Alex Wilson, Phil Blunsom, and Andrew Ker. Detection of steganographic techniques twitter. In Proceedings of the 2015 Conference on Empirical Methods in Natural Language Processing, pp. 2015.
14

---

Published as a conference paper at ICLR 2024
Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, et al. Huggingface's 's transformers: State-of-the ahe- natural language processing. arXiv preprint arXiv:1910003771, 2019.
Max Wolff and Stuart Wolff. Attacking neural text detectors. arXiv preprint 1xXi:2002.117666 2020.
Xi Yang, Jie Zhang, Kejiang Chen, Weiming Zhang, Zehua Ma, Feng Wang. and Nenghai Yu, Trac- ing text provenance via context-aware lexical substitution. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pp. 1 11613-11621 2022.
Ki Yoon Yoo, Wonhyuk Ahn, Jiho Jang, and Nojun Kwak. Robust natural language watermarking through invariant features. arXiv preprint arXiv:2305.01904 2023a.
KiYoon Yoo, Wonhyuk Ahn, and Nojun Kwak. Advancing beyond identification: Multi-bit water- mark for language models. arXiv preprint arXiv:2308.00221, 20236.
Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. Defending against neural fake Advances in neural information processing systems, 32, 2019.
Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Mare Ph Stoecklin, Heqing Huang, and Ian Molloy. Protecting intellectual property of deep neural networks with watermarking, In Proceed- ings of the 2018 on Asia Conference on Computer and Communications Security, pp. 159 172, 2018.
Xuandong Zhao, Yu-Xiang Wang, and Lei Li. Protecting language generation models via invisible watermarking. arXiv preprint arXiv:3302.03162, 2023.
Zachary M Ziegler, Yuntian Deng, and Alexander M Rush. Neural linguistic steganography. arXiv preprint 1999 2019.
A RELATED WORKS
A.1 TEXT WATERMARKING
The idea of watermarking text has been widely explored by many researchers (Cox et al. 2007 Kamaruddin et al. 2018 Podilchuk & Delp 2001 Potdar et al. 2005 Atallah et al. 2001 Jalil & Mirza 2009: Stelan al. Petitcols et al. 1999), even before the advent of large language models. Several techniques involve editing existing text to add a watermark, such as changing
synonyms (Topkara al., 20055 2006c; Chiang al., 2004 Venugopal al.] [011] Yang et al.
2022 or visually indistinguishable words (Rizzo et al.] 2019). altering sentence structures (Topkara
al. 2006b Meral al. 2009), and employing neural networks (He et al., 2022a Yoo al.,
2023a).
Recent advancements in generative models have opened new possibilities for directly generating watermarked results. Two prior works in this domain are by Kirchenbauer et al. (2023) and Aaron-
son (2022) Kirchenbauer al.'s pioneering work, which uses the previous context to generate watermarked tokens, heavily influences our approach. However, their watermarking technique can introduce bias the output, leading performance degradation. Our work addresses this limitation by applying unbiased reweighting and recording context code history.
Aaronson (022) have talked about using a pseudo-random cryptographic function for watermark- ing, but the details are not disclosed, making it challenging to conduct direct comparison. Aaron- son's "cryptographic pseudorandom function" could be a special case of reweighting function in this paper. However, in his blog, there is apparent structure akin to "context code history". a mechanism that plays a crucial role our work to ensure -ssot-undetecttailiity Therefore, remains uncertain whether Aaronson's 's technique could offer similar theoretical guarantee of n- chdetttddetcttbiiiiyyy as ours. Additionally, it is not clear if their method provides an upper bound on type error, like Theorem
15

---

Published as a conference paper at ICLR 2024
Several concurrent studies have explored methods to reduce the bias in watermarking. (Chiist al. 2023) depends on computational power to ensure that an attacker cannot efficiently detect water- marks. This approach presents different trade-off from work; while we rely additional watermark storage, we can strictly guarantee n-shot undetectability, regardless of the computational resources available the attacker. Later, Kuditipudi et al. (2023) builds watermark based watermark key sequence. However, when the generated content length exceeds the length of the watermark key sequence, may use the same key sequence, resulting in compromise of strict unbiasedness.
Additionally, there has been research focus on multi-bit watermarking such as Wang et al. (2023b) and Yoo et al. (2023b).
A.2 ATTACKS ON WATERMARKS
Alongside the development of watermarking technologies, various methods to modify and remove these watermarks and their countermeasures have also been explored. These include attacks based on invisible characters and homoglyphs (Gabrilovich & Gontmakher 2002, Helfrich & Neff 2012] Pajola & Conti 2021 Boucher et al. 2022). generative attacks such as those that prompted the model to change its output in predictable and easily reversible way (Kirchenbauer et al. 2023), and specific instances such as the emoji attack (Goodside) 2023), and paraphrasing attacks (Sadasivan
et al. 2023
Krishna al. 2023
A.3 STEGANOGRAPHY IN TEXT
Steganography hides information in text primarily for secret communication. bears similarities to
watermarking in that it seeks to conceal information. However, while watermarking only needs to
detect the presence of watermark, steganography must recover all embedded information. Many approaches have tried to edit existing text, through rule-based transformations (Wilson et al.) 2015 Wilson & Ker 2016), synonym-basee -based methods SShirali-Shahrene & and more recently, neural network-based methods (Abdelnabi & Fritz, [202]] Ueoka et al.
2014
2008
2021
Information can also be embedded directly during generation (Fang et al.] 2017 7 Dai Cai
2019
Ziegler et al. 2019).
A.4 WATERMARKING MODELS
Watermarking has also been applied to models themselves to protect intellectual property rights and
to guard against model stealing or extraction (Jia et al.] 2021 Boenisch, [022]] Zhao et al. 2023)
The aim here is to gather evidence through inference services (Li et al. 2019 Zhang et al. 2018
and can be accomplished by adding backdoors to models (Adi et al. 2018 8 Gu et al. 2017 2022
While they similar text watermarking in that they embed information without impacting fair use, the focus is on tracing the model rather than the text.
A.5 DETECTING MACHINE-GENERATER TEXT
The objective of detecting machine-genece generated text lies in discerning whether a given text has been produced by an algorithm or written by a human. Such detection crucial to prevent misuse and substantial body of research has explored this area (Zellers et al.) 2019 Ippolito et al. | Crothers cet al., 2022, Jawahar et al. 2020 Tan et al., 2020 Tay et al. 2020 Tang et al. [022]] Wang et al.) 2023a). However, the task has become increasingly challenging due to the continual improvement in language models and the advent of adversarial attacks (Gambini et al. 2022 Wolff & Wolfi 2020
Sadasivan et al.) 2023). The difference between this and text watermarking that watermarking
is employed to differentiate whether a text is generated by a particular model or provider, yet the detection of meneeae-generated text not concerned with specific model.
16

