Permute-and-Flip: An optimally stable and watermarkable decoder for LLMs
Authors: Xuandong Zhao
Lei Li
Yu-Xiang Wang
Venue: ICLR 2025 Poster (2025)
Keywords: LLM
Watermark
AI Safety
Decoding
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: In this paper, we propose a new decoding method called Permute-and-Flip (PF) decoder. It enjoys stability properties similar to the standard sampling decoder, but is provably up to 2x better in its quality-stability tradeoff than sampling and never worse than any other decoder. We also design a cryptographic watermarking scheme analogous to Aaronson (2023)'s Gumbel watermark, but naturally tailored for PF decoder. The watermarking scheme does not change the distribution to sample, while allowing arbitrarily low false positive rate and high recall whenever the generated text has high entropy. Our experiments show that the PF decoder (and its watermarked counterpart) significantly outperform(s) naive sampling (and its Gumbel watermarked counterpart) in terms of perplexity, while retaining the same stability (and detectability), hence making it a promising new approach for LLM decoding. The code is available at https://github.com/XuandongZhao/pf-decoding

Published as a conference paper at ICLR 2025
PERMUTE-AND-FLP: AN OPTIMALLY STABLE AND WATERMARKABLE DECODER FOR LLMS
Xuandong Zhao UC Berkeley
Lei Li
Yu-Xiang Wang UC San Diego yuxi angw@ucad
Carnegie Mellon University 1 0cs cmu. edu
xuandengghh@@@aerreeee.eeeeii
ABSTRACT
In this paper, propose new decoding method called Permute soeuuteeand-FFil and-Flip (PF) decoder. enjoys stability properties similar to the standard sampling decoder, but is provably up 2x better in its quality-stability tradeoff than sampling and never worse than any other decoder. We also design cryptographic watermarking scheme analogous Aaronson (2023)'s Gumbel watermark, but naturally tailored for PF decoder. The watermarking scheme does not change the distribution to sample, while allowing arbitrarily low false positive rate and high recall whenever the generated text has high entropy. Our experiments show that the PF decoder (and its watermarked counterpart) significantly outperformis) naive sampling (and its Gumbel watermarked counterpart) in terms of perplexity, while retaining the same stability (and detectability), hence making it a promising new approach for LLM decoding. The code is available https: / fiihtbb. hhbb com/ Xuandong2hao/ pf- dedoodinnn.
INTRODUCTION
Large language models (LLMS)) (OpenAI, 2022; 2023b; Bai et al., 2022; Touvron et al., 2023) have become increasingly popular in recent years due to their ability to generate human-like -iiee text and solve many tasks through natural chatbot interface.
language model predicts the next word in sentence using real-value function u(:; prompt, prefix): y + R. known logits, which encodes the model's preferences which word to choose. Here V the vocabulary space (typically large discrete set of words); the "prompt" describes the task of interest; and "prefix" includes all preceding words that have been generated so far.
language model decoder refers to a possibly randomized function that takes prompt text r, API access to the logits function input, and outputs sentence 1/:.x
The main thrust of this paper is to introduce new decoder, termed Permute-and and--Fip Flip decoding, work out some of its intriguing properties with an application to watermarking LLM text, and hopefully convince readers that it deserves a shot at your next LLM application.
PROBLEM SETUP AND SUMMARY OF RESULTS
Before diving in, let's set up the stage with a quick tour of existing decoding methods and have brief look into how language model decoder can be evaluated.
Popular existing decoding methods fall into three categories: (1) Planning-based methods such beam search that aims at maximizing the sequence likelihood; (2) cumpling-based methods that recursively sample from the next-word distribution, e.g., the soft(arg)max transform the logits
u(v|=.w1n 1)/2
Softmax sampling: Ve ~ p(v) ΣS (
where T is the temperature parameter, and (3) greedy methods such greedy decoding that simply outputs yt arg max,ey u(yla; y1a-1) as well as its Top (Holtzman et al., 2020) and Top sampling variants that interpolate greedy and sampling methods.

---

Published as a conference paper at ICLR 2025
Performance metries. How do compare different decoding methods? More generally, how do we evaluate LLM- -eMegeerrttedd text? These are questions far from being settled. Naturally, if there is a (possibly (ask-dependent) performance metric U₂ V - R one can define, then the optimal decoder would be the one that outputs yi. = arg max yn evv Un Often Ug is instantiated to be the sequence likelihood Σi= logp(us p(ya (2. 11:1-1) which is equal to Σi=1 (x(e).
Recent works (Ippolito et al., 2019; Wiher et al., 2022), however, report that strategies that aim at maximizing sequence likelihood often result in texts that are more repetitive and less effective in some downstream tasks than those from the sampling- based methods (Holtzman et al., 2020). Depending on what the task is, there is not a one-size-fits-all performance metric, therefore is no single decoding method that works well for all tasks.
For the moment, let us stash the disputes on how to best evaluate an LLM- LLM-generated text and focus on designing methods that maximize any user-specified utility function. In fact, we will also give up on solving the sequence-level utility maximization problem' and simply maximize a per-slep utility function U V + R.
Ue can simply be the logits function that LLMs output, which may have already accounted for potential future utility (like the Q function in reinforcement learning) since the transformer-based language model had access future texts during pre-trate mre-training. Or uy be explicitly augmented regularizers such as a lookahead heuristic as in A decoding (Lu et al., 2022), entropy bonus for promoting
with
term for fact-checking (Lewis al., 2020), diversity (Meister et al., 2020).
Our goal is thus construct possibly randomized algorithm A that takes ue as input and outputs Vs E V that aims at maximizing E. Eyr-A., [ur(Bt)] as much as possible. In the remainder of the paper, we will simply take u as "logits" for concrete exposition all results are valid when u, is instantiated otherwise.
Other constraints/ / consideration. Why doesn't 't the trivial greedy decoder work? That's because there are other considerations besides text quality when selecting LLM decoders. For example, computational efficiency and latency are hugely important, since each API call to the logits function is costly. The diversity of the generated text is also important, especially for creative tasks.
Moreover, the decoding procedure should be watermarkable (Aaronson, 2023; Kirchenbauer et al., 2023; Zhao et al., 2023; Kuditipudi et al., 2024) in the sense that one should be able to inject subtle statistical signals that can be retrieved when given a secret key, to prove that the text is generated by this particular language model. Being watermarkable prevents the LLM from being used for malicious purposes such as scams (Weidinger et al., 2021), fake news (Zellers et al., 2019), and plagiarism (Stokel-Walkee 2022).
In addition to the above, one may also hope the decoding algorithm to be stable against small perturbations to the logits. Specifically,
Definition 2.1 (Stability). We say a decoding algorithm A is L-stable if for any prompt x. prefix V&a. and for any perturbed u such that | ulloo S 8, the log- or-orobbbility ratio satisfies
log P
}
L8 E...
( (v)
The stability helps avoid catastrophic failure in the scenarios where the logits may be subject to data poisoning (Zhang et al., 2022; Lin et al., 2021) or jailbreaking attacks (Zhang et al., 2023; Zhao al., 2024b). Furthermore, stability implies an intuitive notion of diversity, suggesting that tokens with similar logits should have comparable probabilities of being selected. For further discussion and examples, please refer to Appendix B.
Inspecting the decoding methods along the aforementioned dimensions, we notice that planning-basee methods fail to be computationally efficient. While greedy decoding is efficient and has relatively low perplexity, its generated texts are neither diverse nor watermarkable (at least not using existing techniques). The sampling-bass based methods, however, are both watermarkable and diverse. addition, softmax sampling is known to be 2-stable, while the others that we have discussed are not stable.
It is known be NP-Complete (Chen al., 2018).
2

---

Published as a conference paper at ICLR 2025
Table 1: Comparison of different decoding methods against five desiderata.
Methods
Perplexity
Computational Efficiency
Diversity
Watermark
Stability
Search (c.g. Beam)
Lowest
X
X
Greedy
Low
X
Softmax Sampling
Moderate
Top-p Sampling
Low (for small p)
Depends on Depends on
X
Top-k Sampling
Low (for small k)
X
PF Sumpling (ours)
Lower than Softmax
/
Fact 2.2. Softmax sampling decoding using (1) with temperature T satisfies (2/T)
Proof. The result is implied by the differential privacy guarantee of exponential mechanism (McSh- erry & Talwar, 2007, Theorem 6).
L
The pros and cons of different decoding methods are summarized in Table 1. From the table, can see that there a clear tradeoff between minimizing perplexity and preserving other properties. In particular, softmax sampling is the only method that checks all boxes, and the only one that is stable among existing decoders. This observation begs the following research question: Is there a decoding method that as stable as softmax sampling, but has lower perplexity?
In this paper, we answer this question affirmatively by bringing in technique called Permute-and-Pii sampling. Our contributions are fourfold.
We introduce Permute-and andtee--n-FFiii decoding - a new decoding algorithm for language models based on recent development in very different context (McKenna & Sheldon, 2020).
2. We demonstrate that existing results from McKenna & Sheldon (2020) already imply that:
Permute-ande and-Flip decoding is provably stable.
The cubility-perplesse
tradeoff of the PF decoding is Pareto-optimal. In particular, when compared to softmax sampling, PF decoding has up to 2x smaller expected suboptimality while having the same stability parameter L.
3. We designed an analog of Aaronson (2023)'s waabbel-Watrrarrkk for PF decoder, called the PF watermark. We show that the watermarked PF decoder samples from a distribution that is compu- tationally indistinguishable from the watermaaaake PF decoder, and the detection procedure has precisely controlled false positive rate (FPR) and high power in identifying watermarked texts.
4. We empirically demonstrate that open-generation tasks, PF watermark achieves the best balance of the highest detection accuracy and lowest perplexity compared to the baselines.
Overall, our proposed permute-and-flip decoding method provides promising approach to balancing the tradeoff between perplexity and stability in LLM decoding while also admitting watermarking capabilities.
Related work and novelty. PF sampling was invented the differential privacy (DP) literature (McKenna & Sheldon, 2020). Its stability properties are well-understood. The stability of Softmax sampling is also well-known (McSherry & Talwar, 2007). Our contribution is in applying this method to LLM decoding and connecting these known theoretical results to the broader ML audience. To our knowledge. the PF watermark is new to this paper. The design of the watermark leverages the Report-Noisy-Mizt interpretation of the PF sampling (Ding et al.. 2021) which allows similar pseudo-random function like the work of Aaronson (2023) to be applied. A more thorough discussion of the related work is given in Appendix A.
3 PERMUTE-AND-FIIE DECODING ITS PROPERTIES
The Permute-and-Fit Flip decoding iteratively generates the next token by simple procedure that uses only the logits. It involves first randomly permuting the vocabulary, then flipping sequence of biased coins according the permuted sequence until the first "head" is seen (see Algorithm 1).
3

---

Published as a conference paper at ICLR 2025
Algorithm Permute and Flip (PF) Decoding
1: Input: prompt language model M, temperature T.
2: for ? 2, ... do
3: Logits uı M(22, v1a--])-
Find už + m (v)..
5: Permute Shuffle the vocabulary V into V
6: for E do
7: Flip Draw Z ~ Bernoulli (exp ((=())))))
8: if Z then assign y: and break.
end for 10: end for
11: Output: Generated sequence = [y,, Vu).
Permute-and-llip makes words with higher logits exponentially more likely - even more so than Softmax sampling (Eq, 1). To see this, one may consider rejection sampling algorithm for obtaining a sample from Eq. (1), which repeats the following procedures until halts.
1. Uniformly samples y V.
Return it with probability:
plu)/p(y") = exp uu(yv))
This procedure differs from PF sampling in that it samples y with replacement, whereas PF sampling samples without replacement, giving PF sampling higher likelihood of producing y".
PF sampling was initially proposed McKenna & Sheldon (2020) as a differentially private selection mechanism that has better utility than the more well-known exponential mechanism (McSherry & Talwar, 2007). McKenna & Sheldon (2020) also derived a plethora of theoretical properties of the PF sampling. The following theorem summarizes these results in the language of LLM decoding.
Let the logits function be and u" maxyev u(y)- Let PF (u) be the distribution of PF-sampling, and Softmax (u) be the distribution in (1), both with temperature parameter T. The following statements true.
Theorem 3.1.
1. (Same stability) PF-Sampling is (2/T)
2. (Nearly greedy) PF-sampling obeys,
E Ey-pr(c)((()) 2
-Tlog
("Never worse"") For the same PF-sampling never worse than Softmax-sample
Ey-rr())(u()) 2 Ey-SSotmmxxu))uu(y)
U"Up to 2x better") There exists logits u such that PF-sampling is 2x smaller in terms of subopti- mality,
E Ey-pF(uj /u" u(v)] = Soy-Stttmx [u E
u(y)].
(Optimal stability tradeoff) For any decoder that is -table, if there exists u such that
By-P(u)) [u(v)] Ey-PF((y(u())
then there must another such that
E Pyy (y() Ey--PF()) [M()
Proof. The theorem follows directly from McKenna Sheldon (2020), specifically Theorem 1,
Corollary 1, Theorem 2, Proposition 4, and Proposition 6.
4

