Context-aware Watermark with Semantic Balanced Green-red Lists for Large Language Models (2024)

Abstract: Watermarking enables people to determine whether the text is generated by a specific model. It injects a unique signature based on the “green-red” list that can be tracked during detection, where the words in green lists are encouraged to be generated. Recent researchers propose to fix the green/red lists or increase the proportion of green tokens to defend against paraphrasing attacks. However, these methods cause degradation of text quality due to semantic disparities between the watermarked text and the unwatermarked text. In this paper, we propose a semantic-aware watermark method that considers contexts to generate a semantic-aware key to split a semantically balanced green/red list for watermark injection. The semantic balanced list reduces the performance drop due to adding bias on green lists. To defend against paraphrasing attacks, we generate the watermark key considering the semantics of contexts via locally sensitive hashing. To improve the text quality, we propose to split green/red lists considering semantics to enable the green list to cover almost all semantics. We also dynamically adapt the bias to balance text quality and robustness. The experiments show our advantages in both robustness and text quality comparable to existing baselines.

## introduction large language models (llms) show their power on text generations but their formidable power may be used for unethical purposes such as plagiarism @xcite . current research injects watermarks into llms' generated texts, thereby enabling people to distinguish between llm-generated text and human-written text. recent watermark methods inject a unique signature into llm-generated text, which can only be perceived by watermarking methods, facilitating the detection of whether a text was generated by llms. current watermark methods mainly inject the signature according to "green-red list" @xcite : they divide vocabulary into green/red lists, regard words in green lists as the unique signature, and encourage to generate green tokens, which is easy to be recognized. the methods can be divided into two categories: (1) token sampling biasing-based watermark forces llms to select only green tokens during generation. exp-edit @xcite intervenes in the sampling process of each token. however, forcing llms to sample green tokens restricts the semantic richness of llm-generated text, thus undermining its text quality. (2) to improve the generation quality, researchers further propose token probability biasing-based watermark, which enriches the semantics of watermarked texts by introducing a bias to the probability distribution to softly encourage generating green tokens instead of restricting to select green tokens. @xcite proposed ns-mark to constrain the frequency of biasing. @xcite introduced dipmark to approximate the biased probability distribution to the original one. these methods mitigate the impact of biasing on text quality and ensure superior text quality. the above methods narrow the gap in text quality between the watermarked text and the unwatermarked text but lack robustness against paraphrasing attacks. paraphrasing attacks @xcite use language models to modify the watermarked text to evade the unique signature of the watermarked text. specifically, first, the paraphrasing attacks make it difficult for current watermarking methods to match the green/red lists used in watermark injection during the process of watermark detection, causing incorrectly determining whether a token is in the green list; second, the paraphrasing of words turned many green tokens into red tokens, greatly reducing the proportion of green tokens in the text. paraphrasing attacks make the proportion of green tokens in the attacked watermarked text similar to that of the unwatermarked text, destroying the unique signature of the watermarked text, and leading to detection errors. researchers propose to fix the green/red lists @xcite in response to the aforementioned problem of mismatched green/red lists caused by paraphrasing attacks: ensuring that the green/red lists used for watermark detection are always consistently aligned with those used for watermark injection even if the watermarked text suffered paraphrasing attacks. this alignment enables accurate identification of tokens within the green list. however, the watermark method introduces the same bias to the probability distribution during each generation step due to the fixed green tokens, restricting the diversity of watermarked text. researchers have discovered that increasing the proportion of green tokens in the watermarked text can maintain a sufficiently high ratio of green tokens even when paraphrasing attacks reduce their count, thus ensuring the detection of the unique signature, which effectively mitigates the problem described above of reducing the number of green tokens caused by paraphrasing attacks. current works propose to cause greater bias to the probability distribution to increase the sampling probability of green tokens during watermark injection, enlarging the proportion of green tokens @xcite . however, a greater bias leads to more significant disparities between the perturbed probability distribution and the original one, thereby resulting in a degradation of text quality. in this paper, to balance text quality and robustness against paraphrasing attacks, we propose a llm-based semantic-aware watermark method that considers contexts to generate a semanticaware key to split a semantic balanced green/red lists for watermark injection. those green/red lists ensure the semantic distribution of green tokens to be very similar to the distribution of the whole vocabulary, which highly reduces the performance drop due to introducing biases to encourage the green tokens. specifically, to improve the robustness against paraphrasing attacks, we propose the context-aware semantic-based watermark key generator with local sensitive hashing (lsh). it prevents the paraphrasing attack from maliciously replacing tokens and thus changing the watermark key to mislead the watermark detection. to improve the text quality, we propose a semantic-based green-red lists split method, which enables the green lists to cover almost all semantics and en-sures the distribution among green and red lists is balanced. it avoids the bias on green lists and reduces the text quality. to balance the text quality and robustness, we propose an entropy-based dynamic bias adaptation module, dynamically adjusting the bias during generation. the experimental results validate our method's effectiveness in the robustness against paraphrasing attacks and text quality. our contributions are: (1) we propose a semantic-based watermark method for llms to enhance the text quality and robustness against paraphrasing attacks. (2) we obtain the green/red lists based on semantics, making green lists cover almost all semantic spaces and obtain a balanced semantics distribution green-red list. (3) experiments show our method outperforms baselines on text quality, watermarked text detection, and robustness against paraphrasing attacks. ## conclusion in this paper, we propose a semantic-based watermark method for llms that balances text quality and robustness against paraphrasing attacks. our approach effectively retrieves the semantic watermark key and ensures coverage among semantically similar tokens in the green list while reducing the semantic distribution gap between the green list and the entire vocabulary. this allows the model to sample desired text in the green list, enhancing text quality. dynamic bias adaption addresses fixed bias adaptation limitations. the experiments show our method excels in robustness against paraphrasing attacks and significantly improves text quality.