A Semantic Invariant Robust Watermark for Large Language Models
Authors: Aiwei Liu
Leyi Pan
Xuming Hu
Shiao Meng
Lijie Wen
Venue: ICLR 2024 poster (2024)
Keywords: Watermark algorithms
Large Language Models
Robustness
Primary area: societal considerations including fairness, safety, privacy
TL;DR: We propose a semantic invariant watermarking method for large language models that provides both attack and security robustness.

Abstract: Watermark algorithms for large language models (LLMs) have achieved extremely high accuracy in detecting text generated by LLMs. Such algorithms typically involve adding extra watermark logits to the LLM's logits at each generation step. However, prior algorithms face a trade-off between attack robustness and security robustness. This is because the watermark logits for a token are determined by a certain number of preceding tokens; a small number leads to low security robustness, while a large number results in insufficient attack robustness. In this work, we propose a semantic invariant watermarking method for LLMs that provides both attack robustness and security robustness. The watermark logits in our work are determined by the semantics of all preceding tokens. Specifically, we utilize another embedding LLM to generate semantic embeddings for all preceding tokens, and then these semantic embeddings are transformed into the watermark logits through our trained watermark model.
Subsequent analyses and experiments demonstrated the attack robustness of our method in semantically invariant settings: synonym substitution and text paraphrasing settings. Finally, we also show that our watermark possesses adequate security robustness.

Published as a conference paper at ICLR 2024
A SEMANTIC INVARIANT ROBUST WATERMARK FOR LARGE LANGUAGE MODELS
Aiwei Liu', LeyiPan', Xuming Hu², Shiao Meng', Lijie Wen's
'School of Software. BNRist, Tsinghua University The Hong Kong University of Science and Technology (Guangzhou) 1iuaw20 maaaw20@malll 1s.. tsinguua.eee edu.cn, wenl www.iitssnnnuuu..mm www.ghhuuaeeu...oom
ABSTRACT
Watermark algorithms for large language models (LLLMs) have achieved extremely high accuracy in detecting text generated by LLMs. Such algorithms typically involve adding extra watermark logits to the LLM's logits at each generation step. However, prior algorithms face trade-off between attack robustness and security robustness. This is because the watermark logits for a token are determined by a certain number of preceding tokens; small number leads to low security robustness, while a large number results in insufficient attack robustness. In this work, we propose semantic invariant watermarking method for LLMS that provides both attack robustness and security robustness. The watermark logits in our work are determined by the semantics of all preceding tokens. Specifically, we utilize another embedding LLM to generate semantic embeddings for all preceding tokens, and then these semantic embeddings are transformed into the watermark logits through our trained watermark model. Subsequent analyses and experiments demonstrated the attack robustness of our method in semantically invariant settings: synonym substitution and text paraphrasing settings. Finally, we also show that our watermark possesses adequate security robustness. Our code and data are available at https://githubb.ommTHHU BPTHHU-bb Watermark
INTRODUCTION
As the quality of text generated by large language models (LLMs) continues improve, addresses a multitude of practical challenges on one hand, while simultaneously giving rise to spectrum of new issues on the other. Specifically, the proliferation of LLM- generaeee text on the Internet may
lead to an influx of rumor-based content and text copyright concerns (Rillig et al.) 2023). Therefore, the detection and labeling of machine- -eeerrrte text have become extremely important.
Text watermarking techniques for LLMs usually embed specific information during text generation to allow high-accuracy detection LLM-generated text. The mainstream approach for embedding such information is to add extra watermark logits on top of the logits generated by the LLM. For example, Kirchenbauer et al. (2023a) divide the vocabulary into red and green lists and increase the scores for the green tokens the watermark logits. However, current watermarking algorithms cannot possess both attack robustness (robustness to modifications of the watermarked text) and security robustness, which refers the difficulty of inferring watermarking rules from watermarked text. For example, Zhao et al. (2023) demonstrates that global fixed watermark logits enhance attack robustness, yet they compromise security due vulnerability in word frequency analysis (Sadasivan et al. 2023). This is because the frequency of tokens from their green list is much higher compared to those in normal text, the high-frequency tokens could be simply treated as green tokens and further used remove the watermark. Essentially, in current watermark algorithms, the watermark logits for each token depend on its preceding tokens. As the number of required preceding tokens increases, watermarking complexity rises, leading to reduced attack robustness but increased security robustness.
To resolve the aforementioned trade-off, we propose semantic invariant watermarking algorithm that achieves reasonable attack and security robustness. The core motivation is generating watermark
"Coreesooniigg author

---

Published as a conference paper at ICLR 2024
The Hawaii man who was fired after issuing the false ballistic missile alert in mid-January told reporters Friday that he very
Generative LLM
LLM Logits
Final Logits
Watermark Model
Embedding LLM
Watermark Logits
Figure I: An illustration of our semantic invariant robust watermarking method. Text is input into generative LLM for token logits and an embedding LLM for text embedding. The embedding is converted into watermark logits via the Watermark Model. LLM logits and watermark logits are then combined for final logits, which decode the next token using any method.
logits for each token based on the preceding tokens' semantics rather than their token IDs. Thus, semantically invariant text modifications do alter the watermark logits, while the diversity of text semantics increases watermark complexity and guarantees security against watermark cracking. Specifically, to extract semantically invariant features, we use an auxiliary LLM encoder (e.g.. BERT) to extract semantic embeddings of the preceding tokens. We then train small watermark network to transform these embeddings into corresponding watermark logits. The training objective of the watermark network is to ensure high correlation between the similarities of the output watermark logits and input text embeddings. Also, it's imperative that the watermark logits exhibit sufficient diversity and are unbiased for each token. To achieve these goals, two training objectives are adopted: a similarity loss and a normalization loss. For the similarity loss, to ensure the diversity of the watermark logits, we first rescale the similarity values between text embeddings to range from -1 to 1, and then make the similarity of the generated watermark logits fit this similarity. To ensure unbiased token selection and achieve bimodal scores of the watermark logits, our normalization loss centers the mean of each row and column within a batch of watermark logits to zero, while making the absolute value of each entry as close possible. During the detection phase, we compute the watermark logits for each token at its position and obtain the corresponding value. We then average the values across all tokens and determine the presence of a watermark by checking if the average significantly greater than zero.
In the experiment, we evaluate the attack robustness of our watermarking algorithm against various semantically invariant perturbations, including text paraphrasing and synonym replacement. Overall, our watermark robustness comparable KGW-1 (global watermark logits), which is close to the robustness upper bound achievable by watermark logit-based methods. Additionally, employing the spoofing attack paradigm used in Sadasivan et al. (2023), we evaluate the decryption accuracy of various watermarking methodologies gauge security robustness. Our algorithm demonstrates favorable security robustness metrics, effectively resolving the previously encountered trade-off between attack and security robustness. Importantly, the watermark logits could be generated in parallel with the LLM logits, resulting in only a marginal latency increase during text generation.
follows: (1) We propose the first semantically invariant robust watermarking algorithm, which effectively detects watermarks under various semantically invariant perturbations. (2) Our algorithm successfully navigates the trade-off between attack robustness and security robust- ness that plagued previous methods, achieving high performance in both dimensions. (3) We propose a watermark model that adeptly transforms semantic embeddings into watermark logits.
Our contributions
2 RELATED WORK
Currently, there are two approaches to watermarking text [iu et al. (2023c): post- post-processing after text generation, and incorporating watermarks during the text generation of LLM.
alterations to the text, most commonly lexical substitution- based approaches. For instance, Qiang et al. (2023) embedded watermark infor- mation by employing a paraphraser- based lexical substitution, ensuring the text's original semantics remained intact. Yoo et al. (2023) began by selecting stable words to position the watermark and then
Post-process post-processing methods make minor cemantic-preservve
2