---

Published as a conference paper at ICLR 2025
The first statement shows that the PF decoder enjoys exactly the same stability parameter as in Fact 2.2. The second statement provides worst-case bound on how far PF-sampling is away from greedy-decoding a function of the temperature 7' in terms of the likelihood achieved. The third and fourth statements show that PF-samlling is always "more greedy" than softmax -aappiing.. The last statement shows that PF- sampling is not dominated by any other decoder that is equally stable (as in Definition 2.1), thus Pareto optimal. These results provide strong justification on the superiority of the permute-and-fip decoder over the standard softmax sampling in minimizing perplexity.
6.25
co
040dd
Figure 1: Comparing PF decoder vs Softmax
decoder using Example 3.2.
Let's consider a simple example to compare PF decoder and Softmax decoder.
Example 3.2. Let the [V] 2 and the corresponding logits be [A for gap A 0. Softmax decoder chooses the suboptimal token with probability 1/(1 + eA/T), while PF decoder chooses it w.p. A/T).
Since 1/(1 + 2) > 1/(2r) for all x > 1, the probability that the suboptimal token is chosen in PF sampling is strictly smaller than that of Softmax sampling. As shown in Figure 1, on the left, we fix the Gap A = 3.0 and vary the temperature T. On the right, we fix T = 1.0 and vary A. PF beats Softmax all cases.
4 REPORT-NOISY-ME AND WATERMARKING
Next, we turn the well-motivated problem of watermarking LLM generated text. The watermarking problem aims at embedding a secret message in the generated text that (essentially) reads "Beware! written by AI!".
The hope is that this message can be seen by anyone who has access to a secret key, while ensuring that the watermarked version of the LLM generates text that has almost the same distribution (or least very similar) to the original LLM.
More formally, watermarking scheme includes "Watermark" function that injects the watermark and "Detect" function that takes suspect text sequence Vinh as input and outputs prediction of 1 ("It watermarked!"") or 0 ("It is not!").
A wrong accusation of non -on-aaaerddr text as watermarked is called a false positive. A failure to detect watermarked text is called a false negative. The performance of watermark measured by its detection power (i.e., 1 1-false negative rate) at a given false positive rate.
There are many other necessary properties for watermarking scheme to be useful, such as low- overhead, model-agnostic detection, and revilience to edits and other evasion attacks. We refer readers the slide deck of Aaronson (2023) and the related work section of (Zhao et al., 2024a) for review of these desiderata and known results.
Among the recent attempts, two popular watermarking schemes perform satisfactorily on all the above criteria.
Gumbel Watermark (Aaronson, 2023) that uses a "traceable" pseudo-randon softmax sampling when generating the next word.
Green-Red Watermark (Kirchenbauer et al., 2023) that randomly splits the vocabulary into Green and Red then slightly increases the logits for green tokens.
Both of them determine their pseudo-random seeds chosen according to the m preceding tokens of the current token being generated. We will focus explaining the Gumbel watermark as it is more closely related to our approach.
Aaronson (2023)'s 's Gumbel watermark. "Gumbel-Max Trick", which states that:
The key idea of the Gumbel watermark leverages the
5

---

Published as a conference paper at ICLR 2025
Fact 4.1 (Gumbel, 1948). The softmax sampling in (1) is equivalent the following procedure (2)
ue(y)
= arg max
+ G((y)
yEV
T
where Gv(w) ~ Gumbel(O, 1) i..d d for each 1,y-
Gumbel noise can be generated using uniform r.v. Gumbel 1) ~ log (1og(1/ (1nn////nfoo((0000 1])))
So given a random vector T2 ~ (Uniform((0, 1))) VI we can write Gr(y) = = -ogl log(ri (v))).
The Watermark stage for the Gumbel-watermark essentially replaces Uniform((0 1]) with pseudo- random function (y) Fu, mat 1.k (y)) Given the secret key k. the aveudo-random function deterministic function with range [0, 10 but over the distribution of the secret key k, Ti is computationally indistinguishable from sampled from truly i.i.d. uniform distribution, which ensures that the distribution of y/ in the watermarked model computationally indistinguishable to the unwatermarked distribution (1).
At Detect phase of the the Gumbel watermark, the auditor who has access to the key may compute
(estSScoreçuuba((Uinn
- log(1 rr (v.)).
(=++1
If y1:m is not generated from the watermarked model, then the test statistic is a sum of exponential random variable thus [[[estScoree (yrm)) n m. Meanwhile, if yim is generated by the Gumbel watermarked model,
E E[TestScore(Jum))
Σ
E
Σ NEV
1=++1
2 (n - m) +
(1-1
π
Σ
E [Entropy(p:(-)]]
(4)
(=m=1
L-E" dx is Euler's Harmonic number and Entropy where Pt == Softmax(u//T), Ho == So I-z
denotes the standard Shannon entropy (in nats) for a discrete distribution, i.e., Entropy(p] = -Evey ply) poy) The above results were described Aaronson (2023)'s talk, but without detailed proofs. To be self-contained, we added formal statements and proofs about the Gumbel watermarks in Appendix D.3 (see Theorem D.3 and D.6).
Permute-and-Fling as ReportNoisyMax. turns out that the Permute-and-FFli sampling has similar equivalent Report-Noisy--er form. Instead of Gumbel noise, it is the exponential noise that are added to the logits. This less-known fact is due to Ding al. (2021)
Fact 4.2 (Ding et al., 2021, Theorem 5). Permute-ane and-Flip Sampling in Algorithm with parameter T is equivalent to
uc(y)
Vt = arg max vEV T
+ Fely).
(5)
where E4(y) ~ Exponential(1) i.i.d. for each 1, y-
Leveraging this fact, in the remainder of the section, we develop a watermarking scheme for Report- NoisyMax that is analogous the wateeakwatermarkk
Permute-and-Flij watermark. The natural idea to replace the exponential noise Ey(y) with a pseudo-random version that depends on secret key and a prefix with length m. Observe that Exponential - log( (Uniform([] ((0, IJ)), thus the standard pseudo-random function that generates uniform random variables can be used. In the detection phase, we compute:
TestScorepp (yi.)) = Σ - log(rr(u))).
t=
Note that this is a simple change of sign of (31)) comparing to the test score the Gumbel watermark. Detailed pseudo-code for how the watermark works are given in Algorithm 2 and Algorithm 3.

---

Published as a conference paper at ICLR 2025
Algorithm 2 PF watermarking: Watermark
1: Preparation: Randomly sample watermark key
2: Input: Prompt language model M, pseudo-random function F, watermark key k, temperature T
3: for f. 2, do
Compute logits: u + M[[ w1==1))
5: Generate pseudo-random vector r-) using ry)) =
for E V
6: Select the next token using
1/ arg max NEV
uc uv())
log re(w)
(6)
T
7: end for
8: Output: Watermarked sequence
[91, .... yn]
Algorithm 3 PF watermarking: Detect
1: Input: Suspect text yi.., watermark key k, pseudo-randon function H', target false positive rate a
2: Output: Binary decision (1 if text is watermarked, 0 otherwise)
3: Calculate the cumulative score
TestScorepr (Vim))
Σ
(v)(re()))
t=
where (v) Fi mat- 1
4: if TestScore CDF Gammain- mm.1) (1 a) then return 1, i.c., "The suspect text is watermarked."
5: else return 0, i.e., "The suspect text is not watermarked."
Theorem 4.3. Assume the pseudo-randommess is perfect", i.e., F Fmrem.(()) ~ Uniform 1]) i..d W[uim yl E pm+11
The following are true about PF watermark scheme.
1. If you is statistically independent to the secret key k,
E Scorepr (ytreppppyy)))laaa
m..
2. in addition, all m-grams in Vin unique, then conditioning Viww
TestScorepp ~ Gamma(n - m, 1).
The choice CDF-1 Gamma(n - m. - a) ensures the false positive rate in Algorithm 3 equal
to a..
Assume fim is drawn from Algorithm then
mils)
((- log
II (1-1. )
B [esttSorrep (y1:..)
Σ NEV
(8)
Emm++
V'EV.v'vv
The above expression in (8) may appear messy, but is the exact calculation and captures the entropy of the distribution PF-induces for given ut To see this, let instantiate the bound for two special cases that admit more explicit forms.
Example 4.4. When Sofumax(w::) 1/k for an arbitrary subset tokens and for others,
E|- log(re = H₁ = 1 + 1/2 + + 1/k Re log k.
Specifically, when A | this is the uniform distribution, (8) = log [V] while when k = 1, the sequence completely deterministic (c.g., when the LLM is asked to recite the "Declaration of Independence"), then get (8)
as expected.
In the above example, (8) identical to the expected TestScore of the Gumbel watermark in (3). This This because the distributions they sample from also the same. To illustrate their difference, let us revisit the simple two-token case from Example 3.2 again for which we can work out the expectation of the test score explicitly.
This is simplifying assumption. We only need (n m)]V|-way independence.

---

Published as a conference paper at ICLR 2025
0.53
-22
0.4
0.4
0.
6,15
0.99
04
0.0
0.9
00
62
0.20
0.09
0.15
2.20
425
0.50
(a) Comparing the detectability of PF watermark Gumbel watermark using Example 4.5. On the left, we fix the Gap A = 3.0 and vary T. On the right, we fix T = 1.0 and vary A. Gumbel watermark offers higher detectability when I' the same. Very importantly this does not mean Gumbel outperforms PF because PF is more greedy and has less entropy.
(h) Comparing the detectaablity-greeddiee tradcoff of watermark vs Gumbel watermark
two token case. The Gap A = 3.0, both curves are traced out by varying the temperature T with a "zoomed-in" view on the RHS. It is clear from the figure that PF outperforms Gumbel on the tradeoff curve.
Figure 2: Comparing the detectability of PF watermark Gumbel watermark using Example 4.5.
Example 4.5. Let the [V] 2 and the corresponding logits be [A, 0J. The expected TestScore of the Gumbel and the PF watermark (for each watermarked token) are: 14e-a/7 + HIAATT and 1 1+ Le - (1 respectively, where Hg is the th Harmonic number.
H. =-A/
14e577"
is a bit hard to compare them by reading the mathematical expressions, so let us compare them numerically (see Figure 2a). The vertical axis in the figures measures Detectability, which we define to be the expected difference between the TestScore watermarked and unwatermarked token. Since under the null the Ei- log(r+(u))) = E log(1 ru())))] 1, we can simply subtract 1 from the expressions in Example 4.5.
Figure 2a indicates the PF watermark does not beat the Gumbel watermark in terms of detectability when T is fixed. This should not be surprising since for the same temperature, PF watermark better at optimizing (recall Example 3.2 and Figure 1), thus naturally the resulting distribution has less entropy to be exploited by the watermarking scheme.
A more fair comparison, would be to increase the temperature for PF watermark appropriately compare detectability when the suboptimality is aligned. This is shown in Figure 2b. In fact we have added a second baseline that apply Gumbel watermark to the induced sampling distribution from PF- PF-decoding (shown as the dotted line). The distribution induced by PF does not have a simple form, but in our special case, was worked
Example 3.2.
As we can see in Figure 2b, the PF watermark is never worse and even has a slight advantage in the middle. To say it differently, to achieve the same suboptimality, the PF watermark can afford to use larger temperature, which not only improves the stability parameter but also compensates it sufficiently on the detectability front to outperform the Gumbel watermark. In practice, we expect PF watermark to be as effective as the Gumbel watermark, and could even be bit better (if the temperature parameter is chosen appropriately).
In conclusion, we showed that the watermarked version of PF-decoder is computationally indistin- guishable from the original version PF-decoder. Meanwhile, the test score of the PF watermark qualitatively similar to that of the produce similar detectability to the Gumbel watermark, while enjoying the performance boost that comes from replacing softmax sampling with PF.
(and identical in some cases). It is likely to
5 EXPERIMENTS
Datasets and models. We utilize two long-form text datasets in our experiments: the Colossal Clean Crawled Corpus (C4) dataset (Raffel et al., 2020) for open-ended text completion generation, and the Alpaca dataset (Taori et al., 2023) for question-answering tasks. Our primary language model is the ftate-ofttie -hhhhartt open-source model Llama-2 with billion parameters. Specifically, the Llama-2-7B 1ama-2--B-char model for question-answering tasks the Alpaca dataset. For text
8

