Duwak: Dual Watermarks in Large Language Models (2024)

Abstract: As large language models (LLM) are increasingly used for text generation tasks, it is critical to audit their usages, govern their applications, and mitigate their potential harms. Existing watermark techniques are shown effective in embedding single human-imperceptible and machine-detectable patterns without significantly affecting generated text quality and semantics. However, the efficiency in detecting watermarks, i.e., the minimum number of tokens required to assert detection with significance and robustness against post-editing, is still debatable. In this paper, we propose, Duwak, to fundamentally enhance the efficiency and quality of watermarking by embedding dual secret patterns in both token probability distribution and sampling schemes. To mitigate expression degradation caused by biasing toward specific tokens, we design a contrastive search to watermark the sampling scheme, which minimizes the token repetition and enhances the diversity. We theoretically explain the interdependency of the two watermarks within Duwak. We evaluate Duwak extensively on Llama2 and Vicuna under various post-editing attacks, against four state-of-theart watermarking techniques and combinations of them. Our results show that Duwak marked text achieves the highest watermarked text quality at the lowest required token count for detection, up to 70% tokens less than existing approaches, especially under post paraphrasing. Our code is available at https://github. com/chaoyitud/Dual-Watermarks.

text: Findings of the Association for Computational Linguistics ACL 2024, pages 11416–11436 August 11-16, 2024 ©2024 Association for Computational Linguistics
As large language models (LLM) are increasingly used for text generation tasks, it is critical to audit their usages, govern their applications, and mitigate their potential harms. Existing watermark techniques are shown effective in embedding single human-imperceptible and machine-detectable patterns without significantly affecting generated text quality and semantics. However, the efficiency in detecting watermarks, i.e., the minimum number of tokens required to assert detection with significance and robustness against post-editing, is still debatable. In this paper, we propose, Duwak, to fundamentally enhance the efficiency and quality of watermarking by embedding dual secret patterns in both token probability distribution and sampling schemes. To mitigate expression degradation caused by biasing toward specific tokens, we design a contrastive search to watermark the sampling scheme, which minimizes the token repetition and enhances the diversity. We theoretically explain the interdependency of the two watermarks within Duwak. We evaluate Duwak extensively on Llama2 and Vicuna under various post-editing attacks, against four state-of-theart watermarking techniques and combinations of them. Our results show that Duwak marked text achieves the highest watermarked text quality at the lowest required token count for detection, up to 70% tokens less than existing approaches, especially under post paraphrasing. Our code is available at https://github. com/chaoyitud/Dual-Watermarks.

heading: 1 Introduction
text: Large language models (LLMs) are widely adapted for natural language tasks, including copywriting (OpenAI, 2022), machine-translation (Zhang et al., 2023), questioning and answering (Touvron et al., 2023a), and code generation (Rozière et al., 2023). While LLMs achieve remarkable and human-like performance, there are increasing
risks of abusing LLM’s (Kuditipudi et al., 2023) to produce incorrect and adversarial content on social media and to commit fraud in academic rights. Watermarking LLM content is one of the essential solutions to govern the LLM applications and guardrail their misuse and harm to the society, even requested by the governmental policies (Veale and Zuiderveen Borgesius, 2021). Much like physical watermarks, embedding watermark signals on LLM-generated text provides the means to trace content to their generator as well as the LLM models that constantly evolve.
Key criteria for watermarking generative language models are multiple folds: having minimal degradation of the generated content quality, imperceptible to humans for avoiding alteration, detectable by machines for rigorous auditing, and robust against post-text editing. Recent studies show that a single watermark pattern can be hidden in generated text through either altering the underlying token probability distribution (Kirchenbauer et al., 2023a; Yoo et al., 2023; Fernandez et al., 2023) or modifying the sampling strategy (Kuditipudi et al., 2023; Christ et al., 2023; Aaronson, 2022). While the existing watermarks achieve multiple criteria, their practicability on short texts and post-edited text is limited, as the minimum number of tokens required for successful detection, e.g., low false positive rate, under those scenarios is high.
In this paper, we propose a dual watermarking approach, Duwak, which improves the watermark detection efficiency and text quality by embedding two independent secret patterns into the token probability distribution and sampling scheme. To detect the watermark, Duwak searches for the union of these two watermarks—the enabler for efficient detection with a low token count. Under Duwak, we first modify the pre-activation logits of pseudo-randomly selected tokens seeded by a function (i.e., hash) of a prior token sequence and
11416
a secret key, similar to green-red list watermarking approaches (Kirchenbauer et al., 2023a; Yoo et al., 2023; Wang et al., 2023b; Zhao et al., 2023). Consecutively, we randomly split the token into the normal and watermark sampling set, which embeds an additional random number sequence seeded by a second secret key.
The challenge lies in efficiently detecting watermarks without degrading quality. It is known that watermarking activation signals inevitably degrade the text quality due to the bias term on a pseudorandom selection of tokens (Welleck et al., 2020; Kuditipudi et al., 2023). To counteract this degradation, we advocate the use of a quality aware sampling scheme—the contrastive search, which limits token sampling to top-k tokens resulting in the lowest similarity w.r.t. previous generated tokens. Unlike the popular cryptographic sampling, the contrastive search marks sampling patterns, thereby improving the text expression, improving the diversity of token selection and thus the watermarked text quality (Ren et al., 2023; Liu et al., 2023).
Our contributions are summarized in the following: Improving watermark efficiency, through Duwak’s joint dual watermarks patterns in the token probability distribution and sampling scheme. Increasing generation diversity and robustness, by avoiding expression degradation of watermarked text. Duwak includes a novel quality-aware sampling scheme based on the contrastive search.
Empirical evaluation showing the effectiveness of Duwak against existing watermark solutions under nine post-editing attacks. Thereby showing the minimum number of tokens required to reach detection accuracy is up to 70% lower than related work, with nearly the best text quality and diversity.

