P ost M ark: A Robust Blackbox Watermark for Large Language Models (2024)

Abstract: The most effective techniques to detect LLM-generated text rely on inserting a detectable signature—or watermark—during the model’s decoding process. Most existing watermarking methods require access to the underlying LLM’s logits, which LLM API providers are loath to share due to fears of model distillation. As such, these watermarks must be implemented independently by each LLM provider. In this paper, we develop PostMark, a modular post-hoc watermarking procedure in which an input-dependent set of words (determined via a semantic embedding) is inserted into the text after the decoding process has completed. Critically, PostMark does not require logit access, which means it can be implemented by a third party. We also show that PostMark is more robust to paraphrasing attacks than existing watermarking methods: our experiments cover eight baseline algorithms, five base LLMs, and three datasets. Finally, we evaluate the impact of PostMark on text quality using both automated and human assessments, highlighting the trade-off between quality and robustness to paraphrasing. We release our code, outputs, and annotations at https://github.com/lilakk/PostMark.

## introduction large language models (llms) are increasingly being deployed for malicious applications such as fake content generation. the consequences of such applications for the web as a whole are dire: modern llms are known to hallucinate @xcite , and their outputs may contain biases and artifacts that are a product of their training data @xcite . if the web is flooded with millions of llm-generated articles, how can we trust the veracity of the content we are reading? additionally, do we want to train llms of the future on text generated by llms of the present @xcite ? to combat this emerging problem, researchers have developed several llm-generated text detection techniques that leverage watermarking @xcite , outlier detection @xcite , trained classifiers @xcite , or retrieval-based methods @xcite . among these, watermarking methods that embed detectable signatures into model outputs tend to be the most effective and robust @xcite . however, most watermarking algorithms require access to the logits of the underlying llm, which means that they can only be implemented by individual llm api providers such as openai or google @xcite . furthermore, while these methods are able to achieve high detection rates with minimal false positives, their effectiveness goes down when the llm-generated text is modified through paraphrasing, translation, or cropping @xcite @xcite . in this work, we develop postmark, a watermarking approach with relatively high detection rates even in the presence of paraphrasing attacks. postmark is a post-hoc watermark that given some model-generated text, finds words conditioned on the semantics of the text using an embedding model, then calls a separate instructionfollowing llm to insert these words into the text without appreciably modifying its meaning. unlike prior methods, postmark only requires access to the outputs of the underlying llm (i.e., no logits). overall, our contributions are threefold: 1. we propose postmark, a novel post-hoc watermarking method that can be applied by third-party entities to outputs from an api provider like openai. 2. we conduct extensive experiments across eight baseline algorithms, five base llms, and three datasets, showing that postmark offers superior robustness to paraphrasing attacks compared to existing methods. 3. we verify through a human evaluation that the words inserted by postmark figure 1 : the postmark watermarking and detection procedure. given some unwatermarked input text, we generate its embedding using the embedder and compute its cosine similarity with all word embeddings in the sectable, performing top-k selection and additional semantic similarity filtering to choose a list of words. then, we instruct the inserter to watermark the text by rewriting it to incorporate all selected words. during detection, we similarly obtain a watermark word list and check how many of these words are present in the input text. ## postmark: a post-hoc watermark most existing watermarking algorithms embed the watermark during the llm's decoding process. for example, the watermark of @xcite partitions an llm's vocabulary into two lists (a green list and a red list) at each decoding timestep based on a hash of the previous word, and then upweights the green tokens such that they are more likely to be sampled than red tokens. these watermarks have several issues: (1) they require access to the llm's logits; (2) because they rely on modifications to the next-token probability distribution, their effectiveness diminishes on llms that produce lower-entropy distributions, such as those that have undergone rlhf @xcite ; and (3) they show limited robustness to paraphrasing attacks as demonstrated by our results in section 3.2 and supported by findings from prior work @xcite . in response, we develop postmark, a watermarking method that does not require logit access, maintains high detection rates on low-entropy models and tasks, and exhibits improved robustness to paraphrasing attacks. unlike existing watermarks, postmark requires access to just the text generated by the underlying llm, not the next-token distributions. the rest of this section fully specifies postmark's operation. intuition and terminology: at a high level, postmark is based on the intuition that a text's semantics should not drastically change after watermarking or paraphrasing. thus, we can condition our watermark on a semantic embedding of the input text that ideally changes only minimally when paraphrasing is applied. to make this work, we rely on three modules: an embedding model embed-der, a secret word embedding table sectable , and an insertion model inserter implemented via an instruction-following llm. figure 1 illustrates postmark's watermarking and detection pipelines. first, we generate the embedding of an input text using the embedder. we then compute the cosine similarity between this embedding and all of the word embeddings in sectable, performing top-k selection and filtering to form a watermark word list. next, we prompt inserter to smoothly incorporating the selected words into the input to create the watermarked text. during detection, we follow similar steps to obtain a word list, and check how many of the words are present in the input text. ## experiments in this section, through extensive experiments on three datasets and five language models, we demonstrate that postmark consistently outperforms both logit-free and logit-based methods in terms of robustness to paraphrasing attacks, especially on low-entropy models that have undergone rlhf alignment. furthermore, we showcase postmark's modular design by testing an opensource variant, which achieves promising results. ## impact of watermarking on text quality postmark modifies text during watermarking by inserting new words, which often results in longer watermarked text. 8 ## related work early research on watermarking: our work is relevant to early work on watermarking text documents, either using the text document image @xcite , syntactic transformations @xcite , or semantic changes @xcite . later work also explores watermarking machine-generated text @xcite . watermarking llm-generated text: recent research has primarily focused on watermarking llm-generated outputs. most existing approaches operate in the whitebox setting, assuming access to model logits and the ability to modify the decoding process @xcite @xcite @xcite or inject detectable signals without altering the original token distribution @xcite . alternatively, hou et al. @xcite watermark at the sentence level via rejection sampling. prior blackbox methods access only model outputs (like postmark), but rely on simple lexical substitution @xcite @xcite . evading watermark detection: our work also relates to prior work on text editing attacks designed to evade watermark detection. he et al. (2024) propose a cross-lingual attack, while kirchenbauer et al. (2024) studies a copypaste attack that embeds watermarked text into a larger human-written document. krishna et al. (2023) train a controllable paraphraser that allows for control over lexical and syntactic diversity. sadasivan et al. (2024) design a recursive paraphrasing attack that repeatedly rewrites watermarked text. similar to our work, several studies directly prompt an instruction-following llm to paraphrase text @xcite @xcite @xcite . quality-robustness trade-off: relevant to our discussion in section 4, several recent papers highlight the impact of watermarking on quality. in line with our conclusions, @xcite and @xcite both find that less robust watermarks tend to have less negative impact on text quality. ## conclusion we propose postmark, a novel watermarking approach that only requires access to the underlying model's outputs, making it applicable by third-party entities to outputs from api providers. through extensive experiments acorss eight baseline algorithms, five base llms, and three datasets, we show that postmark is more robust to paraphrasing attacks than existing methods. we conduct a human evaluation to show that words inserted by postmark are not easily identifiable by humans. we further run comprehensive quality evaluations covering coherence, relevance, interestingness, and factuality, and find that postmark preserves text quality relatively well. future work could look into further optimizing each of the three modules in postmark, evaluating postmark on attacks other than paraphrasing, or making logitbased methods less entropy-dependent.