Subtle Signatures, Strong Shields: Advancing Robust and Imperceptible Watermarking in Large Language Models (2024)

Abstract: The widespread adoption of Large Language Models (LLMs) has led to an increase in AI-generated text on the Internet, presenting a crucial challenge to differentiate AI-created content from human-written text. This challenge is critical to prevent issues of authenticity, trust, and potential copyright violations. Current research focuses on watermarking LLM-generated text, but traditional techniques struggle to balance robustness with text quality. We introduce a novel watermarking approach, Robust and Imperceptible Watermarking (RIW) for LLMs, which leverages token prior probabilities to improve detectability and maintain watermark imperceptibility. RIW methodically embeds watermarks by partitioning selected tokens into two distinct groups based on their prior probabilities and employing tailored strategies for each group. In the detection stage, the RIW method employs the ‘voted z-test’ to provide a statistically robust framework to identify the presence of a watermark accurately. The effectiveness of RIW is evaluated across three key dimensions: success rate, text quality, and robustness against removal attacks. Our experimental results on various LLMs, including GPT2-XL, OPT-1.3B, and LLaMA2-7B, indicate that RIW surpasses existing models, and also exhibits increased robustness against various attacks and good imperceptibility, thus promoting the responsible use of LLMs.

## introduction large language models (llms) such as chatgpt @xcite and llama @xcite have marked a significant advancement in natural language processing, enabling a range of applications from generating human-like text to understanding complex language patterns. however, this success has also led to pressing challenges: the spread of fake news, the risk of copyright violations, and a rise in academic dishonesty. these issues highlight the necessity for reliable methods to detect and audit machine-generated text. addressing these concerns is essential for mitigating potential harms associated with llms and ensuring their responsible utilization in various domains. to meet that need, watermarking has emerged as an effective method for tagging and detecting machinegenerated text from llms. a watermark in this context is a distinct yet inconspicuous pattern embedded within the text. it is designed to be imperceptible to human readers but allows for the algorithmic identification of the text as synthetic. one major way of using watermarks for llms is watermarking during logit generation @xcite @xcite @xcite @xcite @xcite . this watermarking technique typically involves segmenting the vocabulary into two categories: a 'green list' and a 'red list'. the approach is to preferentially utilize tokens from the green list in the ai-generated text. during the detection phase, the actual frequency of these green list tokens within the text is calculated and compared against an expected probability, exemplified in figure 1 with an expectation set at 0.5. a significant deviation from this expected probability suggests ai involvement in the text's generation, calculated through a statistical method, the z-test. however, the implementation of this method introduces a critical dilemma. the expected probability level for green list tokens can be at odds with the natural frequency distribution of these tokens in regular language use. this discrepancy can lead to either the watermark is not robust enough, making ai-generated text difficult to distinguish under attack, or impacting the overall quality of the text. balancing these concerns is crucial: the watermark must be detectable without compromising the authenticity and readability of the generated content. the disparity between the expected probability and natural frequency of tokens on the green list leads to two challenges: from the broader scope, as illustrated in figure 1 , the natural frequency (at around 0.43) is lower than the expected probability (set at 0.5). when dividing vocabulary list evenly into red and green, previous studies usually set the z-test expected value to 0.5, this will lead to a sluggish response: need to first increase the frequency of these tokens to reach the expected value before any overlap in detection results becomes visible. on an individual token basis, uniformly increasing the logits for all tokens on the green list may not be equally effective. for tokens with inherently low frequency, substantial adjustments to their logits might not significantly alter their frequency in the generated text, as shown in figure 1 . this ineffectiveness suggests the need for a more tailored approach, where adjustments are made by the specific prior probabilities of each token. this allows for more precise detection with minimal, potentially negligible, impact on the overall quality of the text. in this paper, we introduce a novel watermarking approach termed the robust and imperceptible watermarking (riw) algorithm for llms, based on the approach of @xcite . our focus centers on applying prior probabilities of tokens in watermarks to remain detectable under various types of realistic attacks and improve the watermarking imperceptibility. concretely, riw introduces a two-tiered process: a nuanced watermark injection strategy paired with a sophisticated watermark detection mechanism. the watermark injection phase begins with a meticulous selection of tokens from the llm's vocabulary, forming the foundational 'green list'. this list undergoes a deliberate partitioning into two green sublists based on prior probabilities. then we design different modifications to the logits of the token in each sublist, ensuring a sensitive embedding process with imperceptible and minimally intrusive to the original text. this step skillfully balances the randomness inherent in llm outputs with the predictability necessary for watermark detection. in watermark detection, riw employs the 'voted ztest', capitalizing on the prior probabilities of each token, providing a statistically precise and robust framework to accurately identify the presence of a watermark. what sets riw apart is its harmonious blend of robustness and imperceptibility, ensuring the integrity and naturalness of watermarked text. we comprehensively evaluate the watermarking algorithm using three critical criteria: success rate: an indicator of the algorithm's effectiveness in accurately identifying watermarked texts. text quality: determine if the watermarking process compromises the naturalness and readability of the text. robustness: tested by assessing the watermark's resilience to various attack strategies, ensuring that the watermark remains detectable even after potential tampering. through extensive experimentation on models of varying sizes, including gpt2-xl @xcite , opt-1.3b @xcite , and llama2-7b @xcite , riw demonstrates superior performance over existing methods like kgw @xcite and unigram-wm @xcite . riw not only attains enhanced detection accuracy but also exhibits increased robustness against various attacks and good imperceptibility. ## related work large language models (llms) offer the potential for embedding watermarks at various stages of text generation: during the training phase, within the logit generation process, and throughout token sampling. each stage presents distinct approaches and challenges for watermarking. ## methodology in this section, we will introduce the process of embedding our designed watermark to llms as well as the mechanism for detecting such watermarks within sequences. to inject watermarks, we randomly select several tokens from the vocabulary and partition these tokens into two distinct sublists based on their prior probabilities. then, we develop diverse watermarking strategies tailored to each list to ensure the process remains efficient. for detection, we have developed a 'voted z-test', which leverages the prior probabilities of each token to determine the watermark's presence. ## experiments we conduct experiments assessing the performance of watermark detection, the quality of watermarked text, and its robustness against attacks, in comparison to established baseline methods.