WaterMax: breaking the LLM watermark detectability-robustness-quality trade-off
Authors: Eva Giboulot
Teddy Furon
Venue: NeurIPS 2024 poster (2024)
Keywords: machine learning security
llm watermarking
Primary area: safety_in_machine_learning

Abstract: Watermarking is a technical means to dissuade malfeasant usage of Large Language Models.
This paper proposes a novel watermarking scheme, so-called WaterMax, that enjoys high detectability while sustaining the quality of the generated text of the original LLM.
Its new design leaves the LLM untouched (no modification of the weights, logits or temperature).
WaterMax balances robustness and  computational complexity contrary to the watermarking techniques of the literature inherently provoking a trade-off between quality and robustness.
Its performance is both theoretically proven and experimentally validated.
It outperforms all the SotA techniques under the most complete benchmark suite.

WaterMax: breaking the LLM watermark detectbbiity--bbusteee---iiii trade-off
Eva Giboulot Inria, CNRS, IRISA University of Rennes Rennes, France eva. eva. tra.gibouulttinniia.
Teddy Furon Inria, CNRS, IRISA University of Rennes Rennes, France feddy.furon@inria.
Abstract
Watermarking a technical means to dissuade malfcasant usage of Large Language Models. This paper proposes a novel watermarking scheme, so-called WaterMax, that enjoys high detectability while sustaining the quality of the generated text of the original LLM. Its new design leaves the LLM untouched (no modification the weights, logits, temperature, or sampling technique). WaterMax balances robustness and complexity contrary the watermarking techniques of the literature inherently provoking a trade-off between quality and robustness. Its performance is both theoretically proven and experimentally validated. It outperforms all the SotA techniques under the most complete benchmark suite.
Introduction
The availability of powerful large-language models (LL.Ms) allows users to produce texts that look like human writings. The risk for misuse of these models is critical, ranging from the impersonation of individuals to the large-scale generation of fake news. Identifying the provenance of given piece of text is paramount to limit the impact of such 'weaponization' of LLMs. New initiatives or regulations impose technical means for Al traceability
5.
Forensics passive methods generally leverage priori knowledge about the statistics of texts generated by given class LLMs [34] (27). Despite their versatility, these methods offer low performance. The reported probabilities of errors are only validated empirically on some datasets, and because of this, they are never lower than 10-3 [4]
In contrast, active methods like watermarking are only limited by the fact the L.M owner must inte- grate the watermarking within the generation processes. This done by embedding an imperceptible signal in the generated text, which can be retrieved by a detector sharing the secret key of the model owner. Current watermarking methods for generative texts 22 23 provide low and guaranteed false positives rates. Yet, the trade-off between the detectability and the text quality crucially depends on the entropy of the text to be generated, which in turn depends on the prompt and the LLM, as illustrated in Fig. [ This implies that the distortion-free property [3] g ensures that watermarking does not degrade text quality but inherently limits the detectability.
This paper presents WaterMax, watermarking technique that trades off robustmess not for quality, but for complexity. It obeys the regular constraints found in the literature: can be integrated into any standard LLM without fine-tuning the weights, the detection does not need the original LLM, and it can spot the watermark on slice of generated text with some guarantee on the false positive rate. Our contributions are the following:
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

WaterMax is based on new design not relying on the usual mechanisms of the literature; especially, it keeps the next token distribution and sampling (temperature and method) intact. Moreover, it better utilizes the text entropy by working over sub-sequences of tokens, so-called chunks hereafter, rather than token by token.
This new design makes WaterMax almost distortion-free, as shown experimentally (Sect. 7.3 and justified theoretically (App. H). and yet enjoys higher robustness than the state-of-the-art, consistently over several LLMs. Figure shows that the other methods need to boost the watermark strength to as detectable WaterMax, inevitably degrading the quality.
This new design facilitates building up a theoretical model of the watermark robustness characterizing the true positive rates under attack (see Prop. 5.2)
2
Related Work
Watermarking texts generated by LLMs is mainly performed by changing either the distribution 21 or the sampling [ g of the next token. Critically, the false-positive rate of these methods can be reliably controlled [1I. Furthermore, the computational cost of most of these methods is negligible relative to the text generation itself. On the other hand, they all suffer from similar weaknesses:
Text entropy limit Some theoretical works [8 17.111 show that the watermark detectability is highly dependent the entropy of the text to be generated. In practice, this makes the text length necessary for reliable watermark detectability dependent on the type of the text, and also the LLM. One may increase the watermark strength or the temperature in the LLM increase the entropy artificially [19 26). Both solutions degrade text quality compared to the original LLM.
cuttortion-freeness and quality Kuditipudi al. 23 define that watermark is distortion-fret free if does not modify the probability distribution of the next token on average over the keys. This is guaranteed in schemes like [1 [3 (). Yet, these schemes rely heavily the entropy of the token distribution, leading to possibly low detectability without any means to increase it without losing distortionn-rreensss. Appendix | fillustrates the dependence of Aaronson's 's scheme
the original LLM. Moreover, a scheme that is not distortion-free does not necessarily lead to texts with lower empirical quality, but foreseeing the impact of the watermark strength the quality is issue.
Watermark robustness characterization The watermark must resist text editing ranging from simple insertion of words to complete paraphrasing of the text. At the time of writing, there are only two watermarking schemes designed from the ground up to be robust 23 35 Yet, other state-of- the-art methods have experimentally shown resiliency to attacks against long-form texts 22 under a precise control the false-positive rate M.. However, none of these methods can theoretically guarantee its robustness. Only bounds on the moments of the detection score provided in [21 and [
1.0
0.8
0.6
Waterblax Pla-S-ami (letustect
0.4
WaleeMox 2locha---
KGW Phodd dk-turnee
KCW Bhow-Enn
0.2
KGW Lhhn-&Tsscho-l
Aussunsu Pli-kaiiii 4h-ankmee
Kamoon Llmn & Thh-
1.0
1.2
1.4
1.6
1.8
2.0
Relative Perplexity (c- hotter)
Figure Detectability as function of text quality for different L.M architectures. WaterMax always reaches detectability close to 1 despite negligible loss of quality. Probability of false-alarm fixed at 10-6, nucleus sampling (top, 0.95) at temperature 1.0. Text quality measured as the relative perplexity of the watermarked text over the non- watermarmrrred text.

---

This work presents scheme that empirically incurs negligible loss while reaching an arbitrarily high detectability even on small texts. The parameter tuning trades robustness for complexity but has almost no impact on the text quality. Moreover, we characterize its performance under a large attack range by expressing both false-alarm and pre-ppositive rates. Its drawback a large computational cost, which we show how to limit throughout the paper.
3
Main Idea: Watermarking by generating multiple texts
This section first presents a simplified and inefficient version of the method for a pedagogical purpose. The driving idea is that LLM is randomized algorithm. In its simplest implementation, the LLM computes a probability distribution of the next token and randomly samples according to this distribution. The chosen token is appended to the context, and the process iterates. Our main idea is to let the LLM generate several texts for a given prompt and select the one that is the most suitable from the watermarking point of view.
Initially, we select a sound watermark detection algorithm in the sense that it can output a p-value for any piece of text under scrutiny. Usually, such detection computes score and then 'normalizes" it in p-value defined as the probability that notermarrardeed text yields score equal or higher. Appendix A lists some candidates from the literature and presents our own design.
Our watermarking embedding lets the LLM generate texts for given prompt. Since all pieces of text are generated normally, i.e. without being degraded by a watermark, their qualities are likely high. From the generated texts, the LLM outputs the text with the lowest p-value.
The advantages are that the text quality is not degraded and that any sound detection may be used. The price to pay is high complexity and long latency. Suppose that a text is deemed watermarked its p-value evaluated by the detector is lower than the required false alarm probability РFΛ- This raises the question of the number n. of generated texts for successfully embedding the watermark. Proposition 3.1.
The detectability measured by the power of the test, i.e. the probability PD of detecting a watermarked text is the following increasing function w.r.l. n.
PD & (PP < PFA(H.) 1 11 PFA)"
(1)
Appendix B gives a sketch of the proof. We point the reader to two important advantages:
The performance does not depend on the choice of score function used to obtain the p-value.
The performance does not depend on the length of the text. Consequently, even an extremely small text can be watermarked in theory.
Figure the power of the test as a function of n for various probabilities of false alarm. Whatever the choice of PFA. one can clearly observe that huge number of generated texts (>> 50) is required to obtain a power greater than 0.5, which is unacceptable in practice. Section how to improve this base algorithm to reach arbitrarily high power with a smaller computational power.
Another weakness the assumption that the LLM can create n texts whose p-values are independent. For some prompts, the diversity (i.e. entropy) is indeed small, which implics that the LLM creates similar texts or even duplicates of text among the n outputs. Section investigates how self- synchronization mitigates this issue.
4 Watermarking chunks of text
This section devises ways to efficiently explore the space of possible texts to find a low p-value. The idea is to split the generation into N iterations, each iteration creating chunk of the text. The aim is to reduce the computational burden by generating small chunks while exploring many possible texts.
4.1 Exploring the text space
For each chunk, a batch of n text drafts is generated independently based on the text candidates of the previous iteration. Ideally, one would generate drafts at each chunk for each previous candidate, resulting in tree of N texts from which to choose the lowest value. Obviously, this is not
3

---

tractable, We reduce the complexity by keeping only the m best candidates at each step, akin to Viterbi algorithm [3]. The pseudo-code is summarized in Alg. in App. This is suboptimal because the candidates minimizing the p-value at given step may not be the best once completed at iteration N. Other exploration strategies range from greedy search to Monte Carlo Tree Search [6].
The pseudo-code is summarized in Alg. 1 within Appendix F
4.2 Cumulative scores
This paper considers detection schemes that share the following process. The vocabulary V is a list of [ admissible tokens, and a text is decomposed into a sequence of I. tokens. Depending on the secret key k, the detection associates to the i-th token variable uy. The score is computed as the sum over the tokens s = E/=1 u4. This is translated into a p-value assuming that, under Ho. i) the scores of the tokens are independent and identically distributed random variables (U4) giving birth random score S, ii) whose c.d.f. Fs(: L) is known that the p-value is simply:
p P(S s) Fs(s; L).
(2)
Appendix A lists some detection schemes of the literature following this procedure. Our choice is simply U₃ NO(0; 1) so that (s(s; L) (ssVVL.
For the sake of clarity, suppose that the chunks are composed of & tokens. At iteration the j-th candidate has a score denoted $t,j and drafts for its following chunk are proposed. This produces n incremented scores per candidate, thus mn variables: St,f js k. 1 J S m. < k S n. Since these scores are converted into p-values by the same function, i.e. p = 1 - F's (s; E(i 1)), selecting the lowest p-values amounts keep the m maximal cumulative scores, hence the name WaterMax.
4.3 Low latency
One issue is the latency: the final text cannot be issued until all candidates reach an end of sequence. This problem fixed with the drastic choice m text at iteration the chunk draft yielding the biggest incremental score ós,, This choice enables the output of chunk of text at the end of each iteration, hence reducing latency. Of note, this also corresponds to the draft with the lowest local p-value - Fs(
amounts a greedy search appending the
4.4 Optimal detection without attack
This section introduces simple detector to reveal the advantage our watermark embedding. The idea is that the received text is composed of chunks whose local p-values are distributed as beta distributions (1,, 1) (i.e. Up.1) under H. (1,,n) under H, (see Appendix. B). This is generalization of the algorithm of the previous section, the only difference being that the likelihood
0.5
0.6
0
0.4
Pri le 02
0.2
20
1800
2001
2001
10 Namber of /chanok/c
10
Number of Seects
Namober of chonks
Figure 2: Theoretical power of the uni- formly most powerful test (I] as func- tion of the number of generated texts n.
Figure 3: Theoretical power of the optimal 3 and robust tests at PFA 10-6 for m as a function of the number of drafts per chunk and the number of chunks N.