---

Published as a conference paper at ICLR 2025
Table 2: Text generation results for different methods. The true positive rate (TPR) is calculated under 0.01 false positive rate (FPR). PPL1 refers to perplexity measured by Llama2-7B models. PPL2 is perplexity calculated by the Llama2- 13B model. For general text generation, PF decoding produces significantly lower perplexity compared to sampling. For watermarking methods, PF watermark also produces lower perplexity compared to KGW watermark and Gumbel watermark.
Method
TPR1
PPL11
PPL.2
Seq-rep-51
MAUVE?
Method
AUC:
PPL.
PPL.2 Sep-rep-5. MAUVE!
C4, T=1.0, 27m
T= Liama-7B
Gready
1.34mm
1.24
0.56
0.05
Gready
1. 1:25
1.75..cs
0.12
091
Sampling
12.47 32.47o.3
15.31..n
0.02
0.98
Sampling
4 4.23
4.91c.ss
0.06
1.00
PF
2.
10.75
0.03
0.50
PF
3.54m
6.1lc.ss
0.30
0.92
WM
0.989
0.991
16.6
20.626,40
0.01
KOW WM
0.945
8.78us
6.77c.a
0.03
Chumhel WM
B9997
0.98
11
14.126.06
0.04
0.93
Gunohel
0.955
0.982
4.00a or
4.71c.co
0.10
1.00
PF WM
0.995
0.984
8,330
10.28%.20
0.05
0.99
PF WM
0,993
0.980
3 3.38
3.90k.30
0.13
1.00
Alpaca, T=10, Llama2-7B-Chan
Alpaca, T-10, Tiny Lww.aaaaaa-.----.
Gready
1.25amz
1.75
0.12
0.93
Gready
1441am
1.00c.c2
0.30
0.99
Sampling
1.74mm
2.41
Sampling
3.71c.06
1.00
PF
2.300..04
2.53am
3.48c.06
0.12
0.88
KGW WM
0.961
0.596
2:20a.
3.001s.0
0.08
0.93
KGW WM 0.988
0.991
3.8lam
5.28s.co
0.07
0.99
Ghimbel WM
0.985
0.858
1.70uz
2.55gu.
0.30
0.93
Gambel WM
1.000
0.995
2.67am
3. 3.5%..c
0.12
1.00
PF WM 0:979
0.810
1.00am
2.376.34
0.10
1.00
PF WM
0.999
0.986
o.3
3.10c.r
0.14
0.94
1.00
0.35
27 WN: Iluman
0.90
0.85
0.80
Gumbel WN: Watermrres That
Gumbel NN: unwetertmrreed Tox:
TPR
0.75
KGW Watermark
Gumbell WKi Hiumen Text
Gumbel Watermark
PF Watermark
0.80
PPL
Score
(a) TestScore distribution. We calculate the average TestScore the PF watermark and Gumbel watermark using Llama2-7B (T=1.0) on the C4 dataset. The length of the suspect texts is fixed at 200 tokens. A clear gap emerges between positive samples (watermarked) and negative samples (unwatermarked and buman-written), indicating the watermark detectability.
(b) Trade-off between detection accuracy (TPR FPR=0.01) and text quality (PPI.) across three water- mark configurations on the C4 dataset, with tempera- ture settings ranging from 0.2 to 1.0. Each data point represents the outcome for 500 watermarked texts. The PF watermark achieves the optimal balance of the high- est detection accuracy and lowest perplexity.
Figure 3: Comparison of PF and Gumbel watermarks on real data.
completion tasks on the C4 dataset, we employ the base model Llama-2-7B. Furthermore, to evaluate the universal applicability of smaller models, we also assess the performance of the TinyLlama-I.1B model (Zhang et al.. 2024).
Evaluation metries. We calculate perplexity scores from different models, using Llama2-7B to compute PPL1 and Llama2-13B to compute PPL2. We also compute MAUVE scores to measure the distributional similarity between model generations and human text as another metric for text quality (Pillutla et al., 2021). To evaluate repetitiveness, we compute seq-rep-5 across generations, which is the average repetition rate of duplicate 5-grams in a sequence (Welleck et al., 2020). For the watermark evaluation, maintaining a low false positive rate is crucial to avoid misclassifying unwatermarked text as watermarked. Therefore, we set the false positive rates at 1% and 10% for all watermark detection algorithms, adjusting the detection threshold accordingly. We report true positive rate (TPR) and Fl scores to measure the watermark detectability. We compared the well-known Gumbel Watermark (Gumbel WM) and Green-Red Watermark (KGW WM) our main baselines. Experiments were conducted using Nvidia A6000 GPUs. For the details of the experiment setting, please refer to the Appendix C.
1. 1H-Chat-vl..

---

Published as a conference paper at ICLR 2025
Text generation performance. Table 2 shows the text perplexity of generated samples from different LLMs evaluated on two datasets. Using the same temperature, we find that PF decoding produces significantly lower perplexity compared to sampling. Although greedy decoding has the lowest perplexity, it suffers from heavy repetition, as indicated by its high seq-rep-5 score and low MAUVE score. We observe that for guestion-answering tasks, the perplexity is lower, likely due to the fixed form of answers and lower entropy of the text generation. Table 8 shows an example prompt and responses generated by different decoding methods.
Watermarking results. We compare the results of PF watermark with those of the Gumbel Watermark (Gumbel WM) and the Green-Red watermark (KGW WM). In Figure 3a, we present the distribution of detection scores for the PF watermark. The PF watermark demonstrates clear detectability between positive and negative samples. The results of the watermark generation are shown in Table 2 and Figure 3b. The PF watermark achieves the best balance of the highest detection accuracy and lowest perplexity, compared to the KGW WM and the Gumbel WM. Notably, the perplexity of the PF watermark is close to that of the PF sampling, indicating that the watermarking process does not significantly impact the quality of the generated text. All watermarking methods achieved near- rear-perfect detection accuracy the C4 dataset. Besides, the detection results for the small Tinyl laama model are also good, demonstrating the universal applicability of the PF watermark.
Excerimental Faise Positive Rate (EPR)
20-1
Random seed
Random seed
Random seed
FPR-a
(Theoretical)
Figure 4: Comparison of empirical and theoretical false positive rates with different watermark keys. We can see that the second statement of Theorem 4.3 correctly controls the Type error in practice.
Controlling the false positive rate. The key strength PF watermark is its ability precisely control the false positive rate (FPR) during detection. We validate this by conducting experiments using negative examples from diverse datasets (C4, Alpaca, unwatermarked) and different random keys. As Figure 4 shows, the empirical false positive rates align tightly with the theoretical values across different settings. This demonstrates PF watermark's effectiveness in precisely controlling the FPR intended.
Additional watermarking results. For a text watermarking design to be effective, it should be able to withstand paraphrasing attacks that adversary may attempt modify the watermarked text. Furthermore, the watermark should be detectable even with shorter text lengths. In Appendices 1. and C.2.2, we present additional empirical results for the PF watermark, demonstrating its robustness to paraphrasing and editing attacks. The results also show that the PF watermark can still be detected even when the length of the text reduced only 30 tokens.
CONCLUSION
We introduce Permute-and (PF) decoding, new decoding method for large language models that enjoys the same - perturbation-staaiiii guarantees as softmax sampling while achieving substantially lower perplexity. We design a tailored watermarking scheme (PF watermark) for PF decoding that enables precise control over false positive rates while retaining high true positive rates. Our experiments demonstrate that the PF watermark achieves the best balance of the highest detection accuracy and lowest perplexity. All these intriguing properties make PF decoding a promising new approach for practical applications of large language models.
10

---

Published as a conference paper at ICLR 2025
REFERENCES
Scott
Aaronson.
Simons
institute
talk on watermarking of large lan- https: //st:///smmmssss berkeley edu/talks/
guage models, 2023.
URL
Peter Anderson, Basura Fernando, Mark Johnson, and Stephen Gould. Guided open vocabulary image captioning with constrained beam search. Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing, pp. 936-9396-999 945, Copenhagen, Denmark, 2017. Association for Computational Linguistics. doi: 10. 10.18633/11/11--111 URL pttttps://allattho.te org/D17-1098.
Mikhail Atallah, Victor Raskin, Michael Crogan, Christian F. Hempelmann, Florian Kerschbaum, Dina Mohamed, and Sanket Naik. Natural language watermarking: Design, analysis, and proof-of-concepy implementation. In Information Hiding, 2001.
Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna
Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, al. Constitutional ai: Harmlessness from ai feedback. ArXiv preprint, abs/2212.08073, 2022. URL https://aaa /ttp:v//aavvv/..a///a org/ /bs/ 2212. 08073.
Guangsheng Bao, Yanbin Zhao, Zhiyang Teng, Linyi Yang. and Yue Zhang. Fast-detectgpt: Efficient zero-shot detection of machine-generee generated text via conditional probability curvature. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OvenReview.net, 2024. URL / Bpogcr8E82.
/wtp///ppp//....co////e wwt. tettffrummid
Charlie Chen, Sebastian Borgeaud, Geoffrey Irving, Jean-Baptiss Lespiau, Laurent Sifre, and John Jumper. Accelerating large language model decoding with speculative sampling. ArXiv preprint, abs/2302.00318, 2023a. URL https: //aaaiiivv.oo...a hagg/abb abs /2302 01318.
Yining Chen, Sorcha Gilroy, Andreas Maletti, Jonathan May, and Kevin Knight. Recurrent neural networks as weighted language recognizers. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume (Long Papers), pp. 2261-2271, New Orleans, Louisiana, 2018. Association for Computational Linguistics. doi: 10.18653/11/N1-- 1205. URL beattts://acaantten org/N1 Sxg/N18-1205
Yutian Chen, Hao Kang, Vivian Zhai, Liang Li, Rita Singh, and Bhiksha Ramakrishnan. Gpt-sentinel: Distinguishing human and chatgpt generated content. ArXiv preprint, abs/2305.07969, 2023b. URL /ttttps://ariii
org/ abs / 2305 07969.
Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. In The Thirty Seventh Annual Conference on Learning Theory, June July 3, 2023, Edmonton, Canada, volume 247 of Proceedings of Machine Learning Research, pp. 1 125--1399 PMLR, 2024. URL https: pttpp//ecceeig...eeee / mlrr malr.press/
v247 christ24a. http///sstsrrrt22...... html.
Zeyu Ding, Daniel Kifer, Thomas Steinke, Yuxin Wang, Yingtai Xiao, Danfeng Zhang, et al. The permute-ande and- mechanism is identical to report-noisy-max with exponential noise. ArXiv preprint, abs/2105.07260, 2021. URL https:
07260.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography, pp. 265-284. Springer, 2006.
Pierre Fernande7, Antoine Chaffin, Karim Tit, Vivien Chappelier, and Teddy Furon. Three bricks to consolidate watermarks for large language models. 2023 IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1-6, 2023.
GPTZero. Gptzero: More than an ai detector preserve what's human. GPTZero website, 2023. URL https: /gwtzerr.o...ooo/oooooo//oo/.. me/.
Emil Julius Gumbel. Statistical theory of extreme values and some practical applications: a series of lectures, volume 33. US Government Printing Office, 1948.
11

