Paper: A Semantic Invariant Robust Watermark for Large Language Models (ICLR-2024)

Reviewer comment (Reproducibility):
The study appears to omit specific details regarding the parameters $\delta$ and $\gamma$ within the KGW-k model during experiments. Referring to KGW (2023), variances in these parameters can profoundly influence both the quality of watermarked text and robustness. Could the authors provide insight into how these variables were determined in the experimental setups?

Author response:
## About experimental configurations （$\delta$ and $\gamma$）

Firstly, it is crucial to note that for our SIR method, the chosen hyperparameters are $\delta= 2$, and our watermark model is trained with $\gamma= 0.5$. These settings are consistent with the hyperparameters used in the KGW series methods, ensuring a fair comparison in experimental setups.

Further, from an algorithmic perspective, in the KGW series watermark algorithms, the most influential parameter on watermark robustness is $k$ (window size), while $\delta$ and $\gamma$ have minimal impact on watermark robustness. Consequently, these two parameters are seldom explored in watermark research for their effect on robustness. Below is a detailed explanation:

1. Concerning the $\delta$ parameter, it primarily influences the strength of watermark embedding. However, increasing watermark strength comes with a trade-off, affecting the quality of the generated text. A very large $\sigma$ would degrade the algorithm to a hard red-green algorithm, where some tokens cannot be chosen at all. Conversely, a very small $\sigma$ might result in insufficient watermark strength, rendering it undetectable in later stages.

2. Regarding the $\gamma$ parameter, this determines the proportion of the 'green' part. The most common parameter in current studies is 0.5. While a smaller $\gamma$ might enhance watermark effectiveness in no-attack scenarios experimentally, its impact is not significant. Therefore, comparisons controlled at the same $\gamma$ value are fair. Additionally, we conducted the following experiments to test $\gamma$.

| Method        | Ori. F1 (KGW-1) | Re. F1 (KGW-1) | Ori. F1 (SIR) | Re. F1 (SIR) |
|---------------|-----------------|----------------|---------------|--------------|
| $\gamma$=0.25 | 100             | 90.6           | 100           | 90.3         |
| $\gamma$=0.5  | 99.8            | 90.5           | 100           | 90.0         |
| $\gamma$=0.75 | 98.6            | 89.8           | 98.9          | 89.9         |

The observation can be stated as follows: Although a marginal improvement in F1 is noted when comparing different values of $\gamma$, the enhancement is not particularly significant. Consequently, it is a common practice among various works to set $\gamma$ at 0.5.

Reviewer comment (Experiments):
In scenarios involving multiple keys or users, it appears that the model provider must train a separate watermark model for each key or user. This might be expensive. Moreover, it is not clear to me how to ensure that two watermark models inject sufficiently distinct watermark logits and remain distinguishable during later detection.

Author response:
## About multi-keys

Thank you for your insightful question. Contrary to the need for multiple watermark models to implement multi-keys, a single watermark model can be effectively paired with mapping files to achieve this. For instance, consider the watermark model producing logits $L = \{l_1, l_2, \ldots, l_{|V|}\} $ for a vocabulary size $ |V|$. We can define a simple bijective mapping $f: \{1, 2, \ldots, |V|\}\rightarrow \{1, 2, \ldots, |V|\}$, resulting in a new set $L' = \{ j_{1},  j_{2}, \ldots, j_{|V|}\}$where each $ j_{i} $ is defined as $j_{i} = L_{f(i)} $.

This mapping process is efficient, having an $O(1) $ complexity, and does not introduce any extra burden. Moreover, designing just two distinct mappings with low similarity ensures sufficient differentiation between the keys of two users. 

Therefore, we believe that the concern regarding multi-key scenarios may not be a practical issue.

Reviewer comment (Experiments):
It is advisable to consider a more comprehensive range of attack scenarios, similar to the approach taken by Kirchenbauer et al. The authors have conducted experiments to assess robustness, as evident in the attack rephrasing described in Section 6.2 and the security robustness analysis in Section 6.3. I am curious about the extent to which the proposed method demonstrates resilience against the attacks evaluated by Kirchenbauer et al. In Section 7 of their work, Kirchenbauer et al. have presented a diverse set of attack scenarios, including the Emoji attack.

Author response:
## About more attack type

Please refer to third response in "Response to all reviewers".

In summary, we supplemented experiments regarding Emoji attack and copy paste attack, demonstrating that our method is robust in these scenarios.

Reviewer comment (Writing):
Could you kindly elaborate on the definition of 'watermark' within the scope of LLM? It appears that the primary emphasis of the paper is on the detection of text generated by LLMs and a detailed definition would be beneficial for clarity.

Author response:
## About the definition of watermark


In the section three, we have already provided a rather detailed definition and explanation of watermark algorithms. Here, we will elaborate further.

Broadly speaking, the concept of large model watermarking refers to the integration of certain covert features into the text generated by large models. These features are designed to be detectable by specific algorithms, yet remain largely imperceptible to human observation.
The paradigm adopted in this paper is adding small watermark logits to the already generated next token logits.
This is the most widely used watermark paradigm for large models.
Specifically, the watermark logits can be defined as  $P_{\mathrm{W}}(x^{prompt}, t_{:l-1})$,
 and the final logits could be defined as $P_{\hat{\mathrm{M}}}(x^{prompt}, t_{:l-1}) = P_{\mathrm{M}}(x^{prompt}, t_{:l-1}) + P_{\mathrm{W}}(x^{prompt}, t_{:l-1})$, where $\hat{\mathrm{M}}$ is the watermarked LLM. The watermark detector $P_{\mathrm{D}}$ corresponds to $P_{\mathrm{W}}$, outputting 1 if text $t$ contains the watermark, otherwise 0.

Reviewer comment (Theory):
What is the theoretical or practical capacity of the watermark within the framework presented? An explanation of its capabilities would greatly enhance the comprehensiveness of your findings.

Author response:
## Theoretical or practical capacity of the watermark within the framework presented 

To clarify the meaning of 'practical capacity' as you mentioned, if it refers to the amount of information that a watermark can carry, our watermarking technique is similar to that of Kirchenbauer et al. In both cases, the capacity of the watermark is limited to binary classification of the text, determining whether it contains a watermark or not. The watermark itself does not involve carrying additional information.

The primary contribution of our paper lies in enhancing the robustness of the watermark. This can be understood as, although the information borne by the watermark is limited to 0 (no watermark) and 1 (contains watermark), our method increases the difficulty of editing from 1 to 0. In other words, removing the watermark has become more challenging compared to previous approaches.

Reviewer comment (Novelty):
Could you provide further insights into the practical applications of the watermark in the realm of LLM? Digital watermarking is typically used to identify ownership of the copyright of such signal.

Author response:
## Application of Watermark

The primary role of watermarks in large models is to identify texts generated by these models, which has several applications:

1.Large models might be prohibited in certain contexts, such as student homework or examinations. Watermarks facilitate the identification of texts produced by these models in such scenarios.

2.Large models can generate a substantial volume of false or low-quality content online. Watermarks can help in recognizing these texts, contributing to a better online environment.

3.If texts generated by large models are watermarked, it becomes easier to detect instances where someone might use these texts to train their own models. This acts as a deterrent against data theft, providing a layer of protection for the large models themselves. [Zhao et al. (2022)]

In summary, thank you for your question. Your inquiry is very helpful in enhancing the quality of our paper.

## Reference 

Zhao, Xuandong, Yu-Xiang Wang, and Lei Li. "Protecting language generation models via invisible watermarking."