---

Published as a conference paper at ICLR 2024
B DETAILED DEFINITION AND ADDITIONAL PROOFS
B.I DETAILED DEFINITION AND ADDITIONAL PROOFS FOR SECTION 4.1
Definition 10 (hard/soft-red-list reweighting (Kirchenbauer et al. (023 Given two hyper- parameters 0 S S and 6 O. let the watermark code space be
{E E {0,1]*
[ such that f maps y-portion of the tokens in to (which interpreted as "green") ) and the other portion to 0 (which interpreted as "red"), and let PE to be the uniform distribution on space E. For any watermark code E, and for any token distribution P E Az, the outpur distribution of the hard-red-list reweighting function on a token t E E is defined by ((L)P(()
(t) Eier (1)) assuming EiEr E(t) > 0. The soft-red-list reweighting function exp(log +(O+))
is defined by (E(P)(1) Eez expllog P())+ where > O is fixed constant.
Theorem 11. Hard-red-lic and soft-red-list reweighting functions are biased.
Proof. We first show the hard-red-list reweighting is biased. For 7 0.5, consider 2 {a, ba, P(a) = 0.9, P(b)= 0.1, we have
1
P(a) 0 P(a)
Re(P)(a)
+0x
0.5 + 0.9 P(a). P(b)
We then show the soft-red-list reweighting is biased. For 7 0.5, consider E (a, P(a) 0.9, P(b) 0.1, we have
P(P(a) (g(P)(a)= 2 P(a) P(b) + 2
P(a)
x P(a) + Pla)+e&P(0)
It is easy to verify that for any d 0, we have RE P(a).
Thus, hard/soft-red-liin reweighting are both biased.
Definition 12 (f-reweight). Let the watermark code space & be the interval [0, 1}, and let E be uniformly distributed on Given an arbitrary token distribution E Ag. let B be a bijection between Σ and [[]]] construct cumulative density function of P w.r.t. B by Fp(t; B) Ever 1(B(t) & ((I)) E E. Then we can define a mapping sampling : 3 - E,
sampling p = (TEE),
where
I(E) min B(t) s.t. E Fp(t: B),
The 8-reweight function is defined by Rg(P) Ssampling (EE).
Definition 13 (y-reweight). Let the watermark code space E be the of all bijective function between vocabularies set E and a set of indices [|>]] {1,..., Σ),, where [E] is the size of vocabularies set E. Assume the original distribution is Pr(t) As, Vt E. Given the watermark code E 2 + [[21], we define
AE max
1 (()()))))r((()) 1,0 VEE
where 1(E(t) < 1) 1 when E(t) i otherwise 1(E(t) S i) O. We define Procy (t) AE (t())(() Ax(((t) 1). It's easy to verify PTo(E) is distribution by Vt E Σ, Pr (1) 2 and EIEZ (t) = 1. Thus, 7-reweight function is defined by (g(Pr) = PT
Theorem 14. Both 8-reweight and rereehhhht are unbiased reweighting functions.
Proof. According to Definition need show E5 (Re( P for arbitrary P Az.
17

---

Published as a conference paper at ICLR 2024
For 5-reweight, we have (P(P) Sxmmping (F) and E is uniformly distributed [0. 1]. Thus, only need to show vt. E E, Eg sampling (B)) = P()).
I. 1 (ssamplingp(e) = t) de,
EE Egldsumpling p [E)(
1(I(e) B(t)) de,
(I)
FF(t;; B) FP(B (B(BB)((())) 1): B(t) > B(I) =1
B)(;;B)
P(I).
For y-reweight, we need to show Vt E 2, Eg [g( Pr(t)
Br(RR(PP)(e (E) (t)]
(2)
EE[Ag E(t)) Ag(E(t)) 1)].
Denoted by (E(1) 2 (Erex: ((E(t) 1 (t) 1. AE E &, we consider the reserved order E" of E, we have E(t) + E = n + and
gE (E) = Σ { s E(t) + (E(() 2 E(t) + 1))r((() -2 = O.
PEE
So we have
max - (00 (x-
(F0 max (t)) - max (E (t) 1),0)
-1))-)) (1) 0)+
gF-
(1) 0)
<0)-
-9n(E(1)) 9=(((()))) -500)))5((()) (((((())) 11) 0)
9E(E(t)-
-2Pr((),
(3)
which yields
Eg Rg = (e(A&(E(1)) AE(E()) 1)]-
(Er[An(((()) Ar (E(() 1)] E (E A (E" 1)))
= PP(()).
(4)
B.2 ADDITIONAL PROOFS FOR SECTION
Proof of Theorem
We have
E E E. [MM w 11:m [1.m)]
EE EEg..... ..... E.-1 Eg, PM, w (1 (1:m))
-EE Fo-1 EF, [P Mr (In l a1 2im- )) P Prr, (2 ((mm))
-EF, [PM wo (2 almm 2 I:n 1)] [ En [P 1In [amm)
-PM (2:n/a (aimm xinn Eg E..,, PM. (1 01:m))
18

