W ater J udge: Quality-Detection Trade-off when Watermarking Large Language Models (2024)

Abstract: Watermarking generative-AI systems, such as LLMs, has gained considerable interest, driven by their enhanced capabilities across a wide range of tasks. Although current approaches have demonstrated that small, context-dependent shifts in the word distributions can be used to apply and detect watermarks, there has been little work in analyzing the impact that these perturbations have on the quality of generated texts. Balancing high detectability with minimal performance degradation is crucial in terms of selecting the appropriate watermarking setting; therefore this paper proposes a simple analysis framework where comparative assessment, a flexible NLG evaluation framework, is used to assess the quality degradation caused by a particular watermark setting. We demonstrate that our framework provides easy visualization of the quality-detection trade-off of watermark settings, enabling a simple solution to find an LLM watermark operating point that provides a well-balanced performance. This approach is applied to two different summarization systems and a translation system, enabling cross-model analysis for a task, and cross-task analysis.

## introduction large language models (llms) have progressed tremendously and are capable of generating highquality texts for a diverse range of tasks. while these systems enhance automation, concerns arise about potential misuse, such as students using chat assistants for assignments or malicious users generating fake news articles. to counter this, current work has introduced the idea of llm watermarking @xcite , where imperceptible patterns are injected into the generated text, enabling the statistical identification of whether text was generated by an llm or not. however, most proposed watermarking schemes restrict the output generation space, which may lead to a trade-off figure 1 : high-level overview of the waterjudge framework: given a system, watermarking parameters, and set of inputs, watermarked outputs are assessed in terms of quality and detectability, leading to a curve over all operating points. this work proposes waterjudge, a framework for analyzing the trade-off between watermarking detectability and the quality of generated watermarked text. we leverage the llm-as-a-judge evaluation approaches @xcite to measure the average probability that an llm prefers a watermarked text over an unwatermarked text. this is used as a metric for quantifying the quality degradation caused by watermarking, which with watermark detection performance, can be used to determine the quality and detectability of a watermark operating point. this provides an approach for practitioners to visualize the effectiveness of specific watermarking operating points, enabling simple selection of an optimal watermark setting with minimal quality degradation. ## results summarization figures 3a and 3b illustrate the relationship between summary quality and watermark detection performance for bart and zephyr respectively. a clear trade-off between watermark strength and output quality can be observed for both systems, where strong watermarking degrades quality while weak watermarking maintains quality but yields poor detection performance. the results further suggest that though multiple operating points can yield similar quality-detectability characteristics, the framework provides a simple way to visualize points that achieve a good balance between the two. this can be useful for hyper-parameter selection, e.g. to find the setting where there's minimal quality degradation for a desired f 0.5 detectability score. note that the quality scores are upper-bounded near 0.5, consistent with the idea that weak watermarking will enforce little restriction and yield texts of similar quality, while stronger watermarks will restrict generation and therefore yield texts of worse quality. further, the saturation at f 0.5 = 1 denotes the region where one can perfectly differentiate watermarked texts from unwatermarked texts, albeit often at the cost of large quality degradation. additionally, it is observed that different base models can have varying optimal watermarking parameters. zephyr-7b is much larger than bart (7.2b vs 0.4b parameters) and is likely to have a more accurate underlying task language model. as such, it seems to better deal with the restrictions imposed by watermarking, as seen by the vertical region around the probability of 0.5 (where minimal quality degradation and good detectability are achieved). further, in the most extreme settings, zephyr's average comparative probability drops to 0.44 compared to bart's 0.28. examples of the generated watermarked text can be seen in appendix h. translation we repeat analysis for translation, with figure 4 showing similar quality-detectability characteristics when an mbart system, which translates german sentences to english, is watermarked. the plot shows further evidence of how for weaker models (0.6b parameters supporting 50 languages) strong watermarking can cause a significant drop where the system struggles to maintain quality. additionally, we can observe that mbart is more sensitive to watermarking parameter settings and that quality is better for small-green list sizes than for larger-green list sizes, even for settings with equivalent detectability performance. ## conclusions this paper introduces waterjudge, a framework for investigating the quality-detection trade-off when watermarking llms, enabling easy visualization of various watermarking settings and simple hyperparameter selection. comparative assessment is shown to be a practical metric for measuring quality degradation and improves on currently used evaluation methods in its accuracy and versatility. waterjudge is also useful in cross-task and crossmodel analysis, showing good correlations for both detectability and quality, despite varying characteristics due to model strength.