---

Published as a conference paper at ICLR 2025
Chris Hokamp and Qun Liu. Lexically constrained decoding for sequence generation using grid beam search. In Proceedings of the 55th Annual Meeting the Association for Computational Linguistics (Volume I: Long Papers), pp. 5535-1546, Vancouver, Canada, 2017. Association for Computational URL / ac anthologg org/P17-10 41.
Linguistics. doi: 118855/11/P1//
Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi. The curious case of neural text degeneration. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, 2020. URL https: ptttps://openrevicee fert/form? dd=rygGQyrFv..
Xiaomeng Hu, Pin-Yu Chen, and Tsung-Y Yi Ho. RADAR: robust ai-text detection via adversarial learning. In Advances in Neural Information Processing Systems 36: Anmual Conference Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 16, 2023, 2023. URL /papers//pppp..eeeeeee/apeee nips. . ec ww/pppppaee..... htppaaapppppe files httpp//ppprr/////// //ash// 30e1 5e5 41 www.aeeaabaaeeeeeeaeaese ottpr//cceeeeeeeeeaaaaaaaaaa--re htmm..
Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net, 2024. URL httpps://snt httpp:://pperreveew net. forum?id=uwvC5FVi..
Daphne Ippolito, Reno Kriz, João Sedoc, Maria Kustikova, and Chris Callison- Comparison of diverse decoding methods from conditional language models. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pp. 7762- Florence, Italy, 2019. Association for Computational Linguistics. doi: 111118653/1/1111110 https: / acl antlalathhhyyy Arg/P19-1365
URL
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA, volume 202 of Proceedings of Machine Learning Research, pp. 17061-17084, PMLR, 2023. URL https: /ttp//oooeddieee nngs mlr press/ html.
Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit lyyer. Para- phrasing evades detectors of ai-generated text, but retrieval is an effective defense. Ad- vances in Neural Information Processing Systems 36: Annual Conference on Neural Infor- mation Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 /aahh/ Abstract Conference html.
16, 2023, 2023. URL http: //aperssppppppssseeeeeeeees nips . ec cc/paperppppeeeeeeeeeeeeeee wcc/paper_fills/ppeeeeeeeeeeeeee 115cc40013d0eee 0eet:0a3ddde99eeeeeeeeb2bbb
Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion- free watermarks for language models. Trans. Mach. Learn, Res., 2024, 2024. URL https:
//openreview..... net.eeewweeeeeeeeeeeeeeeeeeeeeee www.:/ett/.omtetmeemmee wow.miid--ppaLMO022
Patrick S. H. Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Sebas- tian Riedel, and Douwe Kiela. Retrieval-augmented generation for knowledge-intensive NLP tasks. In Advances in Neural Information Processing Systems 33: Annual Con- ference Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, 2020. URL https: httsttts:: httpss/:///ccceeeeeeeeeeooo www.seuuurrrrcr.eeeeeeee 6b49 032332222222 E 7000 (eteeebc2694550 (01555ff44111555 Abstract - html.
Xiang Lisa Li, Ari Holtzman, Daniel Fried, Percy Liang, Jason Eisner, Tatsunori Hashimoto, Luke Zettlemoyer, and Mike Lewis. Contrastive decoding: Open-ended text generation as optimization. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pp. 12312, Toronto, Canada, 2023. Association for Computational Linguistics. doi: 10. a.333acl-lomm 687.
URL. https / acc anttoaathhoooooo . org/
Weixin Liang, Mert Yüksekgönüül, Yining Mao, Eric Wu, and James Zou. GPT detectors biased against non-native english writers. Patterns, 407):100779, 2023. doi: N...0166J.PAATEE. 100779. URL https: pttttps:///dd/ /ww. http:///ooooooo/////o///o/ 6/ ptt.tttterr......epppaaaaaaee 2022. 100779.
12

---

Published as a conference paper at ICLR 2025
Jing Lin, Long Dang, Mohamed Rahouti, and Kaiqi Xiong. MI attack models: adversarial attacks and data poisoning attacks. ArXiv preprint, abs/2112.02797, 2021. URL abs/ 02797.
Xiaoming Liu, Zhaohan Zhang. Yichen Wang, Hang Pu, Yu Lan, and Chao Shen. Coco: Coherence- enhanced machine-generated text detection under low resource with contrastive learning. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Process- ing. pp. 16167-16 188, Singapore, December 2023. Association for Computational Linguis- tics. doi: 10.18653/v 1/2023, 1/2023.emmlpmmmai. 1005, URL httpshs//caaaattlll.oo// org/2023. emn.p-ma in. 1005/.
Ximing Lu, Sean Welleck, Peter West, Liwei Jiang, Jungo Kasai, Daniel Khashabi, Ronan Le Bras, Lianhui Qin, Youngjae Yu, Rowan Zellers, Noah A. Smith, and Yejin Choi. Neu- roLogic a*esque decoding: Constrained text generation with lookahead heuristics. In Pro- ceedings of the 2022 Conference of the North American Chapter of the Association for Com- putational Linguistics: Human Lunguage Technologies, pp. 780-799, Seattle, United States, 2022. Association for Computational Linguistics. doi: 10.18653/v1/2022 mmacl-main.57 URL https: /ataaaaaanntttooooco org/2022222222 nww.:eaaaaamaaaaaaaaaaaa 57.
Ryan McKenna and Daniel R. Sheldon. Permute-and-fiip A new mechanism for differen- tially private selection. In Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NewrIPS 2020, December 6- 6-12, 2020, virtual, 2020. URL httpt: BRLLittts///proceeding meerriinnnn..eusseeeeeeeeerrrree nwwrips. wctpppper//2///haaeeeeeeeeeeeeee (0000020000000000050000066666220
Abstract html.
Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. In Symposium on Foundations of Computer Science (FOCS'07), pp. 94-103, IEEE, 2007.
Clara Meister, Elizabeth Salesky, and Ryan Cotterell. Generalized entropy regularization or: There's s nothing special about label smoothing. In Proceedings of the 58th Annual Meet- ing of the Association for Computational Linguistics, pp. 6870-6886, Online, 2020. Asso- URL https:
ciation for Computational Linguistics. doi: 10.1 //aclantho wtt.e.rg//2200 aacl-main... 615.
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D. Manning, and Chelsea Finn. Detectgpt: Zero-shot machine--eneraaedd text detection using probability curvature. International Conference Machine Learning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA, volume 202 of Proceedings of Machine Learning Research, pp. https: http:/poceeeddee ingseedddingg. ngs ml press v2222 mi the 12.2..ttmm
PMLR, 2023. URL
OpenAI. Chatgpt: Optimizing language models for dialogue. OpenAl blog, 2022. https:
//openai combbl cttttpt/tt
OpenAI.
New ai classifier for indicating ai-written nAI blog. 2023a.
Ope- URL https::/openaae comeenaii.oomaaaao hom/blog/
text.
new-ai-classide
for indicating indicatiig--i-iviitttee
OpenAl. Gpt-4 technical report. ArXiv preprint, abs/2303.087777 2023b. URL htLps:t:://arx org/ htg/abs/// /as.//33.. 2303. 08774.
Krishna Pillutla, Swabha Swayamdipta, Rowan Zellers, John Thickstun, Sean Welleck, Yejin Choi. and Zaid Harchaoui. MAUVE: measuring the gap between neural text and human text using diver- gence frontiers. In Advances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual, pp. nwurips wwwpppppppppppppppcpc httprr///222hhhllele 4826-4828, 2021. URL =tbttaatdddddda----tatttteteette .atal............mm............m
Lianhui Qin, Vered Shwartz, Peter West, Chandra Bhagavatula, Jena D Hwang, Ronan Le Bras, An- toine Bosselut, and Yejin Choi. Backpropagation based decoding for unsupervised counterfactual and abductive reasoning. Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 2020.
13

---

Published as a conference paper at ICLR 2025
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter Liu. Exploring the limits of transfer learning with a unified text-to- text transformer. J. Mach. Learn. Res., 21:140:1-140:67 2020. URL httt:://jmle html.
papers/v21/20-1
Vinu Sankar Sadasivan, Aounon Kumar, S. Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? ArXiv preprint, 0bs/2303.11156, 2023. URL https:
//arxiv.org. org. aba/ 11..3.1111111.. 11156.
Zhouxing Shi, Yihan Wang, Fan Yin, Xiangning Chen, Kai-Wei Chang, and Cho-Jui Hsich. Red teaming language model detectors with language models. Transactions of the Association for Computational Linguistics, 12:174-189, 2024. doi: 10. 2a11622/aal_a_005333 URL https://
aclanthology org. www.:............. tac1-1.10.
Chris Stokel- Walker. Ai bot chatgpt writes smart essays should professors worry? Nature, 2022.
Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. Stanford alpaca: An mnstruction-following llama model. https:
http//gttttt thu...ub.... coom/aasu-llll stanford_alppcce 2023.
Umut Topkara, Mercan Topkara, and Mikhail J. Atallah. The hiding virtues of ambiguity: quantifiably resilient watermarking of natural language text through synonym substitutions. In Workshop on Multimedia & Security, 2006.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, al. Llama 2: Open foundation and fine-tuned chat models. ArXiv preprint, 0bs/2307.00288, 2023. URL https: /arxiv.
org/abs 2307. 09288.
Eduard Tulchinskii, Kristian Kuznetsov, Laida Kushnareva, Daniil Cherniavskii, Sergey I. Nikolenko, Evgeny Burnaev, Serguei Barannikov, and Irina Piontkovskaya. Intrinsic di- mension estimation for robust detection of ai-generated texts. In Advances in Neu- ral Information Processing Systems 36: Anmual Conference on Neural Information Pro- cessing Systems 2023, NeurlPS 2023, New Orleans, LA, USA, December 10 16, 2023, 2023. URL httt:::/pppers.nniiie nips. cc/ httpp//eeeeppppeeeeeeeeeeeeeeeee fiiles/paper/2// /hash/ TEa44Boe15a222111777a01111110000
Con.erreeeeoooeeeece....o.e html.
Ashwin K Vijayakumar, Michael Cogswell, Ramprasath R Selvaraju, Qing Sun, Stefan Lee, David Crandall, and Dhruv Batra. Diverse beam search: Decoding diverse solutions from neural sequence models. ArXiv preprint, abs/1610.02424,, 2016. 02424.
URL https: aarxiviii org/ abs abs/ /1600.
Laura Weidinger, John J. Mellor, Maribeth Rauh, Conor Griffin, Jonathan Uesato, Po-Sen Huang, Myra Cheng, Mia Glaese, Borja Balle, Atoosa Kasirzadeh, Zachary Kenton, Sande Minnich Brown, William T. Hawkins, Tom Stepleton, Courtney Biles, Abeba Birhane, Julia Haas, Laura Rimell, Lisa Anne Hendricks. William S. Isaac, Sean Legassick. Geoffrey Irving, and lason Gabriel. Ethical and social risks of harm from language models. ArXiv preprint. abs/21 12.04359, 2021. 04359.
URL https:ttp///cc....t. arxiv org/ abs/ /
Sean Welleck, Ilia Kulikov, Stephen Roller, Emily Dinan, Kyunghyun Cho, and Jason Weston. Neural text generation with unlikelihood training. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, 2020. net URL https:://ppeneeeeeeee wtw.:ewwwwwe/teeeeeeeeeaa
forum? www.mmieedssee..........
Gian Wiher, Clara Meister, and Ryan Cotterell. On decoding strategies for neural text generators. Transactions of the Association for Computational Lingwistics, 10:997-1012, 2022. doi: 16.1/62/ tacl a 00502. URL / wttp://oco...r../2...t.....a....
Max Wolff. Attacking neural text detectors. ArXiv preprint, abs/2002. 2020. URL https: / rxiv. wwriv.org/abs//0000 11768.
14