---

Published as a conference paper at ICLR 2024
used masked language model to generate candidate words, thereby facilitating the embedding and extraction of watermarks. Munyer& & Zhong (2023) generated candidate texts through word2vec- based synonym replacements, subsequently comparing semantic similarities among candidates to finalize the watermarked text. Nonetheless, replacing individual words while only considering the unchanged meaning of those words risks degrading overall text quality. In contrast, generative modification methods like AAbdelaabi & Fritz (2021) directly generate watermarked text, along with corresponding networks to recover the watermark information.
Based on the stage at which watermark information is embedded, current watermarking methods for LLMs can be divided into two categories: adding watermarks during token sampling and during logits computation. Christ et al. (2023) proposed a method that embeds watermark information by presetting a random number sequence for token sampling, and detects watermarks by computing correlation between texts and the random number sequence. To improve robustness against text modifications, Kuditipudi et al. (2023) adopted Levenshtein distance for matching texts and the random number sequence, allowing watermarked texts to be detectable even after certain modifications. However, although such token sampling-base
watermarking methods minimize the impact on text quality, they also greatly limit the randomness of generated texts, and only work for sampling decoders instead of other decoding methods like beam search. In contrast, another category is to add watermarks during logits computation. Kirchenbauer et al. (2023a) made minor modifications to current token logits based on hashes of previous k tokens (watermark logits). [ee et al. (2023) designed a similar watermarking method for low-entropy code generation. Waan al. (2023) enabled multi-bit watermark information via proxy LLM. Liu et al. (2023b) implemented watermarking through parameter sharing between the watermark generator and detector. In this work, we are more concerned with watermark robustness. Zhao et al. (202)) proved that using global fixed watermark logits (k=0) in Kirchenbauer al.. (2023a) 's method achieves very strong attack robustness, yet [Sadasivan et al.) (2023)ss work shows that lower k values make watermarks vulnerable to security robustness (easy to break). In this work, we propose a semantically invariant robust watermarking scheme, where watermark logits are generated based on semantic information of the text.
3 PRELIMINARIES
We first introduce the necessary concepts used in this work. Language models could be divided into generative language models and embedding language models. A generative language model M takes prompt promntt and already generated text t.-- input and generates the logits for the next token: PM (xPrompt 11) Meanwhile, an embedding language model E could generate an embedding Ft(t) for the text t. Usually, semantically similar texts will generate similar embeddings. For convenience in later sections, we use the language model to refer to generative language models.
watermarking algorithm for large models embeds specific information in the generated text. The paradigm adopted in this paper is adding small watermark logits to the already generated next token logits. Specifically, the watermark logits can be defined as Pw(x (xpromptt 1.-1), and the final logits could be defined as Pir Promppp 1 = PM Proommpp f.1-1) + Pw Prrrompt - where M is the watermarked LLM. The watermark detector PD corresponds to Pw. outputting I if text contains the watermark, otherwise O. for consistency, we explicitly define pW to denote the value at the i-th position of the watermark logits, and use Pw; to denote a specific example of watermark logits.
The robustness of our work encompasses two aspects: attack robustness and security robustness. Attack robustness evaluates the probability that the watermarked text can still be correctly identified after semantically invariant modifications. Security robustness evaluates the accuracy of inferring the watermark rules from the watermarked text. Once the watermarking rules are disclosed, users can easily modify the text to remove the watermark, rendering attack robustness meaningless. In our work. security robustness is evaluated by employing spoofing attacks Sadasivan et al. (2023). specifically by conducting statistical analysis on watermarked texts.
PROPOSED METHOD
In this section, we provide a detailed introduction to the proposed semantically invariant robust watermark algorithm named SIR. First, in Section 4.1 we introduce the overall process of watermark
3

---

Published as a conference paper at ICLR 2024
generation.
Then, in Section 4.2 explain the training process of the watermark model. Finally, in we present the watermark detection process.
Section 4.3
4.1
WATERMARK GENERATION
As discussed in the previous sections, one of the most important steps in the watermark generation process is the generation of the watermark logits. The watermark logits for the current token are usually determined by its preceding tokens. Our goal is to construct continuous and robust mapping from the semantics of the preceding tokens to the watermark logits. In this way, semantic-preserving modifications to the text will only cause small perturbations the watermark logits.
To extract semantic- invariant features of the text, we utilize an embedding language model E (e.g. B Specifically, given a sequence of preceding tokens 1 we first obtain its semantic embedding
E(C.--)). To transform this semantic-invarian feature to a score over the vocabulary V, we train specialized watermark model to generate the watermark logits: Pw = T(ei). The overall algorithm is described in detail in Algorithm I A thorough introduction the watermark model will be provided in Section 4.2
Algorithm 1 Watermark Generation
1: Input: watermark strength a language model M, previous generated text = [to....41] text embedding language model E, trained watermark model T.
2: Generate the next token logits from PM: (xPrompp -t--)..
3: Generate sentence embedding e, E(t.-1)..
4: Generate watermark logit Pw from trained watermark model T(e;).
5: Define a new language model M where given input t = [fo....t--]] the resulting logits satisfy
Pi Prommp t = PMi (a mrmmpt t.-1) + Pw Pw tt--1)-
6: Output: watermarked next token logits (t)-
4.2 WATERMARK MODEL
The goal of the watermark model to convert semantic embeddings into watermark logits. First, we describe several desired properties for the similarity of watermark logits: semantic-consistent broad range, unbiased token preference, and balanced score.
To ensure the attack robustness, the similarity of the watermark logits should have semantic- consistent broad range. That is, the similarity between generated watermark logits should be highly correlated with the similarity between text embeddings. Also, to ensure diversity and security, the similarty should have a broad range between 1 and -1 (language models typically generate embeddings with similarities concentrated between O and 1), shown in the following equation:
Pw; Pw, E [xr, w]- Va, v E 1-1,11, < :i |Pw:ll x 1l
Additionally, to further ensure the security robustness of the watermark, the watermark logits should have unbiased token preference, meaning there should be no statistical preference for any token:
Vi (1,2,.... /VI, Σ p W =0
Moreover, to make the watermark stable and easy to detect, the watermark logits should have balanced score, meaning the mean the watermark logits is 0 and the score is uniform relative to the mean value, which is shown in the following equation:
V
sign
(P())
where (ign(x) 1 if v: is greater than 0, and -1 if x is less than 0.
4

---

Published as a conference paper at ICLR 2024
To achieve the above design goals, devised non-linear neural network (watermark model) to generate the watermark logits. This neural network consists of several fully connected layers with Rectified Linear Unit (ReLU) activations introduced to induce non-linearity The watermark model employs two losses to meet the stated objectives: a similarity loss and a normalization loss.
The objective of the similarity loss is to attain semantically consistent broad-range similarity for the watermark logits. Specifically, in order to achieve a broad range, the similarity of the text embeddings first needs be normalized to -1,, 1] by caleulating the mean of the similarity and then expanding the range using the tanh function. Finally, the overall goal of the similarity loss is to fit the similarity between the watermark logits to the transformed text embedding similarities. The standard definition of the similarity loss Lg is as follows:
ΣΣ k where | is the size of the sentence embedding space, ' is the watermark model, and ky is hyperparameter used to adjust the range of similarity.
ΣΣ [[T(e))ll2 (1;(2) tanh(ki(
T(e.) T(e,)
Ej ej
ek x ||e:1l2 )){ (4)
||e:1l2 ||el112
We then introduce the normalization loss, whose goal is have the watermark logits exhibit an unbiased token preference while maintaining a balanced score. Specifically, this requires the mean of each watermark logit be zero, and the mean over all tokens in the watermark logits to also be zero. Finally, to make the score of the watermark logits uniform, we constrain the absolute value of each value to be close, with the standard definition of the normalization loss as follows:
f. f- 1--iET(()))
ΣΣ {))
(5)
Where R is hyperparameter denoting the target absolute value for each value in the watermark logits, and A is weight conditioning the normalization loss internally.
The final training loss is weighted sum of the similarity loss and normalization loss, expressed as follows, where 22 is a hyperparameter balancing the two losses:
(6) To augment the separability of watermark logits, the output from the watermark model further processed by the tanh function, yielding the final watermark logits, denoted as: tanh (k2 Te:))) After this procedure, the values of watermark logits are almost exclusively -1. This correlates with the concept of red-green tokens in the work of Kirchenbauer et al. (2023a) (denoted as KGW), indicating a fundamental similarity principles between our approach and the KGW algorithms.
L= L. + A2Cn.
4.3
WATERMARK DETECTION
Similar to some previous works Kirchenbauer et al. (2023a), we assume the null hypothesis and compute a z-statistic. We reject the null hypothesis and detect watermark the average watermark logit for each token is greater than zero. The watermark logit for each token is calculated via Algorithm and its average is zero and standard variation is one (as shown in Figure ((c)), which could be represented as:
Σ ( (xprompt -)- Σ
p(b) (xprompt t---)
N+1
N
Without a watermark, the expected score since the watermark logit mean O. When watermark is present, the score substantially exceeds 0, making this suitable validation approach. In our work, the values of watermark logits are almost exclusively or or- -1, which corresponds to the concept of green-red tokens by Kirchenbauer al. (2023a). Consequently, our detection methodology fundamentally the same to theirs, a point we elaborate on in greater detail in the appendix D Note that the watermarking model is optimized so that the null hypothesis is approximately true non-watermarked text, but no guarantee can be provided (e.g. on out-of-doman text).
ROBUSTNESS ANALYSIS
This section analyzes the attack robustness of the watermark algorithm. As detection relies the z z-score, robustness can be assessed by the z-score change with modifications to the generated text t. The z-score change magnitude indicates robustness. We use f'y to denote the modified text.
5