heading: 2 Background
text: LLM text synthesis Large language models are typically transformer-based neural networks, denoted by M and parameterized by θ. Internally, these models tokenize the vocabulary into a set, V , and generate a token sequence indexed by i, xi≥0, based on the prompt text, which is represented as a token sequence with negative index xi<0. Generally, generative LLMs ‘complete’ a provided sequence (prompt) in an auto-regressive fashion, i.e., the token of t-th position is based on the prompt and thus far generated tokens, i.e., tokens xi<t, from here on notated simplified as x<t. The token generation consists of two stages. First, the LLM estimates the probability scores of the succeeding token xnt for all |V| tokens at the position t, ∀n ∈ V by softmaxing the model’s output logits, lnt = lθ (· | x<t)n,
pθ(·|x<t)n = softmax(lt)n, ∀n ∈ V.
The second step is to sample the token based on the estimated probability distribution. Common sampling schemes differ in their objectives and complexity: greedy search, beam-search, topk sampling (Fan et al., 2018a), nucleus-sampling (top-p) (Holtzman et al., 2020), multinomial (random) sampling, and contrastive search (Su et al., 2022).
Watermarking LLM Watermarks are typically embedded in the process of next-token generation through altering: (i) the logit and probability (Kirchenbauer et al., 2023a; Yoo et al., 2023; Lee et al., 2023a) and (ii) the sampling scheme (Aaronson, 2022; Christ et al., 2023; Kuditipudi et al., 2023). To change the probability distribution, the key idea is to split the vocabulary tokens into a green (preferred) and red list, V ∈ G ∪ R, via a random number that is hashed from a secret key and an aggregate of previous h tokens. The number
of green tokens is controlled by hyper-parameter γ by taking |G| = γ|V|. The logit values of green tokens receive a bias δ, thereby increasing their probability estimates, thus increasing the likelihood of them being selected. The sampling scheme can remain the same as the original LLM. Consequently, watermarked text is expected to have an increase in the number of green tokens. In contrast, sampling-based approaches are deterministic while keeping the model’s next token probability estimate untouched. Aaronson (2022) propose an exponential scheme and choose the token xt = argmaxn∈V { (rn) 1 pn } , where p is the unaltered probability vector and r ∈ [0, 1]|V|, is the random number vector generated by hashing the prior h tokens and the secret key.
Detecting Watermarking Detecting watermarks requires inspecting a sequence of N tokens and computing their watermark likelihood score, SN . The exact score computation depends on watermarking methods. In the case of logit modification through the green-red list (Kirchenbauer et al., 2023a), every token is classified into the green or red list based on the random split, conditioned on the random number sequence seeded by prior tokens and secret key. The total number of green tokens is the score. As for the sampling approach, e.g., Aaronson (2022), computes a pre-determined threshold is exceeded by negative summation of∑
i∈N ln(1− ri). Here the intuition lies in the fact that a token with low pi would require an ri arbitrarily close to 1, thus limiting their contribution to the computed score. This metric essentially measures the aggregate deviation from the expected distribution of tokens under the manipulation of random number vector r.
Watermarking Measures There are multiple measures for watermarking algorithms: text quality, detection efficiency, and robustness. In terms of quality, perplexity (Kirchenbauer et al., 2023a; Wang et al., 2023a; Kuditipudi et al., 2023) metrics, rating from another (larger) LLM (Kocmi and Federmann, 2023; Piet et al., 2023), and diversity (Su et al., 2022; Kirchenbauer et al., 2023b) are used to assess the (watermarked) LLM text. As for detection efficiency and robustness, it measures the number of N tokens needed to achieve significant detection tests under differentattacks, e.g., insertion, deletion, and paraphrasing (Piet et al., 2023).
Z-statistic and p-value (Kirchenbauer et al., 2023a) are commonly used to evaluate the signifi-
cance of the detection test, assuming the detection scores follow the normal distribution with a mean of µ and standard deviation of σ. The null hypothesis of the detection test is that H0: the text is unwatermarked. The Z-statistics represents the normalized observed score value, which is subtracted by the estimated mean and standard deviation. And, its corresponding p-value represents the probability of having a normalized score higher than observed Z under the H0, i.e., the text is not watermarked.
3 Duwak: Dual Watermarking
The objective of Duwak is to maintain the watermarked text quality while keeping high detection efficiency, i.e., high detection confidence by inspecting a low number of tokens. Duwak embeds two secret watermark signals sequentially in the token probability distribution and token sampling scheme as shown in Fig. 1. To mitigate the text distortion caused by modifying the token probability, we design a contrastive search sampling scheme that increases the diversity via selecting tokens with low similarity among the top-k ones. We elucidate the interdependency through the joint watermarking scheme of Duwak, demonstrating that the two watermarks can be integrated efficiently with an efficiency guarantee.

heading: 3.1 Token Probability Watermark
text: To generate token xt from a given prompt and prior generated token sequence, Duwak first alters the token probability distribution pt → p̂t by altering the logit values for a subset of n ∈ V . Specifically, a secret key κtp and the prior sequence of window h, i.e., xt−h≤t≤t−1, are inputs to a pseudorandom number generator, RNG, for generating a fixed-length pseudo-random number sequence. Consecutively, each random number is used to split the token into binary types, i.e., green v.s. red. Generally, the secret keys used during watermarking are only known to the owner. Such a design guarantees that only the watermark owner can identify and decode the watermarked tokens, embedding a layer of security and specificity within the generated text. Following (Kirchenbauer et al., 2023a), a bias term, δ, is added to the logit of tokens on the favored list, termed green list, while keeping logits of nonbiased tokens, coined red list, remains unchanged. As the token probability distribution is computed as taking the softmax function on the logit, shown in Eq. 1, the token probability distribution is thus mod-
ified, risking text quality degradation. The higher the δ value, the higher the distortion to the probability and thus higher the possibilityof degradation in text quality. We note that Duwak is compatible with any probability modification proposed in existing watermarking algorithms, and we, in practice, adopt the algorithms derived in (Kirchenbauer et al., 2023b). More specifically, defining pnt as,
p̂nt = exp
( ln + 1 [ n ∈ G ] δ )
∑ i∈V exp ( li + 1 [ i ∈ G ] δ ) , (1)
where 1[c] is 1 when c holds, otherwise 0.

