EditMark: Training-free and Harmless Watermark for Large Language Models

Authors: Shuai Li, Kejiang Chen, Jun Jiang, Jie Zhang, Kai Zeng, Tianze Chang, Weiming Zhang, Nenghai Yu
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Watermarking, Model Edit, Robust

Abstract:
Large Language Models (LLMs) have demonstrated remarkable capabilities, but their training requires extensive data and computational resources, rendering them valuable digital assets. Therefore, it is essential to watermark LLMs to protect their copyright and trace unauthorized use or resale. Existing methods for watermarking LLMs are mainly based on backdoors or knowledge injection, which require burdensome training or degrade the generation quality. To address these issues, we propose EditMark, a training-free and harmless watermarking method for LLMs based on model editing. 
We observe LLM has diversity and can generate multiple logical and semantic correct answers to some open-ended questions. Therefore, we can use a watermark to generate a harmless mapping to control the LLM's answer to an open-ended question.
Inspired by this insight, EditMark involves generating a harmless mapping based on the watermark, selecting a secret key to generate watermarked inputs, and editing the outputs of LLM to align with the harmless mapping. 
Extensive experiments show that EditMark can embed 8-bit watermarks into LLMs within 2 minutes, with a watermark extraction success rate close to 100%. External experiments further demonstrate that EditMark has fidelity and is robust to model fine-tuning and editing attacks.

Decision: reject
Reviewer scores: 3, 6, 3, 5

Reviews and discussion:
<thread>
creation date:
1730599251451

thread_type:
official_review

<thread_object>
creator: reviewer_srpi

<content>
summary:
This paper presents a black-box watermarking method for large language models that is both training-free and harmless. The work addresses the scenario of copyright protection for large language models by applying a model editing technique to embed the watermark.

strengths:
+）The writing is clear and easy to understand. 

+）The authors propose a new watermarking mechanism for large language models.

weaknesses:
-）Although the paper applies a model editing technique, the technical contribution is limited.

-）The method used for editing the model is not properly cited. It's unclear which paper is referred to as "Memit" (lines 153-154).
Providing more examples would improve the paper.

-）The baseline selection is somewhat limited, as seen with the choice of "A watermark for large language models" [1].

-) If the attacker changes the sampling strategy (e.g., adjusts the temperature of the softmax layer), can the watermark maintain its robustness? The authors may consider extending the experiments.

[1] Kirchenbauer J, Geiping J, Wen Y, et al. A watermark for large language models[C]//International Conference on Machine Learning. PMLR, 2023: 17061-17084.

questions:
Please see weakness.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730622672436

thread_type:
official_review

<thread_object>
creator: reviewer_hcym

<content>
summary:
The paper introduces EditMark, a novel method for watermarking large language models (LLMs) that is both training-free and harmless. The core idea behind EditMark is to leverage the inherent diversity in LLM responses to open-ended questions to embed watermarks without degrading the model's performance. The method involves generating a harmless mapping based on the watermark, selecting a secret key to generate watermarked inputs, and editing the outputs of the LLM to align with the harmless mapping. The authors claim that EditMark can embed 8-bit watermarks into LLMs within 2 minutes, with a watermark extraction success rate close to 100%. The method is also robust to model fine-tuning and editing attacks, maintaining high fidelity across various benchmarks.

strengths:
1. **Training-Free**: One of the most significant strengths of EditMark is that it does not require retraining the LLMs. This makes it highly efficient and cost-effective, especially for large-scale models.
2. **Harmlessness**: The method ensures that the watermark does not affect the logical and semantic integrity of the generated text, which is crucial for maintaining the model's performance and usability.
3. **Efficiency**: The authors report that EditMark can embed watermarks quickly, within 2 minutes, making it a practical solution for real-world applications.
4. **Robustness**: The method is robust against various attacks, including model fine-tuning and editing attacks, which enhances its reliability.
5. **Fidelity**: Extensive experiments on benchmarks such as BLiMP and MMLU show that EditMark has a negligible effect on model performance, indicating high fidelity.

weaknesses:
1. **Complexity of Implementation**: While the method is training-free, the process of generating a harmless mapping and selecting a secret key might be complex and require sophisticated algorithms. The paper could benefit from more detailed explanations and examples of these processes.
2. **Scalability**: The paper mentions that EditMark can embed 8-bit watermarks, but it is unclear how well the method scales to larger watermarks. Embedding more bits might introduce additional challenges and potential degradation in performance.
3. **Security Concerns**: Although the method is designed to be harmless, the security of the watermarking process is not thoroughly discussed. There is a need to explore potential vulnerabilities and countermeasures against advanced attackers who might attempt to reverse-engineer the watermarking mechanism.
4. **Generalizability**: The paper primarily focuses on open-source LLMs, but it is not clear how well EditMark would perform on proprietary models with different architectures and training methodologies. More diverse experimental settings would strengthen the paper's claims.
5. **User Impact**: The paper does not discuss the potential impact of the watermark on user experience. For example, if the watermark alters the model's responses in subtle ways, it could affect the trust users place in the model's outputs.

questions:
1. **Detailed Implementation**: Could the authors provide more detailed steps and pseudocode for generating the harmless mapping and selecting the secret key? How do these steps ensure the watermark remains undetectable?
2. **Scalability**: How does the method scale to larger watermarks? Are there any limitations or trade-offs when embedding more bits?
3. **Security**: What are the potential security risks associated with the watermarking process, and how can they be mitigated? Have the authors conducted any security audits or simulations to test the robustness of the method against advanced attacks?
4. **Generalizability**: How well does EditMark perform on proprietary models with different architectures? Are there any modifications needed to adapt the method to non-open-source LLMs?
5. **User Experience**: How does the watermark affect the user experience? Are there any noticeable changes in the model's behavior that could impact user trust?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730662608302

thread_type:
official_review

<thread_object>
creator: reviewer_hcpj

<content>
summary:
The paper introduces EditMark, a novel approach for watermarking open-source large language models (LLMs) that is both training-free and harmless. Unlike existing methods that rely on backdoors or knowledge injection, EditMark leverages model editing to embed watermarks without significant alterations to the model’s output quality.

strengths:
1. The EditMark method introduces a unique, training-free watermarking solution leveraging model editing, avoiding the significant computational costs and potential risks associated with backdoor and knowledge injection methods. This innovation provides a practical means to protect open-source LLMs.