---

ratio 12 now aggregates a vector p of N observed local p-values:
N
Aopt (p) -- Σ
Ho log pi)
SHi
T.
i=1
Proposition 4.1. The optimal detector Aopt has the following performances when there is no attack:
-N,1 (T), PD = N (7N,1 (Pra)),
(4)
where Ta.y is the lower incomplete gamma cammma,uunaie function with shape parameter I and scale parameter
Appendix gives sketch of the proof. The power of the test Pp is an increasing function of n. Again, note that neither the token variables distribution nor the chunk length affects the detectability.
Figure iillutraats the efficiency of our exploration strategy of the text space. Contrary to Sect. 3 can easily reach power close even at PFA 10 - For example, using N 9 chunks of n 15 drafts, assuming a medium-size text of L 512 tokens and chunks of equal length, one only needs to generate Nn 135 chunk drafts of This is equivalent to generating 15 texts of size 512. This is to compare to Sect. where more than
[L/N] 57 tokens to obtain a power of 0.96.
million texts of 512 tokens are necessary to reach this power at PF 10-6,
5 Robust watermark detection
Until this point, our detector assumed that the text it receives is the generated text. Yet, before reaching the detector, text might have been modified for legitimate malicious reasons: it may be translated, curated, locally modified etc. This section assumes that the scores of individual tokens are distributed standard Gaussian random variables to allow the derivation of closed-form solutions.
5.1 Robust detection
33 is neither optimal nor robust under attack because the insertion or the removal of tokens provokes a desynchronization: The detector no longer knows where each chunk starts and ends, which is necessary for computing the local p-value of individual chunks. More robustness comes with global score simply summing up over all the tokens:
Detector
N
Arob (u)
W(--1)4+5
U4-
(5)
==
Proposition 5.1. The robust detector has the following test performance when there is no attack:
① ( + VNe(n)
PrA= PD
(6)
Vu(n)
where e(n) (resp. v(n)) is increasing (resp. decreasing) quantity computed in Tab. 7
Appendix gives sketch of the proof. Figure 3/hows that the robust test (5) is slightly less powerful than the optimal test (3) when there is no attack. On the other hand, the next section shows that its power degrades smoothly under attacks contrary to 33)
5.2 A model of the robustness against attack
Despite the variety of modifications that can be performed on watermarked text, all attacks have the same end effect: modifying the tokens and potentially the number of tokens. This amounts to modifying a proportion scores to distributed following Ho instead of Hi in the global score. Formally, the score (U) for a text of L tokens becomes: (assuming a is integer)
aL
(1-a)L
Arob (U) = Σ Unolo) +
Σ U U2(())
where 1 - is the proportion of scores impacted by the attack whose variables are denoted (Ü²). and no (resp. mi) is mapping to the indices of the untouched scores (resp. modified tokens). is important to note that does not matter if the size of the attacked text differs from the generated text.
5

---

Proposition 5.2. The robust detector has the following test performance under attack:
PFA -<==/(-//VD) PD ( Φ 1--1 (PFA) + avNe(()
(8)
(I+a2(o(n)
Appendix D gives sketch of the proof. In the end, the power the test decreases smoothly with the strength (1 a) of the attack. Once again, the power of the test does not depend on the text size.
6
Independence
This section discusses the assumptions made so far on the independence of the token and draft scores.
6.1 Token scores independence
All random variables (U;) associated with tokens must be independent and identically distributed within a text. This assumption has an impact on the power of the test and especially on the probability of false alarm. It must hold for non watermarrde text. Otherwise, the score of chunk (or of full text) is not properly normalized into p-value.
We the the i-th token of text depends not only on the secret key but also on the hashing of the current token and the 1 previous tokens in the text (a window of size h). Furthermore, this h-gram is appended to list. If the h-gram is already stored in that list, the variable of the current token is discarded. By doing so, we ensure that for a given text, the (Ut) are always different. Contrary to [Л], this mechanism is enforced at the generation and the detection stages to ensure that both sides compute the same score.
technique as in to enforce the token variable independence: the variable U, of
6.2 Draft score independence
At the embedding, the scores of the drafts of a chunk are assumed to be independent. Yet, some correlations occur when parts of texts repeat across different drafts. For example, in a prompt asking "Who are you?", many drafts of the first chunk of the response likely start with "I am." This assumption only plays a role the power of the detector, not its false-posines positive rate.
Causal hashing window At first sight, hashing the whole chunk draft for seeding each token variable brings draft score independence the drafts differ at least by one token. Sadly, this creates a watermark that breaks even for a single modified token. This forces us score of each token depends only on itself and the previous tokens. The longer the hash window, the more likely h h-gram is and the more diverse the scores. Yet, this diversity is obtained at the cost of robustness. Indeed, changing a single token in a text removes the watermark of tokens because their variables depend on the modification. Another weakness: a given iteration, the j-th token (j < h)) of every draft always refers to the same / - j tokens since the previous chunk is identical for all these drafts. This means that the effective window size for this token is always smaller than h.
causal window: the
enforced diversity This weakness can be tackled by modifying the sampling procedure. important guarantee a high diversity the beginning of the chunk since this is where the effective window size is the smallest. We propose to generate the first b tokens using standard beam- search procedure, which deterministically returns n different beginnings of the chunk. The rest of the draft is sampled normally. However, there is trade-off. The smaller b, the more diversity between the chunks and the closer to the independence assumption we get, the more likely the beam-search procedure selects tokens in the tail of the distribution (for large enough number of drafts n)), the poorer the text quality.
6.3 Experimental validation
For the independence of the score variables, the experiment runs the detector on 100k Wikipedia entries from 2018 for ten different keys. Since the text of Wikipedia is free of any watermark, one should observe the p- values to be uniformly distributed. i.e. the empirical false alarm rate should

---

match the theoretical probability of false alarm. Figure 4a demonstrates that this assumption holds for any window size h. On the other hand, the robustness highly depends on the hashing window size, with h 6 being good trade-off between performance and robustness.
The second experiment measures how much deviate from the draft score independence assumption. It generates 296 texts of 256 tokens on the three tasks from (29). The entropy of the generated texts may be low for a given chunk so that some parts of text may be redundant among the drafts. Figure reports how much our scores under Hi deviate from the theoretical distribution.
This experiment demonstrates that the closer to 1 the number of tokens generated by beam search b, the closer the scores match the theoretical distribution. Notice that even for a large b, such as b= 6, there is a large improvement compared
baseline WaterMax with b 0. In Appendix [] provide a more thorough experimental study of the parameters and b. In particular we show the trade-off between quality and detectability. In the rest of the paper, we select b where small loss of quality acceptable and b = 6 a virtually lossless scheme is warranted.
Experiments
7.1 Experimental protocol
The evaluation is performed on the three long-form creative writing tasks of the 'Mark My Words' benchmark [29] news article generation, summarization of existing books, and writing of invented story. This leads to the generation of 296 texts. We fix the maximum text size L to 256 tokens for all tasks (see App- K for larger text sizes). The length of chunk E is fixed a priori to L/N where I. is the maximum number of tokens allowed in the benchmark and N the number of chunks.
All the evaluations in this section use the model Llama3-8b-Instnn in App. D). Its temperature varies to measure the impact the text entropy on the watermark detectability. The watermarking scheme is not allowed to modify 0 compared to the original LLM.
32 (more models are tested
The evaluation of a watermarking scheme is based on three quantities: the quality of the water- marked text relative to the non-watern non-watermarked text, 2) the detectability, and 3) the robustness.
For KGW and Aaronson's scheme, cwt.luuccoooffcceoooooo wfw.abbokreeeerrcchrrreet. /
the implementation provided by [11] https chrreeerrrrrrchheeerb.b.e For the attack suite, we use the imple-
mentation of the 'Mark My Words' benchmark found at Ihtttt: MarkMyWords
Text quality A number of metrics have been proposed evaluate the quality of generated water- marked texts empirically. We tested the vast majority of these metrics: rating by L.M [29) similarity
between BERT's embeddings [11,, MAUVE 30), ROUGE (25) and perplexity measured by oracle 21
We arrived at the conclusion that perplexity and ROUGE-L are currently the only reliable
Whndiw
Windin doc
Winlen sioz
10-1
Empirical cdd
Smyprticll Phah
10
10-3
1-4 h
10
Tw
60
10
Thousciiaal Pex
Theoretical d.
(a) Empirical vs. theoretical Psa for Aapt. over
(b) Empirical vs. theoretical c.d.f of the score under
10x 100k Wikipedia entries truncated 256 tokens.
H1. over 296 x56 scores. Llama- 2amma---bb-haan Water- Max (n, N) (8, 16), / 6.
Figure 4: Independence of token scores (a) and draft scores (b).
7

---

measures of watermarked text quality in the sense that they are the only ones that consistently vary alongside watermark strength. This section reports the relative perplexity as measured by opt-2.7b as an oracle, computed as the average ratio between the perplexity of watermarked text and the corresponding non-waternarked text. The text quality evaluated by comparing the text generation with and without watermarking at the same LLM temperature O.
Detectability The increasing use of LLM necessitates the use of small false-positive rates. In this section, we settled on reporting the true-positive rate at a conservative false-positive rate of 10-6, For a more complete picture, Appendix aalso reports the median calse-positive rate of each watermark algorithm at different text lengths, akin to the measure of "watermark size" recently proposed in [29].
Robustness We use the attack suite of the 'Mark My Words' (MMW) benchmark 29 We report robustness by measuring the detectability Pp of the watermark at PFA - 10-6 for each attack.
Error bars are reported using standard error for perplexity, using the standard methodology, and detectability, computed using 5000 bootstrap samples for power at PFA = 10-6
7.2 State-of-the-art methods
The recent MMW benchmark considers four techniques names as 'binary' [8. KGW [21] Aaron- son [I] and 'inverse transform' [23]. It concludes that today's 's best methods are KGW and Aaronson, we thus restrict our comparisons to them. Except when specified otherwise, the watermark schemes all use a window size of h = 6 for hashing.
A fair comparison considers watermarking schemes at equivalent level of text quality. Aaronson's 's scheme is theoretically distortion-free and experimentally almost lossless with respect to empirical relative perplexity and the ROUGE-L score. We should ideally tune WaterMax and KGW such that they are also almost lossless. This is not problem for WaterMax as long as the number of tokens
generated by beam-search b is small enough. We choose the setting (N, n) (16, 10), which provides a good compromise between robustness and complexity. As for KGW (21). we fix 5 = 2.0 for an acceptable loss of quality, or d 3.0 for a tangible loss of quality. This gives clear advantage to KGW. We set its green-list ratio = 0.5 following the recommendation of Piet et al. 22
7.3 Results
Quality vs detectability Figure summarizes the benchmark outcomes. They confirm that Water- Max achieves a detectability close to the theoretical prediction - in our case close to 1 at PF 10-6 while, at the same time, incurring a minimal loss in text quality. In particular, for a number of tokens generated by beam-search b = 6, there is virtually no observed loss in terms of perplexity. Furthermore, its performance is independent of the temperature of the LLM, demonstrating the efficient use of the entropy by working on chunks instead of individual tokens. On the other hand, Aaronson's s scheme achieves high detectability only for high temperatures (seldom used in practice), whereas KGW achieves high detectability at the price of a text quality loss: at å = 3.0 despite relative perplexity significantly larger than WaterMax, KGW is still far less detectable.
Robustness Figure 6 summarizes the results for the attack suite of the MMW benchmark. The watermark parameters are fixed to ensure the most negligible quality loss possible: = for WaterMax and 8 = 2.0 for KGW. Without many surprises, no algorithm can resist the powerful re-translation attacks at this PF regime since most words, as well as their order, are modified. The 'typos' attacks safely be disregarded as they modify every token and make the text barely legible in practice. This leaves the attacks that modify only parts of the text. For low temperatures, WaterMax is by far the most robust. Notably, the robust detector (5) can resist far more attacks, with significantly higher detectability against 'synonym', "misspelling" and 'swap' attacks.
Interestingly, for temperatures starting at 1.0, Aaronson's 's scheme is more robust than WaterMax for specific attacks. This is explained by the high reliance of this method on entropy as we show in Appendix as well as the high variance of its p-values. Given enough entropy, some portions of the watermarked text present unusually low p-values, statistically leading to more robustness. On the other hand, WaterMax produces texts with valuus that are more concentrated around their mean.
8

