WaterBench: Towards Holistic Evaluation of Watermarks for Large Language Models (2024)

Abstract: To mitigate the potential misuse of large language models (LLMs), recent research has developed watermarking algorithms, which restrict the generation process to leave an invisible trace for watermark detection. Due to the two-stage nature of the task, most studies evaluate the generation and detection separately, thereby presenting a challenge in unbiased, thorough, and applicable evaluations. In this paper, we introduce WaterBench, the first comprehensive benchmark for LLM watermarks, in which we design three crucial factors: (1) For benchmarking procedure, to ensure an applesto-apples comparison, we first adjust each watermarking method’s hyper-parameter to reach the same watermarking strength, then jointly evaluate their generation and detection performance. (2) For task selection, we diversify the input and output length to form a five-category taxonomy, covering 9 tasks. (3) For evaluation metric, we adopt the GPT4-Judge for automatically evaluating the decline of instructionfollowing abilities after watermarking. We evaluate 4 open-source watermarks on 2 LLMs under 2 watermarking strengths and observe the common struggles for current methods on maintaining the generation quality. The code and data are available at https://github. com/THU-KEG/WaterBench.

text: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1517–1542 August 11-16, 2024 ©2024 Association for Computational Linguistics
To mitigate the potential misuse of large language models (LLMs), recent research has developed watermarking algorithms, which restrict the generation process to leave an invisible trace for watermark detection. Due to the two-stage nature of the task, most studies evaluate the generation and detection separately, thereby presenting a challenge in unbiased, thorough, and applicable evaluations. In this paper, we introduce WaterBench, the first comprehensive benchmark for LLM watermarks, in which we design three crucial factors: (1) For benchmarking procedure, to ensure an applesto-apples comparison, we first adjust each watermarking method’s hyper-parameter to reach the same watermarking strength, then jointly evaluate their generation and detection performance. (2) For task selection, we diversify the input and output length to form a five-category taxonomy, covering 9 tasks. (3) For evaluation metric, we adopt the GPT4-Judge for automatically evaluating the decline of instructionfollowing abilities after watermarking. We evaluate 4 open-source watermarks on 2 LLMs under 2 watermarking strengths and observe the common struggles for current methods on maintaining the generation quality. The code and data are available at https://github. com/THU-KEG/WaterBench.

heading: 1 Introduction
text: LLM has achieved significant success in generating human-like texts (Cai et al., 2023; OpenAI, 2023; Bubeck et al., 2023). However, the potential misuse of LLM has also raised concerns (Li et al., 2023a). For example, ChatGPT can be used to generate fake news (Wang et al., 2023b), which may manipulate the public opinion. To mitigate this kind of risk, it is necessary to develop a watermarking algorithm to detect whether a text is generated by LLM (Kirchenbauer et al., 2023a). As shown in
∗Equal Contribution. †Corresponding author.
green list , which can then be detected by a higher z-
score measurement (z > 4). We utilize TP, TN, and GM to jointly evaluate the watermarking performance.
Figure 1, the watermarked texts are generated with a biased distribution of tokens, which distinguishes it from unwatermarked texts. We believe the goal of watermarking is to achieve high detection accuracy while maintaining the generation quality. So we utilize the commonly used TP (True Positive), TN (True Negative), and GM (Generation Metric) to evaluate watermarks (Ghosal et al., 2023).
Due to the two-stage nature of this task, most studies (Kuditipudi et al., 2023; Zhao et al., 2023) evaluate the generation and detection separately and they do not conduct a unified hyper-parameter search for each watermarking method, which may lead to unfair comparisons. Since, there is usually a trade-off between the detection performance and the generation quality. Besides, previous evaluations are often conducted via text completion on a single dataset, such as C4 RealNewsLike dataset (Raffel et al., 2020), which cannot comprehensively measure the generation quality of LLMs.
1517
Furthermore, most evaluations only calculate the perplexity (Kirchenbauer et al., 2023b), which is not aligned with human preference and thus not practical in the era of LLMs (Chia et al., 2023).
To address these issues, we propose WaterBench, the first comprehensive benchmark for LLM watermarks, which has three crucial factors: (1) Benchmarking Procedure: We first introduce the concept of watermarking strength (Mei et al., 2002), i.e. the detection robustness to disturbance, to quantify the LLM watermarks’ trade-off controlled by hyper-parameters. We present a reasonable hyperparameter search procedure: Given a dataset and an LLM, we adjust the hyper-parameters of each watermarking method to unify the watermarking strength and then freeze the parameters to jointly evaluate the detection and generation performance. (2) Task Selection: To add disturbance on watermarks, we differentiate the task settings based on the length of input and output, which decides how much information the watermark can embed. Therefore, we form a new taxonomy with five task categories and nine sub-tasks, which are selected from existing datasets with various length settings (Dubois et al., 2023). (3) Evaluation Metric: We adopt the GPT4-Judge (Zheng et al., 2023) for automatically evaluating the instructionfollowing performance decline after watermarking. Then we conduct a human evaluation to verify the agreement between the human and GPT4.
Based on the WaterBench dataset, we conduct an experiment of 4 reproducible watermarks on 2 LLMs (Llama2-chat (Touvron et al., 2023) and InternLM (Team, 2023)), leading to some interesting findings: (1) We adjust two different watermarking strengths, 0.7 and 0.95, and observe that the detection and generation performance are significantly different. In other words, if we compare two watermark strategies without aligning their wa-
termarking strengths, it is easy to let one “surpass” another in some aspects. (2) The tasks with short output length are generally more difficult to detect, with lower TP. The V2 watermark (Kirchenbauer et al., 2023b) is the best watermarking method in terms of GM. (3) On the open-ended task, if we use GPT4-judge to evaluate, the watermarked LLM will decrease over 96% from original LLM, which shows the sensitivity of the metric and indicates the common struggles of watermarks on maintaining the generation quality. In human evaluation, the GPT4 obtains over 0.6 Cohen’s kappa coefficient with 3 annotators, achieving substantial agreement.
To summarize, our contributions are three-fold: (1) We propose a new benchmarking procedure that first search hyper-parameters for watermarks then jointly evaluate detection and generation performance to eliminate the unfair comparison between different watermarking strengths. (2) We construct a multi-task benchmark to facilitate future research. (3) We incorporate GPT4-Judge to evaluate the watermarked LLMs, which effectively reflects the decline of generation quality.

heading: 2 Related Work
text: To detect LLM-generated text, previous works (Tu et al., 2023; Guo et al., 2023; Mitchell et al., 2023) mainly explored the classifiers that distinguishes human and LLM-generated texts based on features. However, as LLMs are becoming more and more alike human, some classifiers may mistakenly recognize human as LLMs (Sadasivan et al., 2023).
In addition to black-box classifiers, recent approaches have also introduced white-box detection methods that inject watermarks into LLM generated texts (Tang et al., 2023; Yang et al., 2023; Liu et al., 2024). The inference-time watermarks (Pan et al., 2024) randomly split the vocabulary and ad-

heading: With hard watermark 
text: just the probability distribution at each decoding step, which guarantees the presence of detectable patterns, known as watermarks, in the generated text. Some works (Kirchenbauer et al., 2023b; Liu et al., 2023) focus on improving the detection robustness to paraphrasing attacks (Krishna et al., 2023) or at low-entropy environment (Lu et al., 2024). Other works like unbiased watermark (Hu et al., 2023) and NS-watermark (Takezawa et al., 2023) focus on improving the quality of generated texts (Hou et al., 2024; Li et al., 2023b).
On the other hand, post-hoc watermark (Atallah et al., 2001; Topkara et al., 2005) is also a line of research, which insert watermarks into texts by synonym replacement (Yang et al., 2023; Yoo et al., 2023) or paraphrasing (Munyer and Zhong, 2023). Recently, Sato et al. (2023) presented a simple but effective method that replace each space character with another codepoint of whitespace. However, this simple watermark can also be easily erased.

heading: 3 WaterBench
text: To investigate how inference-time watermarks perform on detection and generation, as shown in Figure 2, we propose a benchmarking procedure that ensures fair comparisons (Section 3.2). Then, we present the WaterBench dataset with a diverse length distribution (Section 3.3). Finally, we introduce the GPT4-Judge evaluation (Section 3.4).