heading: 3.2 Contrastive Search Watermark
text: One of the known limitations of LLM is anisotropic representation—repetitive wording and degenerated expression (Ethayarajh, 2019; Su et al., 2022; Su and Collier, 2023). To avoid such degradation, (Su and Collier, 2023) define a self-similarity measure of token xt with respect to all other tokens in the vocabulary V , i.e., xj∈V \{i}. A higher value of self-similarity suggests a more isotropic representation space. To address the isotropic degradation, the token is then sampled to maximize the summation of the weighted token probability and the penalty of self-similarity.
We adapt such a contrastive search principle into a watermark sampling scheme in a sliding window manner. This approach not only incorporates a distinctive sampling scheme but also significantly enhances the diversity of text generation. Effectively reducing token repetition and mitigating text degeneration, leading to more coherent and varied output. Here, token at position t, are split into two sets, (i) C with a probability η, subject to contrastive search sampling, and (ii) C with a probability 1−η, where standard multinomial sampling is applied. The segmentation into C and C is facilitated by a pseudo-random number generator that leverages a hashing value of previous tokens and a watermark key, κcs.
Contrastive searching sampling aims to reduce the similarity to the prior L token sequence. For all the contrastive set, we limit the selection to the topk tokens, i.e., V (k)t , with the highest kth probability. The top-k sampling is designed to reduce the risk that unlikely tokens are sampled (Fan et al., 2018b), reducing the search space of contrastive search. We then choose a token, v ∈ V (k)t that maximizes the weighted probability and minimizes self-similarity with respect to the prior L tokens.
We first define the similarity between xt and xt−L≤j<t as the cosine distance between their hidden state, s ( hxt , hxj ) = cos(hxi , hxj ), where hxi and hxj represent the last layer hidden states in the model of token xi and xj respectively, and cos is the cosine-similarity between embeddings. Extending it to the L window, the self-similarity of xt is computed as the maximum value with respect to all L prior tokens, xt−L≤j<t, i.e., sL(xt) = maxt−L≤j<t { s ( hxt , hxj )} .
A sliding window L increases generation efficiency by limiting the similarity computation to L preceding tokens. Moreover, it increases robustness against attacks by limiting the context on which the watermark is conditioned. The token is finally chosen by maximizing the weighted probability, p̂vt and similarity penalty, ·sL(xvt ), where α is a hyper-parameter that balances the importance of the weighted probability of the token against its self-similarity penalty.
xt = argmax v∈V(k)
{ (1− α) · p̂vt − α · sL(xvt ) } (2)
Algorithm 1 Duwak Token Generation.

heading: Input: θ, κtp, κcs
text: Params: RNG, k, L,Hash, η, sL Output: xt ∈ V
1: function DUWAKGENERATE 2: seed← hash(x<t) 3: r ← RNG(seed, κcs) 4: procedure TOKENPROBWATERMARK 5: G ← RNG(seed, κtp) 6: Compute p̂nt as Eq. 1 7: procedure CSWATERMARK 8: if r < η then 9: V(k)t ← topk(p̂t)
10: Contrastive search as Eq. 2 11: else 12: xt ∼ Multinomial(p̂t) 13: return xt
3.3 Detection in Duwak To detect the watermarks within a text sequence x of length T , we employ hypothesis testing to differentiate between the null-hypothesisH0: “the text is generated naturally” and the alternative hypothesis H1: “the text is generated with Duwak.”
Given the incorporation of two distinct watermarks, we treat the detection of each as two
Algorithm 2 Duwak Watermark Detection.

heading: Input: θ, κtp, κcs
text: Params: γ, T, η,M,L Output: p-value ∈ [0, 1)
1: function DUWAKDETECTION 2: procedure COMPUTE_Ptp 3: ϕtp ← ∑T t=1 1 [ xt ∈ Gt ] 4: ztp = ϕtp−γT√ Tγ(1−γ) 5: Ptp = 1− Φ(ztp) 6: procedure COMPUTE_Pcs 7: Pcs ← 1 8: for κm ∈ {κm | κm ̸= κcs}Mi=m do 9: Pcs ← Pcs + 1 [ ϕ (κm) cs ≥ ϕ(κcs)cs ]
10: Pcs ← 11+MPcs 11: P ← 1− Fχ2(x, 4) where x = −2(ln(Ptp) + ln(Pcs)) 12: return P
separate and independent tests. We first detect token probability and constrastive search watermark independently and compute their p-values, namely, Ptp and Pcs, against the full hypothesis that the text is not altered by token probability (constrastive search) watermark. We then apply Fisher’s method (Fisher, 1922) to that combining p-values from these two independent tests into a single statistic follows a chi-square (χ2) distribution with d = 4 degrees of freedom:
−2(ln(Ptp) + ln(Pcs)) ∼ χ2(4).
Furthermore, the resulting p-value P , derived from the chi-square distribution, is given as:
P = 1− Fχ2 (−2 (ln(Pkgw) + ln(Pcs)) , 4) ,
where Fχ2 is the cumulative distribution function (cdf) for the chi-square distribution. This provides a unified statistical measure to assess the presence of watermarks in the text.
To compute the p-values for both watermarks, we resort to a concept of score, ϕ, which represents the discernible discrepancy between watermarked and non-watermarked texts. Higher the score, stronger the evidence of watermarked text. We explain how to derive the p-values from their detection scores.
P-value of token probability watermark (Ptp). We use the number of detected green-listed tokens of the T token sequence as the score, i.e., ϕtp = ∑T t=1 1 [xt ∈ Gt], where Gt is generated
from RNG (hash (x<t) , κ), which based on the watermark key and preceding tokens. To assert its significance, we apply a Z-test on ztp =
ϕtp−γT√ Tγ(1−γ)
and then compute the corresponding p-value, as Ptp = 1− Φ(ztp), where Φ is the cumulative distribution function of normal distribution.
P-value of contrastive search watermark (Pcs). As the score distribution in non-watermarked text is unknown, our proposed score for the contrastive search watermark is based on self-similarity difference between the contrastive set, C and noncontrastive set C, split by using the key κ. Intuitively, the score is higher when the correct key, κcs, is used to split the set, compared to using arbitrary keys. To assert the statistical significance in the score difference, we propose to compare the scores between using the known private key κcs and other M randomly chosen keys, κ1≤m≤M .
We first formally define these two sets as, C and C. Following that we define the score of contrastive search watermark using any key κ as
ϕ(κ)cs = − (∑
t∈C sL(xt) |C| −
∑ t∈C sL(xt)
T − |C|
) .
(3) We then compute the score for the key, κcs and κm, and count the number of times that the score of using κm is higher than κcs, Finally, we approximate the p-value of contrastive search as,
Pcs = 1
M + 1
( 1 + M∑
m=1
1 [ ϕ (κtp) cs ≥ ϕ(κcs)cs ] ) .