---

Published as a conference paper at ICLR 2024
where the second last step the independence of the E, values and the last step uses the unbi- asedness of the reweighting function. Repeating the same argument for the remaining Eg values, we obtain
E PM (1.m)) = PM (1mm))m))))))
Proof of Theorem Given watermark code space & and watermark code distribution PE(e), construct a key space K g where each key function from the context code space to the watermark code space. The random key probability density function is defined as (k( NLec (k((())).
This construction forms particular instance of an unbiased watermark code generation function.
B.3 DETAILED THEORY FOR SECTION
Corollary 15. For every generation request by user, Algorithm 7 can provide generation result. This generation service is n-shot undetectability for any n E N if the unbiased watermark code generation function is employed, and the context code history is continuously recorded. Specifically, the context code history ech is updated after each invocation of Algorithm | and the resulting context code history is used as the initial context code history for the next invocation.
On the other hand, if the context code history is reset after every generation task, the generation service only guarantee 1-shot undetectabilityy
Proof. The key design element in this service is the context code history. By maintaining the context code history throughout the generation process, we can ensure that each time the reweighting is performed, the context code is unique, i.e., it has not appeared in any previous generation tasks. According to the properties of the unbiased watermark code generation function Definition 66) this guarantees that the watermark codes generated during each reweighting are independent of previously generated watermark codes. As a result, the final distribution unbiased, and rt-hoot undetectability is achieved.
However, if the context code history is reset after every generation task, it is possible for two in- vocations of Algorithm to produce the same context code, leading to the same watermark code. Consequently, n-shot undetectability cannot be guaranteed for n > 1, and the generation service only provide 1-shot undetectability.
A straightforward variant of the above approach exists in the form of batch variant. If the batch size set and the context code history is reset after each batch, the system can ensure b-shot undetectability.
B.4 PROOF OF TAILED BOUNDS IN SECTION 5
Proof of Theorem g
E
8i
= E
exp
Σ
(lexp(sn))
1=1
E
exp
Σ
St
< S...5
$1
where the abbreviation in the last step means applying similar inequalities multiple times. By applying the Chernoff bound, we obtain the desired result.
Proof of Theurem 9 From Theorem 3, we know that
P
2 t
S _t-
19

---

Published as a conference paper at ICLR 2024
Thus,
P
max IsaSA
Σ S
2 2
S
Σ
P
Σ
(a)
21
s
Ae
1=1
15aşA
A
i=1
B.5 DETAILS ON MAXIMIN VARIANT OF LLR SCORE
B.5.1 DERIVATION OF THE SOLUTION
Recall that we are dealing with the maximin problem given as:
min G, Q/ (.),
max Si
s.t.
exp(())) S 1.
We can find relaxation by replacing the constraint Q E Ag with Exer Q1(x) 1 and no longer requiring (x) 2 Thus, obtain the following inequality:
O%, 2 a TV
min
E.E. ((00).. S,).
min
The new maximin problem becomes:
min ER (10)=..VV0 (Q,
max 8:
s.l.
exp())))) 1.
This relaxation tight, meaning does not affect the final maximin optimal solution. This is because, even though the relaxed problem does not require (((x) 2 0, the maximin problem's optimal solution S and Q'" must satisfy Qi (x) 2 Otherwise, S (a)) could further reduced, implying that S7 (a:) is not an optimal solution and leading to contradiction.
The inner optimization of the relaxed problem can be solved directly:
min E.Ex (a 1% Si) + d (min St(x) max Si()))
This leads the new maximization optimization problem:
max S.). + min S,(x) - max max S,
s.t. (Pr,exp(S)) 1.
We find the KKT conditions for this optimization problem by rewriting it as follows:
max S:
(Q) - d(max S, min Sz)
s.t.
(P. $
max S > (z(z),
min < S,(x).
Let the Lagrangian be
L = max S.) + d(min S; max St)
S,
+ X(1 - (P., eSp()))))
+ (u, max S₁ St)
Sv min St)-
20

---

Published as a conference paper at ICLR 2024
Then, the KKT conditions
ØL
(Qi(.) - [Q(())
+ [(=)]]
exp(s(())) 0,
(.)
0L = -d +
Σ
u(x)) 0,
0mxx S
3EΣ
0L
d Σ v(x) = 0,
O S
3EΣ
X(1 - (P., exp(s.))) 0,
(u, max S: - S:) 0,
(U min St) O.
We can solve for the value of X:
ØL (S((z)
Σ m
d - Σ Pa(x) exp(s((x)) 0. *E
Note that À cannot be O, so the fourth KKT condition implies (P,, exp(S:)) I. Consequently, the above equation implies X = 1.
The final solution is given by:
S.(a) = log Qi(x) u(x)) + v(x)
Pτ(x))
<(x) + 0 iff ((()) = max Si(r),
v(x) + 0 S((x) = -min St(x),
u((z)= Σ u(z) = d.
RE 3EΣ
B.5.2
COMPUTING THE SOLUTION
Let
Xmax = {ir E Σ (((()) max S(x)),
Xmin = for E S((x) min (z))
If x of Xmaxx U Xmin+ then we have
S₂(x) = log Qx(x)
(x)
If ar E X Xmax then we have
max S1(x) S, log (z(z) u(x) + v(x)
Px(x)
Summing over all x E X Xmax, and noting that ExEXmox u(I) = d, we obtain:
ExE X mas
Qi(x)= d + Ezex v(x)
max S( = -log
Exex X Px(x)
2
Similarly,
min S,(x) log ExEX Qi(z) - ExEXmi u(x)) d Exe Xomn P,(x)
2²
When Exex... u(x)) # 0, it implies that there exists an x E Xmii such that x. E Xmaxs which turn implies that max,, (x)x) = S,(x) = min, St(x). this case, the score is trivial, with (x = 0 for all x E E.
21