heading: 3.1 Problem Definition for Watermarking
text: Generation Stage Assume an auto-regressive LLM θ has a vocabulary V , the probability distribution for the t-th token in a sequence S = {s1, s2, . . . , s|S|} can be expressed as:
p(st) = pθ(st|s<t) (1)
LLM predicts the p(st) by calculating a logit vector l(t) ∈ R|V | for each item k in vocabulary. Kirchenbauer et al. (2023a) propose 2 watermarks, namely hard and soft watermarks, to add watermarks to text by imposing restrictions on the vocabulary during each decoding step. Specifically, the “Hard Red List” watermark algorithm randomly divides the vocabulary into “green” and “red” lists using a hash function. During the generation process, only tokens from the green list can be chosen for the t-th position. While soft watermark approach introduces a constant δ to the logit l(t)k of tokens in the green list during the prediction step:
p (t) k = exp(l (t) k + δ)/
∑
i
exp(l (t) i ) (2)
Detection Stage To detect the presence of the watermark in the generated text, statistical analysis techniques such as the one proportion z-test can be applied. While the hash function generates the green lists with a greenlist fraction γ, we can extract the watermark by re-computing the greenlist
at each position to get a set of greenlist tokens Sg. Then the significance can be derived by z-score:
z = (|Sg| − γ|S|)/ √ γ(1− γ)|S| (3)
If the z-score is above the threshold, which means the corresponding P-value is small, then we can ensure that the text S is watermarked.

heading: 3.2 Benchmarking Procedure
text: Due to the two-stage nature of the task, previous works may use different hyper-parameters when testing the detection and generation, leading to unfair comparisons. As shown in Figure 2, we propose a fair benchmarking procedure to jointly evaluate the detection and generation performance.
Watermarking Strength. To retain consistency with the two stages and maintain fairness in our evaluations, we introduce the concept of watermarking strength (Mei et al., 2002) into LLM watermarks. In image watermarking (Akhaee et al., 2009), the higher watermarking strength means the better robustness for detecting the watermark. In LLM watermarking, we believe the watermarking strength should be independent with the referenced answer and can measure the detecting robustness. Therefore, we define the watermarking strength as the ratio of the number of watermarked texts that are correctly detected to the total number of watermarked texts, namely the TPR (True Positive Rate), which is a definite value after setting the input, the watermarking algorithm and its hyper-parameters. By freezing the watermarking strength, the evaluation results can remain consistent in the two stages. Some methods may adaptively set their strength
for each case (Takezawa et al., 2023) and that’s not discussed in this paper yet we leave for the future.
Hyper-Parameter Search. Although the watermarking strength depends on hyper-parameters, the hyper-parameters of different watermarking methods are not comparable (Ghosal et al., 2023). Therefore, we propose a hyper-parameter search procedure to unify the watermarking strength of different watermarking methods. Specifically, we first set the hyper-parameters of each watermarking method to the initial value by default, then we perform grid search (Alibrahim and Ludwig, 2021) to change the watermarking strength to the desired level and minimize the changes to hyper-parameters. Finally, we fix the hyper-parameters to the determined values and jointly evaluate the two-stage performance.
For researchers aiming to introduce a new watermark candidate to WaterBench, a suitable hyperparameter should first be identified by them to achieve a certain True Positive Rate (TPR), for instance, 0.95. Subsequently, the evaluation code can be executed to obtain True Negative (TN) and Generation Metric (GM) results. Ultimately, they can benchmark their performance against other watermarks with an equivalent TPR on our benchmark.

heading: 3.3 Task Selection
text: As shown in Table 2, we select nine typical tasks for five distinct task settings, covering a wide range of input and output length, including:
Category 1: Short Input, Short Answer. As the input and answer length decides how much information that the watermarking algorithm can hide, we first choose two tasks that have short in-
put and answer length to disturb the watermarking methods. Both tasks evaluate the Factual knowledge in a close-ended setting. The task 1-1 is the knowledge probing, we use 200 triplets from KoLA dataset (Yu et al., 2023) with different frequency in Wikipedia to probe the facts from LLMs. For task 1-2, the concept probing, we use the 200 samples from the cic and csj task in Copen dataset (Peng et al., 2022). As the output length is short, we use the F1 score as the evaluation metric.
Category 2: Short Input, Long Answer. To control for the variable of answer length, we choose another 2 tasks with the short input but long answer. Both tasks belong to Long-form QA, which is the common format that users interact with LLMs, where user ask a short question and expect a long answer. For task 2-1, we use 200 samples from the ELI5 dataset, which is a long-form questionanswering dataset composed of threads from the Reddit forum "Explain Like I’m five". For longform QA with finance knowledge (Task 2-2), we use 200 samples from the FiQA dataset.
Category 3: Long Input, Short Answer. To control the variable of input length, we select 2 tasks from LongBench (Bai et al., 2023) with long input and short output. To evaluate the effect of watermarks of LLMs on the reasoning (Task 3-1), we select 200 samples from the HotpotQA dataset (Yang et al., 2018), which is a multi-hop question-answering dataset. For code completion (Task 3-2), we use 200 samples from the LCC dataset (Chen et al., 2021), a dataset constructed by filtering code within a single file from GitHub.
Category 4: Long Input, Long Answer. To control both input and output length, we involve 2 tasks with long inputs and answers. The 2 tasks are both Summarization task, which is a particular skill for serving people’s information needs. We select 200 samples from the widely-used multi-document
news summarization dataset, MultiNews (Fabbri et al., 2019). For query-based summarization, we use 200 samples from the QMSum dataset (Zhong et al., 2021) with both input documents and queries for specific parts of the documents.
Category 5: Open-Ended Generation. While the aforesaid datasets mainly evaluate the specific skills of LLMs, the input and output length may be limited to a certain range that is suited for the corresponding task. In real world application of LLMs, the abilities to follow the user’s instructions are also important where the generation is often open-ended. To comprehensively evaluate the instruction-following performance of watermarked LLMs, we select the AlpacaFarm dataset (Dubois et al., 2023), which contains 805 instructions, consisting of 5 different sources of instructions, with 32.58 tokens in the input and 64.13 tokens in the reference answer on average.

heading: 3.4 Evaluation Metric
text: We used an evaluation method called GPT4Judge (Zheng et al., 2023) to compare how well watermarked LLMs and Davinci-003 could generate text on the AlpacaFarm dataset. The GPT4-Judge measures which model’s output the GPT-4 system prefers when shown two responses for the same instruction. To be fair, the order of the models’ output texts are randomly mixed up before GPT-4 chose to avoid the position bias (Wang et al., 2023a).

heading: 4 Experiments

heading: 4.1 Experimental Settings
text: We choose 2 popular LLMs as our baselines: Llama2-7B-chat (Touvron et al., 2023) and Internlm-7B-8k (Team, 2023), both models are instruction-tuned to align with human preference. We evaluate 4 different representative watermarks on these 2 LLMs on our WaterBench, including:
• Hard Watermark: The hard watermark (Kirchenbauer et al., 2023a) is a binary watermark that restricts the vocabulary of the model to a subset of words during decoding.
• Soft Watermark: The soft watermark (Kirchenbauer et al., 2023a) is a continuous watermark that divide γ vocabulary and adds a constant δ on logits to encourage watermarked vocabularies.
• GPT Watermark: The GPT watermark (Zhao et al., 2023) simplifies the watermarking process with a fixed group of restricted vocabularies to improve robustness against editing attacks.
• V2 Watermark: The V2 watermark (Kirchenbauer et al., 2023b) improves the soft watermark with different hashing schemes, including the LeftHash and SelfHash to secure better robustness to the paraphrasing attack.
As the evaluation procedure described in Section 3.2, we first adjust the watermarking strength
of each watermark by grid search. As shown in Figure 3, we find that the watermarking strength of each watermark increases when δ increases and increases when γ reduces. We then choose the watermarking strength of 0.95 and 0.7 for each watermark and freeze their hyper-parameters for further detection and generation evaluation. Apart from the grid search results, we also display the ROC curve of watermarks in Appendix A.2.

heading: 4.2 Main Results
text: We conduct evaluations at the 0.95 watermarking strength on each task and report watermarks’ results in Table 3 and 4. Here are our findings:
Detection Performance. Among all tasks, the detection performance for the short answer tasks (Category 1 and 3) are significantly worse than other tasks. This is because that watermarked LLMs produce short responses for these tasks, which can not contain enough green-words for detection, re-
sulting in low z-scores, making the detectors more likely to fail on discovering the watermark.
For the overall detection performance, most watermarks can achieve high TP rates of around 95% which is consistent with the fixed watermarking strength, while the TN rates are nearly 100% for all methods. This indicates that current LLM watermarks (Kirchenbauer et al., 2023a) are generally good at detecting watermarked texts while remaining a clear distinction from unwatermarked texts.
Generation Performance. However, in terms of generation quality, all watermarks lead to significant drops in GM compared to the original models. The hard watermark exhibits the largest decreases of over 50% in most cases. The generation performance also declines more severely for the openended task with over 90% drop. These findings suggest that current watermarks encounter challenges in maintaining the generation quality, particularly for instruction-following tasks.
Among different watermarks, as shown in Table 4, the V2 watermark achieves higher GMs in most task categories, highlighting its effectiveness in preserving generation quality. The soft watermark and GPT watermark also exhibit competitive performance. While V2 watermark even shows better True Negative rate in most categories, indicating its advantage on watermark detection, too.
In addition, we observe larger performance drops for InternLM compared to Llama2 under the same watermarking method, indicating that impact of watermarking can vary among LLMs, highlighting
the importance of model-specific evaluations. In summary, while current watermarks are ef-
fective in detection, their generation quality still degrades significantly. Future work can explore new watermark designs to minimize such declines.

