Paper: Necessary and Sufficient Watermark for Large Language Models (ICLR-2024)

Reviewer comment (Experiments):
Why the authors only select a set of small $\gamma$? What happens with larger $\gamma$ ( > 0.1) since in [1], they measured the z-score with values of $\gamma$ varies from 0.1 to 0.9. Whether or not it is because lower $\gamma$s enhance the model performance?. Based on equation 2, If $\gamma$ is small, the z-score will significantly increase. Then, Soft-Watermark with high $\delta$ can produce high z-score without sacrificing the text quality? Is it still true to keep the same Z threshold? Please correct me if I misunderstood.

Author response:
> Why the authors only select a set of small $\gamma$? What happens with larger $\gamma$ ( $> 0.1$) since in [1], they measured the z-score with values of $\gamma$ varies from 0.1 to 0.9. Whether or not it is because lower $\gamma$s enhance the model performance?. Based on equation 2, If $\gamma$ is small, the z-score will significantly increase. Then, Soft-Watermark with high $\delta$ can produce high z-score without sacrificing the text quality? Is it still true to keep the same Z threshold? Please correct me if I misunderstood.

One of the reasons why $\gamma$ tuned by grid search is different from the one in [1] is that the experimental settings are different.
[1] showed the results of generated texts of length $200 \pm 5 $ (see page 6, Fig. 2, and Table 2 in [1]), whereas we provide the results of all generated texts, which contain both long and short texts.
When $\gamma$ is large, the z-scores short texts do not exceed the thresholds even if all words contained texts are green words (see Eq. (4)).
Specifically, texts with lengths shorter than $\tfrac{\gamma Z^2}{1 - \gamma}+1$ cannot exceed the threshold $Z$ even if all words are green.
Thus, $\gamma$ selected in our experiments is smaller than the one in [1], especially in machine translation tasks where generated texts are relatively short (see Figs. 2 and 3).

In our experiments, the hyperparameters of the Soft-Watermark are tuned by the grid search.
Then, the Soft-Watermark achieved the best BLUE scores when $(\gamma, \delta) = (0.01, 8)$ in machine translation tasks
and $(\gamma, \delta) = (0.1, 6)$ in natural language generation tasks.
Thus, by extending the search space of $\gamma$ in the grid search, 
the PPL scores in Table 2 may be increased, but the BLUE scores in Table 1 would not.

Reviewer comment (Evaluation):
How does NS-Watermark compare to Soft-watermark in terms of inference time? In equation 7, the approximated NS-watermark need to generate the text without watermark first, and then solve the constrain optimization problem. Besides, the beam size $k$ and $\alpha$ significantly affect the running time.

Author response:
> How does NS-Watermark compare to Soft-watermark in terms of inference time? In equation 7, the approximated NS-watermark need to generate the text without watermark first, and then solve the constrain optimization problem. Besides, the beam size $k$ and $\alpha$ significantly affect the running time.}

The time complexity of the Soft-Watermark is $\mathcal{O}(k T_{\text{max}})$, whereas the time complexity of the NS-Watermark is $\mathcal{O}(\alpha k T_{\text{max}})$,
where $k$ is the beam size, $T_{\text{max}}$ is the maximum number of words, and $\alpha$ is the hyperparameter for the NS-Watermark.

We evaluated the running time of the Soft-Watermark, adding the results in Fig. 6.
The results are consistent with the time complexity discussed above.
Then, as the review mentioned, the running time of the NS-Watermark with $\alpha=1$ is approximately twice slower than the one of the Soft-Watermark
because the NS-Watermark needs to generate texts without watermarks before generating texts with watermarks.

Reviewer comment (Evaluation):
In the case of robustness, making WS-Watermark more robust with post-editing decreases the performance of model substantially. For example, in figure 5a, when $\beta$ ≥ 0.1 the PPL ≥ 3 which is higher than Adaptive Soft-watermark in Table 2. Similar behaviors with Translation task in figure 5b.

Author response:
> In the case of robustness, making WS-Watermark more robust with post-editing decreases the performance of model substantially. For example, in figure 5a, when $\beta$
 $\geq$ 0.1 the PPL $\geq$ 3 which is higher than Adaptive Soft-watermark in Table 2. Similar behaviors with Translation task in figure 5b.

Table 2 shows the results when the hyperparameters for all methods are tuned to achieve the best PPL under the condition that the false negative rate is less than $5 \%$,
and Fig. 5 shows the results when the NS-Watermark generates texts under the condition that it achieves the level of robustness determined by the hyperparameter $\beta$.
Thus, we cannot directly compare the results in Table 2 and Fig. 5b.
If we tune the hyperparameters of the Adaptive Soft-Watermark as in Fig. 5 (i.e., the Adaptive Soft-Watermark achieves the false positive rate of less than $5\%$ and achieves the level of robustness determined by $\beta$),
the PPL scores of the Adaptive Soft-Watermark may decrease as in the results of the NS-Watermark in Fig. 5.