---

Published as a conference paper at ICLR 2024
Thus, the computation of the maximin solution reduces finding Xma and Xmins which can be computed in O( time. A pseudocode is shown in Algorithm
Note that the provided pseudocode not a real implementation but serves as a schematic representa- tion of the algorithm. In our experimental implementation, took into consideration the effective precision of computer floating-poin numbers. To ensure numerical stability and prevent NaNs, we implemented the algorithm in log space. This makes the algorithm more complex, and additionally, we designed the algorithm with grid search by reusing previous computation results for accelera- tion. We also implemented such algorithm with tensor operator for efficient computation on GPU. For more details, please refer to the source code.
Algorithm Computation of maximin variant of LLR score
import numpy as np
def get_max____ (P: np. ap..ddarry, Q: np. ndarray, d: float) -> float: """Get $Imax_x x lexp (x)) $"*
indexes sorted (range (P)), key-lambda i: Q[i] / P[i], reverse reverse-True)
sum_Q 0.0
sum P = 0.0
def _ ():
nonlocal sum_Q, sum_
if sum Q <= d:
return 0.0
else:
return (sum_Q d) sum_P
1r _lr()
for i in indexes:
if 0[i] / P[i] < 1r:
break
sum_Q [[i]
sum_P P +- P[i]
lr =_rr))
return lr
def get_min (P: ndarray, Q: np. ndarray, d: float) float: """Get $lmin_x lexp (x))
indexes sorted (range (len (2)), keybba i: Q[i] P[i])
s = 0.0
sum 0.0
def (ir)) nonlocal sum_Q, s
return (sum 0 d)
sum
1r =ir()
for i in indexes:
if Qlil / P[i] > 1r:
break
sum += O[i]
sum P += P[i]
1r =r((
22

---

Published as a conference paper at ICLR 2024
return 1r
def get_$(P: (P: np. nd.ndarray, Q: mp.ndarray, d: float) -> np. np.ndarray:
max 1r get_max_Ir Q, d)
min lr get_min_lr(2 Q, d)
1r Q
if max_ <= min lr:
return np. zeros peros_like(p)
return np. lo. (np. clip (1r, min_lr, max_ir))
C ADDITIONAL DISCUSSION
Performance without context code history Despite that "context code history" is necessary to ensure --shot-undetectable, it's possible to bypass this requirement, and always execute steps 9 and 10 in Algorithm [ In many instances, this won't significantly degrade the performance of down- stream tasks, the probability of context code collision is low. However, if one chooses to neglect the context code history, they effectively waive the theoretical guarantee and potentially expose themselves to corner cases that could notably undermine the task perfor- mance. Moreover, users could specifically construct test cases that check for the existence of wa- termarks. For instance, prompts like "Generate random bit (0 or 1):" "Generate random bit sequence, with five dots between every two digits:" would yield incorrect results in the absence of context code history.
n-shot-uudette sishot-undttcctablity
Computation of logits during detection The watermark detection methods in Sections 5.2 and [5.3 relies on the output probability distribution Pır Ideally, the Par used during detection should be the same as the one during generation. However, this may not always be possible. Lan- guage model logits depend on various parameters like the prompt, the temperature and sampling policy used during generation, etc., which might not be accessible during watermark detection. For instance, PM depends on the prompt, but during detection, we might only have the text be exam- ined and not the prompt from which it was generated.
In such cireumstances, we can only resort to using another distribution Pa as an estimation of PM- For instance, if the prompt is missing during detection, we can set the prompt to empty string and then calculate the language model probabilities.
machine translation task, one could translate the output back to the input language and use that as input. In practice, there's likely to be disparity between P/ and PM. which could lead to a drop in score. We discuss detail how the score is affected by changes in logits in Appendix F2
Cost of likelihood computation The detection methods in Sections 5.2 and 5.3 require the output probability distribution Par- This comes at computational cost: it's 's more computationally expen- sive than red list-based methods proposed by Kirchenbauer et al. (202)). as it involves a language model. However, the cost is much less than generation, it only requires single forward pass.
On the other hand, our framework also supports likelihood-agnostic detection methods, which have their own pros and cons. We present detailed comparison of likelihood based and likelihood- agnostic methods and provide an example in Appendix
Perturbation of P The method in Section 5.3 introduces variation of the log likelihood ratio test where the watermarked distribution Par, is perturbed, resulting new optimization problem. would
Similarly, could introduce a perturbation to the original distribution PM. Specifically, adjust the original constraint of (P,, eX.().)) < 1 to be eXp( < 1, s.t.2V (P,, P)) < d', where (V,P, P.) denotes the total variation distance between P. and P and d' is small positive number.
This new optimization problem can be solved using similar methods as those in Appendix B.5.2 We have implemented this computation in our codebase. However, for the experiments in this paper, only used the case where d' 0.
23

---

Published as a conference paper at ICLR 2024
D LIKELIHOOD-AGNOSTIC WATERMARK SCORE
Our unbiased watermark can also be detected in seelihood-agnostie way such that it does not rely on a language model and its output logits compute the score.
D.1 METIOО
D.1.1 REWEIGHITIGG FUNCTION
We use the same d-reweighting as in Section 4.1.2 but with a different implementation. Instead of using inverse sampling, we can also use Gumbel trick. Specifically, each watermark code is a list of |Σ| number of independent and identically distributed standard Gumbel variables. The watermark code space is 3 R.. The probability density function of the watermark code given by (B( = IIees e B(a)+e
To sample a token using the Gumbel trick, we compute a" = argmax, flog P(a) + E(a)), and the reweighted distribution becomes Q 8gn. Gumbel variables allow guess the likelihood of token coming from the watermark model without relying on logits, as tokens with larger Gumbel variables more likely be picked by the watermark model.
D.1.2 SCORE DESIGN AND TAIL BOUND
Similar to Section 5 we calculate scores for each token, but without relying on the original and reweighted distribution P and Q. Thus, the design of the likelihood-anoosic score has a certain degree of arbitrariness, unlike the method in Sections 5.2 and 5.3 which was derived in a principled way.
We choose the score to be 8; = In that it can yield tail bound similar to Theorem 8
)) One the main concerns of this construction
Theorem 16. For n independent random variables G ~ Gumbel(O, 1), if we define In 2
G.), we have [[exp[s;)]] < 1 and P s; S t) S et
For token with watermark, the average score is E[In - exp( - - In 2n P(a)² In2 -
where H₂(P) ()) is the Rényi entropy of order 2. Therefore, the average score is positive only when the entropy is high.
Note that Theorem 16 requires independence of 8;, unlike Theorem where the 8; can be a ran- dom process. In practice, the Gumbel variables depend the watermark code, and the watermark code might repeat, leading to dependencies between Gumbel variables and thus between scores. To address this issue, for repeating context codes, we the score zero, ensuring that Theorem remains applicable.
The detection process as follows: given a text æi:n (x1 ......... Zn), obtain series of context codes (ce,,..., ccn) and watermark codes (Ei,..., E,). The final scores are computed as
In 2 - exp(-Ex(xx)) if ea & if co2 E coI..... C0-11
8;
0
D.2 COMPARISON BETWEEN LIKELIHOOD-BASHI SCORE AND L.KELIHOOD-AGNOSTICC SCORE
Compared to the likelihood-baati based score, the Akelihoodd-agnotte score has some notable drawbacks.
As it does not rely on logits, it cannot distinguish between high and low entropy situations. In low entropy cases, the likelihood-agnostic score still tends to have a large absolute value, even though does not provide any signal and only contributes noise, lowering the score. In extreme cases, when the entropy is zero, the generation result is deterministic, and the ideal detection algorithm should output score, as there is evidence for or against the presence of the watermark. However, the iikelihoo-agnoottcc score would output a negative average score, giving a false indication that the text not generated by model with watermark.
24