heading: 4.3 Watermarking Strength Analysis
text: To analyze the influence of the watermarking strength on evaluating the detection performance and generation quality, we conduct experiments for the 4 watermarking methods with 0.7 watermarking strength at Table 5 to compare with the main results in Section 4.2 at 0.95 watermarking strength. And we have the following observations: (1) There exists a trade-off between the watermarking strength and generation quality. Models tend to exhibit larger drops in GM at 0.95 strength compared to 0.7. For example, the watermark with the worst generation score in Table 5 (0.7 strength) can rank the first in Table 4 (0.95 strength), which can’t reflect the real difference between watermark algorithms. This highlights the importance of using a standardized strength for fair comparisons. (2) At a lower strength of 0.7 , average TP rates drop noticeably compared to 0.95 strength across different tasks. We observe the largest TP rate drop (from ∼90% to ∼0%) in Category1 with short input and short answer. This suggests that our WaterBench is hard enough to add strong disturbance on watermarks for adjusting watermarking strengths. (3) V2 watermark maintains relatively stable detection and generation performance at both strengths, outperforming other methods. However, V2 water-
No watermark
+Hard watermark
+Soft watermark
+Gpt watermark
+V2 watermark
Llama2-7B-chat Davinci-003
mark still makes Llama2’s generation performance drops 31.2%, indicating that further exploration is needed to minimize quality degradation.

heading: 4.4 Human Evaluation
text: To prove the effectiveness of GPT4-Judge on task 5- 1, we conduct a human evaluation that annotate the actual human preferences on model responses. We sample 100 generation results respectively from the 5 models at the watermarking strength level of 0.7. Then we ask three human annotators to vote for their preferred response between the watermarked LLM and Davinci-003 baseline (See Appendix A.3 for more details). In total, we collect 1, 500 human feedback, yielding the following findings: (1) The results from the three human annotators align with the labeling from GPT4. Figure 4 exhibits the average voting results of three humans for the instruction-following task, where Llama2-7BChat without watermark achieves a 50.3% win rate against the Davinci-003 baseline, which is consistent with the GPT4’s simulated win rate of 54.7%. Besides, the other watermarked LLMs also obtain the similar win rates to GPT4’s predictions, further demonstrating the effectiveness of GPT4-Judge. (2) The inter-annotator agreement coefficients between GPT4 and three human annotators are varied, but all of them are above 0.6, indicating substantial agreement. As shown in Figure 5, GPT4 has a 0.83 agreement with human1, which can be viewed as almost perfect agreement. While GPT4 only gets substantial agreement with human2 and human3. Additionally, the agreements among three human annotators are around 0.6, which means substantial agreement. So there also exists a variety of human annotators, which may lead to the different
GPT4 Human1 Human2 Human3
GPT4

heading: Human1

heading: Human2
text: Human3
1.00 0.83 0.64 0.65
0.83 1.00 0.62 0.62
0.64 0.62 1.00 0.59
0.65 0.62 0.59 1.00
0.0
0.2
0.4
0.6
0.8
1.0

heading: 4.5 Correlation Analysis

heading: 5 Conclusion
text: In this paper, we propose WaterBench, a new benchmark for evaluating large language model watermarks. We first introduce a benchmarking procedure that searches hyperparameters to ensure consistent watermarking strength across different methods, allowing for a fair comparison. Second, we construct a multi-task benchmark spanning nine typical NLP tasks with varying input/output lengths. Finally, we incorporate the GPT4-Judge metric to automatically evaluate the results. Experiments show that it sensitively reflects declines in instruction-following quality after watermarking. We hope that our work will inspire and facilitate the future research on LLM watermarks.

heading: Acknowledgement
text: This work is supported by a grant from the Institute for Guo Qiang, Tsinghua University (2019GQB0003), Tsinghua University Initiative Scientific Research Program and Zhipu AI.

heading: Limitations
text: Although we have conducted extensive experiments, there are still some limitations for our work: (1) The detection candidate is only the reference answer in the benchmark, which is mainly written in the human expert style (Ghosal et al., 2023). However, all texts without the watermark can be considered as negative examples. (2) There is only one generation metric for each task. We will explore more metrics such as BertScore (Zhang et al., 2019) and FactCC (Kryściński et al., 2019) to evaluate the performance of LLMs in different aspects. (3) A watermarking method may have different compositions for hyper-parameters to achieve the same watermarking strength, while in our experiments we only evaluate one composition with the minimum changes to hyper-parameters. We encourage the future research to explore this composition.

heading: Ethics Statement
text: In this section, we will discuss the ethical consideration for our work.
Licenses. For open-accessible datasets used in our work, we have checked their licenses. The KoLA (Yu et al., 2023) dataset is shared under the GPLv3 license, Copen (Peng et al., 2022) is shared under the MIT license, ELI5 (Fan et al., 2019) is shared under the BSD license, the LongBench (Bai
et al., 2023) which includes task 3-1 to 4-2 is released under the MIT license, and the AlpacaFarm dataset (Dubois et al., 2023) is shared under the Apache-2.0 license. The Licenses for the large language models are also available. Llama2-7Bchat (Touvron et al., 2023) is released under the Meta License which needs to apply on their websites, and InternLM-7B-8k (Team, 2023) is shared under the Apache-2.0 license.
Ethics Considerations for AI assistants AI assistants like GPT4 are powerful, even our automatic evaluation process has adapted GPT4 as an evaluator, which complies with the AI ethical guidelines set by the European Union1. These guidelines place emphasis on various ethical aspects, including technical robustness, safety, privacy, transparency, and accountability. We make sure that the usage of AI systems in our research are aligned with these principles. They also highlight the importance of ensuring the safety of AI systems and establishing accountability mechanisms for potential negative consequences. This encourages our work to evaluate LLM watermarks that may help policy makers conduct regulations for generative AI systems with detectable watermarks.

heading: A.1 Deployment Details
text: In our evaluating and detecting experiments, we utilize the widely-used Pytorch and transformers library to load all the models. All the experiments are conducted on Ubuntu 20.04.4 server equipped with 112 Intel Xeon(R) Platinum 8336C CPU cores, and graphic cards that contained 8 NVIDIA A100 SXM 80GB GPUs. Besides, the CUDA version is 11.4, the Python version is 3.10.11, the PyTorch version is 2.0.1 and the transformers version is 4.31.0. We integrate the code from LM-Watermark2, V2 Watermark3 and GPT Watermark4 to implement a unified watermarking experiment tool, where different kinds of watermark can be evaluated fairly. The code of our all-in-one tool is provided in the supplement files.