---

1.0
0.
0.9
0.6
0.8
0.7
Wateelaa (itecotios)
0.7
Aucontncc
KCW,
0.6
ROW 1-:00
BOW: 3-330
0.6
KCW,
Watseblue,, (n. (10.16 16
0.5
Wateehlan O6NN (0.56
Wazchlles, N.8 (10.1
Waterblare, (n. N. (10.
0.4
0.4
0.3
0.3
0.2
1.2
1.0
1.2
1.4
1.0
1.5
2.0
Temperatioos
Relative Perpledity better)
(a) Detectability as a function of the LLM temper- ature 0. WaterMax is the only scheme for which detectability is maximal for any 0.
(b) Detectability as a function of text quality, Each point corresponds to temperature from the figure on the left.
Figure 5: Detectability against quality of watermarking schemes using Llama-3- 33-8bIInstrue with nucleus sampling (top, 0.95) and hashing window h = 6.
Via tae IN S.le CINIITII
100
05-
SSON Slu (4280)
02-
BLW duu K-2--
Araah a
The klas Treaditinn seeeitttee
Clas Mondttie ahbug
Tre
(a) Temperature 0.8
(b) Temperature = 0.9
(c) Temperature 1.0
Figure 6: Robustness against the attacks of MMW benchmark. Llama-3-8 3-8-----truee-e with nucleus sampling (top, = 0.95). WaterMax parameters (N, n, b) = (16, 10, 6). The hashing window size is fixed to h = 6 for all schemes.
7.4 Computational complexity
At face value, the computational cost of our scheme is nothing more than Nn text generations, the computation of the scores being negligible. However, the cost of adding more chunk is higher than the cost of generating one more draft. Indeed, the n drafts of a chunk are sampled independently (or by beam search), making their computation highly parallelizable hand, we cannot parallelize the computations over the chunk. Since N has the highest impact on the power of WaterMax, it the main limiting factor for its performance.
modern GPUs. On the other
See Figure 7 for experimental running times. As a rule of thumb, we advise to use parameters fixed as (n, N, 6) (10, 16, 6) good trade-off between computational complexity and detectability. This still incurs a high cost compared to classic watermarking schemes. Under these settings, a text generated with WaterMax takes on average five times longer to generate than KGW Aaronson's scheme.
However, despite higher total computational cost, the latency can be kept relatively low since the text is generated chunk by chunk. Each chunk can be delivered to the user gradually (e.g. using a buffer) in order to make the method practical in a real-life setting. Note that more chunks lead to lower latency and better detectability with negligible cost text quality. We report, under the same settings, the generation time for one chunk measure of latency in Figure 7 In particular,

---

3.5
No Watermurk
Generation time between chunkss (8)
10
3.0
Generation time(s)
2.5
2.0
1.5
7-
1.0
0.5
5
0.0
2
8
10
11
12
13
14
15
16
2
10
11
12
13
14
15
16
chunks
Number chunks
Figure 7: (left) Total generation time seconds of WaterMax as function of the number of chunks N and the number of drafts/chunk for texts of 256 tokens using sampling on Nvidia A100 with Llama-2-chat-hf. (right) Generation latency defined as the average generation time between two chunks compared to the generation time of the same number of tokens with baseline LLM. Note that the baseline time between two tokens is 0.021s.
show that under the advised parameters, the latency of WaterMax is only twice long that of the original LLM.
Conclusion
Contrary previous art, the design of WaterMax starts from a detector and then constructs the generator to maximize the detection power. As result, our watermark scheme offers host of compelling benefits. It achieves high quality and robustness even on short texts, and importantly, does not modify any component of the LLM, preserving its integrity and functionality. This design also complies with common add-ons in the literature, like adapting the sampling temperature [9 or embedding short messages [11.
These advantages come the cost of computational complexity, which stays limited thanks the exploration strategy and the parallelization possibilities of modern GPUs. Another idea left for future work is the distillation of WaterMax, a process that involves fine-tuning an LLM to natively produce watermarked text. This would definitively get rid of the only drawback of WaterMax.
Acknowledgment
Work supported by French ANR AID under the chaire SAIDA (ANR-20-CHIL 0011-01). Experi- ments presented in this paper were carried out using the Grid' testbed, supported by scientific interest group hosted by Inria and including CNRS, RENATER and several Universities as well as other organizations (see https::///// httpp:://www.peee http///wwwwddd00.f..tt
10

---

References
[1] S. Aaronson and H. Kirchner.
Watermarking GPT outputs, 2023.
URL https://
[2] M. Abdin, S. A. Jacobs, A. A. Awan, J. Aneja, A. Awadallah, H. Awadalla, N. Bach, A. Bahree,
A. Bakhtiari, H. Behl, A. Benhaim, M. Bilenko, J. Bjorck, S. Bubeck, M. Cai, C. C. T. Mendes, W. Chen, V. Chaudhary, P. Chopra, A. D. Giorno, G. de Rosa, M. Dixon, R. Eldan, D. Iter, A. Garg, A. Goswami, S. Gunasekar, E. Haider, J. Hao, R. J. Hewett, J. Huynh, M. Javaheripi, X. Jin, P. Kauffmann, N. Karampatziakis, D. Kim, M. Khademi, L. Kurilenko, J. R. Lee, Y. T. Lee, Y. Li, C. Liang, W. Liu, E. Lin, Lin, Madan, A. Mitra, H. Modi, A. Nguyen, B. Norick, B. Patra, D. Perez-Becker, T. Portet, R. Pryzant, H. Qin, M. Radmilac, C. Rosset, S. Roy, O. Ruwase, O. Saarikivi, A. Saied, Salim, M. Santacroce, S. Shah, N. Shang. H. Sharma, X. Song, M. Tanaka, X. Wang, R. Ward, G. Wang, P. Witte, M. Wyatt, C. Xu, J. Xu, S. Yadav, Yang, Z. Yang,
Yu, C. Zhang, Zhang. Zhang, L. L., Zhang, Y. Zhang, Y. Zhang, Y. Zhang, and X. Zhou. Phi-3 technical report: A highly capable language model locally on your phone, 2024.
[3] AI@ Meta. Llama 3 model card. 2024. URL blob/main/HODEL_ CARD.md
http://tttaallaaaaaaaaaaaaaaaaaa 111mma3
[4] S. Boucheron, G. Lugosi, and P. Massart. Concentration Inequalities: A Nonasymptotic Theory of Independence. Oxford University Press, 2013.
[5] CAC. Cyberspace Administration of China: Provisions on the administration of deep synthesis internet information services, 2022. synthesis/
http://wwww..hhaaaaaaaaaaaaaaaaa en/ /neee
[6] A. Chaffin, V. Claveau, and E. Kijak. PPL-MCTS: constrained textual generation through discriminator-guidee MCTS decoding. In M. Carpuat, M. de Marneffe, and I. V. M. Ruíz, editors, Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics; Human Language Technologies, NAACL 2022, Seattle, WA, United States, July 10-15, 2022, pages 2953-2967. Association for Computational Linguisties, 2022.
http///ccaaattoooooooooo org.oooo.oooogggee 2022. wtt../.aacll--m..mmm.... meaacl-main.211
[7] L. Chen, Y. Bian, Y. Deng, D. Cai, S. Li, P. Zhao, and K. fai Wong. Watme: Towards lossless watermarking through lexical redundancy, 2024.
[8] M. Christ, Gunn, and O. Zamir. Undetectable watermarks for language models. Cryptology ePrint Archive, Paper 2023/763, 2023.
[9]
EUParliament, EU AI Act: first regulation on artificial intelliieec,, 2023. URL https eu-
/ www.
ai act ae
[10] J. Fairoze, S. Garg, S. Jha, S. Mahloujifar, M. Mahmoody, and M. Wang. Publicly detectable watermarking for language models, 2023.
[11] P. Fernandez, A. Chaffin, K. Tit, V. Chappelier, and T. Furon. Three bricks to consolidate watermarks for Large Language Models. 2023 IEEE International Workshop on Information Forensics and Security (WIFS), 2023.
[12) A. Fog. Calculation methods for wallenius' noncentral hypergeometric distribution. Com- munications in Stutixtics Simulation and Computation, 37(2):25-225) 273, 2008. doi: 1080/ 03610910001190269 URL.
[13] C. Gu, L. Li, P. Liang, and T. Hashimoto. On the learnability of watermarks for language models, arXiv preprint arXiv:2312.044400 2023.
[14] A. Hans, A. Schwarzschild, V. Cherepanova, H. Kazemi, A. Saha, M. Goldblum, J. Geiping, and T. Goldstein. Spotting LLMS with binoculars: Zero-shot detection of generated text, 2024.
11