---

Published as a conference paper at ICLR 2024
Let U represent the set of altered tokens Their scores considered zero. For unmodified tokens, score changes result from embedding alterations of the proceeding tokens:
| Exeu PP (wrroro 1---1 + + EEE [a (xprompt (.--1)
Pw Paoorrompt 13--1)
Since watermark logit generation from text embeddings is continuous, the Lipschitz constant L can bound the inequality per properties of continuous functions:
A < Ejev PPw (arooprompt, b---)) + Ejev L[B(ts-1) E(U
N
This shows the watermark is theoretically robust long as text modifications do not drastically alter semantics, such that embeddings stay similar. In fact: significant semantic changes would make the watermark meaningless. Moreover, analysis of security robustness is provided in the appendix.
6
EXPERIMENT
6.1 EXPERIMENT SETTINGS
Dataset and Prompt: Similar to the previous works Kirchenbauer et al. (2023a), we utilize the C4 dataset (Raffel et al.) 2020) for data generation, taking the first 30 tokens as prompts and generating the next 200 tokens. The original C4 texts serve as human-written examples. The test objective is to distinguish between generated text and human-written text. During training of the watermark model, we utilize the WikiTexx--O0 103 dataset (Merity et al. 2016) (different from C4) to generate embeddings.
watermarking algorithms as baselines. One is KGW-k (Kirchenbauer et al., 2023a) where k is the number of preceding tokens to hash. The other exponential minimum sampling (EXP-edit) (Kuditipudi et al. 2023), an approach that introduces watermarks through a pre-selected sequence of sampling probabilities during the sampling process and adopts edit distance- based detection achieve strong robustness. For language models, we use LLaMA-7B (Touvroo et al. 2023), OPT1.3B. and OPT2.7B (Zhang et al., 2022) for text generation. Additionally, we tested the efficacy of the watermarking algorithm under both stochastic and deterministic scenarios using sampling and beam search decoding algorithms, respectively. For embedding language models, we utilized Compositional -epoostttioalBBERRTT (Chanchani & Huang 2023) due to its superior ability to produce embeddings that better distinguish text.
Baseline and Language Model: We selected
Similar to Zhao et al. (2023)'s method, to avoid the impact of detection thresholds, set false positive rates at 1% and 10% and adjusted the detector's thresholds accordingly. For comparison, we also report F1 scores at optimal thresholds. Further, we use the superior LLaMA-133 13B model for perplexity evaluation. For safety robustness assessment, we adopt (Sdassivn et al. (2023)' approach of analyzing occurrence frequencies of 181 common words. See Section 6.3 for details.
Evaluation:
Hyper- parpmetrrameters:: The watermark model uses four-layer fully connected residual network with rectified linear unit activations. Hyperparameters are set to k₃ 20, k2 = 1000, a 10, X = 0.1, and the Adam optimizer (Ir=le-5) used for training. The detailed network architecture is provided in the appendix. All experiments were conducted using the NVIDIA Tesla V100 32G GPU.
6.2 ATTACK ROBUSTNESS ANALYSIS
In Table we list the detection accuracy of our watermark algorithm and various baseline algorithms under the no- no-attack setting and when texts are rewritten using GPT3.5, 5, two different DIPPER settings (Krishna et al. 2023) and the copy-pase paste attack Kirchenbauer et al. (2023b). For GPT3.5, we use the gpt-3.5-turbo-06/ 0673 version with the prompt Rewrite the following paragraph: For DIPPER-1 the lex diversity is 60 without order diversity, and for DIPPER-2 we additionally increase the order diversity by 20. For copy-pen paste attack, insert 600 tokens from the origin text before the generated text.
Table [ shows that our watermarking algorithm achieves strong robustness against all attacks. Specif- ically, for watermarked texts rewritten by GPT-3.5 and two DIPPER rewriters, algorithm still

---

Published as a conference paper at ICLR 2024
Table 1: We compared the performance of our watermarking method with others, including KGW-k
(Kirchenbauer et al. (2023)) and EXP (Kuditipudi et al., 2023), using text generated by LLaMA-7B.
Tests involved watermark detection accuracy under no attack, GPT3.5 rewrite attacks, two DIPPER
(Krishna et al. 2023) settings, the copy paste attack as well as the emoj attack (Appendix
Sampling
Beam search
Setting
Method
1% FPR
10% FPR
Best
1% FPR
10% FPR
Best
TPR
F1
TPR
F1
F1
TPR
F1
TPR
F1
F1
KGW-1
0.960
0.975
1.000
0.952
0.983
1.000
0,995
1,000
0.952
0.998
KGW-2
1.000
0.995
1.000
0.952
0.998
1.000
0,995
1,000
0.952
1.000
No attack
KGW-4
1,000
0.995
1.000
0.952
0.998
1.000
0,995
1.000
0.952
1.000
EXP-Edit
0.995
0.993
1.000
0,952
0,995
X
x
X
x
X
(oR(o
1,000
0.995
1.000
0.952
0.995
1.000
0.995
1.000
0.952
1.000
KGW-1
0,590
0.738
0.885
0.891
0,905
0.890
0,937
0.965
0.935
0.955
KGW-2
0,535
0.693
0.760
0.817
0,823
0.655
0.787
0.795
0.839
0,865
GPT3.5
KGW-4
0.225
0.364
0.490
0.614
0,705
0.420
0.587
0.660 x
0.750
0.795
EXP-Edit
0.435
0,602
0,645
0.739
0.775
x
x
x
X
SIR(ours)
0.740
0.856
0.865
0.880
0,900
0.805
0.887
0.945
0.924
0.938
KGW-1
0.715
0.829
0,940
0,922
0,930
0.930
0.959
0.975
0.939
0.962
KGW-2
0.450
0.616
0.710
0.785
0.815
0.770
0.865
0.880
0.888
0,908
D
KGW-4
0.220
0.358
0.545
0.627
0.728
0.380
0.547
0.765 x
0.820 x
0.843
EXP-Edit
0.630
0.768
0.740
0.804
0.830
SIR(ours)
0.765
0.862
0.905
0.903
0.920
0.890
0.937
0.950
0.927
0.948
KGW-1
0.765
0,862
0,935
0.918
0,925
0.910
0.948
0.975
0.940
0,960
KGW-2
0.470
0.635
0.685
0.768
0.803
0.725
0.838
0.860
0.878
0.898
DIPPER-2
KGW-4
0.150
0,259
0.475
0.603
0.718
0.315
0.475
0.645
0.739 x
0.783
EXP-Fdit
0.485
0.649
0.635
0.732
0.775
(oR(o
0.875
0.928
0.92
0.911
0.931
0.870
0.926
0.940
0.922
0.940
KGW-1
0.854
0.901
0.897
0.918
0.920
0.923
0.934
0.918
0.929
0.943
KGW-2
0,860
0.907
0.898
0.905
0.912
0,905
0.913
0.932
0.928
0.940
Copy-Paste
KGW-4
0.877
0.899
0.910
0.910
0.911
0.897
0.931
0.934
0.932
0.936
SIR(ours)
0.856
0.901
0.870
0.905
0.918
0.883
0,913
0,931
0.927
0.938
KGW-1
0.973
0.983
1.000
0.952
0.990
1.000
0.995
1.000
0.952
0.995
KGW-2
0.006
0.434
0.345
0.479
0.532
0.005
0.398
0.298
0.478
0.529
Emoj
KGW-4
0.004
0.456
0.389
0.467
0.497
0.003
0.401
0.314
0.453
0.504
SIR(ours
0.969
0
1.000
0.952
0.986
0.982
0,989
1.000
0.952
0.991
achieves an average detection Fl score of 0.93. This performance is comparable to that of the KGW-1 algorithm, markedly surpassing other watermark algorithms, including KGW-2, KGW-4, and EXP-Edit. As modifications to the token the KGW-1 only affect the label of that particular token, this represents the upper bound of attack robustness for watermark algorithms based on watermark logits. Nonetheless, subsequent experiments demonstrate that the KGW-1 algorithm possesses poor security robustness. We also achieve robustness against copy paste attacks similar to that of the KGW series methods. Appendix G details the robustness to copy-paste and other types of attacks.
To further demonstrate the robustness of our watermarking method against semantic cemantic-preserving text attacks, Figure 2[a) compares the detection Fl score of our watermark algorithm and other bascline methods under different synonymous word substitution scenarios. The synonyms obtained from the WordNet synset (Miller 1995). Since replacing words solely could still alter the semantics as many synonyms are only applicable in certain contexts, we additionally employ BERT (Devlin let al. 2018) to constrain the synonym substitution to induce minimal embedding changes as a context replacement approach. Without context replacement, our algorithm demonstrates robustness comparable to KGW-2, while under semantics- semaantcs-preservving substitutions, our method achieves near of robustness against attacks, similar to KGW-1 and EXP-Edit. These results clearly demonstrate the robustness of our method for semantically invariant text modification.
6.3 SECURITY ROBUSTNESS ANALYSIS
In Figure B a), we analyze the security robustness of our method. Security robustness refers to the difficulty of cracking the watermarking rules. In this work, we adopt the spoofing attack method of Sadasivan et al. (2023), which analyzes the word frequencies of 181 commonly occurring words. If a word in watermarked text has higher frequency than in natural text, it is deemed watermarked (with
7

---

Published as a conference paper at ICLR 2024
140
035
030
F3-ecore
Trkes 10JArg
2010
1007
2006
Praction of Substiitttons
Embedding Similarity
Tolos 10jArgRasked volue)
2009
1800
2000
(a)
(b)
(c)
Figure 2: The left figure shows how detection accuracy changes for different watermark models as the synonym replacement ratio increases. The middle figure shows the correlation between embedding similarity generated by the embedding model and the similarity of the generated watermark logits. The right figure illustrates watermark logits with and without the normalization loss.
Watermarkk Decryption Accuracy
Teat Parplexity
35.0
12.9
SHRtH bus steel *
KCWG
8.5
9.0-
0.5
9.5
6.9
2.5
F1 score after Rewrite
OPT2.78
LLaMA-78
(a)
(b)
Figure 3: The left figure depicts the trade-off' between security robustness and attack robustness across different watermarking algorithms. The right figure shows the text quality generated by language models with different watermarking methods (measured by text perplexity).
positive probability in the watermark logits). The accuracy of this identification is called watermark decryption accuracy, which measures the security robustness of the watermark.
Specifically, for KGW-k we count the frequency of the last word given fixed k-1 prefixes. Due the semantic relevance of our watermarking rules, we employed DBpedia Class dataset (Gangemi et al. 2012) examine watermark decryption accuracy. Specifically, different levels: the overall class, LI class (e.g.. species), and L2 class (c.g.. species: animal). Due to insufficient data at the L3 class level, our research focuses solely on LI and L2 classes.
analyzed the accuracy across three
Figure 3(a) illustrates the trade-off between attack robustness (measured by detection accuracy after rewrite) and security robustness (measured by watermark decryption accuracy) in Kirchenbauer et al. (2023a)'s 's watermarking algorithm. A smaller k implies stronger attack robustness yet simpler watermarking nules and thus lower security robustness. Our watermarking algorithm achieves attack robustness close to KGW-1 while maintaining security robustness close to KGW-4 Although our security robustness degrades slightly with more refined domain text (I.1 and 1.2 level classes), even for the very refined L2 class it is still far superior to KGW-3, Therefore, watermarking algorithm successfully addresses the attack robustness versus security robustness trade-off in prior work.
6.4 WATERMARK MODEL ANALYSIS
To better analyze our watermarking algorithm, Figure 2bb) shows the relationship between the similarity of text embeddings and the similarity of watermark logits generated by the watermark
8