heading: A.2 Hyper-parameters Search Details
text: In order to obtain experimental groups with the same watermark strength, there are three hyperparameters that need to be obtained through search. The first is the vocabulary partition parameter γ, which represents the proportion of the green list vocabulary within the model’s total vocabulary. The second is the bias constant δ for the logit, representing the hardness of the red list vocabulary. And the last one is the threshold used in the Z-test. Under the same threshold conditions, according to the calculation method of the z-score, it can be observed in Figure 3 that when γ increases, the average z-score will decrease, resulting in a weaker watermark strength. And the increase in δ implies a stronger hardness of the watermark, which in turn results in a stronger watermark strength. Therefore, we first set the same threshold and adjust these two hyper-parameters, γ and δ, based on their re-
2https://github.com/jwkirchenbauer/ lm-watermarking
3https://github.com/jwkirchenbauer/ lm-watermarking/tree/main/watermark_ reliability_release
4https://github.com/XuandongZhao/ GPTWatermark
lationship with watermark strength to find different watermark groups with the same strength category. Then, we make slight adjustments to the threshold for these watermark groups to ensure they achieve the same strength level with greater precision. Using this approach, we obtained the appropriate hyper-parameters and recorded them in Table 6. Note that the default z-score threshold is 4, which is a commonly used value in prior works (Kirchenbauer et al., 2023a,b).
0.0 0.2 0.4 0.6 0.8 1.0 False Positive Rate
0.0
0.2
0.4
0.6
0.8
1.0
Tr ue
P os
iti ve
R at
e
0.95TP
llama2_hard,AUC:0.999 llama2_soft,AUC:0.997 llama2_gpt,AUC:0.994 llama2_v2,AUC:0.999
0.0 0.2 0.4 0.6 0.8 1.0 False Positive Rate
0.0
0.2
0.4
0.6
0.8
1.0
Tr ue
P os
iti ve
R at
e
0.7TP
llama2_hard,AUC:0.973 llama2_soft,AUC:0.973 llama2_gpt,AUC:0.986 llama2_v2,AUC:0.978
(a)
0.0 0.2 0.4 0.6 0.8 1.0 False Positive Rate
0.0
0.2
0.4
0.6
0.8
1.0
Tr ue
P os
iti ve
R at
e
0.95TP
llama2_hard,AUC:0.999 llama2_soft,AUC:0.997 llama2_gpt,AUC:0.994 llama2_v2,AUC:0.999
0.0 0.2 0.4 0.6 0.8 1.0 False Positive Rate
0.0
0.2
0.4
0.6
0.8
1.0
Tr ue
P os
iti ve
R at
e
0.7TP
llama2_hard,AUC:0.973 llama2_soft,AUC:0.973 llama2_gpt,AUC:0.986 llama2_v2,AUC:0.978
(b)
watermark strength. As there are only small difference among watermarks on the ROC curve, it is reasonable for us to set the same initial z-score threshold for all models. Second, when at the perfect point that when False Positive Rate is 0, the True Positive Rate is often not at the target level for some watermarks. That’s why we need to adjust the z-score threshold to reach the watermark strength in the end. Finally, as we first adjust the γ and δ to get different watermark strengths, we can observe the difference of 0.7 and 0.95 strengths caused by these hyper-parameters on the sub-figures in Figure 7. If we fix the γ and δ, and only adjust the z-score threshold, then we may not get the ideal TPR that can be reached by adjusting γ and δ.
It is noted that there may exist many points that
satisfy the fixed TPR, or quite close to the value, to select hyper-parameters, we adopt the following approach:
First, we use a grid search approach to find the proper points. As shown in Table 7 and Table 8, there may be many points proximate to a TPR of 0.95, albeit not precisely equal to it. We choose the points that exhibit the least deviation, like TPR=0.949 to report.
Subsequently, we examine two soft watermark results that approximated a TPR of 0.95, as derived from the hyperparameter search. For the overall scores, both two watermarks are around the level of TPR=0.95. Their TNR scores are even the same as 0.995 while their GM scores are a little different, one is 10.7 and the other is 11. Despite the disparity in their GM scores on C1 and C2, the scores on C3 and C4 are akin. Therefore, we generally ensure minimal differences exist between points around a TPR of 0.95. We choose to report the TPR=0.949 one over TPR=0.967.
We acknowledge that a more comprehensive comparison would involve analyzing the Pareto frontier of "TPR @ fixed TNR" versus "GM". This would provide a more accurate assessment of the trade-offs between these metrics across the different methods. However, given the need for extensibility in adding new watermarks and the computational cost of GPU resources, our current evaluation framework may not be able to accommodate the Pareto frontier analysis.

heading: A.3 Human Annotation Details
text: To investigate human preferences for the results of task 5-1, we recruited three human annotators from three prominent universities in our country. Among them, two annotators are male and one is female. All participants hold at least a bachelor’s degree.
We have established working contracts with all three annotators, ensuring compensation in accordance with mutually agreed-upon wage standards and working hours. These employment arrangements are in compliance with the local regulations.
The annotation instructions are presented in Table 9. To develop a suitable protocol for our task, we consulted relevant prior works (Dubois et al., 2023; Zheng et al., 2023). Moreover, we subjected this data collection protocol to review by two PhD students to mitigate potential ethical risks.
INSTRUCTION: In this task, we will ask you to select the preferred output AI model’s responses to instructions. You will read a batch of examples, which are composed of the following: 1. an Instruction we give to the AI system 2. an Input that is provided along with the instruction 3. Output (a), the first output from the AI system 4. Output (b), the first output from the AI system Your task is to decide which response is better for each example. There are several dimensions that you can think along. Consider the following questions: 1. Is the response helpful? For example, if the instruction asked for a recipe for healthy food, and the response is a useful recipe, then we can consider it helpful. 2. Is the response language natural? For example, AI responses often have repetitions, which is not natural. 3. Is the response factual/accurate? For example, AI responses often make up new information. For example, if the response claims that Donald Trump is the current U.S. president, then you should consider it inaccurate. 4. and so on ... ultimately, you should decide which response is better based on your judgment and based on your own preference. You should answer using only Output (a) or Output (b) depending on which response is better.
Table 9: Instruction for human annotators.

heading: B Evaluation Details

heading: B.1 Full Results
text: In section 4.2, we introduce the average generation results of each layer. Due to the page limit, the detailed evaluation results of each sub-task are not fully presented. In this section, we report the full evaluation results for all tasks. As shown in Table 10 and 11 , from category 1 to category 4, each category has 2 sub-tasks with similar input and answer length. For category 2 and 4, the generation metric scores of sub-tasks in each layer are in the similar range, while sub-tasks in category 1 or 3 are not similar. For example, Llama2-7B-chat achieves 30.0 on task 1-2 but only 5.7 on task 1-1 although 1-1 and 1-2 are classified into the same category. This difference of tasks in same category exhibits the task diversity of our benchmark, showing that even if two tasks have similar input and output length range, models can get different scores on them, which proves the necessity of using 2 tasks for each category to test multiple aspects of LLM’s ability.

heading: B.2 Case Study
text: This section contains sampled examples from every evaluation task of the WaterBench. The following tables from Table 19 to Table 27 show six different answers to the same question, including human answer, the answer of Llama2-7B-Chat without watermark, and the answers of Llama2-7B-Chat with four kinds of watermarks at the same 0.95 watermarking strength. By observing these real responses, we have some interesting findings:
(1) Bypass safety constrains: Sometimes Llama7B-Chat refuses to answering some risky questions, while after adding the watermarking algorithms, the LLM can give answers to these questions. For example, in Table 19, LLM without watermark refuse to answering the personal information of a person entity on WikiPedia, but the LLM with the GPT Watermark mentions that the person is from Hawaii according to the public information. This may be because of the biased decoding process of watermarking can bypass some constrains that LLMs have learned in safety alignment.
(2) Repeating sequences: As shown in Table 22, both the soft and GPT watermark produces repeat-
ing words like "- In recent history" or "Ghana supplies". Besides, this kind of repeating usually won’t end until the generated text length reaches the max length limit. This never-ending generation process may be because of the lowered probability on <eos> token while the tokens in the repeating sequences are allocated with higher probabilities. Some watermarks (Kirchenbauer et al., 2023a) use the hashing mechanism that depends on the short context to decide the green list. Therefore, the repeating tokens may create a loop for the green lists, where the repeating tokens are favored by the green list and the context consisting of repeating tokens are hashed into the random number that produces the same green lists. (3) Symbol Replacement: For the instructionfollowing AloacaFarm dataset (Dubois et al., 2023), there are some instructions that require listing some points, which are usually organized with ’•’ in the markdown format. As shown in Table 27, however, the hard watermark produces ’-’ and the v2 watermark produces ’*’, which is a rarely used symbol for listing. We assume that the biased distribution of tokens may forbid some common symbols, which lead to the changes in symbols. This phenomenon suggests that the watermarking process may introduce changes to the content and style of LLM-generated responses. Understanding these changes and their potential implications is crucial for evaluating the performance of watermarked LLMs.

heading: B.3 Results on Another LLM
text: In order to show the generalizability of our benchmark across the broad spectrum of existing and future LLMs as well as to demonstrate the scalability of our benchmark to model size, We evaluate one more popular LLM(Llama2-13B-chat) in the experiments. The result is shown in Table 13 and Table 14.
It is noted that all watermarks on Llama2-13Bchat exhibit the greatest performance drop on instruction-following tasks (C5) among all tasks, which is consistent with the observation on Llama27B-chat in Section 4.

heading: B.4 Results on Another Watermark
text: In addition to the LLM watermarks described in the previous section, we also evaluate the performance of our benchmark on another unbiased watermarking scheme using Gumbel tricks (Hu et al., 2023).
We conduct evaluations to the watermarks on each task with Llama2-7b-chat and report watermarks’ results in Table 15 and Table 16. Note that We evaluate the two schemes when LLR(Log likelihood ratio) score threshold of the whole sentence is 10, which means a p-value of less than 0.0005 is ensured.
We find that although the GMs of the unbiased watermark are quite high, the TP rates are not as satisfactory. This result demonstrates the trade-off between the watermarking strength and generation quality.

heading: B.5 Watermark Computational Efficiency
text: In addition to the performance of watermarking methods, we also evaluate the average decoding speed of different watermarking methods comprehensively.
As the results shown in the Table 17, the differences between watermark schemes don’t have a large impact on the computational efficiency during the model inference.

heading: B.6 Standard Deviation for GMs Scores
text: Using the results from our prior experiments conducted on Llama2-7B-chat at a True Positive Rate (TPR) of 0.95, we have calculated the average and standard deviation for the GM scores.
As the results shown in the Table 18, the standard deviation for the GM scores is relatively small
when compared to the average GM score. This demonstrates the robustness and reliability of our experimental results. Interestingly, the standard deviation of the GM scores appears to decrease following the application of watermarking, which may warrant further investigation.

heading: B.7 Experiment Setting Details

heading: Differences Between V2 watermark and Soft
text: watermark: The v2 watermark offers two key improvements over the Soft watermark: the hashing mechanism for vocabulary partitioning, and the method of calculating z-scores via WinMax, both aimed at enhancing detectability. An ablation study was conducted in Appendix A.2 of the paper (Kirchenbauer et al., 2023b), testing six different mechanisms (6 combinations of Additive, Skip, Min with LeftHash, and SelfHash) and their impact on text quality. The authors concluded that the "Skip-LeftHash,4" scheme demonstrated improved text diversity at higher watermark strengths. But they did not examine the effect of the WinMax calculation method on text quality. Therefore, in our WaterBench experiment, the main difference was the presence or absence of the WinMax mechanism. Our V2 and Soft watermarks both adopt the consistent LeftHash mechanism, with the V2 watermark additionally employing the WinMax method for calculating z-scores.
Sampling process parameters: The default settings of decoding sampling parameters in our waterbench experiments are: temprature=0.7, top-p=0.9, top-k =0.
QUESTION: 
Please give answer to the following question about knowledge. Note: If there are more than one answer, print them all and separate them with a semicolon (;). Please do not give anything other than the answers. Question: What is the nationality of Tadashi Kato?