---

[15] Z. He, B. Zhou, H. Hao. A. Liu, X. Wang, Z. Tu, Z. Zhang, and R. Wang. Can watermarks survive translation? on the cross-lingual consistency of text watermark for large language models, 2024.
[16] Z. Hu, L. Chen, X. Wu, Y. Wu, H. Zhang, and H. Huang. Unbiased watermark for large language models, 2023.
[17] B. Huang, Zhu, H. Zhu, J. D. Lee, J. Jiao, and M. I. Jordan. Towards optimal statistical watermarking, 2023.
[18] M. Huo, S. A. Somayajula, Y. Liang, R. Zhang, F. Koushanfar, and P. Xie. Token-specific watermarking with enhanced detectability and semantic coherence for large language models, 2024.
[19] B. Y. Idrissi, M. Millunzi, A. Sorrenti, L. Baraldi, and D. Dementieva. Temperature matters: Enhancing watermark robustness against paraphrasing attacks. 2023.
[20] S. Kim, Suk, S. Longpre, Y. Lin, J. Shin, S. Welleck, G. Neubig, M. Lee, K. Lee, and M. Seo. Prometheus 2: An open source language model specialized in evaluating other language models, 2024.
[21] Kirchenbauer, J. Geiping. Y. Wen, J. Katz, Miers, and T. Goldstein. watermark for Large Language Models. arXiv preprint arXiv:2301. 10226, 2023.
[22] J. Kirchenbauer, J. Geiping, Y. Wen, M. Shu, K. Saifullah, K. Kong, K. Fernando, A. Saha, M. Goldblum, and T. Goldstein. On the reliability of watermarks for Large Language Models, 2023.
[23] R. Kuditipudi, J. Thickstun, T. Hashimoto, and P. Liang. Robust distortion-fre free watermarks for language models. arXiv preprint urXiv:2307. 15593, 2023.
[24] X. Li, F. Ruan, H. Wang, Q. Long, and W. Su. A statistical framework of watermarks for large language models: Pivot, detection efficiency and optimal rules, 2024.
[25] C.-Y.Lin.. ROUGE: A package for automatic evaluation of summaries. In Text Summarization Branches Out, pages 74-81, Barcelona, Spain, July 2004. Association for Computational Linguistics. U https: www.:w.wwww.rrgg///oommm www..orr///noooog/////000400
[26] Y. Liu and Y. Bu. Adaptive text watermark for large language models, 2024.
[27] E. Mitchell, Y. Lee, A. Khazatsky, C. D. Manning, and C. Finn. DetectGPT: zero-shot machine- generated text detection using probability curvature, 2023.
[28] NIST. National Institute of Standards and Technology: Calls for information to support safe, secure and trustworthy development and use of artificial intelli- gence, 2023. /tt.a//t./////aaaaaaeee//////sss
informaiion www.aaiioossuppprtaaaaaa-e-aaaae org.::/eeeeuu..ee..tttttttttrara
[29] J. Piet, C. Sitawarin, V. Fang, N. Mu, and D. Wagner. Mark My Words: analyzing and evaluating language model watermarks. arXiv preprint 1rX0v:23/2.00273, 2023.
[30] K. Pillutla, S. Swayamdipta, R. Zellers, J. Thickstun, S. Welleck, Y. Choi, and Z. Harchaoui. Mauve: Measuring the gap between neural text and human text using divergence frontiers. Advances in Neurul Information Processing Systems, 34:4816-4828, 2021.
[31] W. Qu, D. Yin, He, W. Zou, T. Tao, J. Jia, and J. Zhang. Provably robust multi-bit water- marking for ai-generated text via error correction code, 2024.
[32] H. Touvron, I.. Martin, K. Stone, P. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, S. Batra, Bhargava, S. Bhosale, al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09228, 2023.
[33] A. Viterbi. Error bounds for convolutional codes and an asymptotically optimum decoding algorithm. IEEE Transactions on Information Theory, 13(2):260-26) 1967. doi: 10.1 109/
TIT.
12

---

[34] K. Wu, L. Pang. H. Shen, X. Cheng, and T.-S. Chua. LLMdet: a third party Large Lan- guage Models generated text detection tool. In Findings of the Association for Computational Linguisties: EMNLP 2023, pages 21 2113-2133, 2023.
[35] X. Zhao, P. Ananth, L. Li, and Y.-X. Wang. Provable robust watermarking for ai-generated text. arXiv preprint 2rXiv:2306.17453 2023.
[36] C. Zhu, J. Galjaard, P.-Y. Chen, and Y. Chen. Duwak: Dual watermarks in large language models, 2024.
13

---

A Possible detection schemes
A.1 Baseline schemes
This section describes the detection of the three main LLM watermarking schemes. They share the same process:
The received text is decomposed into sequence of, say L, tokens
A sliding window of size h forwards the selected tokens to a cryptographic function which computes hash that xored with the secret key compose the seed of a Pseudo Random Number Generator
The variable иN is computed for the i-th token, > h based on the output of the PRNG seeded by the h previous tokens
The score is the sum of the variable: EL 2i=
The score is converted into p-value: p 1 Es(8; L).
The watermark embedding methods are not detailed because our scheme does not use them. This summary is inspired by the work of Fernandez et al. [[]].
For the detection of [22], the output the PRNG used to create a 'green' list which is a subset of of size >/V). Variable U, is set to 1 if the i-th token belongs to this list, otherwise U; = 0. Therefore, üid under Ho. Ug ~ B(7) and S follows a binomial distribution B(L - r). This makes
p = (s, L s 1);
where / the regularized incomplete Beta function.
For the detection of [I] the output of the PRNG is used to draw U, E(1) that S is Gamma distributed under Ho. This makes:
[[L 118)
(10)
T(L
where I' is the upper incomplete gamma function. This formulation also holds for S with the reduction binary alphabet [ =
For the detection of [23], the output of the PRNG is used to draw U, whose distribution matches the distribution of the product of two independent nvv (11-1/2, 1/2]), i.e. (u) 2n(1 log(4/u()) 1/2. There is no closed form to turn the global score into a p-value. The authors use either a bound (see their Lemma 2.4) random seeds. This is the reason why this studies 23 fixes the probability of false alarm to a relatively large value, Lee. 10-2.
empirical p-value computed by costly Monte Carlo simulation with
Since Sect. 4.4 shows that the distribution of U, has no impact, we opt for the simple choice iid
U, (0; 1) and the p-value reads as:
p ②
(11)
VL
A.2 Variants
Numerous works have proposed improvements of the KGW and Aaronson's 's scheme. We herein describe some relevant works and their applicability the WaterMax framework.
KGW Variants Improvements to KGW can be broadly categorized into two classes: modification the sampling mechanism and improvements the bias assignment. Some recent works modifying the sampling mechanism are: 36 which propose to complement baseline KGW with contrastive search to improve text quality as well as inserting a second watermark, [18 uses a multi-objective optimization procedure to conserve the semantic coherence of the watermarked text Works on better bias assignments include: [15] which propose cluster tokens which are semantically related and
assign similar biases to them in order to resist re-translation attacks, [ builds the green and red
14

---

list using a similar clustering method, [26] adapt the bias depending on the entropy of the current completions in order to improve detectability and text quality. Note that any watermarking methods relying on modifying the biases could directly be used by WaterMax as a score function as long as p-value can computed from them. Similarly any modified sampling method could also be applied as long as they can output different texts from the same prompt.
Aaronson's 's scheme variants Most work dealing with improving on the Gumbel-trick of Aaronson's scheme are not explicitly variants but other algorithms with the distortion-five property, or methods to improve on the ad-hoc detector of the original work. Noteworthy distortion-free algorithms include the "binary' 8 'inverse transform' (23] methods, the latter which actually includes a variant of Aaronson. The work in [10] is notable for being an asymmetric (somewhat fragile) watermark. Though technically presented
variant of KGW, one of the proposed method in [16] can be interpreted as variant Aaronson working on group of tokens. Finally, (24) proposes an improved score function for Aaronson through the design of general statistical framework.
Extensions multi-bit watermarking Even though this work is solely concerned with zero-bit watermarks, we note that some works have proposed mechanisms to extend current text watermark methods to multi-bit versions, allowing for example the identification of specific users. Of note, [ have proposed general mechanism applicable every current zero-bit method by associating key to every possible message and designing an efficient detector through a circular shift of the keys, [3] extends KGW to multi-bit using BCH and error-correcting codes.
Watermark distillation To this we add an important work from Gu et al. 13 especially relevant for WaterMax, showing the possibility to directly train LLM to generate watermarked text using either watermarked samples or directly the token distribution. Since the only real cost of WaterMax is the computational complexity of sampling chunk of texts, distilling WaterMax would allow to bypass the sampling cost entirely.
B Proof of proposition 3.1
The main ingredient of scheme is watermark detection that outputs p-value for any text input, whatever its length. This is the case for the main works in the literature, like 1 21 g and to some
extent 23 (see App. AQ. Of note,
In theory, for a continuous score S. the p-value P computed from a random non-watermarked text is uniformly distributed over [0, 1] with p.d.f. ((/))) 1 (p).
In practice, the computation of the p-value can be hazardous on texts with repetitions of token sub-sequences and Fernandez et al. [I]] indicate how to fix this issue.
For given prompt, the generator creates independent texts, each with possibly different number lid of tokens, computes their p-values P3 ~ Mj..1]. and outputs the text with the minimum p-value. Note that in order for the p-value to follow a uniform distribution under Ho, we assume the c.d.f of the scores to be continuous. A well-known results in statistics states that the minimum of n independent p-values follow a beta distribution (11, n) whose p.d.f. is f( Hi) n(1 p)"-!
The detector receives an unknown text and decides between two hypotheses:
Ho: The text is not watermarked. The p-value has not been 'minimized' and follows the uniform distribution.
Hi: The text is watermarked. Assuming no attack was performed, the p-value is distributed as a minimum of n independent uniform variables. We assume the detector knows the value n.
Since the distributions under both hypotheses are known, the detector performs simple test, and the Deyman--Parsson lemma states that the most powerful test under given probability of false-alarm PFA is the (log) likelihood-ratio test:
(p1711)
A (p) A log
(p)HHo
Ho S91
T,
(12)
15

---

under Ho. under H1. where 7 is a threshold which depends on PFA. In our setting, A (p) = (n 1) log pp) + log(n).
which is monotonic function of In other words, comparing SHo PF is equivalent to the Neyman-Peane Pearson test. The power of the test defined as the probability of detecting a watermarked text and turns out to be an increasing function w.r.t. nt
=:
S, Pra d(ppHt)dp==1 = (1- PFA)".
PD a P(P PrAlH)i
(13)
C Proof of proposition 4.1
The optimal detector
aggregates a vector p of N observed local p-values:
N
Appt (p)
Σ
Ho log(1 pc) Smi
T.
(14)
The received text is composed of chunks whose local p-values distributed beta distributions B(1, 1) (i.e. 1)) under Ho or B(1, under H4 when there is no attack (see Sect. B. Knowing that if X B11 3) then log(1 X)= {B),, A(P) is the sum of independent exponential r.v.
and thus follows a Gamma distribution under both hypothesis but with different parameters:
{
Aopt (P) ~ P (N, 1) Aopt (P) D (NN
(15)
This leads to the characterization of the test's performance:
PFA 7N,1 (T), PD 7 (7w) (PFa)).
(16)
(17)
where Yayy is the lower incomplete gamma function with shape parameter x and scale parameter
D Proof of proposition 5.1
Assume the received text is composed of N chunks of & tokens each so that its total number of tokens L = NC. Under Ho, the token variables are independent and normal distributed so that Arob Arob(U) NO0 L). is thus easy find the threshold ensuring probability of false alarm PFA:
=VVL (PPA).
Under H1, A (U) can be written as the sum of N independent chunk scores: Arob (U) ΣNn M These chunk scores are distributed as the maximum of Gaussian variables.N00 E), cor- responding the score of the drafts. Those maxima have the c.d.f. (x) + (z/Vi) and one can compute numerically the expectation EE ((M())) = Vle(n) and the variance ((M Lv(n). Tab. [ As far know, there no closed-form for these quantities, but classical results in con- centration inequalities for the maximum show that e(n) scales as vlog(n) and v(n) as 1/ log(n) 4
An approximation for N large enough Arob ~ NN with
#1 NVle(n)) VNLe(n),
(18)
of = Nlv(n) = Lv(n).
(19)
This gives the following power of the test:
④ (PPA)P + VNe(n)
Pp = Φ
(20)
V /u(n)
16