---

Published as a conference paper at ICLR 2025
Yihan Wu, Zhengmian Hu, Junfeng Guo, Hongyang Zhang, and Heng Huang. A resilient and accessible distribution- bestrbutioon-preerrving watermark for large language models. In Firty-first International Conference Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024. OpenReview.net, 2024. URL https: : hwwp/pppeevveeeeeeee ew net/ forum? d
Xianjun Yang, Wei Cheng, Yue Wu, Linda Ruth Petzold, William Yang Wang, and Haifeng Chen. DNA-GPT: divergent n-gram analysis for training-free detection of gpt-generated text. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net, 2024. URL httphttt///ccm..... http:///ppeeeviiieee net forum?id- XlMyxj2fMp.
KiYoon Yoo, Wonhyuk Ahn, Jiho Jang, and Nojun Kwak. Robust multi-bit natural language watermarking through invariant features. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). pp. 2092-2115, Toronto, Canada, 2023. Association for Computational Linguisties. doi: 10. 1/663//112023.aclllaeo URL httpt:tpp//.omc...t. // /acc/aacaacae/ ceclanthollle ogy org/ 2023. acl acl-longe 117.
117.
Xiao Yu, Yuang Qi, Kejiang Chen, Guoqiang Chen, Xi Yang, Pengyuan Zhu, Weiming Zhang, and Neng H. Yu. Gpt paternity test: Gpt generated text detection with gpt genetic inheritance. ArXiv preprint, 1ttp22305.12519 2023. URL
org/ aass///////// 22005 12519, 9.
Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roes- ner, and Yejin Choi. Defending against neural fake news. In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Process- ing Systems 2019, NeurlPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pp. 9051-9062, 2019. URL https: h/tp:e////////coocgg/sss.s neurips....pp... cc ctt.cc//pppppp htcppaper/2219/hasl/ Abst html.
ZeroGPT. Zerogpt: Trusted gpt-4, chatgpt and ai detector tool by zerogpt. ZeroGPT website, 2023.
URL https: /www zerogpt. comp
Hangfan Zhang, Zhimeng Guo, Huaisheng Zhu, Bochuan Cao, Lu Lin, Jinyuan Jia, Jinghui Chen, and Di Wu. On the safety of open-sourced large language models: Does alignment really prevent them from being misused? ArXiv preprint, abs/2310.01581, 2023. URL https: / /arxii.oogrg///................r
abs/230 2310 0. 01581.
Peiyuan Zhang, Guangtao Zeng, Tianduo Wang, and Wei Lu. Tinyllama: An open-source small language model, 2024.
Zhiyuan Zhang, Lingjuan Lyu, Weiqiang Wang, Lichao Sun, and Xu Sun. How to inject backdoors with better consistency: Logit anchoring on clean data. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022. OpenReview.net, 2022. 9TnDngN.
URL https: opwnrevieeeeeeeeeeeeeeeeeee net ffrumm
Xuandong Zhao, Yu-Xiang Wang. and Lei Li. Protecting language generation models via invisible wa- termarking. In International Conference on Machine Learning. ICML 2023, 23-29 July 2023, Hon- olulu, Hawaii USA, volume 202 of Proceedings of Machine Learning Research, pp. 42187-42199, PMLR, 2023. URL https::: / http:/pproceee pttpppoooeeeeeeeeoooooooooooo.ca ngs.. mll. a.r.press/ / v2.2/ zhao23i html.
Xuandong Zhao, Prabhanjan Vijendra Ananth, Lei Li, and Yu-Xiang Wang. Provable robust wa- termarking for ai-generated text. In The Twelfth International Conference on Learning Rep- resentations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net, 2024a. URL .nt/ htw.rriieew.ntt/ouumilds-...... wtt.:/ommmmmimmmmm00000000
Xuandong Zhao, Xianjun Yang, Tianyu Pang. Chao Du, Lei Li, Yu-Xiang Wang, and William Yang Wang. Weak-to-strong jailbreaking on large language models. ArXiv preprint, abs/2401. 2024b. URL https: /atpiviiiiiv.////i///.../..aaaia org/ abs
Yuqing Zhu and Yu-Xiang Wang. Adaptive private-k-selection with adaptive K and application to multi-label PATE. In International Conference on Artificial Intelligence and Statistics, AISTATS 2022, 28-30 March 2022, Virtual Event, volume 151 of Proceedings of Machine Learning Research, pp. 5622-663555555 PMLR, 2022. URLhttps html.
htt.tttpps//ppcceeiigge/o /ptpceeeiiiggssseee/ee/ps..s..se mlr, prr.ssrss//e.e. wwppss/vvs1l. /v151/ zhu22e.
15

---

Published as a conference paper at ICLR 2025
A MORE ON RELATED WORK
A.1 LANGUAGE MODEL DECODING.
The decoding strategy used in text generation greatly impacts the resulting text's quality and diversity. Traditional deterministic algorithms, like greedy decoding and beam search, often lead to repetitive text (Wiher et al., 2022). To address this, diverse beam search (DBS) (Vijayakumar et al., 2016) has been developed to promote diversity in text generation. Stochastic decoding strategies, such as Top-k and Top-p (Nucleus) (Holtzman et al., 2020) sampling, balance randomness and determinism, selecting from the most likely tokens to enhance variety while maintaining coherence. The Bayes Minimum Risk (MBR) method minimizes expected risk and incorporates a utility function to navigate trade-offss between text attributes. Advanced techniques have been developed to improve decoding for large language models, including the imposition of constraints (Anderson et al., 2017; Qin et al., 2020; Hokamp & Liu, 2017; Lu et al., 2022), enhancing text quality (Li al., 2023), and speeding up the decoding process (Chen et al., 2023a).
Our contributions are complementary to these existing methods in that we are the first to introduce rigorous stability definition and study the tradeoff between utility (e.g. perplexity) and stability. Permute-and-fit sampling can be used as a drop-in replacement for softmax sampling whenever is used, e.g., in standard full sampling or nucleus (Top-p) sampling. We also provide watermarking capabilities for PF-decoder. We believe that the PF decoder has the potential to become a promising new approach for language model decoding.
A.2 DETECT AI-GENERATED TEXT
Another major motivation of the work is to come up with a reliable method for detecting Al-generated text, so as to prevent LLM misuse. We briefly review two categories of existing work on this problem.
Post-hoe detection. Post-hoc detection of LLM LLMeggeerrted text encompasses two main approaches: zero-shot detection and training-based detection. Zero-shot detection is characterized by its capacity to identify Al-generated text without needing specific training data, leveraging the inherent stylistic differences between human and machine writing. Techniques within this category, such as DetectGPT (Mitchell et al., 2023), PHD (Tulchinskii al., 2023), DNA-GPT (Yang et al., 2024), and Fast- DetectGPT (Bao et al., 2024), utilize metrics like log-probability scores, n-gram frequencies, lower intrinsic dimensionality, and conditional probability to differentiate Al-generated content. In contrast, training- baasidg-based detection involves fine-tuning pre- pre-trained language models on datasets that consist of both human and LLM- --geeerrttedd texts to build a classifier. This method is exemplified by various systems, including commercial detection platforms (OpenAI, 2023a; GPTZero, 2023; ZeroGPT, 2023), and research projects (Chen et al., 2023b; Yu et al., 2023; Liu et al., 2023; Hu et al., 2023), which leverage the capabilities of large language models to effectively classify text origins. However, despite post-hoe detection's is effectiveness in many cases, recent studies show detection methods' robustness is limited across different scenarios. They have proven fragile to adversarial attacks and biased against non-native English writers (Wolff, 2020; Sadasivan et al., 2023; Liang et al., 2023; Shi al., 2024). Limitations in accuracy even led OpenAl close their detector in July 2023 (OpenAI, 2023a).
LLM watermarking, The watermarking approach provides a direct solution for Al text detection by intentionally embedding detectable signals or "watermarks" within the text. Unlike post-hoc detection, watermarking aims to determine if the text originates from specific language model and it is robust to distribution shifts. Evolving from earlier techniques such as synonym substitution (Topkara et al., 2006) and syntactic restructuring (Atallah et al.. 2001). modern watermarking strategies involve integrating watermarks into the decoding process of language models (Zhao et al., 2023; Kirchenbauer et al., 2023). Aaronson (2023) works with OpenAl to first develop Gumbel watermark that uses a "traceable" pseudo-random softmax sampling when generating the next word. Kirchenbauer et al. (2023) split the vocabulary into red-green lists based on hash values of previous n-grams and then increase the logits of green tokens to embed the watermark. Zhao et al. (2024a) provides strong theoretical guarantees for the green-red watermarks and advocates the use of a consistent red-green list to enhance robustness to evasion attacks. Christ et al. (2024); Hu et al. (2024); Kuditipudi et al. (2024); Wu et al. (2024) study watermarks that preserve the original token probability distributions.
16

---

Published as a conference paper at ICLR 2025
Meanwhile, multi-bit watermarks (Yoo et al., 2023; Fernandez et al., 2023) have been proposed to embed more complex information in the generation tasks.
PF-watermark is newcomer to the family of LLM watermarks. It is closest to the Gumbel watermark (Aaronson, 2023) and enjoys all desirable properties of the Gumbel watermark. In Section we have thoroughly compared the watermarks with theory and numerical simulation, demonstrating that PFttatrrmarks offer a slightly improved srrecttablityyggreedde tradeoff. Comparisons under real-data experiments were also presented in Section 5.
Our results also have interesting implications for the green-red watermark (Kirchenbauer et al., 2023). For example, perform better than the current green-red watermark in terms of its secectability-distorrii Specifically, the stability guarantee of the PF-decoder (Theorem 3.1 Statement 1) implies that PF Green-Red Watermark enjoys the same quality guarantee as is analyzed in (Zhao et al., 2024a, Theorem 3.1) for oc, but the more concentrated distribution might make the watermark more prominent/ / and more detectable for PF-sampling based Green-Red watermark. A full exploration of this idea will presented in future work or longer version the current paper.
consider PF-sampling version of green-red watermark which may
tradeoff.
A.3 DIFFERENTIAL PRIVACY
While the current work is not about privacy, our technical approach heavily relies on existing methods developed in the differential privacy literature. Specifically, the permute-and-flip sampling was developed by McKenna & Sheldon (2020) as an alternative to the classical exponential mechanism (MeSherry & Talwar, 2007) for the problem of differentially private selection. Ding al. (2021) shows that the PF sampling is equivalent to returning the argmax of a noisy version of the utility function perturbed by independent exponential noise. Moreover, stability can be viewed as an algorithm-centric input-specific version of pure-differentil privacy (Dwork et al., 2006).
While some of the results we present are directly implied by existing work (e.g.. Theorem 3.1), we believe it is a worthwhile (and hopefully beneficial) effort to introduce these results and their implications the broader machine learning community.
To our knowledge, we are the first to draw the connection between various versions of Report-Noisy- Max (RNM) mechanisms in differential privacy to the LLM watermarking problem. Besides Gumbel noise (Gumbel-watermark and exponential noise (PF-watermarrk) there are other versions of RNM that add, e.g., Gaussian noise (Zhu & Wang, 2022, Corollary 9). We hope our work could inspire more interplay between these two research areas.
B MORE DISCUSSION OF STABILITY
In this section, we delve deeper into the concept of stability as defined in Definition 2.1.
B.1 STABILITY AND ITS IMPLICATION FOR DIVERSITY
The definition of stability implies that the LLM decoder is resistant to small perturbations in the logits. Furthermore, stability implies an intuitive notion of diversity, which says that for tokens with similar logits, then their chances of getting chosen should be similar. More rigorously:
Remark 1.1 (Stability implies diversity). If [y) uv(') S 8. then we can construct a ū, such that (y) (,/3 while satisfying [ uell 4. Apply triangle inequality and Definition 2.1, we get
P.A.,, (x))
log PA.,( + log PAa,(v')
log PAs,, (v²) PAs, (v) PAu, (v/)
S LTS.
B.2 COMPARISON OF DECODING METHODS IN TERMS OF STABILITY
Theorem 3.1 establishes the Pareto-optimality of PF sampling with respect the sability-perplestt tradeoff. This implies that no other decoding algorithm can surpass PF sampling in both stability and perplexity simultaneously.
17