heading: 3.4 Theoretical Analysis
text: The following theorem shows that two watermarks do not influence each other.
Theorem 3.1 (Green List Tokens using topk). Given X = {x1, . . . , xT } from an LLM with green list fraction γ, and token n’s adjusted probability at t follows Eq. 1. Define V (k)t as the set of topk tokens by p̂nt ,with xt ∼ Uniform(V (k)t ). Given E|V kt |G ≥ ν, then the expectation and variance of the count of green list tokens |x|G inX are bounded as follows:
E|x|G ≥ ν k T, Var |x|G ≤ T · ν (k − ν) k−2.
In our theorem, we describe a bound that elucidates the interdependency between two watermarks. We model the contrastive search as akin to uniformly sampling from the top-k candidates. By
influencing the selection among the top-k tokens based on historical similarity, with a large vocabulary size |V| and a small k, the process effectively approximates random selection. The theorem sets bounds on the expectation and variance of "green list" tokens, based on the limit of mean green token selection within the top-k candidates. This effectively outlines the interdependency between the two watermarks in our Duwak.

heading: 4 Evaluation
text: In this section, we first detail the evaluation setup on the LLM prompts and evaluation tasks. The evaluation metrics are the quality of watermarked text and the token count needed to achieve certain detection p values under normal conditions and various post-editing attacks. We compare Duwak against existing single watermark techniques and combinations thereof.

heading: 4.1 Evaluation setup
text: Prompt. For evaluation, we use open-ended generation (Su and Collier, 2023) and MarkMyWords’ (Piet et al., 2023) structured tasks. The detailed settings can be found in Appendix C.1.
Models. In our experiments, we utilize two primary models: Llama2-7b (Touvron et al., 2023b) and Vicuna-7b-v1.5 (Zheng et al., 2024).
Evaluation metrics. To evaluate watermark methods, we use the following metrics: Diversity, MAUVE, Rating, and Detection efficiency. Details on these metrics and their configurations are provided in Appendix C.2.
Baseline. A summarized baseline overview is given in Tab. 1 (i) the Kirchenbauer-Geiping-Wen (KGW) algorithm (Kirchenbauer et al., 2023a), Exponential (EXP) (Aaronson, 2022), Binary (Christ et al., 2023) (BINARY), Inverse Transform Sampling (Kuditipudi et al., 2023) (ITS) and Contrastive Search (CS) (ours) are the single watermarking algorithm, and (ii) KGW-EXP, CS-EXP, and Duwak (ours) are the dual watermark algorithms. We highlight where the watermark signals are inserted in the token probability or sampling. For dual watermarking schemes, we conduct the χ2 test on the p-value of each watermark as Duwak. Hyper-parameter setting. For a fair comparison across algorithms, we limit the hashing input to the first preceding token to generate watermark seeds for all watermarking algorithms. As for the fraction of green tokens, γ|V| under KGW proba-
bility modification, we use a fixed γ = 0.5. The detection window of Duwak is set as L = 50 token, and the probability of contrastive search is η = 0.5.