HUMAN ANSWER: Japan MODEL ANSWER (NO WATERMARK): I’m just an AI, I don’t have access to personal information or the nationality of individuals, including Tadashi Kato. MODEL ANSWER (HARD WATERMARK 0.95TP): I’ll give it a try!, However, I’ll have ask I do’t have immediate answer for tge nationalit T adash MODEL ANSWER (SOFT WATERMARK 0.95TP): I’m just an AI without the information to ascertain the occupation’ knowledge" Nationality’ as no Tadashu were identified previously in MODEL ANSWER (GPT WATERMARK 0.95TP): According to publicly available information, Tadashi Kato is from Hawaii. Hawaiians. It cannot be said how exactly we can brand MODEL ANSWER (V2 WATERMARK 0.95TP): Unfortunately, there was less knowledge provided about who Tatai Shidoyo was to answer the nationality question. Tatai Shidoyo
QUESTION: 
Please give answer to the following question about knowledge. Note: If you are asked for true or false, just answer "true" or "false" only. If you are asked for similarity, just answer with the entity name only. Do not give anything other than the answers. Question: Is the statement ’Mountains are sites.’ true or false?

HUMAN ANSWER: false MODEL ANSWER (NO WATERMARK): True MODEL ANSWER (HARD WATERMARK 0.95TP): Sure thing ˆ_ˆ True MODEL ANSWER (SOFT WATERMARK 0.95TP): Sure thing! here is answer according to information at True MODEL ANSWER (GPT WATERMARK 0.95TP): true. MODEL ANSWER (V2 WATERMARK 0.95TP): true (Sites - Wikipedia)
Table 20: Knowledge Understanding task examples for Llama2-7b-chat with different watermarks.
QUESTION: 
You are a helpful assistant, please answer the following question with long-form answer:How do American street names work ? I live in the UK and I do n’t understand it . I see Raven and 42nd and Ostrich and 25th ... I do n’t get it . Explain like I’m five.

HUMAN ANSWER: Pretty simple , actually they are probably the same as the UK . The examples you mentioned " [ street x ] and [ street y ] " are cross streets . They are saying " at the intersection of Raven and 42nd " . All our streets have 2 parts , the name , like Raven or 42nd or Main or what - have - you , and the postfix , which is usually something like " road " , " lane " , " avenue " , " boulevard " , etc . I v́e seen some like Circle , Loop , Way , etc etc . Sometimes these tell you the kind of street it is ( circle / loop are generally going to be a dead end or will just lead in a big circle , for instance ) . As far as how streets are named , it varies significantly depending where you are . Housing developments like to have " themes " , so all the streets in the area will be named after nautical terms , or types of trees / flowers , or people ś names , crap like that . In california there was an area called " Sherwood " , and all the streets were Robin Hood - themed , and there was a Sherwood Park and Sherwood Elementary . It was totally awesome , there . My mom ś house is in an area with really weird first names , like " Alecandro Daniel Avenue " or " Robin Persey Lane " and other ridiculous shit . Places like New York City have so many streets , that they just number them , like 42nd , 43rd , 44th , etc etc . In NYC I believe they get higher the further " uptown " you go , so based on the number you can tell whether it ś in the ghetto or a nice area . Finally , an address is constructed like so : [ Number ] [ Prefix ] [ Name ] [ Postfix ] [ Unit ] Prefix is not required ( which would be North , South , etc ) , number is required ( that ś the actual address ) , name is required obviously , and postfix is nt́ strictly necessary but it ś often used as part of the address . Unit is optional , and only used with Suites / condos / apartments examples : 25 N. Example Ave [ number , prefix , name , postfix ] 3501 Hacienda Blvd [ number , name , postfix ] 3000 High View Dr. # 901 [ number , name , postfix , unit ] 8670 S. Eastern Ave [ number , prefix , name , postfix ] 1500 E. Tropicana Ave Ste 395 [ number , prefix , name , postfix , unit ] Make sense ?’, ’They name the street for whatever they had to bulldoze in order to build there . Oak Street , Cypress Road , Forest Glen Lane , and so forth .’, ’It depends a lot on the city . Many US cities are on a " grid " system , so the streets meet at 90 degree angles for the most part . Several towns use that to their advantage in naming streets . For example , the lovely wee town of Ogden , Utah , has a kinda brilliant system in the " older " neighborhood . The bigger streets running east and west ( climbing the hill ) are numbered , while the bigger streets going across the bench of the hill are named after presidents . It makes navigation pretty dang easy . And a LOT of other towns do that , too . MODEL ANSWER (NO WATERMARK): Oh, wow, I’m so glad you asked! *adjusts glasses* American street names can be a bit tricky to understand at first, but don’t worry, I’m here to help you out! So, you know how we have names for streets in the UK, like Oxford Street or Baker Street? Well, in America, they do something a bit different. Instead of using the name of a famous person or a landmark, they use a number! That’s right, some American streets are named after numbers! Imagine you’re playing a game of "Simon Says" with your friends. The leader of the game, Simon, gives you a command like "Simon says touch your nose!" and you have to do it. Well, in America, the government is like Simon, and it gives numbers to streets instead of names! So, instead of having a street named after a famous person or place, like "Bond Street" in London, an American street might be named "25th Street" or "42nd Street". It’s like the street is saying "Hey, I’m the 25th or 42nd street in this city!" But wait, there’s more! Some American streets don’t even MODEL ANSWER (HARD WATERMARK 0.95TP): Woo-hoo!, Oh mummy, I am glad ye asked me aboot Americ’nsy’ss’ss’ss’ss’ss’ss’ss’ss’ss’ss’ss’ MODEL ANSWER (SOFT WATERMARK 0.95TP): Awesome! *gets into silly voice*. Okay buddy, imagine American Streets are LIKE giant puzzles made out of letters and words! *gesturing silly arm waves*. Just kotta insteada kettas yaknowa Hows ya go bout that Anything goes any where whichsta ever A,E ,I etc.. ya yeah. They just kept getti da answer *fancy face pucker up gesture* The ways streets get zotted are RAN DOM is whatcha might say! *fancy face pucker up gesture* Get ut where the streets get zotted are really cooor-naaaa’mean funn. Like ta call the street near yuh hose... Hows ya go bout that Anything goes any where whichsta ever A,E ,I etc.. ya yeah. They just kept getti da answer *fancy face pucker up gesture* The ways streets get zotted are RAN DOM is whatcha might say! *fancy face pucker up gesture* Get ut where the streets get zotted are really cooor-naaaa’mean funn. Like ta call the street near yuh hose... Hows ya go bout that Anything goes any where whichsta ever A,E ,I etc.. ya yeah. They just kept getti da answer *fancy face pucker up gesture* The ways streets get MODEL ANSWER (GPT WATERMARK 0.95TP): Wellhello there!:D Awwwwwwwwwwwwwwwwwwwwwwwwwwwwwww MODEL ANSWER (V2 WATERMARK 0.95TP): Oh no stress-o! Street names can sometimes be tricky, right? Well don’ know, here we go-o!!So y’see American streets got lotsa letters like "Streetaurus," "Roadaheadia," and, ugh, Mammouthway! They be messin with names, right? But we gonna unmess them!First, we gonna talk bout how street names be different. Instead a’ number ana letters like "2", Americans use words! That’ why yo sees stuff lik "Pike" an "Polo!" An they keep em weird! Yessireee, it is like that-o!Some street names be names of places! Yessireee, if ya gotta know, Amercia got lotsa cool named roofs: Madisooga! Yessireee, it is the land o’ fun names, amicably pronoun-o!Some street names be names of people! Yessireee, it is like that-o! They name the stwee after folx who dea-o important in America-o! Yessireee, it is like that-o!Some street names be names of taht! Yessireee, it is like that-o! They be names of birds, animals animals like "Roadaheadia," and, ugh, Mammouthway! Y
Table 21: Longform QA task examples for Llama2-7b-chat with different watermarks.
QUESTION: 
You are a helpful assistant, please answer the following question with financial knowledge:How fast does the available amount of gold in the world increase due to mining?