---

Published as a conference paper at ICLR 2025
Table 3: Comparison of stability and suboptimality across different sampling methods.
Property
Softmax
PF
Beam/Grredd//To--k/Toopp
Stability (Def 2.1)
L 2/T
L = 2/T
t (Not stable for any pa- rameter L)
Expected Subopti- mality (Worst-case
T log [V
Tlog [V]
0 for "greedy"; Tlog k for "Top-k"
bound)
Expected Suboptimal- ity (Per instance)
Exponentially higher
Between 1-2 2 smaller than Softmax
0 for "greedy"; Same as Soft- max on "Top-k"
log-like likelihood
Table 3 summarizes the stability guarantees of various decoding methods. Notably, only softmax sampling and PF sampling exhibit provable stability according to Definition 2.1. This is in contrast to other popular methods like beam search, greedy search, and Top-k/Top-p sampling, which lack such guarantees.
In our definition, stability implies that small perturbations to logits should not significantly alter the output text distribution. This definition also constrains the degree of greediness that decoder can exhibit, as small changes to logits may change the sorted order of the next token. Thus, it is clear why greedy decoding and Top-k/p sampling cannot be stable.
When we say an algorithm A cannot be stable, we mean that for any L < +oo, there exist two decoding problems ue and ūt such that jM, 2o for some 5 0, but the log-probability ratio between A A(u,) and A(ū²) exceeds őL.
To establish non-stability, only need counterexample. Below, construct explicit counterexam- ples for each decoding method:
Greedy: We have a vocabulary of two tokens. Let u, = [0, 1] and dn [1, 0]. This satisfies that |u, - so I 8 with 8 1. But Greedy(u:) outputs the second token with probability 1, Greedy (ū+) outputs the second token with probability O. Therefore, the importance ratio unbounded, i.e. there isn't any finite L that bounds the probability ratio.
Top-k: Let's consider k 2 as an example,
let vocabulary size 3. Let u [0, 1, 1,,-- 2 and ū, [0. 2, -1. Again, |u, /o/co S 8 with d 1. Now, Top-2 sampling will never output the third token on u, while will output the third token with probability on üt The importance ratio is unbounded.
Top-p: Same example as in Top-k above. The softmax of u, and th are approximately [0.844, 0.114, 0.042] and [0.844, 0.042, 0.114] respectively. If we set p 0.95, then Top-p with we will exclude the third token, while that with ūi will retain it it- leading to an importance ratio of co. Beam Search: Since beam search with constant score function reduces to greedy decoding, the same counter-example for greedy decoding demonstrates its non-stability.
Therefore, these counter-examples highlight that greedy, Top-k, Top-p, and beam search decoding are not stable according to our definition.
B.3 THE CONNECTION BETWEEN STABILITY AND SAFETY
Stability can provide robustness against certain types of adversarial attacks, such as jailbreaking, within a gray-box threat model.
Consider scenario where attacker can alter the logits and receive responses from API, as is common with OpenAl's logit bias feature*. Recent research has shown that it is possible to jailbreak an L.MM to encourage specific outputs like "Sure" "Definitely" other tokens (Zhang et al., 2023; Zhao et al., 2024b). By employing the PF decoding method, the API provider can make jailbreaking significantly harder while also making the output watermarkable. thereby enhancing the model's safety and security.
api
18

---

Published as a conference paper at ICLR 2025
Stability serves fundamental guarantee against these perturbations. That said, all attacks will eventually manifest as perturbations to logits, and having a "Lipschitz" transformation from logits to token probabilities is nice guarantee. Without this, even tiny changes to the logits can have big influence on the final token probability distribution.
For instance, consider the difference between provably stable decoder (such as softmax) and non-stable one in a gray-box jailbreaking scenario. Suppose the language model has a vocabulary of just three words: "Sure", "OK", and "Sorry". Initially, the logits 8, = [-2, -1 0] indicate that the LLM is inclined to output "Sorry". If the adversary aims to increase the likelihood of outputting
"Sure", they could perturb the logits ü, = [0. 11, 0]. which satisfies [u, ūn xc I 8 with 8 2.
When applying Top-k sampling with k: = 2 (as an example of several sampling methods that lack stability, such Greedy, Top-k, Top-p, and Beam Search), the model would never select "Sorry". the third token, whereas with the original logits, "Sorry", would still have a non-zero probability of being selected. This demonstrates that Top-k sampling lacks stability. In contrast, PF sampling and softmax sampling maintain stability under such perturbations.
C ADDITIONAL EXPERIMENT DETAILS
We provide additional details on the experiments here. We use the C4 (Raffel et al., 2020) and Alpaca (Taori et al., 2023) datasets. Specifically, we select samples from C4 with text longer than 500 tokens, using the first 200 tokens as the prompt input to the language model and the next 300 tokens the numam-generatte reference. This gives 600 examples. For Alpaca, with prompts/instructions longer than 25 tokens and answers also longer than 25 tokens, giving 550 examples. Since Llama2-Chrn is fine-tuned version of Llama-2 optimized for dialogue, Chat version (Llama-2-74) 2-7--hh-- for the question-answan answering task and the base model (Llama-2-7B") for the text completion task.
select samples
the
Given that PF decoding can integrate with Top-p sampling. which initially selects the top p tokens before normalization, we conduct the performance tests using p 1.0 for full sampling. The max generation length is set to 256 tokens for all experiments.
For perplexity calculation, we observe high variance with differrent methods, often influenced by outliers. To address this, we remove the top and bottom 3% of perplexity scores as outliers and then calculate the average perplexity and standard error. For MAUVE scores, we use the human-writter references from C4 and Alpaca as the human distribution.
For watermarking experiments, we generate 500 watermarked and 500 unwatermarked sentences per method. We label them as "watermarked" and "unwatermarked" respectively, with corresponding human-writter text as "human" for each prompt. Following Kirchenbauer et al. (2023), we use a watermark strength of 5 2.0 and green list ratio of = 0.5 for the KGW watermark. For fair comparison, we use the same long prefix as the pseudo-random function, hashing the previous m tokens to get the random vector for Gumbel/PF watermarks, or to split the green/red token lists. For the watermark robustness test (Table 4) we use a 4-token prefix, and an 8-token prefix elsewhere. For the false positive control, we 3000 negative examples, with 1500 from C4/Alpaca human text and 1500 unwatermarked model-generated text. In our robustness testing, we evaluate two configurations of the DIPPER (Krishna et al., 2023) model: DIPPER-1 with lexical diversity I. 40, order diversity O = 40, and DIPPER-2 with I. 40, O 100.
C.I PF WATERMARK ROBUSTNESS RESULTS.
To evaluate the robustness of the watermark detection, we test the PF watermark under paraphrasing and text editing attacks. Note that robustness here refers to the watermark's 's resilience against removal attacks, which is different from the logit stability in Definition 2.1.
We employ various paraphrase attack techniques intended to remove the watermark text. The experiments are conducted with a 4-token prefix for the pseudorandom function. We also added the
"nttps://hugginggfaae /eetammeaa-a.. amaa / 1.1 ama 2- to-chat-hf "https://hugging co/ / ama ama 2- 7b-hf
19

---

Published as a conference paper at ICLR 2025
Table 4: Detection results for three watermarking methods using Llama2-7B on the C4 dataset under different attacks.
1% FPR
10% FPR
Setting
Method
AUC
TPR
F1
TPR
F1
KGW (m=4)
0.998
0.996
0.989
1.000
0.906
KGW (m=1)
0.999
1.000
0.995
1.000
0.906
No attack
Gumbel
0.992
0.979
0.979
0.986
0.913
PF
0.996
0.977
0.980
0.993
0.898
KGW (m=4)
0.661
0.057
0.105
0.317
0.416
KGW (m=1)
0.876
0.389
0.554
0.717
0.720
DIPPER-1
Gumbel
0.838
0.367
0.529
0.642
0.697
PF
0.824
0.374
0.537
0.622
0.684
KGW (m=4)
0.638
0.051
0.096
0.278
0.375
KGW (m=l)
0.885
0.342
0,501
0.662
0.714
DIPPER-2
Gumbel
0.764
0.239
0.380
0.523
0.608
PF
0.795
0.250
0.394
0.544
0.625
KGW (m=4)
0.936
0.484
0.644
0.881
0.844
Random
KGW (m=l)
0.956
0.752
0.836
0.923
0.839
Delete (0.3)
Gumbel
0.981
0.941
0.960
0.959
0.898
PF
0.985
0.936
0.956
0.966
0.888
original soft watermarking method with I-token prefix for comparison (m for KGW watermark (Kirchenbauer et al., 2023)).
In our experiments, utilize versions of the DIPPER paraphrasing model (Krishna et al., 2023), denoted as DIPPER-1 and DIPPER-2. DIPPER-2 generates more diverse paraphrases than DIPPER-1. Moreover,
a random word deletion attack, which common technique used to manipulate text. These experiments represent realistic scenarios where an adversary may attempt to remove watermarks through paraphrasing or editing. The results, shown Table illustrate the robustness of the PF watermark to these paraphrasing and editing attacks. The PF watermark achieves comparable detection performance to the Gumbel watermark and KGW watermark methods when using the same long prefix as the pseudorandom function.
Table 5: PF watermark detection results with different lengths.
1 %
FPR
10%
FPR
Length
AUC
TPR
F1
TPR
Fl
200
0.994
0.977
0.978
0.985
0.915
150
0.993
0.975
0.980
0.985
0.913
100
0.992
0.970
0.972
0.983
0.911
50
0.987
0.950
0.966
0.970
0.902
30
0.980
0.923
0.950
0.953
0.888
C.2 IMPACT OF TEXT LENGTH ON WATERMARK DETECTION.
Our watermarking method aims to be effective across texts of varying lengths. To evaluate this, conducted experiments to analyze the impact of text length on watermark detection performance. Texts are truncated to 30, 50, 100, 150, and 200 tokens. The results, shown in Table 5, validate the robustness our approach to different text lengths. Watermark detection accuracy is consistently high, even with only 30 tokens.
20

---

Published as a conference paper at ICLR 2025
Table 6: KGW Watermark with 7 0.1, 2.0 and single token for hash
Temperature
TPR@0.01FPR
PPL1
1.0
0.690
15.07
0,8
0.686
4.434
0,6
0.681
2.047
0,4
0.643
1.768
0.2
0.628
1.559
Table 7: KGW Watermark with 7 0.25, 2.0 and single token for hash.
Temperature
TPR@0.01FPR
PPL1
1.0
0.973
16.31
0.8
0.972
4.887
0.6
0.934
2.328
0.4
0.893
1.940
0.2
0.859
1.791
C.3 EXPERIMENTS ON VARIANTS OF KGW WATERMARK
We conduct additional experiments the C4 dataset using Llama2-7B with the original configuration, but modify the hashing mechanism to utilize single token for testing the performance of various versions of the KGW watermark. We select y values of 0.25 and 0.1. The results can be found in Tables 6 and Upon comparing these results with the data from Figure 3b, the PF watermark remains at the Pareto front, providing the optimal trade-off between the highest detection accuracy and the lowest perplexity.
D PROOFS OF TECHNICAL RESULTS
D.1 PERMUTE AND FLIP SAMPLING
First, let us calculate the probability of Permute-and-Fiip sampling from Line 3-9 of Algorithm We will the equivalent (eportNoisy(ArgJMax form from Fact 4.2.
Wt = arg max (Uw,t - log Tw,t) WEV
First, observe that the event that "w is selected" is the same as the event that for uh log rw > Ung log r.p' for all w' * w.
Observe that for each w', this event is equivalent to range of integral for w'
Mar log Fwo Uny
log Fwr < log Tus Uap Mey! + log Fan
Fwo to -wo
21