---

Table Expectation and variance of the maximum of independent normal random variables.
n
2
3
5
6
7
8
9
10
e(n) v(n)
0
0.56
0.84
1.03
1.16
1.26
1.35
1.42
1.48
1.54
0.68
0.56
0.49
0.45
0.42
0.40
0.37
0.36
0.34
E Proof of proposition 5.2
This section derives the distribution of variables of individual tokens under H1.
We first express the distribution of vector of i.idd normal variables, given that their sum equals given value S:
( (u. ~
(21)
1=0
with 1r the vector of all ones in R& and I the identity matrix of dimension L.
The attacks leaves aL variables untouched (assuming 0 S a S 1 and aL N). This is encoded in matrix A E {0, JJaLx which selects these variables. This means that A has exactly one single entry equal to in each row, AAT = LaL, and A1, lal.
The sum of these aL variables can be written as 1 La AU. This makes:
L AU
~N (aas-
(22)
(=0
This distribution is independent of A: does not matter which tokens are left unchanged. For a 1, there is no attack and the variance is null because AU = 17 = For a = 0, the attack has modified all the token variables and the variance is null because 1 AU = 0.
According App. D approximation for N large enough is S Muu;oft. The law of total variance gives
1 AU ~ N (ap1 La(1 - a) + a²
(23)
On top this, the attack adds (1 - L tokens distributed under Ho, which amounts to add a noise distributed A/ (1 L) the above score. In the end, the global score is distributed
Arob (U) ~ (avNLe(n); L(1 a² (v((n)) - 1)))
(24)
We thus obtain an approximate expression of the power of the robust test:
PD = + ① 1p-1 ( + tavNe(n)
(25)
a(+))(u(n) -
Observe that, once again, the power of the test does not depend on the size of the text. More precisely, it does depend indirectly on it given that a can only take finite number of values, the number of which decreases with the size of the text. For example, if the text is composed of L tokens, 1/L,1}.
(0, 1/L,,..,.,
Note that this analysis is general in the sense that it does not depend on the existence of an attack at a given resulting in acceptable quality. We believe the role of the watermark designer is to ensure the highest possible detectability whatever the strength of the attack; the design of attacks preserving text quality is the burden of the attacker. An analysis of the robustness of watermark should thus be comprehensive, providing the performance of the watermark under any possible type of attacks, existing not, and independent of text quality.
17

---

Pseudo-code of the watermark embedding
Algorithm 1 Iterative watermarking of generated texts
Input: prompt pr. parameters (N, m, f), p-value computation Detect, LLM Generate Initialize: x, [, V1 J S m
for i 1 to NV do
for j = to m do
context [pr]|x;] for l: = to n do
njj 1) + k yv = Generate(context, E)
Pv (x)lx)(())lly.))
end for end for
(v1 ... vm) = arg min
for -11 to m do
end for end for
arg arg mignnisssmm Det)ct(x,) Output: X
G Experimental running time
3.5
No Watermaris
Generation time between chanks (6)
No Waternouk
3.0
Generation time(s)
2.5
2.0
1.5
1.0
6-
0.5
0.0
2
16
N Number chunks
Number chunks
Figure 8: (left) Total generation time in seconds of WaterMax function of the number of chunks N and number of drafts/chunk n for texts of 256 tokens using sampling on a Nvidia A100. (right) Generation latency defined the average generation time between two chunks compared to the generation time the same number of tokens with a bascline LLM. Note that the baseline time between two tokens is 0.021s.
We report the running time averaged on 5 texts of 256 tokens generated using Llama- 2-cmaa--chha-hjj at temperature 1.0 and nucleus sampling (lopp 0.95) for different parameters in Figure 8
Overall, generating the 296 texts the 'Mark My Words' benchmark on a single A100, with maximum batch-size, takes approximately 6min for Aaronson and KGW. For WaterMax at (n, N, b) = (10, 16, 1),6). takes approximately 30min. The resource usage report of the cluster used run the experiments, taking into account both CPU and GPU cores, indicates total use of 5024 core hours.
18

---

H MaterMax is almost distortion-free
This appendix elaborates a theoretical model justify why WaterMax is close Eetortion-ffrenesss.
Consider given iteration of WaterMax where one particular draft among n is selected as the output chunk. Denote the set of possible chunks by C. If the chunks are all composed of & tokens, then = 1V'. Each chunk C; E C has a probability p; to be sampled by the LLM. We denote by Pr the probability that WaterMax selects this chunk. This probability is computed on expectation over the set of secret keys.
A watermarking scheme is distortion-free if 1t Pt, Vp: E [0, 1]. This appendix shows this is not the case for WaterMax. Yet, since we operate on chunks, iee, sequences of tokens, and not individual tokens, their probabilities are small in practice. In this regime, we show that p. R ps which theoretically justifies the high text quality.
H.1 draws with replacement
This version of WaterMax samples n drafts in C. This corresponds to draws with replacement because a draft can be sampled several times.
Denote by X; the number of times the th chunk is drawn over n samples. It follows the binomial distribution X; ~ Pt), Vi (1...., [C])
Denote by Y, the binary random variable s.t. Y, = if X, > follows the Bernoulli distribution Y; B(1 - (1 p,) vi E (I,...,,CI] [C]].
Denote by S the subset of chunks which have been sampled, i.e. - {c: Y; = 13 C. The size
of this set is a random variable ranging from to n and whose expectation is E((S) = > Y
|C| Σ. cl pp)"".
For given watermark secret key, i.e. a given instance of the token variables [ WaterMax computes the score of each draft in S, and it chooses the one with the maximum score. Over the ensemble of secret keys, there is reason why given draft is more likely to be chosen due the symmetry of the random token variables. Therefore, a draft given subset S has a probability 1/|8| be chosen expectation the secret keys. This yields the following global probability:
D = Σ P(S).
(26)
S
S:C.ES
Upper bound The above summation includes the subset {ci} which happens with probability p.. For all the other subsets, which include |S] 2 2. This gives an upper bound:
p. < UB(p) = pp (1 (1 (1) p.¹) (1 (1 (1)) +
(27)
Lower bound The above summation can be written as Σn x= Es _ 3 (SS). When
X, k, there are at most n &o other unique sampled chunks: |8| S n 1: 1. This makes the following lower bound:
(1) 16 Pf (1)pt(
12)
1- (1 pt) n+ Ps R+1
De 2 LB(p:) n 1: +
Σ
p.) pi)m-
(28)
(n + 1)(1 Pt)
Remarks Note that p. Pt, Vp, E 1] when E {1,2} because the lower and upper bounds correspond the identity. The choice n 1 is not an option since it corresponds to the regular use of the original LLM without watermarking. The choice n = 2 allows watermarking with the distortion- property. The price pay is low robustness.
For n > 2, WaterMax is not distortion-fres Indeed the upper bound (27) ( is lower than p; for p: > 1/2 showing that D. does not equal pt on the interval (1/2, 1). However, note that
LB(p))
lim
1.
(29)
Pi
19

---

This property explains why WaterMax reaches text quality as good as other distortion-fiee watermark- ing schemes. WaterMax works with chunks of text whose probabilities are all very small, contrary to other schemes working tokens which sometimes have picky distribution (one token gets almost all the probability mass). Therefore, missing the distortion-free property for large p; is irrelevant because this case never happens in practice when dealing with chunks. On the contrary, having Pi R p; locally for p. - is key,
H.2 draws without replacement
This version of WaterMax samples n drafts in C making sure that they are all different thanks to the beam-search suggested in Sec. 6.2] This corresponds to draws without replacement because a draft cannot be sampled twice. In other words, |S| n. Equation (26) simplifies to:
1 P(c E).. n
(30)
However, the probability P(c: E S) is cumbersome to calculate as it relates to the multinomial Wallenius noncentral hypergeometric distribution. When all the chunk probabilities are very small, one can show that [1]]
n-1 P
1- 1- PP)" -0 Ps-
P:
Σ (1 p.)
(31)
72
k=0
The same rationale as above applies: WaterMax is not distortion-fre but tends to this property when all the chunks have small probabilities. This is what happens in practice when working with long chunks.
I Impact of hashing window size and beam-search tokens
Section 6 discusses how the window hashing size h well the number of tokens generated by beam-search 6 can help to increase detectability. Both parameters, however, lead to a tradc-off. First, higher h provides better detectability when no attack is performed on the text but makes the watermark less robust since modifying one token leads to at most h scores, which become unusable. leads to better detectability by enforcing diversity between chunk drafts,
Secondly, a lower at no cost to robustness, but at the cost of text quality since the beam-search has more chance of selecting tokens in the tail of the distribution. Note that & 0 corresponds to the baseline WaterMax, which is empirically lossless.
To select the best trade-off, we generate 296 texts of 256 tokens following the same protocol described in Sect. (6) we use Llama-3-8b- 3-8t--nntrrtett with temperature 0 = 1.0, nucleus sampling (top, = 0.95), and WaterMax Nn) (8, 16). We report the results in Fig. II
From Figure I0 we see that the most significant improvement in the trade-off detectability vs. quality is by going from b 0 to b 6. This is done almost cost the text quality. A larger gain in detectability is obtained for 1 < b < but with a significant loss of quality.
Regarding the window size, h = 2 leads to weak scheme. An acceptable performance, close to PD = 1.0 at PFΛ = 10-6 without attack, requires h 2 However, Figure 11 reveals that a close match to the theoretical score distribution under H, is only reached for h
20

---

0.8
0.7
0.8
10-9
0.5
Pa
0.4
PpAPra
0.4
6
1.0
1.1
1.2
1.3
1.4
1.5
1.6
Beam- mumber
Relactio perplesity
better)
Figure 9: Detectability funetion of the
Figure 10: Detectability
function of the text quality. The points correspond to the dif- ferent used in Fig. 9
number tokens generated by beam-search b
10
10
Empircedl ell
10-2
10-2
le2 bet
1-0
h 6.6
10-1
brg bod
10
10-2
10-1
10-2 Theoretied edl
Theoresical
(a) h
2
(b) =
10P
-0
Empirical c...
10
10-1
b-6 h-d
b-6, h-d
p-d) b-2
1-66,
10
10-3
10-3
10-11
10a
(c) 6
Figure 11: Score independence as function of the window hashing size h and number of tokens generated by beam-search b.
21