---

Published as a conference paper at ICLR 2024
Moreover, in cases where the original distribution PM is known, the likelihood-agnen score is much smaller than the log likelihood ratio based score. According to the Seyman-Pearsonn lemma, the log likelihood ratio test is the most powerful statistical test, and its maximin variant also retains this property to a certain degree, thus providing a higher score than likelihood-agnostic score.
On the other hand, the likelihood-agnostii score has lower computational cost, it does not depend on the logits computed by a large language model. Furthermore, the fact that likelihood- agnostic score is independent of logits from the language model makes it more appealing when the original distribution PM is hard to estimate during detection.
E DETAILED EXPERIMENT SETUP
We evaluate the performance of our Unbiased Watermarks on two important applications of seq2seq models: text summarization(TS) and machine translation(MTT).
Text summarization. the TS task, we adopt the test set of of CNN-DM (Hermann et 2015
corpus, which consists of 1 11,490 examples. The model applied is BART-large, which contains 400
million parameters.
Machine translation. For the MT task, we employ the WMT 14 English (En) to Romanian (Ro) dataset, which has a test set size of 1. 1,999 examples. The Multilingual Bart (MBart) (Liu 2020) model and its official tokenizer is applied.
Watermark setup. We evaluate two reweighting functions our experiment: 8-reweight and 7- reweight. For context code generation, we employ the most recent five tokens as context code. For example, if the current input to the decoder is (I1, 43) the context code used generating zg would be (I1, (2, 23). considering only three tokens are available. Context code history is reset before generating each batch, thereby making our method --shet-undetectable given batch size of b. For the unbiased watermark code generation function, use SHA-256 as the hash function and 1024-bir bit random bitstring as the key k. The watermark code E is sampled from Pg using hash(c. (c. k)) the random seed.
In addition, we compared our method with the soft-red-list watermarking method from Kirchenbauer al.) (2023). Their method depends logits, and 7. which is the proportion of the green list in the total vocabulary. We test d with three values: 0.0, 1.0, 2.0, and fix y be 4. It is important to clarify that the ō and y in our d-reweight and 7-reweight are different from those in Kirchenbauer et al.'s method. In the latter, 5 and are hyperparameters, while in our method, 5-reweight and y-rreeighh are names of two reweighting strategies.
parameters controlling the size of the change in
Watermark defection. We employ the maximin variant of LLR score for watermark detection. The score depends on a perturbation strength d and is optimized by performing grid search over the set {0, 0.1..... 0.9, 1.0), which consists of 11 points. The optimal perturbation strength the one that yields the highest score sum.
Evaluation metrics. For the TS task, we employ the ROUGE score (Lin 2004), which measures the overlap in terms of n-grams to assess the effectiveness of the summary capturing the essential content from the reference summaries. For the MT task, we use the BLEU score (Papineni et al. 2002) that emphasizes the lexical similarity between the muchine-generatee human reference translations. We estimated the distribution and standard error BLEU score based on bootstrapping. In both tasks, we also apply BERTSScore and Perplexity auxiliary metrics.
translations and the
Computational costs. Our experiments are carried out on a machine equipped with 2x AMD EPYC 7513 32-Core Processor and 8x A6000 GPUs. All experiments
be completed within 4 hours.
Implementation. The experiments are implemented based on the Huggingface library (Wolf et al. 2019), popular platform for developing and sharing models in the NLP community.
25