heading: 4.2 Results
text: Quality v.s. detection efficiency. We summarize the overall results in Tab. 2 and Tab. 3, highlighting the difference among human, unaltered LLM, and watermarked LLM text from all the watermarking methods. First of all, human-written text shows the highest diversity and MAUVE scores. Regarding the quality of the watermarked text, Duwak ranks as the first or the second-best method in terms of diversity, MAUVE, and rating, achieving similar results as the unaltered LLM text. CS achieves the highest diversity and MAUVE as expected among the single watermarks. Among dual watermarks, the direct combination of the common probability modification (KGW) and token sampling (EXP) deteriorates text quality due to the EXP sampling method, which heavily biases the modified token probability. Overall, including contrastive search improves the text quality to its CS-less counterpart.
The efficiency of detection of watermarks measures the number of tokens needed to detect watermarks with p-values of 0.02. EXP-CS is the only exception because both watermarks are embedded in the sampling process and interfere with each other, arguing the risk of blending multiple watermarks. On the other hand, a single watermark
requires a significantly higher number of tokens, especially for BINARY, ITS, and CS, strengthen the watermarked text’s robustness and quality.
Fig. 2 provides a sensitivity perspective of watermark methods under different hyper-parameter settings and p-values, 0.02 and 0.05. Specifically, different δ values are used in KGW probability modification. Duwak shows more consistent performance across all δ’s compared to KGW, i.e., slightly higher rating and lower tokens with a lower variance. This trend continues for a p-value of 0.05, with a more pronounced difference in their required token counts. Specifically, when compared to the best KGW watermark, our algorithm requires ∼ 40 fewer tokens. When p-values are smaller, the number of tokens needed for detection increases considerably. Duwak achieves the best quality efficiency ratio, high diversity, MAUVE, and rating, using fewer tokens to detect watermarks accurately compared to other watermarking methods.
Post-editing attack robustness. Here, we evaluate the robustness of Duwak under different postediting attacks, i.e., attacks that alter the tokenization. Specifically, we consider contraction, lowercase, misspelling, repetition, swap, synonym, translation, typo, and paraphrase attacks from MarkMyWords (Piet et al., 2023). Tab. 4 and Tab. 5 present the efficiency of reaching a p-value of 0.02 under KGW, EXP, and Duwak. Such a selection is based on the observation in Tab. 2 that only these three methods achieve reasonable text quality while inspecting roughly 100 tokens.
In Tab. 4, while EXP shows the best efficiency in the no-attack scenario (through significant inference quality), Duwak requires significantly lower
tokens for inspection in the presence of attacks, i.e., ranging between 6 to 70%. The presence of attacks clearly increases the need to consider more tokens for all watermark methods. Let’s zoom into the performance of Duwak against each of those attacks, in contrast to the cast of no attack. TypoAttack significantly increases the detection difficulty and results in a more than 3× increase in the number of tokens. Misspelling and repetition&deletion, swap, and synonym (25%) are simple attacks, even reducing the number of inspection tokens. Paragraphs and TypoAttack are where Duwak has the best performance, compared to EXP, the secondbest policy. We attribute this difference to the two watermarks and no interference among them. Additionally, Duwak benefits from incorporating two distinct watermarks that operate without mutual interference, thereby enhancing its robustness. In results from Vicuna-7b-v1.5, as shown in Tab. 5, we observe similar trends in performance. However, under some attacks, particularly simpler ones, EXP achieves better efficiency. Nevertheless, in more severe scenarios, especially with strong attacks like the paraphrase attack, Duwak significantly outperforms EXP, demonstrating its robustness in handling more complex attacks.
Impact of contrastive search sampling. Here, we highlight the impact of contrastive search compared to the single KGW watermark. In Fig. 3, we show the rating and the number of inspected tokens to achieve a p-value of 0.02 under the different distribution shifting(δ ∈ {2.5, 3, 3.5}) with clean and paraphrase attack versions. Unsurprisingly, Duwak outperforms KGW due to the addition of contrastive search, such the advantage diminishes with increasing δ. When δ is large, e.g., 3.5, it introduces a large distortion in the generation probability, leaving little room for Duwak to further improve the quality. In the case of the challenging
paraphrasing post-attacks, shown in Fig. 4b, one can observe the clear advantage of using contrastive search. This observation again verifies our design of dual watermark, which is inherently more robust to the post-editing when compared to the tokenlevel approaches of prior art.

heading: 5 Related Studies
text: Prior single watermark solutions embed the watermark signal at the token level with a modification of the generation process by modifying either the token probability distribution (Lee et al., 2023b; Wu et al., 2023; Takezawa et al., 2023) or sampling scheme (Aaronson, 2022; Christ et al., 2023; Kuditipudi et al., 2023).
Watermark in token probability distribution. Kirchenbauer et al. (2023a) design the very first single-bit watermark method for LLM text generation, splitting tokens into a green and red list using a cryptographic key.
To further improve the text quality and robustness, subsequent studies modify the criteria of green-red splits. Zhao et al. (2023) prove that global red-green splits improve robustness against post-editing attacks, whereas Kirchenbauer et al. (2023b) propose to use the minimum hashed token to determine the red-green list.
Furthermore, to improve the governance of watermarks and provide additional information, e.g., copyright and timestamp, multi-bit watermarks (Wang et al., 2023b; Yoo et al., 2023; Fernandez et al., 2023) are proposed, introducing messagespecific red-green lists. We note that such watermarks split the text into multiple sections, each of which has only a single watermark in their token probability, whereas our solution embeds up to two watermarks into a single token.
Watermark in Sampling Binary watermark (Christ et al., 2023) samples the token based on the comparison of the predicted probability and the pseudo-random presentation. Because of the fixed length of pseudo-random numbers, the LLM can end up generating the same text for the same prompt. Kuditipudi et al. (2023) propose the usage of longer pseudo-random number sequences than the generated text itself and randomly choose the insertion location in the text to add the watermark. Hou et al. (2023) resort to watermarking via sentence-level sampling, which iteratively performs sentence-level rejection sampling until the sampled sentence falls within
the watermarked region. We note that orthogonal to watermark detection is more general detection of whether text is synthesized by LLMs (Solaiman et al., 2019; Gehrmann et al., 2019; Mireshghallah et al., 2023; Mitchell et al., 2023). However, as traceability to specific models cannot be provided, these detection works are limited in their application for the governance of synthesized text.

heading: 6 Conclusion
text: In this paper, we propose a dual watermark scheme for LLM, Duwak, which embeds human imperceptible and machine detectable watermarks in token probability distribution and sampling schemes. Combining two watermarks significantly decreases the minimum number of tokens for detecting watermarks with a desirable false positive rate, especially when encountering post-editing attacks. To avoid text quality degradation due to watermarking token probabilities, we design a contrastive search sampling scheme that samples tokens with the lowest similarity. We show the effectiveness of Duwak by providing a theoretical lower bound on the watermarked tokens and extensive empirical evaluation. Compared against existing single watermark solutions and combinations thereof, Duwak provides a better watermarked text quality. This is especially highlighted in terms of diversity, and robustness against nine post-editing attacks, using up to 70% less tokens for detection.

heading: 7 Limitation
text: This study introduces advancements in watermarking techniques for Large Language Models (LLMs) through Duwak, while also recognizing certain limitations that warrant future investigation. Firstly, our approach’s effectiveness is contingent on the specific characteristics of the LLMs evaluated, primarily Llama2. Consequently, the applicability of Duwak to different models and subsequent versions of LLMs is a subject that merits further exploration. Moreover, our evaluation was restricted to text-generation tasks. The extension of our methodology to encompass additional tasks, such as the generation of mathematical proofs or code, remains an area requiring in-depth study. Additionally, Duwak necessitates conducting two separate detection processes for each watermark, which results in a decrease in detection time efficiency compared to single watermark methods.