---

5000
Phi---mini--kiinstrree Average 0.60
Meta- Berto-lamm---SO-hnuttee Average 0.45
Llama-2 (amna-2-7b-chan 2-7b-hhat-hf Average= 0.25
4000
3000
2000
1000
0
Entropy of the completion distribution
Figure 12: Entropy of the distribution of 64 x 100 completions for different LLM at temperature
0 = 1.0 using nucleus sampling (topp 0.95).
Impact of the LLM and its entropy
This appendix studies the impact of the LLM on the watermark performance. As we alluded to numerous times, the performance of the watermark of KGW and Aaronson is highly dependent on the entropy of the completion of individual tokens. This dependence is well-illustrated by the impact of temperature on their performance. However, this also means that we can expect vastly different behaviors of these schemes depending on the LLM used since, depending on how the LLM was trained and fine-tuned, the average entropy of the completions varies wildly.
To demonstrate this point, repeated the experiments in Sect. for other models: the older Llama-2- 2-7b-hh-- (32) and the smaller Phi-3-mini-44k-nstfee (2 (3.8 billion parameters). We report
the results, along with those of Llama-3-8b- ----tuuuuutctt in Figures 13
The performances both KGW and Aaronson are abysmal on Llama-2-7b-chat, with extremely low detectabilityy, even for high 8 for KGW. At the opposite end, every algorithm performs well on 1-133-mmii-4--nnstreee
However, once again, KGW still incurs a high cost in terms of text quality, whereas WaterMax b 6 and Aaronson both virtually lossless at this regime. -lamm---Sb--nstrucee sits in between these two extremes.
To understand these results and verify our claim with regard to entropy, generated 64 100 completions using each model. Fig. [12 reports the distribution of their entropy. Very clearly, the entropy follows observation, with Phi-3-minis 4I-Instruct having the highest average entropy whereas Llama-2-7b-dae 2-7b-chat has the lowest with a lot more tokens which are close to being deterministic.
This is an essential observation for watermark evaluation since different schemes are better suited to different LLMs. However, WaterMax currently the only scheme that consistently attains almost perfect detectability at PPA = 10-6 irrespective of the LLM, of the temperature, and at almost no cost text quality.
22

---

1.0
Annasa BGW, 22
NEWW,
0.8
0..
Wateebtor (6. V. (6.
0.0
WatcMer (Sscatioa)
0..
R00 20
100 E-
PoMPP4
0.4
WuscMte (4AA (6.6
Watchii (s. M. (6-6-))
Pyolyy
0.2
0.0
0.0
1.0
1.2
1.5
1.5
2.0
Temperoture
Perplesity bettor)
(a) Detectability as function of the temperature of the LLM.
(b) Detectability as function of relative perplexity. Each point corresponds to one temperature in the left figure.
Figure 13: Detectability against quality with Llamm-2-7b-chat-hh nucleus sampling (top, = 0.95). and hashing window h = 6.
0.9
00.8
0.7
Mare
Annavon
NGW, 201
0.6
NEW
ROW 3.0
WateeMMor, 9. 210
2.30 (2..0.))
0.5
(N.N (6,)
0.4
0.4
0.5
1.0
Trmpesiure
Relative Porplesity (- better)
(a) Detectability as function of temperature of the LLM.
(b) Detectability as function relative perplexity.
Each point corresponds to one temperature in the left figure.
Figure 14: Detectability against quality with and hashing window h = 6.
nucleus sampling (lopp = 0.95),
1.0
0..
0.8
0.7
0.6
(laerotion))
0.6
0.5
KCR 2.0
Wasteraaa, In. N. (10 20.4
Wattehdaa, K..
0.8
1.0
1.3
1.2
Trapenotuee
Relative Perplexity (e- better)
(a) Detectability function of the temperature of the LLM.
(b) Detectability function of relative perplexity. Each point corresponds one temperature the left figure.
Figure 15: Detectability against quality with mhi-3-mini-4kiisttuee nucleus sampling (Lopp 0.95), and hashing window h =
23

---

K Further experimental results
This section reports more results of interest the practitioner to tune their watermark choice. In particular, report different quality metrics varying the watermarking parameters. We also study the impact of text size on the detectability watermarks.
In this appendix, the experiments are based on three MMW tasks defined in 29 namely:
generating 100 fictional news articles,
generating 100 reports on well well-known books,
generating 96 stories given a synopsis.
All texts are generated using Llama-2-chat-le with nucleus sampling (top, = 0.95). The hashing window fixed to h = for all algorithms. WaterMax is used with b b= (no beam-search), which entails virtually lossless scheme. Every watermarking scheme, except for Aaronson's is, is applied on a LLM working at temperature # 1.0.
K.1 Quality
Figures 16a 17c report the relative perplexity using opt-2.7b as an oracle as well as the ROUGE-L score for Aaronson, KGW, and WaterMax function of their respective parameter.
5.0
Llama 2.7b 7b-tthat-h hf
Llaana 2-Tb-that-ln
4.5
Relative Papkecty (OPT-2.76)
Relaive Pecylodo (OPT-2.7)) T0)
3.5
3.3
3.0
3.0
2.0
1.5
1.5
2
0.8
1.0
1.2
1.3
Temperature
(a) KGW
(b) Aaronson
5.0
Llama 7-
[telatre Peplosit (PT)-276)
1.175
Relative Perslesiyy (OPT-2 Tb)
8.0
1.150
3.5
1.125
1.100
2.5
1,075
2.0
1.050
1.5
1.0
40
60
100
120
20
80
60
30
100
120
Number of chumii N
Number clunaks
(c) Watermax n 14,
(d) Focus on Figure 16c Note that relative
perplexity of WaterMax does not exceed 1.2.
Figure 16: Relative perplexity of watermarked text over non-watermarked text measured using opt-2.7b an oracle.
24

---

2 chat bf
0.25
Llana 2 chab- H
0.25
ROUGE-L (4 bester)
0.26
0.25
ROUGEL (+
0.24
0.22
0.23
0.22
0.8
0.9
1.0
1.1
1.3
Temperature R
(a) KGW
(b) Aaronson
1amm---7--ehht-iii
0.26
ROUCE-L bettes)
0.25
0.23
0.22
20
100
Number of chrnkes NV
(c) Watermax n 14, b
Figure 17: ROUGE-L
K.2
LLM judges
Recent works have proposed using LLM judges to evaluate the quality watermarked texts. Some examples include the Mark My Words benchmark (29) which directly uses Ilama2 as judge for evaluating watermark quality. Several open-source proxies fine-tuned for this task have been recently proposed in the literature such Prometheus [20].
Yet, our use of these models for evaluating the quality of watermark texts has not proven fruitful. We provide the results of using 1lama-2-7b-chall
iiistral7b-iinsruut--d0 and Prometheus-7b-- -bb-22.. as LLM judges of the text quality in Fig. of the global response. We asked each of these LLM to grade out of 5 the texts of the "Invented Stories" task of the Mark My Words benchmark following methodology 20 using the code provided in the official Github's implementation.
The grading inconsistent between LLMs, with Prometheus-75 biased towards higher grades and 1lama-2-7b-chal towards lower. Note that the ranking of each watermark is different for each LLM judge. Furthermore, grading can be inconsistent even for non- watermarked texts, with Mistral-7b-instrruct-0.22 highly biased in favor of non-watermarked texts generated with temperature 1.0.
The average grade does not fluctuate significantly for different watermark strengths, whatever the choice of LLM judge. Interestingly, Fig. [18 shows that increasing ó can slightly increase the LLM grading, which should not be the case.
This prompted us to study the grading of barely legible texts, by randomly replacing percentage of the characters within texts: LLM judges still provide similar average grades despite this attack. More precisely, the grade starts to degrade when the texts starts to look like random strings (around 15% of modified letters). However, there is no impact to the grading for, i.e percentage 10%. Here an example of text with a maximum grade of 5/5; "sir edward, chiv Wlrous knight, had always been driGen by sense of duty and
25

---

st FoD SdventuFe. as a yLung man, hw had heard tales of the legendary holy graif, said to grant the deepest desIreD of FhoWe who posseZsed convinced tUat thi grail helX the KeT to bringing pFace and prosperity iK hil) kingdl.K, sir Wdward set out perill us quesY to find it. he bSgal his jouTnFy y the miDty mountaiMs of wales, where he souFhi [...]"
Our conclusion is that, as of writing, these LLM judges don't tt seem suited to the evaluation of watermarked texts quality. As explained in the paper, we prefer the relative perplexity and ROUGE which fluctuate as expected with watermark strength.
45-
MIN 60
12-
30
11
10
23
35
3,0 Thegeesdere
Tespescent
(a) Llahh-h-7b
(b) -iistal-7B-Instruutt-00
(c) Promeehhess-7-v22.0
Figure 18: Average grade out of for texts generated by Meta-Llama-3-88 ---amm----B-Insruuee for the task "Invented story" of the Mark My Words benchmark. Texts are watermarked with KGW with different values of and y = 0.5. The grade computed using the Prometheus-ere framework for different LLM models as judges and for different temperatures. The corresponding non-watene oo-waatrmarred text is provided to the judge as the reference text.
K.3 Impact of the text size
We generate texts of maximum size of L 1024 tokens. For such long texts, the detectability easily reaches PD 1.0 if fixing PFA = 10-6, Instead, we a detectability of PD 0.5 and compute the corresponding p valuuuss. This metric is close to the definition of 'watermark size' defined by Piet et al. [29]. The advantage of this metric is that we can report an increase watermark performance for long texts p-svalues tend to decrease substantially with text size.
26

---

1077
10-
1071
107
12-10
12-1
11175
1177
10.94
15075
10
272
300
400
304
1.20
3/22
196
123
154
Too
(okmm))
Viod moe (1dkeo))
(a) KGW
(b) Aaronson
13
037*
16
122 100 200 250 211 300
102
Teat ubc (10066
(c) Watermax (6 0) with chunk size fixed to 16 tokens. Due text size not always reaching 1024 tokens, the effective N closer 41.
27

---

NeurIPS Paper Checklist
The checklist is designed encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No], or [NA]-
[NA] means either that the question Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1 (1-2 sentence) justificatin right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include it (after eventual revisions) with the final version of your paper, and its final version will be published with the paper.
The reviewers of your paper will be asked While "[Yes] " is generally preferable to "[No]" ", it is perfectly acceptable to answer "[No] providded a proper justification is given (e.g., "error bars expensive" or "we were unable to find the license for the dataset we used"). In general, answering binary way, we
the checklist one of the factors in their evaluation.
reported because it would be too computationally
"[No] " or "[NA] is not grounds for rejection. While the questions are phrased acknowledge that the true answer often more nuanced, so please just use your best, judgment and write justification elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS paper checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract and main claims accurately reflect that our watermark reaches SOTA performance on the detectability, robustness and quality metric, which is amply demonstrated through many experiments both in the body of the paper and in the appendices. All theoretical claims, notably regarding the power of the detectors, are dully proved.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
28

---

Answer: [Yes]
Justification: The paper emphasizes the main limitations of the method namely; its com- putational cost compared to standard method as well the difficulty reaching fully independent draft scores in order to reach theoretical performances in terms of detector power. Finally, the cases where another algorithm might have an edge specific setting -i.e the robustness of Aaronson can be higher for high enough LLM temperatures are pointed out.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: All theoretical results in the body of the paper have corresponding proof in the appendices. The assumptions about the continuity of the c.d.f and the independence of the scores are also stated.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
29

---

Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: The settings of the LLM and watermark parameters provided in full in Section as well as in appendices.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is a dataset and/or model, the authors should describe the steps taken make their results reproducible verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often good way to accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g.. with an open-source source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open tions to faithfully reproduce the main experimental results, as described in supplemental material?
the data and code, with sufficient instruc-
Answer: [Yes]
Justification: A full repository of the code used for the experiments provided as well as the exact commands to replicate them.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.cc
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
30

---

reproducible, they The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
htips.cc/public/guu..ee Subee ssi wswsssssoslliio onpolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: The settings of the LLM and watermark parameters provided in full in Section as well as in appendices.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: The standard error is systematically reported as error bars in the main figures of the paper, though it is extremely small for most results. As reported, they were calculated in the standard way for text quality and using bootstrap for detectability.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report 1-sigma error bars, but should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
31