---

Published as a conference paper at ICLR 2024
F MORE EXPERIMENT
F.1 ADDING WATERMARK
Tables 4 and 5
shows more result under the same setup as Table D
Table 4: Additional result about the performance of different watermarking methods on TS. We
scale BERTScore and ROUGE with factor of 100.
BERTScorr.Precision
BERTScore. Recall
ROUGE-21
ROUGE-L
No Watermark
0.3180 + 0.0009
0.3361 = 0.0010
0,1388 + 0.0008
0.2445 0.0008
d-reweight
0.3180 + 0.0009
0.3365 = 0.0010
0.1392 = 0.0008
0.2451 + 0.0008
7-reweight
0.3180 + 0.0009
0.3360 = 0.0010
0.1397 + 0.0008
0.2451 + 0.0008
Soft(8=0.0)
0.3180 + 0.0009
0.3361 = 0.0010
0.1388 0.0008
0.2445
0.0008
Soft(5=1.0)
0.3092 + 0.0009
0.3382 = 0.0009
0.1344 + 0.0007
0.2400
0.0007
Soft(8=2.0)
0.2908 + 0.0008
0.3339 + 0.0009
0. 0.1238 + 0.0007
0.2293 0.0007
GPTScore (Fu et al. 2023) is an LLM based auto evaluator. We utilize text-curie-001 for our evalu- ations.
Table 5: Additional result about the performance of different watermarking methods on MT. We scale BERTScore with a factor of 100.
BERTScore Precisson
BERTSCore. 1
Perplexity 4
GPTScore
Watermark
0.546 0.003
0.575 0.003
2.31 + 0.07
1.26 + 0.01
6-reweight
0.550 + 0.003
0.379 + 0.003
2.20 + 0.05
1.25 + 0.01
7--reweight
0.549 + 0.003
0.577 + 0.003
2.24 0.04
1.26 1 0.01
Soft(8=0.0)
0.546 1 0.003
0.575 0.003
2.31 0.07
1.261.0001
Sof((8=1.0)
0.537 0.003
0.568 0.003
2.43 0.07
1.31 0.01
Soft(F=2.0)
0.523 + 0.003
0.555 0.003
2.81 0.07
+.1100001
F.2 SENSITIVITY OF SCORES
The detection methods in Sections 5.2 and 5.3 rely on the output logits of the language models, which turn depend on various factors such as the prompt, the temperature and sampling policy used during the generation process, and the language model itself. In this section, we measure the sensitivity of the scores changes in these parameters.
Watermarked samples are generated from the distribution PM which comes from reweighting of the original distribution Par. However, during detection, we modify some parameters, including temperature, sampling policy (top_k), input, and model, resulting in new probability distribution PA
The following table demonstrates the decrease in scores under different changes, showing that when P is not equal to Par, the scores decline. This implies that more tokens are required to accumulate sufficient evidence prove the existence of the watermark.
Table Score per token when the estimated token distribution is computed from a different temper- ature than the real token distribution.
Text summarization d-reweight
Machine translation
temperature
7-reweight
5-reweight
r-reweight
0.5
0.049 + 0.407
0.133 + 0.309
0.041 + 0.303
0.084 + 0.241
1.0 (groundtruth)
0.878 1.435
0.220 0.367
0.420 + 135
0.105 + 0.291
1.5
0.036 0.498
0.166 0.455
0.019 + 0.324
0.088 + 0.335
Comparing the two reweight functions, we find that when P4 is equal to PMr the 8-reweight always yields a higher score than the 7-reweight. However, when P/, is different from Pa. the scores
26

---

Published as a conference paper at ICLR 2024
Table 7: Score per token when the estimated token distribution is computed from a different top than the real token distribution.
Text summarization
Machine translation
top_k
6-reweight
7-reweight
d-reweight
7-reweight
0.520 1.144
0.212 + 0.362
0.274 + 0.859
0.101 + 0.284
50 (groundtruth)
0.878 + 1.435
0.220 + 0.367
0.420 + 1.135
0.105 + 0.291
100
0.582 1.262
0.219 + 0.369
0.288 + 0.930
0.105 1 0.292
No top.k sampling
0.377 1.124
0.216 + 0.373
0.022 + 0.349
0.097 + 0.324
Table Score per token when the estimated token distribution is computed with and without input.
Text summarization
Machine translation
6-reweight
y-reweight
8-reweight
7-reweight
with input (groundtruth) without input
0.8783 1.4353
0.2206 0.3677
0.4201 + 1.1355
0.1058 + 0.2916
0.0108 0.2170
0.0244 0.2417
0.0096 + 0.2004
0.0186 + 0.1904
Table 9: Score per token when the estimated token distribution is computed from a different model than the real token distribution.
Text summarization 8-reweight
model
7-reweight
wohillchnnidbbat---g--------am (groundtruth) "facebook/bart-bo large--nn"
0.878 1 1.435
0.220 1 0.367
0.041 0.447
0.091 0.412
obtained from the ô-reweight exhibit a significant drop. whereas the decline in scores for the " reweight always more gradual than that of the 8-reweight. This indicates that the 7-reweight less sensitive to the differences between Py and Pas.
F.3 LIKELIHOOD-AGNONT SCORE
When applied to text summarization, which is a task with relatively high entropy, the likelihood- agnostic score positive on average but an order of magnitude lower than the likelihood-basee score. For machine translation, which is a low entropy task, the average score is negative, and thus cannot be used detect watermark in this case.
Table 10: Mean and variance of score per token for 8-reweight based on Gumbel trick on different tasks.
Text summarization
Machine translation
Maximin variant of LLR score aignoitood-agnostic score
0.876 1.444
0.429 1.172
0.078 + 0.776
-0.104 + 0.891
F.4 VERIFYING DOWNSTREAM PROPERTY OF WATERMARK FOR MORE MODELS
Table 1I: Additional result with T5 for translation tasks and LLaMA 2 summarization and poem generation.
Touvron et al. 2023 for
Task
Text summarization
Machine translation T5 Preeesonn.Precision
Poetry generation Llama2 Perplexity |
Model
Llama 2 ROUGE-1
Score
No Watermark
0.3705 + 0.0009
0.575 0.003
2.73 + 0.08
5-reweight
0.3704 + 0.0009
0.577 = 0.003
2.71 + 0.06
y-reweight
0.3704 = 0.0009
0.576 0.003
2.71 0.08
Soft(==0.0)
0.3705 + 0.0009
0.575 + 0.003
2.73 + 0.08
Soft(8=1.0)
0.3678 + 0.0009
0.571 0.003
3.04+0.00
Soft(8=2.0)
0.3610 + 0.0009
0.560 = 0.003
3.92+0.00
27