heading: Impact Statements
text: With the popularity of large language models and their applications, embedding watermarks into their generated content is an essential step toward trustworthy and responsible AI technology development and deployment. Our findings of improved watermark detection performance and utility provide novel insights into the research and practice of watermarking for large language models.

heading: Acknowledgment
text: This work has been partly funded by the Dutch National Science Foundation Perspectief Project, DEPMAT.

heading: A Nomenclature
text: α Parameter balancing the importance of token probability and self-similarity in contrastive search.
θ Large language model parameters used for text generation.
δ Bias term added to the logits of tokens on the green list to alter their probabilities.
η Probability determining whether contrastive search or multinomial sampling is used for token generation.
γ Portion of the vocabulary designated as the green list in the token probability modification process.
p̂nt The probability distribution over tokens after applying watermark modifications.
κcs, κtp Secret keys used for embedding watermarks in the text.
G A subset of tokens selected for next word generation, influenced by a watermark key. V The set of all possible tokens the LLM model can generate. Φ, Fχ2 Cumulative distribution functions used to calculate p-values in hypothesis testing for watermark
detection.
ϕcs A score for Contrastive Search watermark.
ϕtp A score computed for token token probability watermark
HV The representation of tokens in the model’s hidden layer.
k Top-k parameter defining the number of top predictions considered in the generation process.
L Sliding window length used in contrastive search to compute token similarity.
lt The raw outputs of the LLM model for the next token, before applying the softmax function.
P , Pcs, Ptp P-values indicating the likelihood of observing the test results under the null hypothesis.
sL(xt) A measure of a token’s similarity to its preceding tokens within a sliding window of length L.
Hash A function used to generate a hash value based on the current context.
RNG A function generating pseudo-random numbers based on a seed and possibly a key.

heading: B Additional Results
text: B.1 Rating and perplexity comparison between Duwak and KGW
B.2 Empirical false positive rates To assess the theoretical false positive rate (p-value) through empirical means, we utilize a the following methodology to identify unwatermarked text within the Wikitext dataset. For each watermark, we examine 10,000 samples, each with an average length of 260 tokens. The empirical false positive rate is determined by the proportion of texts erroneously identified as watermarked at the p-value threshold.
We observe that our algorithm does not result in an empirical false positive rate (FPR) higher than the theoretical FPR. Moreover, all methods tend to overestimate the false positive rate when the p-value is lower than 0.1, particularly in the case of KGW.
B.3 Detection Efficiency Under Different p-value Thresholds

heading: EXP ITS KGW

heading: B.4 Ablation Study
text: We conducted additional experiments on the Llama2-7b model, as shown in Table 6, to assess the effectiveness of our Duwak when both components are active as well as to assess the effectiveness of each individual component (KGW and CS) on the process. Table 6 summarizes the detection efficiency results, defined as the median number of minimal tokens needed for detection when the p-value reaches 0.02. These findings clearly demonstrate that the combined use of both the KGW watermark and the contrastive search watermark within our Duwak results in superior detection efficiency compared to the performance the individual components.

heading: C Evaluation Setup

heading: C.1 Prompt
text: For evaluation, we use open-ended generation and MarkMyWords’ (Piet et al., 2023) structured tasks. Open-ended text generation: Following Su and Collier (2023), 40 WebText corpus token prompts are used to generate completions of up to 200 tokens. Comparing the quality of watermarked generations to the datasets’ human-completions indicates the watermarkings’ relative effectiveness.
MarkMyWords generation tasks: Additionally, we include three tasks from the MarkMyWords dataset— book reports, story generation, and fake news generation—to mirror realistic scenarios where watermarking allows for harm mitigation and accountability.

heading: C.2 Evaluation metrics
text: We use the following metrics to assess the performance and effectiveness of watermark methods. Diversity: Accounts variance in generated content using repetition under varying n-grams (n ∈ {2, 3, 4}).
MAUVE: (Pillutla et al., 2021) Measures the similarity between generated and human-written text token distributions. Higher MAUVE shows better resemblance to human text.
Rating: Automated evaluation with the GPT-3.5 Turbo API, rating the relevance and fluency of watermarked texts on a 100-point scale based on zero-shot prompting.
Detection efficiency: The minimum token count required for watermark detection for a type-I error rate (p-value). Thus ensuring a precise balance between text length and the efficacy of watermark detection, highlighting our watermarking technique’s efficiency.

heading: C.3 Assessment Guidelines for Rating Responses
text: To systematically evaluate the text quality, each text will be graded out of a total of 100 points by GPT-3.5. The grading criteria are divided into four key categories, with points allocated as follows:
Accuracy (20 points): This measures the correctness and relevance of the response in relation to the provided prompt. Points are awarded based on how well the response adheres to factual accuracy and pertinence to the initial query or statement.
Detail (20 points): This assesses the comprehensiveness and depth of the response. A higher score is given for responses that cover the topic thoroughly, providing a nuanced understanding of the subject matter.
Grammar and Typing (30 points): This category evaluates the grammatical and typographical precision of the response. A flawless submission, free from spelling errors, punctuation mistakes, and grammatical inaccuracies, will receive full points.
Vocabulary (30 points): This criterion looks at the appropriateness and richness of the language used. Responses that utilize a diverse vocabulary appropriately and effectively to convey ideas will score higher in this category.
Points should be deducted for any deficiencies observed within each category. The total score, calculated out of 100, should be presented at the beginning of the evaluative feedback.
Prompt Template:

 
 You are given a prompt and a response, and you need to grade the response out of 100 based on: Accuracy (20 points) - correctness and relevance to the prompt;
Detail (20 points) - comprehensiveness and depth; Grammar and Typing (30 points) - grammatical and typographical accuracy; Vocabulary (30 points) - appropriateness and richness. Deduct points for shortcomings in each category. Give a total grade at the first line of the response. 
 Prompt: {} Response: {} 
 Grade out of 100:
This structured approach ensures a comprehensive and fair assessment of GPT-3.5’s responses, facilitating a consistent evaluation process.