---

8. Experiments Compute Resourees
Question: For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Answer: [Yes]
Justification: see Section G for breakdown of the cost of running our methods as well as the experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code Of Ethies
Question:
Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer: [Yes]
Justification: the research conducted the paper conform, in every respect, with the NeurIPS Code of Ethics
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The potential positive impact of watermarking methods touched upon in the introdutcion of the paper. No negative impact is apparent us.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (c.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
32

---

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks. mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (c.g., pretrained language models, image generators, scraped datasets)?
Answer: [NA]
Justification:
Our research do not pose such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: The authors of the benchmark clearly credited, as well as the authors watermarking algorithms and metric packages.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website). the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, sasperswithcod. come..co/aaaaeeeeeee/ datassee has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: Not Applicable
Guidelines:
The answer NA means that the paper does not release new assets.
33

---

Researchers should communicate the details of the dataset/codeemmodll as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: Not applicable
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
Justification: Not applicable
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
34


Reviews:
[{"review_id": "AI0fe2i79p", "reviewer": "Reviewer_VU2G", "summary": "The work proposes a new LLM watermarking scheme called WaterMax, that does not modify the distribution or the sampling procedure but uses rejection sampling on multiple generated segments of tokens to cause a high watermark score. A theorem is given to characterize the detector power under attack, given certain independence assumptions. The experiments attempt to demonstrate superior detectability under the constraint of high quality, independent of the temperature/entropy, as well as superior robustness.", "questions": "- Is GPT4 unreliable for the task of judging text quality? Can you provide empirical evidence?\n- Can you repeat the main experiment with any model larger than 8B? \n- Can you repeat the main experiment with a more standard variant of KGW?", "limitations": "The only comment I have is regarding quantification of the efficiency degradation which I believe should be explicit in the main paper.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "- **The approach is novel**: the work investigates a fundamentally different approach from prior baselines which is a valuable contribution in itself. \n- **Thorough analysis**: the work analyzes the proposed method from several perspectives, and both theoretically and empirically, making it a well-rounded study. I especially appreciate the care taken to discuss the underlying assumptions and investigate their violations in practice. \n- **Good writing**: the work is generally very well written, discusses the prior work well, and introduces the method in an understandable way, splitting the different components across different parts of the paper.", "weaknesses": "- **Questionable experimental evaluation**: The experimental setup of the main experiments (Figure 5) is mostly reasonable and the observation about the instability of Aaronson holds up. However, the key claim seems to be that \"KGW used with common/realistic settings is both of lower quality and has lower detectability than WaterMax\". I have several observations here. \n1) This claim is made by observing 1.2x relative perplexity measured with a weak 3B model; it is not clear that this is a reliable estimate of text quality in pratical use-cases (see e.g. https://arxiv.org/pdf/2312.02382). The result would be more convincing if a larger model was used, but more importantly, a SOTA LLM (e.g. GPT4) was used as a judge of responses in at least one setting. The author's claim regarding this is ambigious, are they claiming that GPT4 is unreliable for this task? \n2) The watermarked model itself is a single 8B model. I see two more small models in Appendix J (7B and 4B). On Llama2-7B the variants of KGW that were tried actually have /higher/ quality that WaterMax, so it is not clear if increasing delta would significantly ruin quality but it may lead to high TPR. Regardless, at least one larger model (e.g., 13B) should in my opinion be tried to substantiate the claim.\n3) Even in Fig. 5 a non-standard variant of KGW is used with h=6 and gamma=0.5. To make the claim stronger, can the authors repeat the experiment with more standard h=4 and with gamma=0.25 as well? \n\n- **High computational cost**: while the authors acknowledge this explicitly to some extent, no quantifiable measurement of the computational cost is shown in the main paper, and the appendix suggests that the full experiment took 5x more with WaterMax. This clearly makes WaterMax inapplicable in most real deployments where latency is critical. \n\nHowever, despite the 5x slowdown, I still believe the paper would have sufficient merit as an exploration of an interesting idea, if the authors could fill the gaps in the experimental evaluation and make the case regarding quality vs power fully convincing. My current borderline accept score is conditioned on the authors providing these additional results to remove my doubts.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> Q1: \"*Is GPT4 unreliable for the task of judging text quality? Can you provide empirical evidence?*\"\n\n\nFirst of all, using closed-source models available through API is against our ethics because it prevents reproducibility: GPT-4 is not free; we do not fully control the prompts; it will be no longer available when replaced with GPT-5, etc.\n\nWith that said, we acknowledge the trend towards evaluating text quality using LLM judges -- as an example the *Mark My Words* benchmark [1] directly used Llama2 as a judge for evaluating watermark quality. Several open-source proxies fine-tuned for this task have been recently proposed in the literature such as Prometheus [2].\n\nYet, our use of these models for evaluating the quality of watermark texts has not proven fruitful. We provide the results of using Llama-2-7b-chat, Mistral-7b-instruct-v0.2 and Prometheus-7b-v2.0 as LLM judges of the text quality in Fig. 3 of the global response. We asked each of these LLM to grade out of 5 the texts  of the \"Invented Stories\" task of the *Mark My Words* benchmark following the methodology of [2], using the code provided in the official Githubs's implementation.\n1. The grading is inconsistent between LLMs, with Prometheus-7b biased towards higher grades and  Llama-2-7b-chat towards lower. Note that the ranking of each watermark is different for each LLM judge. Furthermore, grading can be inconsistent even for non-watermarked texts, with Mistral-7b-instruct-v0.2 highly biased in favor of non-watermarked texts generated with temperature 1.0.\n2. The average grade does not fluctuate significantly for different watermark strength, whatever the choice of LLM judge. Interestingly, Fig. 3 shows that increasing $\\delta$ can slightly increase the LLM grading, which is a total non-sense.\n3. This prompted us to study the grading of barely legible texts, by randomly replacing a percentage of the characters within texts: LLM judges still provide similar average grades despite this attack. More precisely, the grade starts to degrade when the texts starts to look like random strings (around 15% of modified letters). However, there is no impact to the grading for, i.e a percentage of 10%. Here is an example of text with a maximum grade of 5/5:\n\n``\nsir edward, a chivWlrous knight, had always been driGen by a sense of duty and a thiFst foD SdventuFe. as a yLung man, hW had heard tales of the legendary holy graiP, said to grant the deepest desJreD of FhoWe who posseZsed it. convinced tUat thS grail helX the keT to bringing pFace and prosperity tK hiD kingdLK, sir Wdward set out on a perilLus quesY to find it.\\n\\nhe bSgaJ his jouTnFy in the miDty mountaiMs of wales, where he souFht [...]\n``\n\nOur conclusion is that, for the moment, these LLM judges don't seem suited to the evaluation of watermarked texts quality.  As explained in the paper, we prefer the relative perplexity and ROUGE which fluctuate as expected with watermark strength were.\n\n[1] *Mark My Words: Analyzing and Evaluating Language Model Watermarks*, J. Piet et al.\n\n[2] *Prometheus: Inducing Fine-grained Evaluation Capability in Language Models*, S. Kim et al. \n\n> Q2: \"Can you repeat the main experiment with any model larger than 8B?\"\n\nWe repeated the experiments with Llama-2-13b and Phi-Medium-4k, two models with 13 and 14 billion parameters respectively. We report the results in the global response in Fig. 1-2. The results are mostly identical to the smaller models: Phi-medium has high entropy and thus all watermarking scheme perform well, whereas Llama-2-13b has low entropy leading to low performance except for WaterMax. This points to the fact that the main parameter of importance is the entropy of the completion, not the size of model. (Note that there is no official 13b version of Llama-3-Instruct.)\n\n> Q3: \"Can you repeat the main experiment with a more standard variant of KGW?\"\n\nWe chose to fix $\\gamma = 0.5$ per the recommendations of the *Mark My Words* benchmark [1]. We repeated the experiments following the reviewer's specifications in Fig. 1a and 2a of the pdf. The results are mostly similar and illustrate the trade-off between quality and detectability: smaller $\\gamma$ leads to better detectability but lower quality.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "TSXfwJ7jRm", "reviewer": "Reviewer_F9zP", "summary": "The paper presents a novel watermarking scheme for large language models (LLMs). The proposed WaterMax scheme aims to achieve high detectability while maintaining the quality of the generated text, without modifying the LLM's weights, logits, temperature, or sampling technique. WaterMax balances robustness and complexity, distinguishing itself from existing methods that often trade off quality for robustness. The performance of WaterMax is theoretically proven and experimentally validated.", "questions": "1. How does WaterMax perform with LLMs that exhibit low diversity in generated texts? Are there any measures in place to handle such scenarios effectively?\n2. In Line 290, the authors mentioned that there are no methods that can defend against translation attacks. However, many works have been proposed to defend against paraphrase-based and translation-based attacks [1, 2, 3]. Comparison with these methods is necessary.\n3. Watermark stealing attack has been proposed recently [4,5,6], which can infer the parameters of the watermarking scheme and remove the watermark from the text. Watermark stealing attacks exhibit significant ability in removing watermark. How does the proposed scheme perform against watermark stealing attacks? \n* [1] A. B. Hou et al., “SemStamp: A Semantic Watermark with Paraphrastic Robustness for Text Generation.” http://arxiv.org/abs/2310.03991\n* [2] J. Ren et al., “A Robust Semantics-based Watermark for Large Language Model against Paraphrasing.” http://arxiv.org/abs/2311.08721\n* [3] Z. He et al., “Can Watermarks Survive Translation? On the Cross-lingual Consistency of Text Watermark for Large Language Models.” http://arxiv.org/abs/2402.14007\n* [4] N. Jovanović, R. Staab, and M. Vechev, “Watermark Stealing in Large Language Models.” http://arxiv.org/abs/2402.19361 \n* [5] Q. Wu and V. Chandrasekaran, “Bypassing LLM Watermarks with Color-Aware Substitutions.” http://arxiv.org/abs/2403.14719 \n* [6] Z. Zhang et al., “Large Language Model Watermark Stealing With Mixed Integer Programming.” http://arxiv.org/abs/2405.19677", "limitations": "This method may affect the quality, diversity and latency of the output text.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. WaterMax introduces a new detection mechanisms that improve the detectability of watermark in short text, thus preserving the original LLM's token distribution and sampling method.\n2. The scheme maintains the quality of the generated text, which is a critical factor in practical applications of LLMs.\n3. The paper demonstrates that WaterMax achieves higher robustness and detectability compared to other state-of-the-art watermarking techniques, even under various attack scenarios.\n4. The theoretical and experimental evaluations are thorough, covering multiple LLMs and benchmarks. This provides a solid validation of the scheme's effectiveness.", "weaknesses": "1. The method involves generating multiple texts for a given prompt and selecting the most suitable one, which increases computational cost and latency. Although the paper suggests ways to limit this, it remains a potential drawback.\n2. Based on the randomness in the sampling strategy, LLMs can generate diverse outputs from the same input. This method requires generating multiple outputs and selecting the most suitable one, which may damage the diversity and quality of the generated text.\n3. The method's latency, especially in generating longer texts, could be a limitation in time-sensitive applications.\n4. The scheme requires careful tuning of parameters to balance robustness, detectability, and computational cost. This adds complexity to its implementation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> W4: \"The scheme requires careful tuning of parameters ... This adds complexity to its implementation.\"\n\nThe tuning of our algorithm is **less complex** than the tuning of KGW. The two main parameters of WaterMax are the number of chunk $N$ and the number of drafts per chunk $n$:\n- Detectability/robustness: the performance of Watermax can be computed *a priori* using the theoretical formulas in Eq.(4) or Eq.(6).\n- Quality: $(N,n)$ have basically no impact on text quality.\n- Complexity: Increasing (N,n) increases computational complexity. The cost of $n$ can be reduced through parallelization, wheras the cost of $N$ cannot.\n \nThe size of the h-window mostly set the trade-off between robustness and security (against Watermark stealing attack). This is common to any fixed h-window based scheme like KGW and Aaronson's schemes.\n \nIn contrast, the choice of $(\\gamma,\\delta)$ for KGW is not well documented: their impact on the detectability and quality is not easy to predict.  Their setting must be done empirically.  \n\n\n>Q1: \"How does WaterMax perform with LLMs that exhibit low diversity in generated texts? ... \"\n\nA LLM that exhibits low diversity in generated text is a LLM with low entropy in its completions. We direct the reviewer to Appendix J which is explicitly treating this question. We show that both Aaronson's scheme and KGW are sensitive to the LLM's entropy whereas WaterMax 's performance stays constant whatever the choice of LLM and temperature. The reason for this behavior being that WaterMax works on the level of chunks of token whereas the other two algorithms works token per token. This means that, as long as a LLM provides at least some diversity at the chunk level, WaterMax's performance should not suffer compared to other schemes.\n\n> Q2: \"In Line 290, the authors mentioned that there are no methods that can defend against translation attacks. However, many works ... [1, 2, 3]. Comparison with these methods is necessary.\"\n\nWe agree with the reviewer: this statement was not correct. We thank the reviewer for providing these references, which we will add to the paper.\n\nHowever, we cannot compare to the proposed methods as they don't provide any guarantees in terms of false-alarm contrary to the three algorithms studied in our work. Furthermore, due to the lack of theoretical false-alarm rates, these works only compute empirical FPR, --with the papers providing results for FPR from 1% to 10%. This is to be compared to our work which demands false-alarm rates at $10^{-6}$ or below. On the other hand, WaterMax, KGW and Aaronson easily reach 100% TPR with almost not cost on quality or complexity for FPR from 1% to 10%.\n\n> Q3: \"Watermark stealing attack has been proposed recently [4,5,6] ... How does the proposed scheme perform against watermark stealing attacks?\"\n\nWe again thank the reviewer for these references. The problem of watermark stealing is mainly linked to the choice of 1) hashing function and 2) scoring function.\n1) The attack in [4] only works for the Min-Hash and Sum-Hash functions. We don't use these hashing functions for any watermark scheme as they are intrinsically flawed. The hash is computed recursively on each token in the window, guaranteeing a new hash -- and thus a different key -- for each token. Moreover, we use much longer hash windows: $h=6$.\n2) The references in [4,5] only work for UNIGRAM and KGW as they are based on the existence of a green-list of tokens. Like Aaronson, WaterMax is not based on a binary partition of the tokens: it associates a *real soft* value to each token. Stealing the secret of this kind of schemes has not been demonstrated.\n3) References [4,5,6] work token-wise, whereas WaterMax works over chunks, not token. This means that it may select a chunk containing a low valued token because globally that chunk  maximizes the score. Therefore, the frequency of a token may not be related to its associated secret value.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "U2IPeUsTKJ", "reviewer": "Reviewer_3Sjs", "summary": "The authors propose a method for watermarking language models through the use of rejection sampling. By sampling and discarding \"chunks\" from the model until the p-value returned by an (arbitrary) detection rule is sufficiently low, the proposed method simultaneously preserves output text quality while achieving strong robustness to a variety of attacks. Crucially, the proposed method does not require any intervention within the model itself (e.g. via logit biasing).", "questions": "* Did the authors explore the use of detection rules other than (11) in conjunction with WaterMax, and if so, did they observe any significant differences in performance?", "limitations": "* See comment on efficiency in \"Weaknesses\" section", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* The proposed method is both elegant and flexible.\n* The paper is clearly written and adequately describes the proposed method.\n* The authors demonstrate strong results in terms of text quality, detectability, and robustness against a reasonable selection of attacks.", "weaknesses": "* A previous LLM watermarking work, \"SemStamp\" [1], is similarly based on rejection sampling. Adding experimental comparisons to SemStamp might therefore strengthen the paper by showing how the proposed method fares against the most directly comparable existing method. Otherwise, the authors should probably cite it.\n* The authors claim on line 62 that the method of Kuditipudi et al. is the only watermark explicitly designed for robustness; however, the unigram method of Zhao et al. [2] also appears to provide theoretical robustness guarantees.\n* While the authors propose an algorithm to limit search over candidate generations, the computational complexity of the proposed method is somewhat concerning. Based on figure 7 (appendix G), it looks like WaterMax incurs ≤ 40% additional runtime on top of generation at a length of only 256 tokens; for the texts in the \"Mark My Words\" benchmark, the authors report in line 560 that WaterMax requires 5 times the runtime of KGW & Aaronson for watermarked generation. Additional computation is unavoidable with a rejection sampling watermarking scheme, but the authors could address this limitation more clearly within the main paper body.\n* A very minor note -- given that the authors consistently compare three watermarking schemes (WaterMax, Aaronson, KGW), it might improve legibility to use a consistent color scheme to refer to these methods across figures.\n\n[1] https://arxiv.org/abs/2310.03991 (NDSS '24)\n[2] https://arxiv.org/abs/2306.17439  (ICLR '24)", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> W1: \"A previous LLM watermarking work, \"SemStamp\" [1], is similarly ... Adding experimental comparisons to SemStamp ... Otherwise, the authors should probably cite it.\"\n\nWe thank the reviewer for pointing us to SemStamp. We acknowledge that there exists some proximity to our work in the sense that they perform rejection sampling on sentences. It can also be seen as a KGW-type algorithm at the level of sentences instead of tokens.\n\nHowever, the work exhibits two major weakness that prevent comparison:\n1) Since the watermark works at the level of sentences and not tokens, extremely large texts are necessary to attain acceptable performance. SemStamp's false positive rate is around 1%. All algorithms studied in our work easily reach 100% TPR within this regime.\n2) The authors compute the FPR using a z-score which allows an accurate approximation of the p-value only when the number of sentences is high -- however this is never achieved in practice. No empirical validation of this approximation is provided. On the other hand, our work computes exact p-values which are very low for watermarked text. For these reasons, we cannot sensibly compare SemStamp to the state-of-the-art.\n\n> W2: \"The authors claim on line 62 that the method of Kuditipudi et al. is the only watermark explicitly designed for robustness; however, the unigram method of Zhao et al. ...\"\n\nWe agree. We thank the reviewer for pointing out this oversight. We added this reference.\n\n\n> W4: \"A very minor note ... it might improve legibility to use a consistent color scheme to refer to these methods across figures.\"\n\nWe corrected the colors of Fig. 1 which were indeed  not consistent with the other figures. Thanks for pointing this out.\n\n\n> Q1: \"Did the authors explore the use of detection rules other than (11) in conjunction with WaterMax, and if so, did they observe any significant differences in performance?\"\n\nIf 'detection rule' means the distribution of the values associated to each token, then yes: As we show in the paper, the choice of detection rule theoretically does not impact the performance of WaterMax. \n\nIf detection rules means other kind of score function like SemStamp based semantics, then no, we did not try.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ukOSholZoa", "reviewer": "Reviewer_5ir5", "summary": "This paper proposes a watermark technique called WaterMax to distinguish LLM-generated texts and human-written texts. WaterMax starts with the watermark detector and asks LLMs to generate a group of candidates from which the one with the lowest p-value determined by that detector is selected as the final output. This work offers a brandnew perspective of text watermarking as there is no formal watermark generator to embed watermark into LLM outputs. Watermax breaks the trade-offs between watermark detectability, quality and robustness, which is carefully discussed in this work with theoretical proof and experiment validation.", "questions": "Is it possible to include low-entropy tasks such as code generation to test if the detector can still properly function? Several works [1,2] can be refered to.\n\n[1].Who Wrote this Code? Watermarking for Code Generation\n[2].An Entropy-based Text Watermarking Detection Method", "limitations": "It would be better to include more datasets, and further improve the time complexity if possible.", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "1. WaterMax offers a brendnew research perspective in the field of text watermarking, where there is no official watermark generator.\n2. WaterMax is almost distortion-free as it achieves high text quality on LLM outputs, yet the detectability is preserved.\n3. By upgrading the detector, WaterMax can achieve high robustness as well.\n4. The superiority of WaterMax is both theoretically proven and experimentally validated.", "weaknesses": "1. The dataset used for experiments is limited to high-entropy text generation, yet in reality there is need to watermark LLM-generated codes.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> Q1: \"Is it possible to include low-entropy tasks such as code generation to test if the detector can still properly function? Several works [1,2] can be refered to.\"\"\n\nWe thank the reviewer for the references. At the detection side, these works weight the token value depending on an estimated entropy of the token: hard thresholding for [1], soft weighting for [2]. In principal, this idea can be integrated to WaterMax at the detection side (and thus at the embedding as well since it uses the same score function). Applying hard thresholding [1], WaterMax will not embed a watermark in a chunk where all tokens have low entropy. Yet, we do not recommend the soft weighting of [2]: this prevents from computing a sound p-value.  \n\n>[1] *Who Wrote this Code? Watermarking for Code Generation*\n>[2] *An Entropy-based Text Watermarking Detection Method*", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We thank all the reviewers for their constructive comments which help us improving our submission.