---

Published as a conference paper at ICLR 2024
Table 2: Text generation speed, measured in seconds (s), was compared with and without applying the watermarking algorithm, for generated token length of 200. All experiments were performed on a single NVIDIA Tesla V100 32GB GPU.
Embedding Model
Setting
OPT-1.3
OPT-2.7B
LLaMA-7B
w/o watermark
3.14
4.10
5.76
Com-BERT Base
w/ watermark
4.98
6,87
7.23
w/ watermark (parallel)
3.32
4.45
5.81
w/o watermark
3.14
4.10
5.76
Com-BERT Large
w/ watermark
5.67
7.44
7.83
watermark (parallel)
3.55
4.89
model. The average similarity of watermark logits is shown for each range of embedding similarity, It can be seen that the similarity watermark logits maintains strong correlation with the embedding similarity, especially for very similar embeddings that certainly correspond to very similar watermark logits (similarity greater than 0.8). Meanwhile, the range of watermark logit similarity is also extended to 11 to (the figure only shows the average similarity in the range so -1 is not shown), which also makes the watermarking rules more diverse and robust. From the figure, the average similarity of the original sentence embeddings is 0.45, which also reflects the advantage of using Compositional-Be -ERT, which can better distinguish dissimilar texts compared to the original BERT, helping to improve the diversity of watermarks. We will analyze in more detail in the appendix the impact of different embedding models on watermarking.
In Figure 2e), plot the specific watermark logits. It shows that after using our normalization loss, the watermark logits becomes more symmetrical without overly small logit values. After applying the tanh scaling method introduced in Section 4.3, the watermark logits only contain values close to -I and 1. The potential impact of the watermark on text quality depends on the maximum absolute token logit value (as it would only select that token if too large), so making the absolute values of all token logits equal to the minimum max value is an optimal solution. See more detail in the Appendix.
6.5 TIME COMPLEXITY AND TEXT QUALITY
In Table 2 we further analyzed the time complexity of our watermarking algorithm. As shown, without parallel processing, our algorithm imposes additional time costs on text generation, mainly due to the language model embedding and the watermark model is just a four-layer linear network, with negligible time costs. As language models increase in size, the proportional time increase diminishes, with LLaMA-7B only taking 40% longer. Figure Iillustrates that our algorithm can generate LLM logits and watermark logits in parallel with minimal additional time cost, particularly for larger models like LLaMA-7B.
To evaluate the impact of watermarking method on text quality, Figure (b) shows the perplexity comparison of the generated text. The perplexity calculation uses the LLaMA-133 model, and the text on OPT2.7B and I.aMA-7B is generated using sampling decoding. It can be seen that our method and previous watermarking methods have a slight impact on text quality (perplexity increases slightly). But at the same time, our method can achieve slightly lower perplexity than the KGW series of watermarking algorithms, which may be the result of our semantic-bat based watermarking algorithm being more consistent in text expression. We will present examples in the appendix.
7 CONCLUSION
In this work, we propose a semantically invariant robust watermarking algorithm that generates watermark logits based on the semantics of context. We validate the robustness of our algorithm through series of analyses and experiments, particularly in scenarios involving text rewriting and synonym substitution, while maintaining the watermark's resistance to decryption. For future improvements, we suggest utilizing superior quality embedding models, which will enhance the performance of our watermarking algorithms. Furthermore, there is potential for expansion of our algorithm for use in different watermarking approaches. Since our first release, there has been work that improved upon method and applied it multilingual settings He al. (2024).

---

Published as a conference paper at ICLR 2024
8 ACKNOWLEDGMENTS
This work is supported by the National Nature Science Foundation of China (No. 62021002), Tsinghua BNRist, and the Beijing Key Laboratory of Industrial Bigdata System and Application. Additionally, it receives support from the Beijing Natural Science Foundation under grant number QY23117. We would like to express our sincere gratitude to the anonymous reviewers IhfF, FTnC, 1s48, and yZti from ICLR, as well as area chair zZK2, for their invaluable feedback during the review process. Their insightful comments have significantly contributed to the improvement of the quality of our work.
REFERENCES
Sahar Abdelnabi and Mario Fritz. Adversarial watermarking transformer: Towards tracing text provenance with data hiding. In 202/ / IEEE Symposium on Security and Privacy (SP), pp. 121-140. IEEE, 2021.
Sachin Chanchani and Ruihong Huang. cemposition-contratiiii learning for sentence embeddings. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 15836-15848, 2023.
Canyu Chen and Kai Shu. Can Ilm-generated misinformation be detected? arXiv preprint arXiv:2309. 13788, 2023.
Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. arXiv preprint arXiv:2306.091 199944 2023.
Marta R Costa-jusså, James Cross, Onur Çelebi, Maha Elbayad, Kenneth Heafield Kevin Heffernan, Elahe Kalbassi, Janice Lam, Daniel Licht, Jean Maillard, et al. No language left behind: Scaling human-centered machine translation. arXiv preprint (xxxx:2207.04777 2022.
Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv: 04.0000000 2018.
Aldo Gangemi, Andrea Giovanni Nuzzolese, Valentina Presutti, Francesco Draicchio, Alberto Musetti, and Paolo Ciancarini. Automatic typing of dbpedia entities. In The Semantic Web-ISWC 2012: 11th International Semantic Web Conference, Boston, MA, USA, November 11-15, 2012, Proceedings, Part I 11, pp. 65-811 81. Springer, 2012.
Zhiwei He, Binglin Zhou, Hongkun Hao, Aiwei Liu, Xing Wang. Zhaopeng Tu, Zhuosheng Zhang, and Rui Wang. Can watermarks survive translation? on the cross-lingun consistency of text watermark for large language models. arXiv preprint arXiv:2402. 14007, 2024.
Xuming Hu, Chenwei Zhang, Yusong Xu, Lijie Wen, and Philip S Yu. Selfore: Self-supervised relational feature learning for open relation extraction. arXiv preprint arXhv:2004.02438, 2020.
Xuming Hu, Junzhe Chen, Xiaochuan Li, Yufei Guo, Lijie Wen, Philip S Yu, and Zhijiang Guo. Do large language models know about facts? arXiv preprint arXhv:2310.05117 2023.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. arXiv preprint 231.:22001..2226 2023a.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the reliability of watermarks for large language models. arXiv preprint arXiv:2306.0446 046344 2023b.
Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. Paraphras- ing evades detectors of ai-generated text, but retrieval is an effective defense. arXiv preprint arXiv:2303. 13408, 2023.
Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion-free watermarks for language models. arXiv preprint -xX.::2377./593, 2023.
10

---

Published as a conference paper at ICLR 2024
Tachyun Lee, Seokhee Hong, Jaewoo Ahn, Ilgee Hong, Hwaran Lee, Sangdoo Yun, Jamin Shin, and Gunhee Kim. Who wrote this code? watermarking for code generation. arXiv preprint arXiv:2305.15060, 2023.
Aiwei Liu, Honghai Yu, Xuming Hu, Shu'ang ang Li, Li Lin, Fukun Ma, Yawen Yang, and Lijie Wen. Character-level white-box adversarial attacks against transformers via attachable subwords substitution. arXiv preprint arXiv:2210. 2022.
Aiwei Liu, Xuming Hu, Lijie Wen, and Philip S Yu. A comprehensive evaluation of chatgpt's zero-shot text-to-sql capability. arXiv preprint arXiv:2303. 13547, 2023a.
Aiwei Liu, Leyi Pan, Xuming Hu, Shu' ang Li, Lijie Wen, Irwin King, and Philip S Yu. A private watermark for large language models. arXiv preprint 2rXiv:2307.162560 2023b.
Aiwei Liu, Leyi Pan, Vijian Lu, Jingjing Li, Xuming Hu, Lijie Wen, Irwin King, and Philip S Yu. A survey of text watermarking in the of large language models. arXiv preprint arXiv:23 2023c.
Aiwei Liu, Haoping Bai, Zhiyun Lu, Xiang Kong, Simon Wang. Jiulong Shan, Meng Cao, and Lijie Wen. Direct large language model alignment through self-rewarding contrastive prompt distillation. arXiv preprint arXiv:2402.1 1907, 2024.
Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher. Pointer sentinel mixture models. In International Conference on Learning Representations, 2016.
George A Miller. Wordnet: a lexical database for english. Communications of the ACM, 38(11): 39 39-41, 1995.
Travis Munyer and Xin Zhong. Deeptextmark: Deep learning based text watermarking for detection of large language model generated text. arXiv preprint urXiv:2305.05773 2023.
Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. Red teaming language models with language models. arXiv preprint arXiv:2202.03220 2022.
Jipeng Qiang, Shiyu Zhu, Yun Li, Yi Zhu, Yunhao Yuan, and Xindong Wu. Natural language watermarking via paraphraser- based lexical substitution. Artificial Intelligncce, 317:103859, 2023.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. The Journal of Machine Learning Research, 21 (155555555555, 2020.
Nils Reimers and Iryna Gurevych. Making monolingual sentence embeddings multilingual using knowledge distillation. Proceedings of the 2020 Conference on Empirical Methods Natural Language Processing. Association for Computational Linguistics, 11 2020. URL https:77
arxiv. wwwp:///gg//bbor//ooooooosss 2204. 29801.99113
Matthias Rillig, Marlene Agerstrand, Mohan Bi, Kenneth A Gould, and Uli Sauerland. Risks and benefits of large language models for the environment. Environmental Science & Technology, 57
14.364-34666 2023.
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? arXiv preprint arXiv:2303.11156, 2023.
Ruixiang Tang, Yu-Neng Chuang, and Xia Hu. The science of detecting ilm-generated texts. arXiv preprint wwXivv23303007200 2023.
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023.
Lean Wang, Wenkai Yang. Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun. Towards codable text watermarking for large language models. arXiv preprint arXiv:2307.1599) 2023.
11

