WASA : WA termark-based Source Attribution for Large Language Model-Generated Data (2025)

Abstract: The impressive performances of Large Language Models (LLMs) and their immense potential for commercialization have given rise to serious concerns over the Intellectual Property (IP) of their training data. In particular, the synthetic texts generated by LLMs may infringe the IP of the data being used to train the LLMs. To this end, it is imperative to be able to perform source attribution by identifying the data provider who contributed to the generation of a synthetic text by an LLM. In this paper, we show that this problem can be tackled by watermarking, i.e., by enabling an LLM to generate synthetic texts with embedded watermarks that contain information about their source(s). We identify the key properties of such watermarking frameworks (e.g., source attribution accuracy, robustness against adversaries), and propose a source attribution framework that satisfies these key properties due to our algorithmic designs. Our framework enables an LLM to learn an accurate mapping from the generated texts to data providers, which sets the foundation for effective source attribution. Extensive empirical evaluations show that our framework achieves effective source attribution.

## introduction large language models (llms) @xcite have recently demonstrated remarkable performances and hence received a surging interest. these llms, trained using massive text data, have displayed impressive text generation abilities. this has given rise to the immense potential of adopting llm-generated texts for commercial use. however, this potential commercialization has led to major concerns regarding the intellectual property (ip) of training data for llms because the texts generated by an llm may infringe the ip of the data being used to train the llm. these concerns have been reflected by the increasing regulations on data protection re-lated to ai models. for example, the coalition for content provenance and authenticity has stressed the necessity of certifying the source of online content produced by generative models @xcite . therefore, it is of crucial importance for llms to be equipped with source attribution for their generated synthetic texts. in source attribution, given some texts generated by an llm, its aim is to find the source responsible for the generation of these texts. that is, if the data from a data provider has been used to train the llm and contributed to the generation of a sentence by the llm, then source attribution identifies this data provider. moreover, source attribution also improves the interpretability of llmgenerated texts: for example, if the generated content from an llm is attributed to a trustworthy source (e.g., a peer-reviewed academic paper), then the user is likely to consider the content more reliable. the ability to perform source attribution can endow the llm with the capability of data provenance, which presents a different problem where a data provider can verify whether its data has been used to train the llm. this problem can be solved with source attribution. specifically, a data provider can check the source of the generated texts from an llm via source attribution, and hence verify data provenance, as detailed in app. e.1.6. while some recent works have addressed the problem of data provenance in llms @xcite , to the best of our knowledge, effective source attribution for llms remains an open problem. in contrast to data provenance which presents a binary determination, source attribution aims to identify the specific data source(s) influencing a particular output, which presents a more challenging task. our work focuses on addressing source attribution rather than on data provenance. additionally, recent studies have explored data selection and can find the most influential training data for test points @xcite @xcite . however, they are limited to supervised downstream tasks such as classification, question answering, or summarization, where test points with ground truths are available. in contrast, our work focuses on attributing all varieties of llm generations, encompassing both supervised tasks and unsupervised generations, which do not have predefined ground truths. to perform source attribution for llmgenerated texts, a natural solution involves watermarking, i.e., by enabling the llm to generate synthetic texts with embedded watermarks that contain information about their source(s). consequently, source attribution can be performed by examining the watermarks embedded in the generated texts. our problem setting (fig. 1 ) involves 3 parties: data providers contributing text data that may be used for llm training, an honest third-party llm platform operator producing an llm with generated texts that embed watermarks (hence allowing for source attribution), and users of the texts generated by this llm. the users may request source attribution for the llm-generated synthetic texts to find out which data provider is responsible for the generated texts. we consider scenarios where each data provider contributes ample data with unique characteristics, i.e., the data from different providers exhibit dissimilarities. this encompasses a wide variety of real-world scenarios: for example, online articles written by different authors (i.e., data providers) usually feature their unique writing styles. on the other hand, we do not consider individual documents/sentences as data providers since they have insufficient data. for instance, in a dataset containing academic papers, we consider academic publishers or research domains as the data providers. additionally, this work focuses more on single-source scenarios and discusses potential applications in multi-source attributions. an effective source attribution framework has to satisfy some key properties: the framework should (1) achieve accurate source attribution, (2) be robust against malicious attacks on the watermarks, (3) preserve the performance (i.e., text generation ability) of the llm, (4) be scalable to a large number of data providers, (5) ensure that the generated watermarks are transferable to (i.e., persist after being used as training data for) other llms, and (6) be adaptable to fit different llms. sec. 3 discusses these key properties in more detail. to this end, this paper introduces a watermarking for source attribution (wasa) framework which, to our best knowledge, is the first framework capable of enabling effective source attribution in text generated by large language models our wasa framework assigns a unique watermark (i.e., imperceptible to human eyes) to every data provider, and enables an llm (coined as wasa-llm) to learn an accurate mapping from the texts of different data providers to their corresponding watermarks (sec. 4). so, if a data provider is responsible for generating a sentence, then our wasa-llm is able to include the unique watermark of this data provider in this generated sentence, which naturally supports source attribution. our contributions are summarized below: ## problem formulation and key properties here, we first present a clear definition of source attribution. for a piece of