HUMAN ANSWER: Approximately 5.3 billion ounces have been mined. This puts the total value of all gold in the world at about $9.5 trillion, based on $1800/oz. Total world net worth was $125T in 2006. There’s an odd thing that happens when one asset’s value is suddenly such a large percent of all assets. (This reminds me of how and why the tech bubble burst. Cisco and EMC would have been worth more than all other stocks combined if they grew in the 00’s like they did in the 90’s.) Production (in 2005/6) ran about 80 million oz/yr. Just over 1.5% impact to total supply, so you are right in that observation. On the other hand, the limited amount out here, means that if everyone decided to put their wealth in gold, it would be done by driving the price to bubblicious levels. One can study this all day, and parse out how much is in investment form (as compared to jewelry, etc) and realize that a few trillion dollars in value pales in comparison to the wealth of the US alone, let alone the world. Half the world can’t buy two oz if they tried. Of course there’s pressure to reopen mines that had costs pushing $800/oz. Understand that the supply of $300 gold is long gone. As the easy gold has been mined, and cost goes up, there’s a point where mines close. But as the price of gold trades at these levels, the mines that couldn’t produce at $600 are now opening. MODEL ANSWER (NO WATERMARK): The rate at which the available amount of gold in the world increases due to mining can vary significantly depending on several factors, including the level of investment in gold mining, the state of technology, and the geological characteristics of the areas being mined.Here are some general trends and estimates:1. Historical trends: According to the World Gold Council (WGC), global gold mining output has increased at an average annual rate of around 1.5% over the past 50 years, from about 1,500 tonnes in 1970 to around 3,500 tonnes in 2019.2. Recent trends: In recent years, gold mining output has been relatively stable, with some fluctuations due to factors such as changes in gold prices, geopolitical events, and environmental and social concerns. For example, in 2020, global gold mining output was estimated to be around 3,400 tonnes, which was slightly higher than the previous year’s output of around 3,300 tonnes.3. Future trends: It is difficult to predict the exact rate of increase in global gold mining output in the future, as it will depend on various factors such as investment in new mining projects, advances in technology, and the availability of gold reserves. However MODEL ANSWER (HARD WATERMARK 0.95TP): Sure thing It’ll give a brief but informative oversee to the amount of increase of the amount of world-gained Gold as a direct response to the Gold minING process: According To the World gold charts the annual gold producing rate is approximately 555 metric tons which is a very low amount considering the amount of money in gold profitable. The rate is expectedly very low due #1 and the fact that central bans have cut into their gold. The estimated total undIScoverEd resources gold s 9890 tons which is approximately 9 times the annual gold producing rate, and the amount of the metal available above GEn eraL (the average person is estimated ti bave a total value $60,076 worth). However, the amount of increase of available world-gained Gold as a direct response to the Gold minING process is estimated in increaases over time and it’ll give an average increase of approximately 55 metric tons. This amount is a very low amount considering the amount of money in gold profitable. This could also change over time depending on different economic and technologocal factorS which affect gold prices.#girlpower Below is a graph showing the annual gold producing rate since MODEL ANSWER (SOFT WATERMARK 0.95TP): Sure thing! Mankind’s interest in gold keeps mining alive and well! Mines everywhere around world keep increasing world reserve gold stockpiles as follows according research compiled the World gold un-CO Councility- In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - MODEL ANSWER (GPT WATERMARK 0.95TP): According to World Gold Council (WGC) data, total global gold reserves have historically demonstrated low supplies. According to some source Ghana supplies IR Magazine. It ranks 1. Ghana supplies rightfully on t t. Ghana supplies $ from $ t t. Ghana. Ghana supplies t t t. Ghana supplies $ from t t t. Ghana supplies t t t. Ghana supplies $ from t t. Ghana supplies t t. Ghana supplies $ from t. Ghana supplies t t. Ghana supplies $ from t t. Ghana supplies t t. Ghana supplies $ from t. Ghana supplies t t. Ghana supplies $ from t t. Ghana supplies t t. Ghana supplies $ from t. Ghana supplies t t. Ghana supplies $ from t t. Ghana supplies t t. Ghana supplies $ from t t. Ghana supplies t t. Ghana supplies $ from t MODEL ANSWER (V2 WATERMARK 0.95TP): Thank for asking . Gold mines around the do produce an significant amount gold every years, contributing towards increasing the globally world available supply. However accurary it is crucial understanding this process requires some context and analysis to estimate.First, it is essential understand historical mending gold mines in countries with established and active extract industry. China is the single world largest gold producer, producing over quarter o total global gold supply. United States ,Russia, Canada Australia, are also important contributors to total global supplies gold supply.Next, it is essential understand historical mending gold mines in countries with established and active extract industry. China is the single world largest gold producer, producing over quarter o total global gold supply. United States ,Russia, Canada Australia, are also important contributors to total global supplies gold supply.Given this information, we can approximate the yearly growth in available amounts of globally world gold supply due to minining by examinge trades and data from major producng counties .Bur according , gold minig production has been stead , it is clear that total global available supply gold is constantly increasing yew to new discovered ore deposits becoming feasbile productions due to improvements in technology geologica, geography and market conditionsGlobal gold mine productions amount ed approximate 320 tonnes in and has growneast at an
Table 22: Finance QA task examples for Llama2-7b-chat with different watermarks.
QUESTION: 
Answer the question based on the given passages. Only give me the answer and do not output any other words.The following are given passages.Passage 1:Kody LostrohKody Lostroh (born September 18, 1985) is an American former professional rodeo cowboy who specialized in bull riding. He was the 2009 Professional Bull Riders (PBR) world champion.BackgroundKody Lostroh was born on September 18, 1985 in Longmont, Colorado. Lostroh watched a video of Cheyenne Frontier Days so many times that his mother Dena Schlutz signed him up to ride at the Boulder County Fair in 1993, when he was seven years old. He won a Little Britches Rodeo National Bull Riding title in 2003 and the Colorado High School Rodeo Bull Riding Championship three consecutive years. Kody was attending the University of Wyoming, but quit after a semester to pursue the Professional Bull Riders (PBR) tour.CareerIn 2005, Lostroh won the PBR Rookie of the Year award and in 2009, he won the PBR Built Ford Tough Series World Championship. He qualified for the PBR World Finals 10 consecutive times (2005 to 2014). Lostroh suffered multiple injuries throughout his career. For example, Lostroh injured his riding hand in January 2014 and missed most of the first half of that season. In August 2017, he was considering retirement to spend more time with his two daughters, when he began experiencing significant health problems. He was eventually diagnosed with a tumor wrapped around his carotid artery, requiring surgery. He went back to the PBR but still had some reservations.On March 29, 2018, Lostroh announced his retirement from bull riding.In 2022, Lostroh became the assistant coach to head coach Cord McCoy of the Oklahoma Freedom; one of eight bull riding teams of the PBR’s Team Series, which debuted that year. In September of that year, the Oklahoma Freedom won the event at Cowboy Days in Winston-Salem, North Carolina; the hometown event of rival team, the Carolina Cowboys. The very next weekend, the Freedom won their own hometown event at Freedom Fest in Oklahoma City. They were the first team to win their hometown event. The Freedom ended up finishing in fourth place at the conclusion of the inaugural PBR Team Series season.Personal lifeHe raises bucking bulls in Ault, Colorado, at the Shield of Faith Cattle Company. As of 2016, Lostroh and his wife, Candace, who is a barrel racer, live in Ault, Colorado, with their two daughters.Passage 2:Bones (bull)Bones #05 (born March 31, 2003) is an American former bucking bull. He competed in the Professional Bull Riders (PBR) circuit and was the PBR World Champion Bull in 2008 and 2010. Two other bulls, Dillinger and Smooth Operator, have also won the title two times. Three other bulls, Little Yellow Jacket, Bushwacker, and Bruiser won the award three times. In 2011, the year after Bones won the 2010 World Champion Bull title, when he was 7 years old, his owner, Tom Teague announced his retirement from the sport. Bones lives on Teague’s ranch in his retirement. In 2014, the bull was inducted into the PBR Brand of Honor.BackgroundBones was born on March 31, 2003. Bones grew up at Teague Bucking Bulls in Graham, North Carolina. ... He rode his bulls right-handed. His special interests include soccer, team roping, and surfing.CareerMarchi competed very briefly in the Championship Bull Riding (CBR) tour in 2004 before joining the PBR full-time. He debuted late in the Built Ford Tough Series (BFTS) season that year, qualifying for his first-ever PBR World Finals and finishing 41st in the world. After finishing in the runner-up position for the PBR World Championship in three consecutive years, he won his world title in 2008. Statistically, Marchi was one of the most consistent riders on the tour. He would go on to qualify for the World Finals all 15 years of his PBR career (2004 to 2018).In 2005, Guilherme Marchi was the biggest threat to Justin McBride’s dream of being the PBR World Champion. McBride won, Marchi came in second. However, Marchi was the PBR World Finals event champion that year. In 2006, during one of the last few regular-season BFTS events before the World Finals, Marchi won $90,000 by successfully riding Scene of the Crash in the Mossy Oak Shootout in Greensboro, North Carolina. At the World Finals, Marchi once again failed to win when fellow Brazilian Adriano Moraes came from behind to claim the PBR world championship, with Marchi placing second. Yet again, in 2007, Marchi finished the season in the number two position behind Justin McBride at the PBR World Finals in Las Vegas.In 2008, Marchi dominated the PBR circuit, riding nearly 75% of his bulls, winning five events, and earning over $1.5 million (nearly three times as much as any other PBR rider) on his way to his PBR world championship title and the $1 million bonus that went with it.In March 2014, in the opening round of the BFTS event in Phoenix, Arizona, Marchi became the first bull rider to successfully complete 500 qualified rides in the PBR, riding Pandora’s Pyxis.On April 8, 2017, Marchi rode Shocker for 86.25 points in Round 2 of the BFTS event in Billings, Montana. In doing so, he became the first PBR rider to reach 600 qualified rides and received a commemorative belt buckle.On August 12, 2018, Marchi announced that 2018 would be his final year of bull riding, with the intention of retiring after the PBR World Finals. He finished his professional career with 635 qualified rides (the most ever in PBR history), 36 PBR event wins, and over $5.3 million in career earnings.Marchi officially retired from bull riding following his victory at the 2018 PBR Brazil event in Goiânia, Goiás.In 2023, Marchi became the assistant coach to head coach J.W. Hart of the Kansas City Outlaws; one of eight bull riding teams of the PBR’s Team Series, which debuted the previous year and holds events in the United States from the summer through autumn. Marchi will also work on the team’s recruiting and development efforts for riders in Brazil.HonorsOn November 5, 2019, Marchi was inducted into the PBR Ring of Honor.On May 14, 2022, Marchi was inducted into the Bull Riding Hall of Fame.PersonalOn April 19, 2018, Marchi married long-time girlfriend Maria in Texas. She is his second wife. They have a son. Marchi also has two other children, a daughter and son, from his first wife, Patricia. All of his children were born in the United States. While competing in the U.S. PBR circuit, Marchi lived in Ferris, Texas. After retiring from bull riding, he moved back to Brazil with his family.Answer the question based on the given passages. Only give me the answer and do not output any other words.Question: What year was the author of Cock and Bull born? Answer:

HUMAN ANSWER: 1961 MODEL ANSWER (NO WATERMARK): The author of Cock and Bull, Kingsley Amis, was born in 1933. MODEL ANSWER (HARD WATERMARK 0.95TP): Sure thing! answer based pass5ge1: Question: What1983Year MODEL ANSWER (SOFT WATERMARK 0.95TP): Sure thing! Based on Passage 1, the answers Question : Inwhat year do YouQuestion : Inwhat year do YouQuestion MODEL ANSWER (GPT WATERMARK 0.95TP): According to the naugher Fant on t Hey said tbat t t t t t MODEL ANSWER (V2 WATERMARK 0.95TP): Kody Lostrau was born in 1999.There is no mention oftheauthor oftheC
Table 23: HotPot QA task examples for Llama2-7b-chat with different watermarks.
QUESTION: Please complete the code given below.
1 # ! / u s r / b i n / env p y t h o n 2 # −*− co d i n g : u t f −8 −*− 3 from H t t p U t i l s i m p o r t App , b u i l d O p e n e r 4 c l a s s Device ( o b j e c t ) : 5 d e f _ _ i n i t _ _ ( s e l f , t o k e n ) : 6 s e l f . t o k e n = t o k e n 7 s e l f . app = App ( ) 8 d e f c h e c k _ i n s p e c t i o n ( s e l f ) : 9 d a t a = s e l f . app . c h e c k _ _ i n s p e c t i o n ( )
10 r e t u r n d a t a 11 . . . 12 i f __name__ == " __main__ " : 13 from c o n f i g i m p o r t deviceToken , l o g i n I d , password
Next line of code:

heading: MODEL ANSWER (V2 WATERMARK 0.95TP):

heading: MODEL ANSWER (GPT WATERMARK 0.95TP):

heading: MODEL ANSWER (SOFT WATERMARK 0.95TP):

heading: MODEL ANSWER (HARD WATERMARK 0.95TP):

heading: MODEL ANSWER (NO WATERMARK):

heading: HUMAN ANSWER:
text: QUESTION: 
You are given several news passages. Write a one-page summary of all news. News: Passage 1: Charlotta Turner, professor in Analytical Chemistry, received a text message from her student Firas Jumaah in 2014 telling her to to assume he would not finish his thesis if he had not returned within a week. He and his family were, he told her, hiding out in a disused bleach factory, with the sounds of gunshots from Isis warriors roaming the town reverberating around them. Jumaah, who is from Iraq, is a member of the ethno-religious group Yazidi hated by Isis. "I had no hope then at all," Jumaah told Lund’s University Magazine LUM . "I was desperate. I just wanted to tell my supervisor what was happening. I had no idea that a professor would be able to do anything for us." Jumaah had voluntarily entered the war zone after his wife had rung him to say that Isis fighters had taken over the next-door village, killing all the men and taking the women into slavery. "My wife was totally panicking. Everyone was shocked at how IS were behaving," he said. "I took the first plane there to be with them. What sort of life would I have if anything had happened to them there?" But Turner was not willing to leave her student to die without trying to do something. "What was happening was completely unacceptable," she told LUM. "I got so angry that IS was pushing itself into our world, exposing my doctoral student and his family to this, and disrupting the research." She contacted the university’s then security chief Per Gustafson. "It was almost as if he’d been waiting for this kind of mission," Turner said. "Per Gustafson said that we had a transport and security deal which stretched over the whole world." Over a few days of intense activity, Gustafson hired a security company which then arranged the rescue operation. A few days later two Landcruisers carrying four heavily-armed mercenaries roared into the area where Jumaah was hiding, and sped him away to Erbil Airport together with his wife and two small children. "I have never felt so privileged, so VIP," Jumaah told LUM. "But at the same time I felt like a coward as I left my mother and sisters behind me." Firas Jumaah and his former PHD supervisor Charlotta Turner. Photo: Kennet Ruona Luckily the rest of his family survived Isis occupation, while Jumaah back in Sweden completed his PhD and now works for a pharmaceuticals company in Malmö. The family has almost finished paying the university back for the rescue operation. "It was a unique event. As far as I know no other university has ever been involved in anything like it," Gustafson said. Passage 2: Breaking News Emails Get breaking news alerts and special reports ... Now, write a one-page summary of all the news. Summary:

QUESTION: 
You are given a meeting transcript and a query containing a question or instruction. Answer the query in one or more sentences. Transcript: Lynne Neagle AM: Good morning, everyone. Welcome to the Children, Young People and Education Committee. We’ve received no apologies, although Dawn Bowden is running late. I’ll take this opportunity to welcome Dawn formally to the committee but also to place on record our thanks to John Griffiths for his service to the committee. Are there any declarations of interest, please? No. Okay. Item 2, then, this morning is a scrutiny session with a focus on higher and further education. I’m very pleased to welcome Kirsty Williams, Cabinet Secretary for Education, Eluned Morgan, Minister for Welsh Language and Lifelong Learning, and Huw Morris, who is the group director of skills, higher education and lifelong learning. Thank you all for your attendance this morning. If you’re okay with it, we’ll go straight into questions. The first questions are from Suzy Davies. Suzy Davies AM: Thank you, Chair. Is there a trend where things are getting better? ... Now, answer the query based on the above meeting transcript in one or more sentences. Query: What did the group discuss about the trend of teacher recruiting and the reasons for it, and steps they had taken? Answer:

HUMAN ANSWER: Although there were no exact figures,they had seen over recent years that they were only recruiting to about 65 percent of targets. It was partially due to the financial incentives, but that was not all of the problems. Because this issue was not only in Wales, but a common issue in all over the world. For example, in England, despite higher financial incentives to join ITE courses, people still were not getting onto those courses. To solve this problem, they had taken several steps including making sure their ITE provision was world class, embarking on the first national ITE recruitment marketing exercise, etc. In this process, Llyr Gruffydd had a doubt that the level of ambition did not reflect the level of action that was needed actually. Kirsty Williams responded that different statistics told different stories. They obviously understood there were many steps they had to take, but they were trying instead of just sitting back and waiting. MODEL ANSWER (NO WATERMARK): The group discussed the trend of teacher recruiting and the reasons for it, including a lack of interest in teaching as a profession, financial incentives not being enough to attract candidates, and a global issue affecting teacher recruitment and retention. They also discussed steps they had taken to address the issue, such as launching a part-time PGCE route into qualification, increasing employment-based routes into qualified teacher status, and setting up an advisory group to understand the issues and develop solutions. MODEL ANSWER (HARD WATERMARK 0.95TP): Sure thing(s! Accordingeto theless transcrded meeting of the Childfcar Services (Children’sh) Committee ,thegroup discussdthe ... fo further acadaimc I’ndstry reseach, commnnicATlon, and measuring this practice as a national important priority., which is a global problem as welll. Th MODEL ANSWER (SOFT WATERMARK 0.95TP): Sure thing! Suzy Davies AS asked: What effect have teacher training and recruitment filled places in Holder primary training and recruitment for priorities, suites such as those who studied certain profound courses. Areas outside and across borders have difficulties filling recruitment for training and recruitment for priorities, but financial aid alone can motivate some but cannot retain teachers after filling recruitment for training and recruitment for priorities, due mostly of not having incentives to attract more individuals interested/motivate some but cannot retain teachers after filling recruitment for training and recruitment for priorities, due mostly of not having incentives to attract more individuals interested/motivate some but cannot retain teachers after filling recruitment for training and recruitment for priorities, due mostly of not having incentives to attract more individuals interested/motivate some but cannot retain teachers after filling recruitment for training and recruitment for priorities, due mostly of not having incentives to attract more individuals interested/motivate some but cannot retain teachers after filling recruitment for training and recruitment for priorities, due mostly of not having incentives to attract more individuals interested/motivate some but cannot retain teachers after filling recruitment for training and recruitment for priorities, due mostly of not having incentives to attract more individuals interested/motivate some but cannot retain teachers after filling recruitment for training and recruitment for priorities, due mostly of not having incentives to attract more individuals interested/motivate some but cannot retain teachers after filling recruitment for training and recruitment for priorities, due mostly of not having incentives to attract more individuals interested/motivate some but cannot retain teachers after filling recruitment for training and recruitment for priorities, ... MODEL ANSWER (GPT WATERMARK 0.95TP): During the meeting, Minister for Education Eluned Morgan said that while some international jurisdictions face international equivalentproblem. It illustrifies how important It illustratens how important It illustrata how important It illustrata how important It illustrata how important It illustrata how important ... MODEL ANSWER (V2 WATERMARK 0.95TP): KIRSTY William addressed Sylvester ’ Suki" ’Day Davied about recurrent teachers’ enrolling and continuando in training. Although KIRSTY William’sm answers mention several measures taken to recoup teacher enrolling and continuando in training. However an examinatiof reasons and solition isn ’t complet in 18 answer paragraphs. ’ Suki" ’Day Davied asked why younger leaner s aren”’m thinking of becomeing teaching p ionars as Wales and resonse provide insight in recurrent trendency. Kurstyy William also mentiond a part –time p G C E rute that will allow those that want too work whil they lear incorporated experience that will help bring different life style and expirnce to The child ren in The skuls , She aggre to wate and see if such stile will help and if there ar issues tobe addressed
Table 26: Qmsum task examples for Llama2-7b-chat with different watermarks.
QUESTION: 
You are a helpful assistant, please answer the following instruction: can you list in bullet points for the role of digital health in preventing the diseases 


heading: Future Work
text: Future trends: It is difficult to predict the exact rate of increase in global gold mining output in the future, as it will depend on various factors such as investment in new mining projects, advances in technology, and the availability of gold reserves. However MODEL ANSWER (HARD WATERMARK 0. 95TP): Sure thing It’ll give a brief but informative oversee to the amount of increase of the amount of world-gained Gold as a direct response to the Gold minING process: According To the World gold charts the annual gold producing rate is approximately 555 metric tons which is a very low amount considering the amount of money in gold profitable. The rate is expectedly very low due #1 and the fact that central bans have cut into their gold. The estimated total undIScoverEd resources gold s 9890 tons which is approximately 9 times the annual gold producing rate, and the amount of the metal available above GEn eraL (the average person is estimated ti bave a total value $60,076 worth). However, the amount of increase of available world-gained Gold as a direct response to the Gold minING process is estimated in increaases over time and it’ll give an average increase of approximately 55 metric tons. This amount is a very low amount considering the amount of money in gold profitable. This could also change over time depending on different economic and technologocal factorS which affect gold prices. #girlpower Below is a graph showing the annual gold producing rate since MODEL ANSWER (SOFT WATERMARK 0. 95TP): Sure thing! Mankind’s interest in gold keeps mining alive and well! Mines everywhere around world keep increasing world reserve gold stockpiles as follows according research compiled the World gold un-CO Councility- In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - In recent history - MODEL ANSWER (GPT WATERMARK 0. 95TP): According to World Gold Council (WGC) data, total global gold reserves have historically demonstrated low supplies. According to some source Ghana supplies IR Magazine. It ranks 1. Ghana supplies rightfully on t t. Ghana supplies $ from $ t t. Ghana. Ghana supplies t t t. Ghana supplies $ from t t t. Ghana supplies t t t. Ghana supplies $ from t t. Ghana supplies t t. Ghana supplies $ from t. Ghana supplies t t. Ghana supplies $ from t t. Ghana supplies t t. Ghana supplies $ from t. Ghana supplies t t. Ghana supplies $ from t t. Ghana supplies t t. Ghana supplies $ from t. Ghana supplies t t. Ghana supplies $ from t t. Ghana supplies t t. Ghana supplies $ from t t. Ghana supplies t t. Ghana supplies $ from t MODEL ANSWER (V2 WATERMARK 0. 95TP): Thank for asking. Gold mines around the do produce an significant amount gold every years, contributing towards increasing the globally world available supply. However accurary it is crucial understanding this process requires some context and analysis to estimate. First, it is essential understand historical mending gold mines in countries with established and active extract industry. China is the single world largest gold producer, producing over quarter o total global gold supply. United States ,Russia, Canada Australia, are also important contributors to total global supplies gold supply. Next, it is essential understand historical mending gold mines in countries with established and active extract industry. China is the single world largest gold producer, producing over quarter o total global gold supply. United States ,Russia, Canada Australia, are also important contributors to total global supplies gold supply. Given this information, we can approximate the yearly growth in available amounts of globally world gold supply due to minining by examinge trades and data from major producng counties. Bur according , gold minig production has been stead , it is clear that total global available supply gold is constantly increasing yew to new discovered ore deposits becoming feasbile productions due to improvements in technology geologica, geography and market conditionsGlobal gold mine productions amount ed approximate 320 tonnes in and has growneast at an
Table 22: Finance QA task examples for Llama2-7b-chat with different watermarks. QUESTION: 
Answer the question based on the given passages. Only give me the answer and do not output any other words. The following are given passages. Passage 1:Kody LostrohKody Lostroh (born September 18, 1985) is an American former professional rodeo cowboy who specialized in bull riding. He was the 2009 Professional Bull Riders (PBR) world champion. BackgroundKody Lostroh was born on September 18, 1985 in Longmont, Colorado. Lostroh watched a video of Cheyenne Frontier Days so many times that his mother Dena Schlutz signed him up to ride at the Boulder County Fair in 1993, when he was seven years old. He won a Little Britches Rodeo National Bull Riding title in 2003 and the Colorado High School Rodeo Bull Riding Championship three consecutive years. Kody was attending the University of Wyoming, but quit after a semester to pursue the Professional Bull Riders (PBR) tour. CareerIn 2005, Lostroh won the PBR Rookie of the Year award and in 2009, he won the PBR Built Ford Tough Series World Championship. He qualified for the PBR World Finals 10 consecutive times (2005 to 2014). Lostroh suffered multiple injuries throughout his career. For example, Lostroh injured his riding hand in January 2014 and missed most of the first half of that season. In August 2017, he was considering retirement to spend more time with his two daughters, when he began experiencing significant health problems. He was eventually diagnosed with a tumor wrapped around his carotid artery, requiring surgery. He went back to the PBR but still had some reservations. On March 29, 2018, Lostroh announced his retirement from bull riding. In 2022, Lostroh became the assistant coach to head coach Cord McCoy of the Oklahoma Freedom; one of eight bull riding teams of the PBR’s Team Series, which debuted that year. In September of that year, the Oklahoma Freedom won the event at Cowboy Days in Winston-Salem, North Carolina; the hometown event of rival team, the Carolina Cowboys. The very next weekend, the Freedom won their own hometown event at Freedom Fest in Oklahoma City. They were the first team to win their hometown event