Reviewer comment (Presentation):
The figure 1's illustration is not very clear. What's the difference between the two sub-figures in figure 1(a)?

Author response:
Fig. 1(a) is used to explain the idea described in the last paragraph in Sec. 3.2.
Naively, the table $\mathbf{T}[t][g]$ stores the texts of length $t$ containing $g$ green words. Then, we need to fill $\mathbf{T}[t][g]$ for all 

$$(t,g) \in \\{ (t,g) \in \mathbb{N}^2 \mid 1 \leq t \leq T_{\text{max}}, 0 \leq g \leq t-1 \\}.$$

That is, we need to fill the areas colored in blue and light blue in the right figure in Fig. 1(a).
However, if $G_{\text{max}}$ green words appear after generating $t$ words, we do not need to count the number of green words in the remaining text because the constraint in Eq. (4) is guaranteed to be satisfied.
To utilize this idea, we modify the table $\mathbf{T}$ such that $\mathbf{T}[t][G_{\text{max}}]$ stores the texts of length $t$ containing \textbf{at least} $G_{\text{max}}$ green words.
After this modification, we only need to fill the table $\mathbf{T}[t][g]$ for all 
$$(t,g) \in \\{ (t,g) \in \mathbb{N}^2 \mid 1 \leq t \leq T_{\text{max}}, 0 \leq g \leq \min\\{ t-1, G_{\text{max}} \\} \\},$$
 which is the area colored in the left figure in Fig. 1(a).
Compared to the right figure in Fig. 1(a) with the left figure, the area in the table $\mathbf{T}$ we need to fill is shrunk. Then, the time complexity can be reduced to $\mathcal{O}(\gamma k T_{\text{max}}^2)$ from $\mathcal{O}(k T_{\text{max}}^2)$.

Reviewer comment (Experiments):
The experiment about the robustness to post-editing is not convincing. The authors only show the relation between the text quality and the hyper-parameter controlling the robustness. What is expected is to see the robustness under real attacking methods. The included attack methods could refer to the three types of attacks adopted in Section 7 of the paper [1]. Without seeing such experimental results under attacking, it's hard to be convinced about the robustness of the proposed method.

Author response:
The main advantage of the NS-Watermark over the Soft-Watermark is that
when the level of robustness to be achieved is given by the hyperparameter $\beta$, the NS-Watermark can minimize the degradation of text quality under the conditions that it achieves the given level of robustness.
As shown in our experiments, the Soft-Watermark inserts more than the required number of green words in the generated texts and degrades the text quality more than necessary, even if its hyperparameters are tuned.

The hyperparameter $\beta$ can be intuitively interpreted
and ensures that up to $50\beta \\%$ of the words can be replaced without removing the NS-Watermark.
Then, how watermarks should be robust to post-editing depends on the application.
Thus, we leave it to future work to experimentally evaluate the robustness using the attacking methods that the reviewer mentioned.

Reviewer comment (Evaluation):
The proposed model explores a less conservative region of z-scores compared to Soft-Watermark. Soft-Watermark's conservative approach provides robustness against attacks. And the NS-Watermark is much slower in terms of decoding speed.

Author response:
Generally, there is a trade-off between text quality degradation and robustness against post-editing.  
Thus, the main advantage of the NS-Watermark over the Soft-Watermark is that  
when the level of robustness to be achieved is given, the NS-Watermark can minimize the degradation of text quality under the conditions that it achieves the given level of robustness,  
whereas the Soft-Watermark cannot and inserts more than the required number of green words in the generated texts.  

More specifically, by using hyperparameters $\beta$, the NS-Watermark can insert the minimum number of green words to achieve the level of robustness determined by $\beta$.  
In contrast, even if the hyperparameters $\gamma$ and $\delta$ are tuned, the Soft-Watermark cannot control the number of green words contained in the generated texts  
and degrades the text quality more than necessary, as shown in Fig. 3 and Th. 1.

Reviewer comment (Experiments):
Since watermarking is designed to distinguish watermarked text and unwatermarked text, it makes more sense to consider human text and unwatermarked AI-generated text together as negative samples.

Author response:
As the reviewer mentioned, LLM-generated texts without watermarks are also considered negative samples in the formulations of the Hard/Soft-Watermark and NS-Watermark.  
However, for the simplicity of explanation, we ignore LLM-generated texts without watermarks, as in the prior work [1].

Reviewer comment (Experiments):
Since the watermarked tokens are dynamically added, if the adversary truncates the text and only provides part of the generated text, will this affect the detection performance?

Author response:
Truncation is also regarded as post-editing.  
Thus, we can make the NS-Watermark robust to the truncation by using positive $\beta$.  
When we set $\beta$ to zero, the truncation can remove the NS-Watermark because the number of green words inserted by the NS-Watermark is minimal and depends on the length of generated texts (see Eq. (4)).