2. The proposed method can embed an 8-bit watermark within approximately two minutes, as demonstrated across multiple LLMs. This rapid embedding process, combined with a high extraction success rate (ESR) close to 100%, highlights the method's effectiveness and time-efficiency compared to existing techniques.

3. Experiments conducted using the BLiMP and MMLU benchmarks show that EditMark has a negligible impact on the model’s overall performance. The watermarking process preserves the logical and semantic integrity of the LLM’s output, ensuring that model functionality is maintained.

4. EditMark demonstrates notable resilience to common model attacks, including fine-tuning and editing. The watermark extraction success rate remains high even after such modifications, indicating that EditMark's approach offers robust protection without significantly compromising model usability.

weaknesses:
1. The paper mentions the trade-off between watermark capacity, ESR, and embedding time. Although embedding an 8-bit watermark is efficient and robust, scalability to higher capacities could present challenges, potentially limiting its utility in scenarios requiring more extensive watermarking.

2. The robustness of EditMark against an informed attacker (i.e., one who knows the specific model editing layers used) shows some vulnerabilities. As depicted in experiments with targeted attacks, the watermark's resilience could be compromised, suggesting that further enhancement in adaptability is needed.

3. The reliance on the Memit model editing technique limits the flexibility of the approach. While Memit is efficient for editing multiple knowledge instances, the method’s compatibility with other editing frameworks is not addressed, which could be a limitation for broader application.

4. The paper's citation formatting is problematic. The authors may use "(authors et al.)" to highlight the citation part rather than directly show "authors et al."

questions:
1. How scalable is the EditMark framework when embedding larger watermarks (e.g., 16-bit or 32-bit) without significantly affecting ESR and embedding time?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730717557039

thread_type:
official_review

<thread_object>
creator: reviewer_7qd4

<content>
summary:
The paper tackles the issues of watermarking LLMs, such that a LLM provider can track the usage of its models by third parties. Backdoors or knowledge injections have drawbacks. Instead, EditMark propose to align with a harmless watermark mapping to open-ended questions, such as controling the number of digits when generating a float.

strengths:
The topic is important, and adequately using knowledge injection to watermark LLMs is interesting. Doing so with open-ended questions, particularly with math questions, seem relevant and adequate.

weaknesses:
- The paper has a lot of flows. A lot of paragraphs really look LLM written and hard to digest
- The fact that the method is simple is a good thing. However, the explanation of the watermark extraction and experimental set-up appears very light. It would help to add in the appendix more details on the experiments, examples, related work. Overall I am not convinced by the literature review, and the choice of methods that the authors compare to. It is not clear wheter the novelty comes from the choice of watermarking or the choice of doing model editing instead of full finetuning. 

Overall, the method is interesting but the paper is too drafty. 



Minor:
- The LLMs that are considered are a few years old, I don't understand why.
- The authors could use \citep insstead of cite/citet when adequate.
- "Kirchenbauer et al. proposed the first watermarking methods Kirchenbauer
et al. (2023) for LLM." What about aaranson et al ?

questions:
When reading this (which has flaws):

"To address this issue, Li et al. proposed a watermarking method Li et al. (2024) via knowledge injection, which embeds the watermark into the knowledge and injects the watermarked knowledge into LLM. In addition, the watermarked text is logically correct, which makes it harmless for LLM. However, this method also requires training the LLMs to embed watermarks, which is a huge cost for large-size LLMs.""


- I understand that there are already some work to insert watermarked harmless knowledge into a LLM. But it needs full fine-tuning so the authors don't compare to them. On the other hand the proposed method uses model editing. But couldn't that be applied to the previous harmless knowledge injection approached?

- Does the novelty come from the proposed method of watermarking the ouputs of math questions, or from the model editing part?

- Could the authors clarify how detection is done?

- What is the field "begin" in the table?

- Could the authors detail how they generated the question-answer pairs? how many of them are used for training? how many are used for detection? Are they the same questions as the training ones?

- In figure 3, why is Llama not as good as the other models?
</content>
</thread_object>

</thread>


Metareview:
metareview:
This paper introduces EditMark, a training-free and harmless method for watermarking large language models (LLMs) using model editing. Unlike existing approaches that rely on backdoors or knowledge injection, EditMark embeds watermarks by leveraging the natural diversity in LLM outputs. The method creates a harmless mapping, generates watermarked inputs using a secret key, and edits model outputs to match the mapping. EditMark can embed 8-bit watermarks in under 2 minutes, achieving near 100% extraction success. It is robust to fine-tuning and editing attacks, ensuring high fidelity and no degradation in model performance, making it suitable for copyright protection.

The idea of inserting information without training the LLM is an interesting direction. However, as noted by the reviewers, the comparison to existing methods is limited. Since LLM watermarking is a hot topic, there are numerous existing works [1]. Therefore, it would be beneficial to discuss the differences between the proposed method and existing methods, and it would be great to include some additional comparisons. I encourage the authors to revise the paper based on the reviewers' comments and resubmit it to a future venue.

[1] A Survey of Text Watermarking in the Era of Large Language Models
https://dl.acm.org/doi/full/10.1145/3691626