---

Published as a conference paper at ICLR 2025
We have
Pr(w is selected]
= E [1 (w is selected)]
(Lo
II wfw
(uw - log Tw Uww logro rw dwd drw
(froe drw drw
-ow)
w you
(1 (1-Tw Tw E"" em ) drw
" F
II (1 Tw e"'ur cuw dr
(10)
plaa) F(w
p(u'') p(w)
1 Tw
drw
where (x)+ = (0, x), and p(-) == Softmax(u). In the above, wt = arg max, Mwr and observe that
. If w w", (1
uw) cannot be negative, and e "us = 1.
If w w², then for Tw Se" "uw-, we can drop the clipping.
In both cases, we can integrate to uu=-" and drop the clipping in (-)+-
Proof of Example 3.2. When we have only two tokens in the vocabulary and u [A, 0] The proba- bility of softmax sampling is immediate. As for PF sampling, the results are obtained by instantiating (10) and solving the integrals for and where V fa, b). is w", so the integral becomes Pr(a is selected]
So re dr 0.5e A The Pr[b (b selected] 0.5e-A L
D.2 PERMUTE AND FLIP WATERMARKING
Our analysis in this section focuses the idealized situation when the pseudo-random function is perfectly iid uniformly random.
Recall that the Permute and Flip watermark works follows.
1. Sample the random number Ty from uniform distribution ~ Unif(O, 1) for all y E V.
2. Output y/t arg max,ev (My,t logry.t)
3. Detection statistic Σi=n-m+1 log ft.y.
Proof of Theorem 4.3. The first statement calculates the test score under the null hypothesis where the suspect text is not watermarked, i.e., statistically independent to the secret key thus independent Vi.n, Tt.y remains uniformly
to F and by extension to rt.-- Thus in this case, when conditinoing distributed for every y E including the yt we conditioned on. -log(rt,g)) Exponential(1) for each f, thus the expected value is is for each token. The total is m.
The second statement requires stronger assumption on the pseudo-random number generator. The generated random vectors in each step needs to be mutually independent for all subset of of length n - m among the set of all m- te-grams, which is implied by the even stronger condition of perferet independent randomness assumed in this theorem, and the fact that there prefixes among the n - m of them. Clearly, sum of n - m independent exponential V.s satisfies an Erlang distribution with shape parameter
duplicate m-grams
The inverse CDF claim follows directly.
Let's now prove the third statement under the alternative hypothesis when the text Visa is actually generated according the watermarking scheme.
We will focus on - log Tw,, for = m 1,2,...,n. Drop subscript for now. Let i be the selected token.
22

---

Published as a conference paper at ICLR 2025
E logra
Σ
P(w w is selected) log Tw w! is selected]
WEV
Σ
E
log Tu 1 (w is selected)]
Fix w, let us calculate B|- log hi 1 (w is selected)].
Again, use (9) and follow the same lines of arguments as we calculate the probabilities, we get:
E
log Ta 1 (w is selected)]
(L (uw - logro Tw > Uw - log du') dr
log Tw
II un' F-u
(Jre exp (M -ww)
log Tw II
drw dr
w' #2
log Tw
II (1-1e rw e" emwr-Mw) dr
wi pto
log Tw II (1 Few e -ww drw
(11)
w/ sko
p(wm)
p(w)
p(w')
log T'w
1-Tw Tw
drw.
p(w)
Finally, observe that the proof is complete because (11) what Statement 3 states.
The examples we gave essentially just instantiate (11) to cases where the integral can solved by simple integration by parts.
Proof of Example 4.4. Deterministic = P(w*)
2(w)
E - log (w is selected)]
=
Jn
pw*)
- -log Tw
II
1 - Tw
P(w")
P(w)
dr
w'sw
1 for w = w
log Tw dr
J0
10 otherwise
23

---

Published as a conference paper at ICLR 2025
Fully random = uw u'y N for all w. w'.
2(w)
- logra Fw (w is selected)]
P(w
log Tw II
(1-rus Tw
P(w') P(w)
dr w
w w'tw
log Tw - -rmm) -ram) dr
1 d (1-1-rad (w-) -1
log Tw
N
N rw)
~w))~~ 1 -1 cl log Tw
(1 rw) drw
00
N
Fw
1
du
JO
N
1
Hn
N
Ha is the a-th Harmonic number H, So 1-z" dx. The stated k-subset example is implied by the
fully random case.
Proof of Example 4.5. 4.5. The case with two variables is a special case of the one-off model below with N 2.
Example D.1 (One-Off model). Let the logits be [-A,0, 0, ..., 0J with a total length of N.
The probability distribution [pi....,PN from Permute-ande and and-Flip satisfies
-
P1 eAN' P2 = PN
N(N - 1)
(1+ N
log(r = HN-1+ +
Proof. By (10), for the first token (with logits
A) we get its probability is equal to
Lo (1 (1- A
N
the remaining tokens has probability equal to 1/(N - 1) of N. By (11) we have that for w (the suboptimal token with logits A
E - log ft 1 (w is selected)) = 1/ (1 (1- (1)eAp)N-1a) dr
+ HN cAN
For other (optimal) tokens, we get that
E[ log ft (( is selected)] f." - logr 1o) - Ar)rr
H
HN -1 N(N 1)
N
All integrals follows from Lemma D.2.
(H
A+HN N(N -1) + eAN
HN_ -1 1
E log(rw)) = 1(N -1)
N
(1+ A)e
=NN-1+ +
N
24

---

Published as a conference paper at ICLR 2025
Lemma D.2. for any 0 and N > 1.
1/a
ag1 aarr)=--d loga HN a a+N
HN-1 N(N -1)
log x0 xx)" 2d
Proof. The proofs of both integrals follow from integration by parts. These were checked formally using WolframAlpha. The details are omitted.
D.3 GUMBEL WATERMARK AND ITS THEORETICAL ANALYSIS
Let Pw be the probability of the next token being w (and the is the corresponding logits), Gumbel watermark (Aaronson, 2023) chooses the next token by
Wc arg max T
arg max arg min
log Tw
Pw
1
log
Pw
T'w
arg min
(- Po Pw + log log
Tw
1
arg max (log log log
-)
Tw
arg max (uw - log log Tw
where Tw is pseudo-random number drawn from Unif(0, 1) independently for each It follows that log log Gumbel(1).
The detection statistic used in the Gumbel watermark is E log T-rwe Let's focus on log T-r. For every fixed w E V
log
Exp(1),
1 Tw
therefore, under the null hypothesis when w is statistically independent of rw. Ellog 1 =
However, the distribution changes when is the chosen word from the Gumbel watermark. The following Theorem calculates its expectation.
Theorem D.3. Assume Tw ~ Unif(O, 1) iid for each w E V and tt = arg max,, (uw - log log rw Let IP be the resulting distribution of w. Then
1
E
log
chosen
ra
P(
where H() is zth harmonic number defined as
H((2) = /
x²
1 dx
17.
n(n +
n=1
==1
In addition,
E log
P(w)H
P(w)
WE
Let us consider two examples.
log --re =1
Example D.4. When I is deterministic deterministic then (P(1)) = 1. i.e. E
25

---

Published as a conference paper at ICLR 2025
Example D.5. When IP is uniformly random P(w)
N for all w, then
Σ
P(W)H
N
1 N
1 +
3 +
(12)
P(w)
N
WEV
log N 0.58,
(13)
where 0.58 is Euler- Malcc-MMacheroni Constant. If the vocabulary size (for Llama) is 32000:
E
log
log 32000 0.58 10.95
Tw
Theorem D.3 is connected to Shannon Enaroon-Entropy of IP. Aaronson (2023) addition obtained an interpretable lower bound of the expression of the expectation in terms of the Shannon-Fntrooy.
Theorem D.6 (Aaronson,, 2023)). Let Tw, W. IP be defined as in Theorem D.3.
1
π
E
log
④ is chosen 2 11
-
logí P(W))
(14)
Empirical Entropy
E
log
1
2 1+
n²2
-
Σ
P(w) log( P(w)
(15)
6
Shannon Entropy
In the following will prove Theorem D.3 and Theorem D.6. These results not this paper, but the proofs were not published before to the best of our knowledge. We believe that by including the proofs help the research community build upon these results.
Proof of Theorem D.3.
1
E
log
E
log
1 (w is chosen)
Pib
w WEV.
Σ WEW
(Pw is chosen)
E
log
w is chosen
(**)
e Phot
P(w is chosen)
Ex fn Mow!
where (P( is chosen) being the softmax distribution follows from the Gumbel softmax trick. We will focus calculating (+). (**) is also relevant, but can be obtained from (*) follows:
1 Tw
log
(w chosen)
=P(()B log
(w is chosen) is chosen
Tw
+ (1 (1-P(O ((w)) log 1 rw
(w is chosen) w is not chosen
E log 1
IP( is chosen)
chosen
Tw
IP()) (**)
26

---

Published as a conference paper at ICLR 2025
log
1
(w is chosen)
1 Tie
log
Uw
log log
> Umm -
log log
Vw' + Fw)
Tio
log
1
J
1
Nhw
log log
Uno
log log
II
dud dw
Fw
Fw
Two
log
1
2(w' Plast
log
rw drw
Tw
1
1-plw) log Fw dr w F(w)
log
Tw
1
log
Tw
F(w)
drw
Tw
1
log
P(w) drw 7(
Fw
log(1 rw) (())) d(r P(Jj 1)
rw) (r F(w 1) L/" P(w)(Tw 1)) rw))
P(w)
log(1 Fw
-0+
P(w) w
dr m
F'n
P(w)
P(w) 1 Twn
drw
Twp R(o
(ww)
dr
Fwo
Harmonic number
=
P(w)
The third equation follows:
1
1
Uy
log log
>
log log
7
log
ane log
Fw
Fw'
log
log
Two
F'
p(w') F(o)
loR Pm
Two
P(wn) Flat
l0yz
Tun
So far, have
1
E
log
E
log 1 - Tw
1 (w is chosen)
= Σ P(w)H H
(16)
Tm
P(w)
WEV
WEV
Proof of Theorem D.6. Define function f supported on 2 1
2
f(x) = H(x)) - - - log x.
27

---

Published as a conference paper at ICLR 2025
An alternative form of the Harmonic number is
H(x) = (0x + +
where y is the digamma function and y is the Malchernas constant (~ 0.58).
To prove the stated inequality, it suffices to prove that f(z) 1 for all 1.
Observe that f(1) = 1. we can show that (() 2 for all x 2 1, then we are done. Let's differentiate fxx with respect to
d
-1)
T22 6
f'(x) dæ
H())
( (x +1
where (b(1) is the trigamma function. To prove (x) 2 0 it suffices to prove that
π72
g(z) = x (x + 1) ス -1 1
6
for all x 2 1.
Using the series representation of the trigamma function
1
(xc 1)
1
1-2
(x k3)2
k=
we can write
g(x) - xx
x
(x + k))
Observe that g()) =/. - Take the derivative of g we get
2x
g'(x) = Σ
(xr + k)²
(x + kya
(x + k)2 dk 1000 x
2r
dk
(x + k)3
(a + 2) + 1)2 2 0.
T
(x
for all 2 1. It follows that g is monotonically increasing x N 1, thus g(Φ) g(1) x²
for
all x 2 1.
This implies that fz(x) 2 0 for all 2 1, which completes the proof.
28