heading: D Generated text
text: EXP 1.5 Title: A Clockwork Orange\nAuthor: Anthony Burgess\nPublication Date: 1962\nGenre: Dystopian Novel, Horror, Science Fiction\n\nBook Report:\n\nSet in a dystopian near-future, Anthony Burgess’s "A Clockwork Orange" follows the story of Alex, a charismatic young hoodlum who, along with his gang, commits gruesome acts of violence and rape. The novel explores themes of free will, morality, and the impact of societal conditioning on human behavior.\n\nTitle Analysis:\nThe title "A Clockwork Orange" is a clever play on words, referencing both the novel’s dystopian setting and the lead character’s name. The term "clockwork orange" is a contradictory phrase, as oranges are typically associated with nature and growth, while clockwork implies mechanical, predetermined movement
KGW 2.5 Title: A Clockwork Orange\nAuthor: Anthony Burgess\nPublished: 1962\nPage Count: 307\nGenre: Dystopian Fiction, Satire, Novel\n\nSummary:\n\nA Clockwork Orange is a dystopian novel written by Anthony Burgess, published in 1962. The story takes place in a futuristic society where violence and sexuality are condoned and encouraged. The protagonist, Alex DeLarge, is a charismatic young hoodlum who is sentenced to a form of experimental conditioning called the "Ludovico technique" in an effort to reform him
A Proofs for Section 3 (Duwak: Dual Watermarking)
Theorem 3.1 (Green List Tokens using topk). Given X = {x1, . . . , xT } from an LLM with green list fraction γ, and token n’s adjusted probability at t follows Eq. 1. Define V (k)t as the set of top-k tokens by p̂nt ,with xt ∼ Uniform(V (k)t ). Given E|V kt |G ≥ ν, then the expectation and variance of the count of green list tokens |x|G in X are bounded as follows:
E|x|G ≥ ν k T, Var |x|G ≤ T · ν (k − ν) k−2.
Proof. Expectation: The expected number of green list tokens, E|x|G , is calculated as the sum of expectations over all tokens being selected from the green list across all T steps. Given that xt is uniformly chosen from the set of top-k tokens V (k)t , the probability of choosing a green list token at any step t is the fraction of green list tokens in V (k)t , which is |V kt |G k . Therefore:
E|x|G = T∑
t=1
∣∣V kt ∣∣ G
k =
1
k
T∑
t=1
E [∣∣∣V kt ∣∣∣ G ] .
Given E ∣∣V kt ∣∣ G ≥ ν, it follows that:
E|x|G ≥ ν
k T.
Variance: For the variance, considering the sum of independent but not identically distributed Bernoulli
trials, each trial’s success probability is the fraction of green list tokens at step t, |V kt |G
k . The variance of a Bernoulli variable with probability p is p(1− p). Therefore, the variance of the total count of green list tokens is:
Var |x|G = T∑
t=1
∣∣V kt ∣∣ G
k
( 1− ∣∣V kt ∣∣ G
k
) .
This simplifies to:
Var |x|G = T · E [∣∣V kt ∣∣ G
k
( 1− ∣∣V kt ∣∣ G
k
)] .
By applying Jensen’s Inequality, due to the concavity of the function f(x) = x(1− x) for x in [0,1], and given E ∣∣V kt ∣∣ G ≥ ν, we derive:
Var |x|G ≤ T · ν
k
( 1− ν
k
) .
Theorem A.1 (Green List Tokens in Duwak). Given X = {x1, . . . , xT } from an LLM with green list fraction γ, and adjusted probability of token n at t being
p̂nt = exp(ln + 1[n ∈ G]δ)∑ i∈V exp(l i + 1[i ∈ G]δ) ,
define V (k)t as top-k tokens by p̂ n t , with xt ∼ Uniform(V (k)t ). The expectation and variance of green list tokens, |x|G , are bounded by: E|x|G ≥ AT, Var |x|G ≤ AT (1−A)(k + T − 1)k−1, with
A = γβS⋆
1 + (β − 1)γ under an approximation of top-k sampling to a stochastic sampling based on adjusted probability without replacement for k times. So (xt) from V (k) t approximates a stochastic process without replacement, reflecting the dynamic adjustment of probabilities as tokens are selected.
Proof. Referencing Lemma E.1 from Kirchenbauer et al. (2023a), when a token index v is sampled from the watermarked distribution, the probability that the token is from the green list in the top-k candidates is
P[v ∈ G] ≥ γβ 1 + (β − 1)γSt.
For simplification in the proof, we rewrite ∣∣V kt ∣∣ G as V k t and |x|G as x.
Then, the expectation of the number of green list tokens in the top-k can be expressed as:
Ek[V kt ] = k · γβ
1 + (β − 1)γS t.
Given V kt , the expectation of the number of green list tokens in X is
Et[x | V kt ] = T
k Ek[V kt ].
Therefore, the total expectation of green list tokens in X becomes
Et[x] = Et [ T
k Ek[V kt ]
] = T
k · k · γβ 1 + (β − 1)γEtS t ≥ T · γβS
⋆
1 + (β − 1)γ ,
i.e., Et[XG] ≥ TA.
Then, the variance of the green list tokens in the top-k, considering a Bernoulli distribution:
VarV kt = k γβSt
1 + (β − 1)γ
( 1− γβSt
1 + (β − 1)γ
) .
Consider the variance within the top-k candidates, the variance of the green list token number in the whole sequence is
Varx = Et[Var[x | V kt ]] + Var[Ek[x | V kt ]].
Var[x | V kt ] = T · V kt k (1− V k t k ),
Et[Var[x | V kt ]] = T ( Et[V kt ]
k − Et[(V k t ) 2] k2
) ,
given Et[(V kt )2] = (Et[V kt ])2 +Vart V kt and Et[V kt ] ≥ kA, Vart V kt ≤ kA(1−A),
Var[Ek[x | V kt ]] = T 2 · VarV kt k2 ≤ T 2 · kA(1−A) k2 ,
combine all terms together: Varx ≤ AT (1−A)(k + T − 1)k−1.