---

Published as a conference paper at ICLR 2024
Yioo Yoo, Wonhyuk Ahn, Jiho Jang, and Nojun Kwak. Robust multi-bit natural language watermarking through invariant features. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 2092-2115, 2023.
Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, et al. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.01065 2022.
Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-X fu-Xiang Wang. Provable robust watermarking for ai-generated text. arXiv preprint arXiv:2306. 17439, 2023.
12

---

Published as a conference paper at ICLR 2024
SIR(ours)
KGW-1
The Hawaii man who was fired after issuing the false ballistic missile alert mid-January told reporters Friday that he was very upset over the incident but remained adamant nt that
The Hawaii man who was fired after issuing the false ballistic missile alert in mid-lanuary told reporters Friday that he was very upset over the incident but remained adamant that he
Prompt
did not intentionally send out a false alert. In an interview with CNN affiliate KITY, Hawaii Emergency Management Agency Administrator Vern Mivagi said was Vextremely upsett about the incident. YThis was a mistalke made during & time of high stress when everybody was worried about their (amilliss; Miyagi told KITV, 'There was no intention to deceive anybody. There was cover upi was mistake that madieot Mixagi told CNN that he was tvery upset about the incident-Jl t was upset with myself was upset that I made a mistake/) he said. teut was not upset that there was false alert sent out, it was mistake: It was honest mistake to deceive anyonel I was trying to get message out) that we needed to take seriousty!! The false alert was sent out zam 13: The agency sent out follows up message saying there was missile threat: The false alert sparked widespread panic as thousands of people took to social media to ceport that they were seeking shelter.
had done nothing wrong. "I'm sorry. apologize," said Brian Schatz. "I know scared the hell ous of peoplei And know how much work people do to protect and keep us safe: And sorry that caused them to have to scramble and do all of that, And will do everything in my power to ensure that nothing like this happens againd Hawall Gov David and other officials said during news conference Friday morning that the false alarm had been caused by mistake in the emergency alert system, The mistake had to do with how emergency messages are distributed: (This is not have been errors the emergencies and communications// said laes Wilhii is very serious matter It is very unfortunate matter. And it is very disturbing. And there will be changes to ensure that does happen again The governor sald there were indications of a malicious acti (But there are lessons to be learned/" said (ges) (And there are changes to be madei And there are lesson to be learned;
Generated Text
time there
trying
Z-Score
0.77
0.34
The man from Hawaii who was fired for issuing the ballistic missile alert January expressed his distress over the incident but maintained that he did not intentionally send out false alert. In interview with CNN affiliate KITV, Vern Miyan, the administrator of the Hawail Emergency
The Hawaii man who was terminated after issuing false ballistic missile alert mid-January expressed his deep remorse during à conference on Friday Brian K: Schatz acknowledged the fear and panic he caused and apologized to the public and the Individuals responsible for ensuring their safety. He sowed to talk all necessary measures to prevent similar incident from occurring in the future) Hawall Governor David Ige and other officials also addressed the situation, attributing the talse alarm to mistake the emergency alert system's 9 distribution process, They emphasized the seriousness of the matter and pledged to implement changes to prevent such errors in the future: While there were no indications malicious intent,
Management Agency, shared that he textremely upset' about what had happened: He explained that the mistake occurred during a time of high stress when everyone was concerned about their families Miyagy emphasized Intention deceive or cover up the mistake, as is was an honest erros He admitted feeling upset with himself for making the mistake but clarified that he was not upses about the false allers being sent out Miyagi's intention
Rewrite w. GPT3.5
there was no
convey serious message that needed to be taken seriously, The false alert)
incident highlighted the need for lessons learned and improvements to be made, Hanolalu Mayor Kirk Caldwell acknowledged that the incident had raised concerns about the effectiveness of the emergency notification system:
was issued on lanuary 13, and the ageney promptiy sent follow-up message clarifying that there was missile threat: The incident caused widespread panicy with many individuals taking social media to report seeking shelter
Z-Score 0.41
0.13
Figure 4: This figure demonstrates the examples of our watermark method and the KGW-1 method when using the same prompt. It contrasts the effects of detection on the unmodified text versus text rewritten by GPT-3.5 and then detected. All the texts are generated using the LLaMA-7B model. In our method, tokens with watermark logit value greater than 0 are marked in green color (corresponding to green tokens in the KGW-1 method).
A
CASE STUDY
To more intuitively demonstrate the robustness of our semantic invariant watermarking algorithm, we present a comparison between texts generated by our algorithm and KGW-1, KGW-2, and KGW-4 given the same prompt in Figures 4 and [5] Both figures show the original texts produced by the corresponding watermark algorithms and the texts rewritten by GPT-3.5. The green color indicates tokens with watermark logit values greater than 0 (corresponding the green tokens in the KGW-k
13

---

Published as a conference paper at ICLR 2024
KGW-2
KGW-4
The Hawaii man who was fired after issuing the false ballistic missile alert mid-January told reporters Friday that he was very upset over the incident but remained adamant nt that he
The Hawaii man who was fired after issuing the false ballistic missile alert mid-January told reporters Friday that he was very upset over the incident but remained adamant that he
Prompt
was very upset over the incident but remained adamant that he had done nothing wrong. State
was very upset over the incident but remained adamant that had followed protocol. Jared Takai] 24-year-old Hawall Emergency Management Agency employee) said he did not want to be the person to tell the publlic about false ballistie-missile warning, Uljuss didn't want that cespansibility my shoulders: was just trying do my best get the alert out Takai told reporter. "And bknow &mmessed up. made a huge mistake. He also said that if he had known alert was fake, he would have never sent out, Takal's admission military said has now conducted a thorough
emergency management officials announced that the Hawaij Emergency Management Agency's computer system was the source of the groblem
"There was no flow in the emergency system. and the process not automated) erroneously reported said spokeswormn Richelle Sakai, The allrrs were sent at about 8:0S a.m. Hawaii time, and the false computer system joint project Hawaii and Federal Emergencc Management Assaciation, and the agency's chief administrator said Friday the system is (fullly operational!! The Honolutu Star, Advertiser reported that the Hawaiian emergency system is a REMA system that is "fully automated" and is tnot designed to allow for human errort which is what the report says happened: AA correction message was within minutes bi said.!
Generated Text
was corrected within minutes;
the U.S.
investigation into the incident: The investigation determined that the employee cesponsible for issuing the alert followed standard operating procedures the U: Pacifie Command said statement Friday "While the investigation found no malicious intent or indication of compromise of the emergency management system)
Z-Score
0.46
0.50
man who was fired for issuing false ballistic missile alert mid-January expressed his distress over the incident but maintained his innocence, according to reports on Friday, State emergency management officials stated of the problem the computer system of the Hawaii Emergency Management Agency.
Hawaii man was fired issuing false ballistic missile alert in January expressed his distress over the incident but maintained that he had followed protocal. Jared Takai, a 24-year-add employes of the Hawaii Emergency Management Agency, stated that did responsible for informing the public about false warning, He admitted to making a significant mistake and emphasized that he would not have sent out the alert had known was has completed thorough investigation into the incident, concluding ng that the employee had followed standard operating procedures, However, the investigation also highlighted the need for additional testing and improvements to strengthen the emergency management system, The false alert, which was sent out during an internal test) was after 36 minutes
Spokesseomn Richelle Sakai clarified that there was no flaw the emergency system that it was not automated) contrary earlier reports, The false alarm which was sent approximately 8:05 a.mi Hawaii time was rectified within minutes: The computer system, collaboration between Hawal and the Federal Emergency Management
Rewrite w. GPT3.5
The U.S. military
Association is confirmed to be (ully operational the agency's chief administratos The Honolute Star Advertiser reported that the Hawailan emergency system which is FEMI system, is fully automated and not designed to allow for human error, which is believed to have occurred in this case
Z-Score 0.07
-0.05
Figure 5: This figure demonstrates the examples of the KGW-2 method and the KGW-4 method when using the same prompt. The other settings of this figure are identical to Figure 4
algorithms). These examples illustrate that our algorithm maintains high z-scores even after GPT-3.5 rewriting, while the robustness of the KGW-k algorithms decreases as k increases.
B WATERMARK LOGITS ANALYSIS
In this section, we analyze the influence of the shape of watermark logits on watermarks. Specifi- cally, we study the impact on watermark detection success rate and text quality after four different transformations of the original watermark logits. The four transformations are:
tanh (10000))0 scaling, which is the method used in this work, after which all values will be close to -1, shown in the top graph of Figure
14