**The reviewers globally find that the limitations on the complexity is not enough outlined.**

The submission already accounted that:
- The main point of WaterMax is to strike the trade-off detectability/complexity (without loss of quality) instead of the trade-off detectability/quality (without extra complexity) well documented in the literature.
- The paper proposes means to reduce the complexity overhead and latency (from sampling text to chunks, sampling chunks in parallel, beam search ...).
- App. G shows experimental results about runtimes.

$\to$ *We agree that the complexity overhead and the latency of the final scheme is not properly reported in the main body. We will rewrite Sect. 7.4 "Computational complexity" explicitly as a limitation with reported runtime and latency measurements. Especially, we will clearly say that WatermMax is 5 times slower for our recommanded setup.*

**The attached pdf file shows the following news results as suggested by the reviewers.**

- Fig. 1.a and Fig. 2.a: repeat the main experiment with a standard KGW set as $(\gamma,h)=(0.25,4)$ as Reviewer VU2G suggested.
- Fig. 1.bc and Fig 2.bc: repeat the main experiment with larger models (Llama-2-13b and Phi3-medium), as Reviewer VU2G suggested.
- Fig 3: demonstrate the limited applicability of LLM judges in evaluating watermarked text quality, in response to Reviewer VU2G's question.

Meta-review: This paper proposes a new LLM watermarking scheme, WaterMax, which achieves high detectability while maintaining the quality of generated text. The performance of WaterMax is theoretically proven and experimentally verified. LLM watermarking is a less-regarded but interesting research topic. The proposed watermarking scheme is novel, and the theoretical analysis and experimental evaluation are thorough. The paper is generally well-written. In the rebuttal stage, the authors addressed most of the issues raised by the reviewers. The next version needs to properly report the complexity overhead and latency of the scheme.
Decision: Accept (poster)