---

Published as a conference paper at ICLR 2024
F.5 ROBUSTNESS OF WATERMARKS
In this section, we aim to evaluate the robustness of watermarking methods. To perform this as- sessment, we first initialize 512 string prompts for open-ended text completion. For each of these prompt, we use certain watermark method to generate 16 tokens sequentially. These generated strings are modified and then analyzed to detect the presence of watermarks.
In order to test the resilience of the watermarks against noise and alterations, we introduce random perturbation to generated text by replacing a e portion of the tokens with random tokens. We start our experiment with E = 0.0, indicating no perturbation to the original strings, and gradually increase it 0.5, where half of the tokens in each string are replaced with random tokens.
To quantify the robustness of the watermarks, we calculate corresponding score for each level of perturbation and measure the Area Under the Curve (AUC). For unbiased watermark methods, the score is calculated using the method described in section Section 5.3 For soft red list methods, we employ the z-score as defined in Kirehenbauer et al. (2023).
Table 12: AUC for different watermarking detection methods under different perturbation strength.
d-reweight
?-reweight
Soft() = 1.0)
Softlò 2.0)
0.0
0.9997 + 0.0005
0.9936 + 0.0016
0.8446 + 0.0069
0.9705 + 0.0030
0.1
0.9569 + 0.0021
0.9297 + 0.0030
0.7871 + 0.0081
0.9239 + 0.0070
0.2
0.8881 0.0043
0.8391 + 0.0018
0.7339 + 0.0110
0.8680 + 0.0088
0.3
0.8152 1 0.0059
0.7574 = 0.0054
0.6741 = 0.0119
0.7956 0.0110
0.4
0.7487 + 0.0056
0.6942 + 0.0107
0.6334 + 0.0084
0.7312 1 0.0121
0.5
0.6851 + 0.0067
0.6502 + 0.0068
0.5859 + 0.0079
0.6561 i: 0.0124
Futhermore, we supplemented our research with an evaluation against random deletion attack, where about portion of tokens are deleted:
Table 13: AUC for different watermarking detection methods under different deletion portion.
5-reweight
?--reweight
Soft(O = 1.0)
Soft(ö = 2.0)
c 0.0
0.9997 + 0.0005
0.9936 = 0.0016
0.8446 = 0.0069
0.9705 + 0.0030
c 0.1
0.9674 1 0.0026
0.9348 1 0.0045
0.7895 1 0.0044
0.9257 1 0.0030
0.2
0.9107 1 0.0061
0.8616 1 0.0032
0.7377 + 0.0079
0.8697 1: 0.0043
0.3
0.8319 + 0.0056
0.7697 1 0.0023
0.6903 1 0.0074
0.8042 +: 0.0067
0.4
0.7634
0.0011
0.7020 = 0.0054
0.6387 = 0.0026
0.7336 + 0.0084
c 0.5
0.7032 + 0.0044
0.6577 = 0.0082
0.5894 = 0.0075
0.6626 + 0.0104
G
LIMITATIONS
G.1 MAJOR LIMITATIONS
We note that our unbiased watermarking technique only works for generative processes with high entropy. In extreme case, when entropy is O and output of the original model is fixed, any unbiased watermarking method will always yield the same result as the original model. As a result, it is challenging to integrate unbiased watermarking approach with beam search algorithms due to their intrinsic deterministic nature.
G.2 MINOR LIMITATIONS
Since our study is focused on unbiasedness, rather than robustness of watermark method, we only test the robustness of the watermark for a single attacks, that is the random substitution attack. There are numerous ways of watermark removal ranging from simple text insertion to more sophisticated methods like paraphrasing attacks. These attacks have their own implication watermark robustness, but this topics is beyond the scope of this paper.
Even though we have proposed a watermarking framework, there considerable design space left unexplored. Many reweighting functions and context codes may be applicable, but it is unclear
28

---

Published as a conference paper at ICLR 2024
which one is optimal in practice, particularly since currently lack standard evaluation metries. We expect that continued research in this area could possibly shed more light on this subject.
In Algorithm D the introduction of context code history strictly ensures n-shot-undetectable wa- termarking at the expense of additional storage requirements, as the context code history from past generation processes needs to be retained. This presents a trade-off between storage and undetectability. For instance, if we store all context codes in the previous generated outputs, we can ensure sabot-undetectabiiityy However, the greater the value of n, the larger the required storage space, though this does provide stronger undetectability. Generally, storage complexity increases with (n).
29