---

Published as a conference paper at ICLR 2024
Tanh(1000x) Scaling
Scaling
1.0
1.0
0.8
Scabed nateres legit
0.8
Scaled wateraas laghs
0.6
0.6
0.4
0.4
0.2
0.2
0.0
0.0
.0.2
6.2
-0.4
-0.4
-0.6
-0.6
-0.8
-0.8
-1.0
-10
10008
ID(ArgRanked
ID(ArgRanked
Tanh(10k) scaling
Cubic Scaling
origh uatemmrs logit
Origh watemark ligit
0.2
0.2
0.0
0.0
-0.2
-0.4
-0.4
-1.0
-10
10000
20008
30000
10000
26000
3 30000
Token RArggRaanked by value)
Token ID(ArgRanked by value)
(a)
Figure 6: Examples of the shapes of four watermark logits that we tested are presented: (a) The top graph of Figure (a) illustrates the tanh(1000x) utilized, (b) the top graph of Figure (b) displays the data originally ranked and linearly scaled to the interval between -1 and 1, as demonstrated by Equation 10. Subsequently, the graph below Figure (a) depicts tanh transformation applied the top graph of Figure (b), and the graph below Figure (b) demonstrates a cubic transformation applied likewise to the top graph of Figure (b).
Linear scaling: uniformly distributed between and according to the rank of the data (top of Figure b)):
L(x) - argsort(argsortt
(10)
len(x) x) -1
(an)(107(zz)) scaling, applying an additional tanh transform on top of the linear scaling, shown in the bottom graph of Figure G(a).
L(x)* scaling, applying an additional cubic transform on top of the linear scaling, as shown in the bottom Figure b(b).
Figure o iillstraass that the four distinct watermark logits exhibit minimal differences in their impact on text perplexity (PPL) under various values, corroborating our hypothesis articulated in Section 6.4 This hypothesis posits that the influence text quality predominantly depends the token with the maximum value in the watermark logits, as the four employed watermark logits possess the same maximum value under identical values. Nonetheless, these watermark logits require different 5 values to achieve optimal detection results; the need for larger 8 values increases with higher distribution of values near zero. Correspondingly, the watermark logits we adopt can achieve excellent detection performance with minimal impact on text quality.
C ANALYSIS OF DIFFERENT EMBEDDING MODELS
To investigate the impact of different embedding language models on watermark algorithms and to discern how to appropriately select an embedding model, we enumerate in Figure X the distribution of sentence embeddings and the relationship between sentence embedding similarities and watermark logits similarities when employing three distinct embedding models: BERT Devlin et al. (018)) Sentence-
MirtenceeBERTPPPe Reimers & Gurevych (2020), and Compositional-BRRT Chanchani & Huang (2023).
Sentenee-BERY (SBERT) and Compositional -EER (CBERT) have been refined for sentence simi- larity tasks. They show near-normal distribution of embedding similarities with moderate average similarity, making them ideal as our embedding models. In this study, we opt for Compositional- BERT, though employing Sentence- BERT would yield comparable results. Conversely, the origin
15

---

Published as a conference paper at ICLR 2024
Detaction scora value Different Settings
va. valuu Differant Settings
410
0.5 3.5
3/3
value
(b)
Figure 7: The left figure shows how the watermark detection Fl score changes as the value of d (the extent of watermark augmentation) varies, using the 4 different watermark logits from Figure The right figure shows how the perplexity (PPL) of the generated text changes with 8 for the different watermark logits.
40
Similan
4.50
Simllary
Number
6.28
4.3
431
Similarity
CBENT
AF
M6 64
24.31 AF 04 6
04 05
(a)
(b)
(c)
Figure 8: Comparison of similarity distributions for different embedding language models and the corresponding watermark logits after transformation.
BERT model, not specifically designed for text similarity, tends have uniformly high text similarity scores, which in turn means that minor perturbations in embeddings can significantly affect watermark logits, rendering it unsuitable as the embedding language model for our robust watermark algorithm.
D MORE DETAILED COMPARISON TO KGW
we have already mentioned that the watermark generation and detection principle of our method and the KGW approach Kirchenbauer et al. (2023a) are fundamentally very similar. Here, we delve into a more detailed comparison.
In Sections 4.2 and 4.3
Firstly, regarding the watermark generation process, introduced in Section 4.2 our watermarking method can generate watermark logits with a nearly equal ratio of and This is essentially the same as the red-green token method of KGW. The difference is that in our approach, 1 and -1 (green and red) are determined by semantic embedding while in the KGW method, they are decided by the hash of tokens within the local window.
should noted that our method corresponds solely to the scenario in the KGW where the proportion of green tokens (y) is 0.5. Here, clarify that our method also supports flexible configuration of y. This can be achieved by simply modifying the loss function during the training process of the watermark model. Specifically, first define function S(v) {$1, -2,..-,8, Sn], where
16

---

Published as a conference paper at ICLR 2024
y=
3.0
Orgin
1.0
Seaeed neterment light
0.8
0.6
0.4
0.4
0.2
0.2
-0.2
-0.4
-0.6
Salee wntermntt legit
20000 Token (A(rgRaaneed by value)
10000
30000
10000
20000
30000
Token IDIArgRanked by value)
a
b
Figure The shape of watermark logits when the proportion of (green token ratio) is 0.25 and 0.75.
(1-7) 8j
Ujs
vf 0 otherwise
=
(11)
U/1
Consequently, the normalization loss can be modified
Ln G Σ Σ E S(T(e,)())
+ S(T
ΣΣ
R 01
(12)
And the corresponding similarity loss could be modified as:
ΣΣ
S(T(e))) S(T(e:))
tanh(ki(
e,
ΣΣ
ek el
))l (13)
|S(T(e:))] []S(T())))II
||:||
||ell2
|
2 ||
With the defined loss function, watermark model that generates watermark logits with a ratio of I proportional to y could trained accordingly. Further, in Figure we demonstrate the shape of watermark logits when is 0.25 and 0.75.
In terms of watermark detection methods, our approach also nearly identical the KGW method. The principle involves identifying which tokens in the text correspond to watermark logits of (belonging to the green list). Both our method and KGW employ the z-value test method for watermark detection. In fact, completely equivalent.
perform transformation that makes the detection method
((t) First, transform the range of Pw from [-1, to [0, 1]. For this, define Q
Then, conduct z-value test the cumulative value of Q(4)) across the entire text. The mean is yN and the standard deviation is /N(1 -777, making the detection formula:
Σ j=1 Qu:
(t,)) (sprompt, ty-1) 7N
(14)
VN(1 ?/r
This makes our detection formula essentially the same as that in KGW, The surface-form difference the detection equation is due the different z-value test target.
E DETAIL NETWORK STRUCTURE OF THE WATERMARK MODEL
To elaborate detail on our methodology, we present the Python implementation code of the watermark model described in this work, as illustrated in Figure TO Precisely, the network consists of an input layer, output layer, and a middle linear network with residual connections. The dimensions of the input correspond with the output dimensions of the embedding model, while the output dimensions align with the size of the vocabulary. During our implementation, given the variation in vocabulary size across different language models, predetermined fixed output dimension of 1000. Subsequently, random mapping was established to project various vocabularies randomly onto this output dimension.
17

---

Published as a conference paper at ICLR 2024
class ResidualBlock (nn.Module):
def _ast__(sefff, dim): super (RsidduaBok, self)... init
self.fe nn. Linear (dim, dim) self.relu mn Rn.))L(()
def (sel,, x)
out self. (x) out self. relf.relu (out) out out x return out
11
class TransformModel (nn.Module))
def _init__iiettt__ (self, num_layers, input_dim, hidden_dim, output_din)
15
super (Iganssfrrforrr self)._init_1
16
self. = nn ModMuleLList
self self. for in range (num_layers) layers 2):
Lnn.Linear (input_ding _imm hidden_dime
sclf waw.llyyyss.po.o append (ResidualBlock (hidden_dimi
20
sclf.laycrs append append (nn.Linear (hidden_dim, output_dim)
21
def forward x)
for in range (len (self. llyerr))))) x self. layers (x)
34
25
return
Figure 10: The code implementation of the watermark model in this paper, where the TransformModel class represents the watermark model network.
Furthermore, it is unnecessary to recalculate using the watermark model for every token generated during the implementation process. Since the semantics of the text typically do not alter dramatically with the addition of individual tokens, we compute the watermark logits at intervals of steps (where N ranges between and 10) in practice. This approach effectively reduces the computational complexity of our watermarking algorithm.
F SECURITY ROBUSTNESS ANALYSIS
In this section, we provide a general analysis of the security robustness. Herein, security robustness refers to the likelihood of users deducing the watermark generation methodology from knowledge of the watermark algorithm and generated watermark text examples.
More specifically, there is strong correlation between security robustness and the number of water- mark rules the watermark algorithms. For instance, the KGW-k watermark algorithm possesses number of watermark rules equivalent | (each combination of tokens of k window size corresponds to a watermark logits), hence exhibiting an exponential increase in security robustness with increasing k.
Regarding our algorithm, assuming no correlation between different watermark generation rules, the number rules our algorithm be calculated using the following equation:
V
(15)
where represents potential text length. However, many rules generated in this manner are se- mantically similar, necessitating consideration of rule correlation when estimating the number of watermark rules. Calculating such correlation is highly complex and not straightforward.
Rather than directly calculating the complexity of watermarking scheme, demonstrate its security and robustness by the success rate of attack algorithms in cracking the watermarking rules. Thus in Figure a) we utilize the word frequency analysis method employed by (Sadasivan al.
18