heading: Future Work
text: 5 Title: A Clockwork Orange\nAuthor: Anthony Burgess\nPublication Date: 1962\nGenre: Dystopian Novel, Horror, Science Fiction\n\nBook Report:\n\nSet in a dystopian near-future, Anthony Burgess’s "A Clockwork Orange" follows the story of Alex, a charismatic young hoodlum who, along with his gang, commits gruesome acts of violence and rape. The novel explores themes of free will, morality, and the impact of societal conditioning on human behavior. \n\nTitle Analysis:\nThe title "A Clockwork Orange" is a clever play on words, referencing both the novel’s dystopian setting and the lead character’s name. The term "clockwork orange" is a contradictory phrase, as oranges are typically associated with nature and growth, while clockwork implies mechanical, predetermined movement
KGW 2. 5 Title: A Clockwork Orange\nAuthor: Anthony Burgess\nPublished: 1962\nPage Count: 307\nGenre: Dystopian Fiction, Satire, Novel\n\nSummary:\n\nA Clockwork Orange is a dystopian novel written by Anthony Burgess, published in 1962. The story takes place in a futuristic society where violence and sexuality are condoned and encouraged. The protagonist, Alex DeLarge, is a charismatic young hoodlum who is sentenced to a form of experimental conditioning called the "Ludovico technique" in an effort to reform him
A Proofs for Section 3 (Duwak: Dual Watermarking)
Theorem 3. 1 (Green List Tokens using topk). Given X = {x1,. , xT } from an LLM with green list fraction γ, and token n’s adjusted probability at t follows Eq. 1. Define V (k)t as the set of top-k tokens by p̂nt ,with xt ∼ Uniform(V (k)t ). Given E|V kt |G ≥ ν, then the expectation and variance of the count of green list tokens |x|G in X are bounded as follows:
E|x|G ≥ ν k T, Var |x|G ≤ T · ν (k − ν) k−2. Proof. Expectation: The expected number of green list tokens, E|x|G , is calculated as the sum of expectations over all tokens being selected from the green list across all T steps. Given that xt is uniformly chosen from the set of top-k tokens V (k)t , the probability of choosing a green list token at any step t is the fraction of green list tokens in V (k)t , which is |V kt |G k. Therefore:
E|x|G = T∑
t=1
∣∣V kt ∣∣ G
k =
1
k
T∑
t=1
E [∣∣∣V kt ∣∣∣ G ]. Given E ∣∣V kt ∣∣ G ≥ ν, it follows that:
E|x|G ≥ ν
k T. Variance: For the variance, considering the sum of independent but not identically distributed Bernoulli
trials, each trial’s success probability is the fraction of green list tokens at step t, |V kt |G
k. The variance of a Bernoulli variable with probability p is p(1− p). Therefore, the variance of the total count of green list tokens is:
Var |x|G = T∑
t=1
∣∣V kt ∣∣ G
k
( 1− ∣∣V kt ∣∣ G
k
). This simplifies to:
Var |x|G = T · E [∣∣V kt ∣∣ G
k
( 1− ∣∣V kt ∣∣ G
k
)]. By applying Jensen’s Inequality, due to the concavity of the function f(x) = x(1− x) for x in [0,1], and given E ∣∣V kt ∣∣ G ≥ ν, we derive:
Var |x|G ≤ T · ν
k
( 1− ν
k
). Theorem A. 1 (Green List Tokens in Duwak). Given X = {x1,. , xT } from an LLM with green list fraction γ, and adjusted probability of token n at t being
p̂nt = exp(ln + 1[n ∈ G]δ)∑ i∈V exp(l i + 1[i ∈ G]δ) ,
define V (k)t as top-k tokens by p̂ n t , with xt ∼ Uniform(V (k)t ). The expectation and variance of green list tokens, |x|G , are bounded by: E|x|G ≥ AT, Var |x|G ≤ AT (1−A)(k + T − 1)k−1, with
A = γβS⋆
1 + (β − 1)γ under an approximation of top-k sampling to a stochastic sampling based on adjusted probability without replacement for k times. So (xt) from V (k) t approximates a stochastic process without replacement, reflecting the dynamic adjustment of probabilities as tokens are selected. Proof. Referencing Lemma E. 1 from Kirchenbauer et al. (2023a), when a token index v is sampled from the watermarked distribution, the probability that the token is from the green list in the top-k candidates is
P[v ∈ G] ≥ γβ 1 + (β − 1)γSt. For simplification in the proof, we rewrite ∣∣V kt ∣∣ G as V k t and |x|G as x. Then, the expectation of the number of green list tokens in the top-k can be expressed as:
Ek[V kt ] = k · γβ
1 + (β − 1)γS t. Given V kt , the expectation of the number of green list tokens in X is
Et[x | V kt ] = T
k Ek[V kt ]. Therefore, the total expectation of green list tokens in X becomes
Et[x] = Et [ T
k Ek[V kt ]
] = T
k · k · γβ 1 + (β − 1)γEtS t ≥ T · γβS
⋆
1 + (β − 1)γ ,
i. e. , Et[XG] ≥ TA. Then, the variance of the green list tokens in the top-k, considering a Bernoulli distribution:
VarV kt = k γβSt
1 + (β − 1)γ
( 1− γβSt
1 + (β − 1)γ
). Consider the variance within the top-k candidates, the variance of the green list token number in the whole sequence is
Varx = Et[Var[x | V kt ]] + Var[Ek[x | V kt ]]. Var[x | V kt ] = T · V kt k (1− V k t k ),
Et[Var[x | V kt ]] = T ( Et[V kt ]
k − Et[(V k t ) 2] k2
) ,
given Et[(V kt )2] = (Et[V kt ])2 +Vart V kt and Et[V kt ] ≥ kA, Vart V kt ≤ kA(1−A),
Var[Ek[x | V kt ]] = T 2 · VarV kt k2 ≤ T 2 · kA(1−A) k2 ,
combine all terms together: Varx ≤ AT (1−A)(k + T − 1)k−1