llm-generated synthetic text s, if s correlates the most with the llm's training data provided by one data provider compared to other providers, we recognize that data provider as the source for s and denote as a one-hot label y s := {0, 0, ..., 1, ..., 0} where y s [i] = 1 if y s [i] is the source, otherwise y s [i] = 0; the dimension is n, which is the total number of data providers and is fixed. the goal of source attribution is: given a piece of llm-generated text s, we want to find a mapping @xmath0. to simplify the problem, we consider two scenarios: (1) while x may correlate with multiple training data from provides, meaning that y may not necessarily be a one-hot vector, we only consider attribution to a single data source (that x correlates the most with), restricting the y to be one-hot vector in our case, and present case studies when attributing to more than one data source in app. g.3; (2) there might be an edge case where the generated content x correlates the most with pretraining data (from public training datasets) rather than data from data providers. we do not consider this case in our paper and ensure that in our evaluations the generated contents are related to the data from providers with controlled experiments. in this paper, we address the problem of source attribution with watermarking. specifically, to use watermarking for source attribution, we first transform the data providers y to watermarks wtm correspondingly: encoder(y) = wtm where encoder denotes the watermark encoder. during llm training, we enable the llm to learn a mapping g : @xmath1. then during inference, we can perform the mapping @xmath2, translating the watermark to sources for the user. importantly, since each generated content s must correlate with some pieces of training data, there always exists a source y s which is the most correlated data source with s. hence, under all conditions (except the special case mentioned above), as long as a user requests, s should be attributed to its source y s . in our wasa framework, since we assume that all data providers provide watermarked training data, we can perform source attribution under all conditions: upon request, we can perform y @xmath3. subsequently, we discuss the key properties for an effective watermarking source attribution framework and how our wasa framework satisfies them. accuracy. accurate source attribution should be enforced. our wasa framework achieves this by training the wasa-llm to map texts from different data providers to their respective watermarks. specifically, we first train wasa-llm using watermarked texts (sec. 4.1) and separate the prediction/generation spaces for the texts and watermarks to both reduce the complexity of watermark prediction (sec. 4.2) and explicitly enforce watermark generation (sec. 4.3). empirical results in sec. 5.1 demonstrate the effectiveness in source attribution. robustness. generated text with watermarks should be robust against malicious attacks. since our trained wasa-llm is able to learn an accurate mapping from the texts to the watermarks as mentioned (a) it can be exploited to regenerate the watermarks even if generated texts are tampered with and (b) it maintains generating the correct watermarks even if the input texts (prompts) are perturbed, which are empirically verified in sec. 5.2. scalability. the framework should allow source attribution for a large number of data providers. the design of watermarks (sec. 4.1) supports the generation of numerous unique watermarks. we empirically verify that our framework is more scalable than the baselines in sec. 5.3. transferability. after the generated watermarked texts are used as training data for other llms, their generated texts should preserve the watermarks. we achieve this by ensuring that the watermarked training data of our wasa-llm has the same structure as the generated watermarked data. adaptability. the framework should be easily adapted to fit different llms. our wasa framework only requires mild modifications to the llms and can hence adopt a wide variety of llms using the transformer architecture, as shown in sec. 5.1. we have only listed above the most essential properties of such source attribution frameworks; there may be additional considerations depending on specific applications. in sec. 4, we will discuss in more detail how our wasa framework satisfies these key properties due to our algorithmic designs. ## watermarking for source attribution (wasa) framework sec. 4.1 discusses watermark design and embedding process. sec. 4.2 details the training of wasa-llm with watermarked texts and its alignment with key properties. sec. 4.3 explains how our trained wasa-llm produces synthetic texts with watermarks for source attribution. ## experiments we perform extensive empirical evaluations to validate that our wasa framework satisfies the 6 key properties in sec. 3. the experimental results are the average taken from 5 random seeds. we consider two datasets in the main experiments: arxiv is collected by post-processing academic papers from arxiv @xcite . this dataset contains academic papers from several fields, each field functions as a data provider. booksum (kryściński et al., 2022) consists of various books, each considered as a data provider. we adopt 10 data providers for each dataset in our main experiments and show that our wasa can scale to a larger number of data providers in sec. 5.3. we further incorporate more diverse datasets and conduct experiments. they reflect realistic scenarios, including when data providers offer similar information, thus presenting more challenging scenarios for source attribution, as detailed in app. e.1.7. we obtain wasa-llm from our second-stage pre-training (sec. 4.2) of the pre-trained gpt2-large , opt-1.3b, and llama2-7b. the results from opt-1.3b are presented in app. e. more details on the datasets and model training are given in app. d, and an ablation study on generalizing to a frontier model, llama3-8b model @xcite , is in app. e.1.8. baseline. since wasa is the first effective source attribution framework, there is no existing baseline. we extend bm25 @xcite , a search engine algorithm that estimates the relevance of generated texts to data providers, to perform source attribution. we also extend a machine learningbased technique as an additional baseline that compares the semantic representations of generated text from each contributor and synthetic text, following a similar setup to @xcite . details of the baselines are presented in app. e.1.3. ## conclusion this paper describes our proposed wasa framework which allows for effective source attribution as a solution to intellectual property infringement in the context of llms. by embedding unique watermarks into llm-generated texts, wasa not only enhances the reliability and interpretability of llm-generated content but also provides a crucial tool for data protection, allowing data providers to verify the use of their contributions in llm training processes. the extensive empirical evaluations of the wasa framework affirm its effectiveness in achieving accurate source attribution while satisfying the key properties we have identified above.