---

Published as a conference paper at ICLR 2024
2023) In this experimental setup, analyzed 2000 generated texts, each with length of 200, and found that the security robustness of our algorithm is superior to KGW-3 and closely approximates KGW-4
G ROBUSTNESS TO MORE TYPES OF ATTACK
Table The left table illustrates comparison of the robustness between our method and the KGW series methods under the Emoji Attack scenario. The right table, meanwhile, presents comparison between our method and the KGW series methods in the context of the Copy-Paste Attack.
Method
Origin F1
Emoji attack F1
Method SIG(ours)
Same topic
Different topic
SIG(ours)
100
98.6
91.8
88.1
KGW-1
99.7
99.0
KGW-1
92.0
91.8
KGW-2
100
53.2
KGW-2
91.2
91.1
KGW-4
100
49.7
KGW4
91.1
91.0
Even though our work has implemented numerous attack methods, including text rewriting, synonym replacement, and spoofing attacks, to test the robustness, there are still some missing attacks. We here conduct two additional attack methods: the emoji attack and the copy-paste attack (prefix injection attack).
Regarding the emoji attack described by Kirchenbauer et al. (2023a), we conducted experiments using the llama2-7b-chat model (Touvron et 2023). Specifically, our approach involves prefxxigg our prompt with the following addition: inserting asterisk between each generated token. Subsequently, we remove these asterisks from the generated text. The experimental results are presented in the left half of Table Both our method and KGW-1 exhibit strong robustness against the emoji attack. The robustness of KGW-1 attributed to its generation minimizes the impact of inserted emojis. On the other hand, our SIR method demonstrates significant resilience because the insertion of emojis does not drastically alter the sentence's 's embedding. Of course, this depends the robustness of the embedding model, but in our experiments, our SIR method proved to be highly robust to the emoji attack.
global red- oddgrreen list, which
We further explored the robustness against the copy-paste attack. Following the approach of Kirchen bauer et al. (2023a), we inserted 150 watermarked tokens into 600 human tokens. Specifically, we tested scenarios: the first where the human text and watermarked text share the same context, meaning they convey the same topic; the second scenario involved entirely different contexts. where the human text and watermarked text address distinct topics. Here, "having the same topic" refers to language model (LLM) extending where both text segments are directly combined to form a copy-paste result. Conversely, "having different topics" means that after the LLM generates 150 tokens, these tokens merged with 600 tokens from a different text, forming the copy-paste result. The results could be seen in the right part of Tabe Overall, in scenarios where the topics the same, the robustness of both the KGW-1 method is nearly identical. However, in cases involving different topics, the effectiveness of our method may slightly diminish. Although robustness decreases in cases of different topics, believe that in the vast majority scenarios, the copyed text should be of the same topic.
original text of 600 tokens with an additional 1,50 tokens,
method and
H EVALUATING TEXT QUALITY IN MACHINE TRANSLATION TASK
To further demonstrate that our method does not adversely affect text quality, we conducted additional experiments in the context machine translation. Specifically, we utilized the NLLB-200-distilled Costa-jjajs et al. (2022) model for experiments in the French-English and German-Englian scenarios on the WMT14 dataset. As shown in Table 4 although there is a slight decrease in the BLEU score after watermarking, the extent of this decrease is minimal. This indicates that the impact our method on the quality of the text smaller compared to that the KGW-1 approach. Moreover, approach also achieves high detection F1 score.
19

---

Published as a conference paper at ICLR 2024
Table 4: This table demonstrates the efficacy of watermarking algorithm in machine translation tasks. We conducted experiments using two scenarios within the WMT14 dataset: and German- German-English. The machine translation model employed was MLLB--20-distilldd-0000 Costa-jussà et al. (2022). We compared the watermark detection FI score as well as the BLEU values before and after watermark insertion.
Setting
Method
Ori.BLEU
Wat. BLEU
Detection FI
FR-EN
KGW-1
37.9
36.5
99.8
FR-EN EN
SIG(ours)
37.9
36.8
100
EN-DE
KGW-1
38.5
37.7
100
DE-EN
SIG(ours)
38.5
37.9
Table 5: The table illustrates the experiments at various text generation lengths. Specifically, experiments were carried out under four scenarios with generation lengths of 50, 100, 300, and 600. In each of these four scenarios, the effectiveness of detecting the original generated text and the text rewritten using GPT-3.5 was tested.
Method 50-L Ori/Re
100-L Ori/Re
30i-Le
600-L Ori/Re
SIG(ours)
92.8/78.4
98.4/87.5
100/92.2
100/98.7
KGW-1
92.5/77.3
97.5/88.0
100/92.4
100/98.9
KGW-2
91.7/71.5
98.0/81.2
100/84.8
100/93.2
KGW-4
92.3/65.2
98.1/71.4
100/73.5
100/82.1
I EVALUATING THE EFFECTIVENESS OF WATERMARK UNDER DIFFERENT LENGTH
To further demonstrate the effectiveness our method, we conducted experiments under various text generation lengths, specifically at lengths of 50, 100, 300, and 600. In these four scenarios, we tested the detection effectiveness on both the original generated text and the text rewritten using 5PT-3.5. The detailed experimental results presented in Table The shows that the generation length increases, both the effectiveness and robustness of detection improve. This trend is consistent with the KGW method. Even when the length exceeds 600, surpassing the 512-length limit of the embedding model, truncating the context does not affect the specific detection.
J EVALUATING THE REPETITIVENESS OF GENERATED TEXT
To further assess the quality of the generated by our method, we conducted additional evaluation of the text's repetitiveness. Specifically, we quantified repetitiveness using the probability of N-gram recurrence, where N was set 1, and The results of this assessment can be seen
Table 6: The table evaluates the repetitiveness of text generated by our watermark compared to other methods. Specifically, we assess repetitiveness using the probability of N-gram repetitions, where N selected as 1, and 3.
Method
1-gram
2-gram
3-gram
SIG(ours)
0.41
0.11
0.02
KGW-1
0.46
0.14
0.03
KGW-2
0.40
0.09
0.02
KGW-4
0.38
0.07
20

---

Published as a conference paper at ICLR 2024
in Table 6 It can be observed that the level of repetition in generated texts is lower than that of KGW-I, but higher than KGW-2 and KGW-4. Although our method did not achieve the lowest degree of repetition, compared to the KGW series, it still represents optimal balance in terms of text repetitiveness, robustness, and security.
K BROADER IMPACT
Large language models (LLMs) have heen applied to various tasks, including those based on parsing Liu et al. (2023a) and those based knowledge Hu et al. [2023 2020). However, there still exists the potential for misuse of large language models, which includes unintentional misuse (hallucinations)
and intentional misuse Chen & Shu (2023). To mitigate unintentional misuse, methods such as red-teaming Perez et al. 2202); Liu et al. (2022) and safety aligmment Liu et al. (2024) can be utilized. However, these strategies may prove less effective in countering intentional misuse, underscoring the necessity for mechanisms to identify L.LM-generated content. Predominantly. two methodologies have been identified: the black-box approach, which entails the development of classifiers to distinguish L.LM-generated text Tang et al. (2023), suffers from a lack of interpretability and diminishing efficacy as LLM output quality enhances. Alternatively, this study explores LLM watermarking, offering a more interpretable means of detecting LLM-generane text. The main contribution of this work is the establishment of the current best balance between security and robustness for LLM watermarking.
21