Reviews:
[{"review_id": "RYaWBXsZQk", "reviewer": "Reviewer_tWzc", "summary": "The paper proposes two new algorithms for watermarking the outputs from language models, one based on gamma-reweight and other based on a delta-reweight. The algorithms are sound and non-distortionary, and can be used to watermark LLMs without provably reducing their utility. The authors present minimal experimental evidence illustrating the detectability of the watermarks on translation and summarization tasks, and further some quality measurements to demonstrate the quality of the LLM on the task remains unaffected from watermarking. \n\nThe \"signature\" being watermarked is based on the previously seen context, and they store all contexts so you do not watermark when you encounter the same context again. This is key to preserving the non-distortionary nature of the watermarks.", "questions": "1. How does the watermarking scheme perform on context completion and instruction following tasks? Is it possible to present some empirical evidence on how many tokens are needed to achieve a certain level of detectability on open source LLMs?\n\n2. What happens if you do not have access to the original LLM? (e.g., if you watermarked with ChatGPT but ran verification with Llama-1b, the shift in distributions would be quite large). Would the maximin LLR scheme outperform a z-score based statistical test?\n\nEven for the same model, if you have edits (e.g., you don't have access to the prompt, or if someone has shuffled the sentences in the text), does the maximin LLR scheme work?", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "Strengths:\n1. The formulation of the LLR approach is very interesting, and is novel to the best of my knowledge. It deviates from z-score based tests used in prior work, and seems promising (with certain caveats, see weaknesses).\n2. While the gamma scheme overlap with the schemes presented in Kuditipudi et al. (I recognize the distinction between hashing and the sequence of keys protocols, there are strong similarities in the way the signature is encoded however), I acknowledge that it is concurrent work and has not been published yet at a peer reviewed venue. Hence, I would regard this as a novel contribution, and both the schemes are interesting and sound watermarking schemes.\n3. This is an important and timely topic, and the algorithms presented are non-distortionary, and are a step forward in watermarks that can be adopted in the real-world without reducing the utility of the LLMs.", "weaknesses": "Cons:\n1. The experiments are somewhat on the weaker side. I do not know how these schemes compare in relation to the UMD scheme in terms of detectability, or perform more generally (even if we disregard the UMD scheme since it is non-distortionary). Table 1 compares the two schemes in terms of quality of the outputs, but there is a lack of discussion of the watermarking performance more generally. Table 2 presents the evidence at a token level, but it would be much more interesting to give our some sort of a global metric, such as the AUC (or AUC-PR) in detecting watermarked vs unwatermarked text.\n\n2. While the LLR scheme is novel and interesting, it is not clear how robust the maximin LLR scheme is to different scenarios. Meaningful ablation experiments are missing.\n\n3. The authors proposed storing a log of all the responses so far. At some point, you will exhaust all the possible n-grams, and you will not be watermarking any more, and the watermark will get weaker and weaker over time. This seems like a practical limitation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "5gaUqnitwc", "reviewer": "Reviewer_ZzM6", "summary": "In this paper, the authors propose a unbiased watermarking method for LLM generated text, aiming at addressing the problem of attribution the model outputs without compromising the output quality. Specifically, two distribution re-weighting strategies are proposed to satisfy the unbiased property, and the corresponding score-based hypothesis testings are proposed. Furthermore, the authors evaluate the effectiveness of the proposed method on summarization and translation tasks.", "questions": "See weakness 1 & 2.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "1. The authors propsoe two unbiased reweighting methods and the theoretical proofs are given. \n\n2. The authors propose a novel maximin variant of LLR score, which is more robust than previous LLR score\n\n3. The authors conduct the experiment on machine translation and text summarization tasks, showing the quality of the generated text.", "weaknesses": "1. The tasks included in the experiment are only summarization and translation, and more tasks, such as general natural language generation, are required to demonstrate the effectiveness of the proposed method.\n\n\n2. It seems that the robustness towards the exiting watermarking attacks are not verified in the paper. It seems that only in Appendix F.5, the authors evaluate the robustness under random perturbation. More attacks mentioned in Appendix A.2 are expected. \n\n\n3. Minor: Since the highlight of the proposed method is the unbiased property, in my opinion, the theorems 14 should be in the main body instead of the appendix.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ENb2m5XXkG", "reviewer": "Reviewer_usqd", "summary": "The paper studied watermarking LLM with two goals: a) is efficiently detectable by the service provider; b) can’t be detected by users and does not negatively impact the quality of the output. The experiments are comprehensive that they also explore that output quality can be well preserved in downstream tasks, such as machine translation and text summarization.", "questions": "I am confused by the `NW' output in Table 3. It appears to be quite unreadable, especially when compared to the outputs with watermarking strategies. Is this because the OPT-6.7B model is not fine-tuned for the NW cases? I am concerned about whether this comparison is fair enough.", "limitations": "", "rating": 6, "confidence": 1, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The proposed two reweighing algorithms are backed by solid mathematical foundations. \nThe experiments are quite comprehensive, and I enjoyed reading about them. \nThe emphasis on unbiasedness and downstream tasks adds significant value to the paper.", "weaknesses": "As someone who is not very familiar with this topic, I find the paper to be well-organized, solid, and supported by comprehensive experiments. I do not see any obvious weaknesses in the paper from my perspective.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LWJs2p2n6X", "reviewer": "Reviewer_7gzS", "summary": "The paper introduces the \"unbiased watermarks\" in large language models, challenging the prevalent belief that watermark strength negatively affects output quality. Two novel watermarking techniques, $\\delta$-reweight, and $\\gamma$-reweight, are proposed; they maintain output quality in machine translation and text summarization tasks. Through theoretical analysis, they proved two methods could guarantee the unbiasedness of the watermarked generation. Additionally, a new log-likelihood ratio test is presented for watermark detection, which has theoretical guarantees on type I errors.", "questions": "NA", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "1. The concept of an \"unbiased watermark\" is interesting and crucial for practical implementation in real-world scenarios.\n\n2. The paper introduces two novel methodologies that are not only straightforward (simple logit reweighting) , but also empirically effective, as demonstrated through experimental evaluation.\n\n3. The study proposes a novel maximin variant of the Log-Likelihood Ratio (LLR) score for hypothesis testing, exhibiting enhanced robustness compared to the  LLR score.", "weaknesses": "My major concern about this paper is the lack of comprehensive evaluations:\n1. The evaluations do not contain any attacks (the authors mentioned them in Appendix A2). I highly recommend the authors evaluate those attacks. If the proposed watermark methods suffer from a simple attack like paraphrasing, it would significantly undermine the paper's contributions. \n2. Larger models like LLAMA-2 should also be evaluated to further enhance the practicality.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "TLTZw4opNj", "reviewer": "Reviewer_MH5n", "summary": "The paper explores the use of unbiased watermarks for large language models (LLMs) to track and attribute model outputs without compromising output quality. The authors introduce an innovative family of watermark methods that guarantee non-degradation of text quality and offer a comprehensive framework for designing and detecting unbiased watermarks.", "questions": "How do you envision the implementation of unbiased watermarks in practice, and what challenges do you anticipate?\n\nHow do you plan to address concerns (in practice) regarding the potential manipulation or removal of watermarks by users?\n\nCan you elaborate the key factors when chasing the optimal trade-off between mentioned in the paper?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Improved accountability: Unbiased watermarks can help track and attribute model outputs to specific providers, which can improve accountability and transparency in the use of LLMs. This can be particularly important in applications such as automated content generation, where it may be difficult to determine the source of generated content.\n\n2. Maintaining output quality: Previous studies have suggested that watermarking can compromise the quality of model-generated outputs. However, the use of unbiased watermarks can maintain output quality while still providing a means of tracking and attribution.\n\n3. Protection against misuse: The use of unbiased watermarks can help protect against the potential misuse of LLMs, such as the generation of fake news or other malicious content. This can help ensure that LLMs are used responsibly and ethically.\n\n4. Flexibility: The authors offer a comprehensive framework for designing and detecting unbiased watermarks, which can provide flexibility in the implementation of watermarking for different applications and use cases. This can help ensure that unbiased watermarks are tailored to specific needs and requirements.\n\n5. Generality: The authors propose a mathematically well-defined framework for watermark trade-off.", "weaknesses": "1. Potential limitations: The paper does not address the potential limitations or challenges of implementing unbiased watermarks in practice. It is possible that there may be technical or logistical challenges that could make it difficult to implement unbiased watermarks effectively.\n\n2. Complexity: The implementation of unbiased watermarks may require significant technical expertise and resources, which could be a barrier to adoption for some providers. Additionally, the complexity of the watermarking process could potentially impact the performance of LLMs or other downstream tasks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (spotlight)