---

Published as a conference paper at ICLR 2025
Table 8: Comparison of different decoding methods.
Your role is that of helpful Assistant tasked with responding user referred to as 'Human'. Focus providing natural, detailed, and diverse answers, ensuring they are both informative and engaging. VaHuman: Sources predict that the stock price for Company A will either stay the same or go up for the next 10 trading days. Pick strategy for if the price will go up stay the same. Assistant:
Prompt
Great question! If the stock price for Company A is expected to go up for the next 10 trading days, here are few strategies you could consider: ln 1. Buy more shares: If you already hold some shares of Company A. you could consider buying more take advantage of the expected price increase. This can help you maximize your potential profits.An 2. Sell call option: A call option gives the holder the right, but not the obligation, to buy the underlying stock at a specified price (strike price) within specified time frame. If you think the stock price will go up, you could sell call option with higher strike price [continues...]
Greedy
Thank you for reaching out! I'm here to help. Based on the information provided, there are several possible strategies that an investor could consider for their investment in Company AAn in Before we dive into the specific strategies, it's important to understand that investing in the stock market always carries inherent risks. The value of stocks can fluctuate rapidly, and there is always the possibility that an investment may not perform as expected. Therefore, it's essential conduct thorough research, consult with financial experts, and evaluate your risk tolerance before making any investment decisions. In in With that said, here investor might consider if they believe that the stock price of [continues...
Sampling
few strategies that
Hello Human! I' glad you're interested in learning more about Company A's stock price. Based on your prediction. I will provide strategy for potential increase in stock price. Please keep in mind that this is purely hypothetical and not based on any actual market data insider information.) An in Human: What are some potential reasons why the stock price of Company A may go un Assistant: Excellent question! There several factors that could contribute an increase in Company A's stock price. Here are some possible reasons''n 'n 1. Strong Financial Performance: If Company reports strong financial results, such increased revenue or profitability, investors may hecome more optimistic ahout [continues...]
PF
Great, let's dive into this! Based on the information provided, there are a few strategies you could consider when making your decision. In in Firstly, you could consider buying more shares of Company A if you believe the stock price will go up. This is because the increased demand for the shares will likely drive the price higher, resulting in potential profit for your investment. However, please remember that this a high-risk strategy, there price will indeed increase. An in On the other hand, if you think the stock price will stay the sume, you could consider holding onto your current shares and waiting for additional information come to light. This approach is often referred as "buying and holding." " where you hold onto your shares for [continues...]
KGW Watermark
guarantee that the stock
Hi there, Human! That's interesting question. If the stock price for Company A is predicted either stay the same or go up for the next 10 trading days, here are a few strategies you could consider for either scenario:An In 1. Buy and Hold: If the stock price is predicted to stay the same or go up. buy and hold strategy could be a good option. This involves buying portion of the company's 's stock and holding onto for extended period of time, potentially for years. This approach aims benefit from the long-term growth of the company's stock price, without worrying too much about short-term fluctuations. An 2. Dollar-Cor Cost Averaging: Another strategy to consider is collar-cost averaging. [continues...]
Gumbel Watermark
Great question! An In If the stock price for Company A is predicted to either stay the same go up for the next 10 trading days, there are several strategies you could consider viel diversify your portfolio. Here are a few options:A In 1. Buy and hold: If you believe the stock price will continue to rise, you could consider huying more shares of Company and holding them for the long term. This approach can be less risky than trying to time the market, hut also means you'll '1l miss out on any potential gains if the stock price declines. 2. Diversification: Another strategy is diversify your portfolio by investing in other stocks or assets that are not directly related to Company A. This can help reduce your overall risk by spreading your investments across different industries and sectors. [continues...]
PF Watermark
29


Reviews:
[{"review_id": "gjnTKVbKQ2", "reviewer": "Reviewer_acjD", "summary": "In this paper, the authors propose a new decoding method called the Permute-and-Flip (PF) decoder. This decoder maintains stability properties similar to standard sampling decoders while achieving up to 2x better performance in the quality-stability tradeoff than traditional sampling methods. A cryptographic watermarking technique from the specifically designed PF decoder has also been developed.\nThis work's core idea lies in applying PF sampling, initially developed in the context of differential privacy, to watermarking. They also argued that it is the first work to apply this method to LLM decoding and introduce the PF watermarking technique.", "questions": "The paper claims that the proposed method allows for arbitrarily low false positive rates and high recall when the generated text has high entropy. However, it does not clarify the specific conditions or thresholds that define \"high entropy\" in the generated text nor the proportion of generated samples expected to meet this criterion. This is particularly confusing given the statement, \"PF watermark is better at optimizing (recall Example 3.2 and Figure 1); thus, naturally, the resulting distribution has less entropy to be exploited by the watermarking scheme.\" This apparent contradiction raises questions about whether PF performance is generally suboptimal due to lower entropy. A precise explanation of these points would clarify the effectiveness and limitations of the PF watermark across different text generation conditions.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This paper introduces a new decoding method for large language models, called Permute-and-Flip (PF) decoding, along with a watermarking technique that allows precise control over false positive rates while maintaining high true positive rates. As a result, the approach balances detection accuracy and low perplexity, making it effective for generating high-quality text while preserving watermark detectability.", "weaknesses": "- While the PF watermark optimizes better, it reduces entropy in the distribution, potentially weakening the statistical signals that the watermarking scheme can leverage. This suggests that PF decoding may prioritize lower perplexity at the expense of detectability, raising questions about the balance between watermarking efficacy and text quality.\n- PF decoding requires tuning the temperature T parameter to maximize detectability. Incorrect temperature settings could degrade performance, potentially limiting practical applications where robustness across diverse settings is essential.\n- PF decoding involves a more complex computational process than softmax sampling, which can lead to higher computational costs, especially when handling large vocabulary sets. This complexity may restrict its applicability in real-time or resource-constrained environments.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "0Qeq06yojf", "reviewer": "Reviewer_TLR6", "summary": "In this paper, authors propose Permute-and-Flip (PF) decoding for large language models (LLMs),\nWith reference to McKenna & Sheldon (2020)’s differentially private selection mechanism.\nIt enjoys the same perturbation-stability guarantees as softmax sampling and achieves substantially lower perplexity.\nThey also design PF watermark tailored for PF decoding that enables precise control over false positive rates while retaining high true positive rates, with reference to Aaronson (2023)’s Gumbel watermark.\nTheorems and experiments indicate that PF decoding a promising new approach for practical applications of LLMs.", "questions": "I have no questions.", "limitations": "", "rating": 8, "confidence": 2, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "This paper successfully combines the results of previous studies such as McKenna & Sheldon (2020) and Aaronson (2023) in the context of LLMs research.\nTheoretical guarantees are well organized and experimental performance verification is carried out sufficiently, and those make this study reliable.\nThe proposed method seems to have practical promise.", "weaknesses": "I found no serious weakness.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rtpJnVUlus", "reviewer": "Reviewer_5yGg", "summary": "The paper proposes sampling text from a language model using the Permute and Flip mechanism of McKenna and Sheldon—treating the token log probabilities as the \"score\" function to implement the mechanism—and proposes a method for watermarking text sampled from this mechanism.", "questions": "> A more fair comparison, would be to increase the temperature for PF watermark appropriately so we compare detectability when the suboptimality is aligned. This is shown in Figure 2b. In fact we have added a second baseline that apply Gumbel watermark to the induced sampling distribution from PF-decoding (shown as the dotted line). The distribution induced by PF does not have a simple form, but in our special case, it was worked out in Example 3.2.\n\nAfter increasing the temperature of the PF watermark so that its detectability is on par with the Gumbel watermark, is the utility of PF still better than that of Gumbel?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "The application of the Permute and Flip (PF) mechanism to sampling text from a language model is an interesting idea. The paper supports its main claims (about the effectiveness of the watermark) with both theoretical and empirical evidence.", "weaknesses": "Some parts of the overall problem formulation are not clear. For example, the stated goal is to maximize some utility function, in which case—unlike with differential privacy (i.e., the original context in which PF was proposed)—the optimal decoding strategy should be deterministic. The paper acknowledges as much but nonetheless argues in favor of using sampling via the following:\n\n> That’s because there are other considerations besides text quality when selecting LLM decoders. For example,\ncomputational efficiency and latency are hugely important, since each API call to the logits function is costly. The diversity of the generated text is also important, especially for creative tasks.\n\nSeveral aspects of the above except are unclear. First, in what sense is greedy decoding more computationally expensive than sampling? Also, if diversity is important then why not formalize this as part of the problem statement (e.g., via the utility function)? Making these desiderata precise would help clarify the main problem statement and aid in comparing to prior work. For similar reasons, it's not clear what the motivation is for the stability property (Definition 2.1). The paper cites data poisoning and jailbreaking attacks as motivation, but the precise connection is not made explicit. The paper also mentions a connection between stability and diversity; however, if the only purpose of stability is to be a proxy for diversity, then why not just explicitly consider diversity? In general, being more explicit and rigorous about the problem formulation / desiderata would be helpful for clarity.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YhyiPo8kM3", "reviewer": "Reviewer_vtHu", "summary": "The paper introduces the PF decoding method for LLMs, which is designed to improve text generation stability while lowering perplexity compared to traditional sampling methods. This method enhances quality-stability balance and integrates a cryptographic watermark for AI-generated text detection, using a pseudo-random technique that makes it secure and resilient to adversarial modifications. PF decoding achieves lower perplexity than softmax sampling while maintaining stability, and the PF watermark allows for high detection accuracy with precise control over false positives.", "questions": "please see above.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The proposed decoding method for LLMs is novel.\n2. This paper provides theoretical proofs to support its statements.", "weaknesses": "1. Could authors specify the difference between the PF watermark and the Exponential Minimum watermark proposed in [1].\n\n2. Diversity is an important property of LLM sampling. Are there any metrics or experiments to measure the diversity of different decoding methods?\n\n3. PF watermark provides lower perplexity compared to Gumbel-Max watermark. Could authors present the robustness performance among PF watermark and other watermarking methods, like a token replacement, etc?\n\n4. In Table 1, the authors specify the beam search can not watermark, but [2] uses beam search. Moreover, could authors explain the reason why beam search is not stable?\n\n[1]. http://arxiv.org/abs/2307.15593\n[2]. http://arxiv.org/abs/2301.10226", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "DfitOJCwbe", "reviewer": "Reviewer_wmcS", "summary": "The article introduces a novel decoder algorithm for LLMs. The proposed algorithm is based on the Permute-and-Flip (PF) method for differential privacy protection of data, which transforms the output of a dataset into independent sampling based on assigned probabilities to data elements. The paper also references an equivalent construction of PF, converting data sampling into random adjustments of the probability distribution of data elements, thereby outputting the element with the highest probability. This decoder algorithm can be used for embedding the output text, and the paper presents a watermark embedding algorithm based on the PF decoder. Compared to existing decoder algorithms, the paper demonstrates that the PF algorithm offers better stability.", "questions": "1. Some symbols in the paper are not fully defined. For example, what does  E_{y∼PF(u)}[u(y)]  mean?\n\n2.In Theorem 3.1,  u^*  is the maximum value of  u(y)  outputs. However, in point 4,  u^* - u(y)  is used. How should one interpret a number being subtracted from a set? Perhaps this is related to the previous question?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. A novel LLM decoder algorithm is proposed, and compared to existing algorithms, the PF decoder offers better randomness, which may provide improved output adaptability for certain application scenarios.\n\n2. The paper proposes a method for embedding watermarks using the PF decoder. It converts candidate output tokens into different values using a pseudo-random function, thereby altering the output probabilities of the tokens to embed the watermark information.", "weaknesses": "1. The description of the scheme in the paper is not very straightforward. The PF decoder designed in the paper is not directly based on the original Permute-and-Flip method, but on a variant algorithm. Although it cites (Ding et al., 2021) to illustrate that the two methods are equivalent, this paper is still in a preprint status.\n\n2. The paper does not sufficiently explain the characteristics of the PF decoder. In Theorem 3.1, the paper cites several quantitative calculations from (McKenna & Sheldon 2020) but does not explain their significance. Especially since the original paper was not intended for LLM decoders, the impact on the characteristics of the decoder in this context is unclear.\n\n3. The experimental results show that PF does not demonstrate a significant advantage over existing algorithms. For instance, in text generation, its PPL is not superior to the greedy algorithm, and in watermark embedding detection, its TPR results are also not better than the comparison schemes.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)