Reviews:
[{"review_id": "j7eBevX8d5", "reviewer": "Reviewer_1hfF", "summary": "This paper proposes a method for watermarking the outputs of autoregressive large language models. Following previous works, the proposed approach intervenes at the sampling step by perturbing the language model's predicted logits for the current token. Rather than determine the logit perturbation vector (\"watermark logits\") via a fixed partition of the token vocabulary or a hash of preceding tokens, the proposed method uses a \"semantic\" representation of preceding tokens to determine the perturbation. Because detection is performed analogously, the proposed method is robust against semantics-preserving transformations of watermarked text, while obtaining stronger security against the reverse-engineering attack of Sadasivan et al. [1].\n\n[1] Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? arXiv preprint arXiv:2303.11156, 2023.", "questions": "If the semantic embeddings are insufficiently sensitive -- i.e., if they remain similar as more tokens are generated and added to the context -- couldn't this lead to highly repetitive generations as the same logits are boosted (similar semantic embeddings are mapped to similar watermark logits)? I could see this becoming an issue as the length of the context passed to the semantic embedder increases, as new tokens will constitute an increasingly small portion of the context window. The provided example of text generated with the proposed method (Appendix A, pp.12) seems more repetitive than the Kirchenbuaer et al. examples. It would be interesting to know whether the authors evaluated the quality of watermarked texts in terms of repetitiveness or other metrics beyond perplexity.\n\nHave the authors tried using different fixed context lengths for the semantic embedder? Because the experiments in the paper use a generation length of only 200 tokens, the authors presumably feed all previous tokens to the semantic embedder. It would be interesting to see how short and long contexts (e.g. up to the limit of the embedding model) affect the performance of the watermark in terms of robustness, security, and text quality. The required context length could also have implications for the strength of the watermark as a function of the number of tokens generated, and its robustness to cut-and-paste attacks where generated text is spliced into human-written text [1].\n\nThe watermark of Kirchenbauer et al. allows for an arbitrary \"green-list\" size. With normalization, the distribution of watermark logits produced by the proposed method looks very symmetric (Figure 2c, pp.8), corresponding to a \"green-list\" size of 50% of the vocabulary. However, this is presumably computed in aggregate over the data distribution. In practice, do the watermark logits for individual time steps ever deviate significantly from an even split between $±1$?\n\n\n[1] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the Reliability of Watermarks for Large Language Models. arXiv preprint arXiv:2306.04634, 2023.", "limitations": "", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Using a \"semantic\" representation of previous tokens to determine the watermark logits for the current token, rather than e.g. a hash of the preceding n-gram, is a novel and interesting idea.\n\nThe general method of mimicking the green-list/red-list vocabulary partition of Kirchenbauer et al. [1] by using embedding and mapping networks to generate logit perturbations in $±1$ is clever, and the proposed training scheme for the mapping (\"watermark\") network is intuitive and well-motivated.\n\nThe proposed method achieves similar or better robustness to established language model watermarking methods while maintaining similar or better generated text quality (as measured by perplexity) and increased robustness against the reverse-engineering attack of Sadavisan et al.\n\n[1] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. arXiv preprint arXiv:2301.10226, 2023.", "weaknesses": "The detection equation (7) on pp.5 is not very clear. I'm assuming that detection is performed by computing the watermark logits vector for each time step, checking if the vector entry corresponding to the observed text token at each time step is 1 (as these logits should roughly be $±1$ given the saturated $tanh$), and keeping a running tally (in practice, a running sum of these selected logit values). This is basically how detection works with the watermark of Kirchenbauer et al., with the \"green list\" corresponding to watermark logits valued $1$ and the \"red list\" to logits valued $-1$. If this is indeed the case, it doesn't really come across in equation (7) -- the notation looks like we are taking the logit at the index corresponding to our current integer time step $j$ rather than the one corresponding to the observed token at the current time step $j$. I think either better notation or some additional explanation is needed.\n\nWhile the authors consider the attack of Sadasivan et al., they do not consider _adaptive_ attacks performed with general knowledge of their proposed watermarking method. Could a motivated attacker leverage a semantic embedding model of their own to better estimate or remove the watermark? Even with access to only a surrogate embedder model and no access to the mapping/watermark model, my intuition is that the tight correspondence between semantic embeddings and watermark logits might make such an adaptive attack feasible. If the number of semantic contexts that need to be observed to infer the watermark's \"rules\" in such a scenario is much lower than, say, the number of n-grams that need to be observed for KGM-n, this would constitute a serious security flaw.\n\nThe evaluation of the quality of watermarked text is somewhat limited, only covering perplexity.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UfRAJKhni3", "reviewer": "Reviewer_FTnC", "summary": "The paper introduces a robust watermarking method for large language models (LLMs) that balances attack robustness and security robustness without the usual trade-offs. By using semantic embeddings of text, the proposed method embeds watermarks that remain consistent despite semantically invariant changes like synonym substitution or paraphrasing. The technique uses an auxiliary LLM to generate embeddings which a watermark model transforms into watermark logits, combined with LLM logits to generate text. Experiments show that the method maintains robustness against semantic perturbations and is secure against watermark cracking, with minimal impact on text generation. The approach represents a novel contribution to watermarking in LLMs, effectively distinguishing between watermarked and non-watermarked text.", "questions": "1. Could you kindly elaborate on the definition of 'watermark' within the scope of LLM? It appears that the primary emphasis of the paper is on the detection of text generated by LLMs and a detailed definition would be beneficial for clarity.\n\n2. I would appreciate additional information on the reconstruction process of the watermark. The method described in Section 4.3, involving calculations for each token t_j, piques my interest for a more in-depth understanding.\n\n3. What is the theoretical or practical capacity of the watermark within the framework presented? An explanation of its capabilities would greatly enhance the comprehensiveness of your findings.\n\n4. Could you provide further insights into the practical applications of the watermark in the realm of LLM? Digital watermarking is typically used to identify ownership of the copyright of such signal.", "limitations": "", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The authors proposed an important issue in the era of generative models.\n2. High Accuracy: Achieves high accuracy in detecting text generated by LLMs.\n3. Security Robustness: Designed to be secure against attempts to crack the watermark.\n4. Efficiency: Allows watermark logits to be generated in parallel with LLM logits, causing only marginal latency increase.\n5. Novelty: First of its kind to be semantically invariant and robust in both attack and security aspects.", "weaknesses": "1. It is advisable to consider a more comprehensive range of attack scenarios, similar to the approach taken by Kirchenbauer et al. The authors have conducted experiments to assess robustness, as evident in the attack rephrasing described in Section 6.2 and the security robustness analysis in Section 6.3. I am curious about the extent to which the proposed method demonstrates resilience against the attacks evaluated by Kirchenbauer et al. In Section 7 of their work, Kirchenbauer et al. have presented a diverse set of attack scenarios, including the Emoji attack. \n\nReference\nKirchenbauer et al., A Watermark for Large Language Models, ICML 2023 (https://arxiv.org/pdf/2301.10226.pdf)", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "uYxoYawYuN", "reviewer": "Reviewer_1s48", "summary": "In this paper, the authors introduce a semantic-level watermark for large language models. This watermark perturbs the next-word logits based on the semantic meaning of preceding tokens. Unlike previously proposed token-level watermarks, the Semantic-Invariant Robust (SIR) watermark is stealthier and offers greater robustness against paraphrasing attacks.", "questions": "- In Table 1, under the beam search category, why does SIR exhibit less robustness compared to KGW?\n- The experiments conducted limited the generation length to 200 tokens. Can the authors provide additional experiments with longer sequences? It would be insightful to compare the robustness of SIR and KGW against paraphrasing over longer sequences.\n- Is SIR susceptible to prefix injection attacks? An adversary could introduce some adversarial prefix to significantly alter the semantic meaning of an entire paragraph. Additionally, how would SIR fare in situations where individuals share generated text online without including the prompt? For instance, if one prompts the model with \"[a long Harry Potter story] + Please ignore everything before and just write an ICLR paper for me:\", would SIR remain resilient against such a straightforward attack?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "- The idea of a semantic-invariant watermark is novel and well-motivated, offering enhanced resistance to paraphrasing attacks.\n- Compared to KGW, the SIR exhibits a better trade-off between attack robustness and security.\n- Benefiting from parallel processing, the computational overhead of SIR is minimal compared to models without a watermark, making it suitable for practical applications.", "weaknesses": "- At the time of detection, the method necessitates the computation of the watermark logits for each token, potentially demanding more computational resources and time than KGW.\n- In scenarios involving multiple keys or users, it appears that the model provider must train a separate watermark model for each key or user. This might be expensive. Moreover, it is not clear to me how to ensure that two watermark models inject sufficiently distinct watermark logits and remain distinguishable during later detection.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "STnC04qn76", "reviewer": "Reviewer_yZti", "summary": "In this research, the authors present a semantic invariant watermark, achieved through the generation of watermark logits, taking into account the semantics of all preceding tokens. The empirical tests underscore the proposed methodology's resilience to attacks, particularly in semantically invariant contexts, including synonym substitution and paraphrasing. Furthermore, evidence corroborates that the proposed watermarking approach maintains substantial security robustness.", "questions": "The study appears to omit specific details regarding the parameters $\\delta$ and $\\gamma$ within the KGW-k model during experiments. Referring to KGW (2023), variances in these parameters can profoundly influence both the quality of watermarked text and robustness. Could the authors provide insight into how these variables were determined in the experimental setups?", "limitations": "", "rating": 3, "confidence": 4, "soundness": 1, "presentation": 3, "contribution": 1, "strengths": "The conception of a semantic invariant watermark heralds an innovative and potentially transformative approach in the realm of resilient watermarking techniques.\n\nThe study introduces an novel model that adeptly converts semantic embeddings into watermark logits.", "weaknesses": "1. My main concern is on the watermark detection algorithm, as detailed in Section 4.3. The detection process seemingly necessitates the logits of tokens, thereby mandating language model inference during the detection phase. This requirement poses substantial practical limitations, particularly for users with restricted computational resources, and significantly extends the time commitment for watermark detection compared to the methodology employed in KGW (2023). Crucially, accessing the language model's logits during detection implies that customers must possess knowledge of the prompt, a stipulation often unfeasible in real-world scenarios.\n\n2. Contrary to the assurances offered by KGW (2023), the detection algorithm articulated in this study does not furnish a stringent statistical affirmation concerning the rate of false positives.\n\n3. Concerning experimental configurations, the authors elected to compare their model against the KGW-k variant, where k represents the count of preceding tokens subject to hashing. It is evident that amplifying k inversely impacts watermark robustness under text modifications since any token modification influences the red-green list of k+1 tokens per the KGW (2023) framework. It would be expedient for the authors to pivot their attention toward the more resilient KGW-1 model, exploring the effects of varying parameters like watermark strength $\\delta$ and the red-green list delineation $\\gamma$.\n\n4. A scrutiny of Table 1 reveals a distinct advantage of KGW-1 over the Semantic Invariant Representation (SIR) in scenarios employing beam-search. This observation prompts the question of the necessity for SIR when KGW-1 already demonstrates superior robustness, efficiency, and a more systematic detection methodology.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)