A Robust Semantics-based Watermark for Large Language Model against Paraphrasing (2024)

Abstract: Large language models (LLMs) have show their remarkable ability in various natural language tasks. However, there are concerns that LLMs are possible to be used improperly or even illegally. To prevent the malicious usage of LLMs, detecting LLM-generated text becomes crucial in the deployment of LLM applications. Watermarking is an effective strategy to detect the LLM-generated content by encoding a pre-defined secret watermark to facilitate the detection process. However, the majority of existing watermark methods leverage the simple hashes of precedent tokens to partition vocabulary. Such watermarks can be easily eliminated by paraphrase and, correspondingly, the detection effectiveness will be greatly compromised. Thus, to enhance the robustness against paraphrase, we propose a semantics-based watermark framework, SemaMark. It leverages the semantics as an alternative to simple hashes of tokens since the semantic meaning of the sentences will be likely preserved under paraphrase and the watermark can remain robust. Comprehensive experiments are conducted to demonstrate the effectiveness and robustness of SemaMark under different paraphrases.

## introduction large language models (llms) have shown their great ability in various natural language processing (nlp) tasks like question answering (qa) @xcite , reasoning tasks @xcite and code development @xcite . however, tremendous concerns have been raised that llms are possible to be used improperly and illegally. for example, indistinguishable fake news are easy to be fabricated @xcite by language models, which, when disseminated, could instigate widespread panic. similarly, in the commercial sphere, convincingly generated reviews can manipulate consumer perceptions, leading to unethical business competition @xcite . therefore, detecting llm-generated text has become crucial in the real-world applications of llms @xcite @xcite . among diverse methods to detect llmgenerated texts, the watermark strategies have demonstrated outstanding precision @xcite @xcite . it is proposed to encode a secret watermark into the generated texts, such that we can tell whether a text is generated by detecting this watermark. one representative strategy @xcite is to encode the watermark based on the "partition of vocabulary". in detail, given a language model, these methods devise a mapping from precedent tokens to a particular partition of the vocabulary by a partition function for the consequent token. the partition function leverages the hashes of the input as the seed of a random generator to split the vocabulary to a green list and a red list. during the text generation phase, the consequent token has an increased probability to be sampled from the green list. in this way, the watermark is encoded through the matching between the precedent tokens and the vocabulary partition for the consequent token. the detection is also facilitated by detecting this matching in generated contents. however, recent works @xcite reveal that this watermark may be easily eliminated by sentence paraphrasing. individuals seeking to improperly utilize llms without being detected can paraphrase the generated contents, like altering the order and the choices of the words, and only retain the general meaning of the text to achieve their malicious goals like faking news. these paraphrases will change the seed of the partition function, i.e. the token hashes, and as we show in the section 4.4, the partition function is sensitive to small changes. consequently, the matching between the precedent tokens and the green list will be disrupted, and the detection effectiveness of the watermark can be dramatically compromised. in this paper, we propose to leverage the semantic meaning of precedent token sequences as the seed for partition function, instead of simple hashes of precedent tokens, since the core semantic meaning is expected to be maintained after paraphrase. to achieve this goal, one key obstacle is how to capture the semantics when applying them for the partition function to watermark the generated texts. it is a common practice to quantify the semantics via embeddings @xcite @xcite . embeddings indeed can represent consistent semantics after paraphrase. since the embeddings are highdimensional vectors in the continuous space, they often present some minor changes after paraphrase. although the main semantics are preserved, these minor changes can lead to a substantial difference in the partition of vocabulary because the random generator in the partition function is sensitive to the change of the seed, as shown in section 4.4. to overcome the above challenge, i.e., to make the quantified semantics invariant and make the watermark robust under paraphrase, we propose a new watermark method, semamark, which discretizes the continuous embedding space. intuitively, the discretization can coarsen the representation of the embeddings which could tolerate the potential minor changes caused by paraphrase. by proper discretization, the paraphrased semantics could stay in the same discrete section with a high probability and the discretized quantified semantics will likely remain the same even after paraphrase. therefore, the partition results will not change. however, directly converting the high-dimensional embedding space into discrete is intricate and challenging. for example, discretizing each dimension will lead to a large amount of discrete values which is exponential to the number of dimensions. thus, the minor changes by paraphrase can still cause the change of discrete values because the number of discrete values are too dense and each discrete value can tolerate only small changes. therefore, the minor changes of high-dimensional embeddings can have a strong impact on the partition function. to address this problem, semamark first uses a multi-layer perception (mlp) to condense the continuous high-dimensional embeddings into normalized vectors in 2d space. the vectors are located on a unit circle named normalized embedding ring (ne-ring). then the condensed ne-ring is equally divided into various sections, transforming the continuous space into distinct discrete values, i.e., "semantic values". based on the discretization, semamark further introduces two strategies to advance the watermark's concealment and to improve the robustness under paraphrase. first, semamark leverages the uniformity @xcite of contrastive learning(cl) @xcite to strength the mlp and mitigate the problem that the semantics are unevenly concentrating on some discrete sections on ne-ring. the unevenly distribution will cause the final discrete semantic values overly monotonous. it raises the concern that the watermark might be cracked by counting token frequency @xcite . second, semamark utilizes an offset detection method to further enhance the robustness at the boundary of different discrete sections whose semantic values are possibly vulnerable to paraphrase. comprehensive experiments are conducted to demonstrate the effectiveness and robustness of semamark under different paraphrases. watermark. the distinction between watermark and other methods is that watermark can proactively change the generation to insert a concealed watermark into the generated text. this gives clear difference between watermerked and non-figure 1 : the watermarking process of semamark watermarked texts. watermark shifts the text using a small but pre-defined rule to make the detection much more effective. the partition of the vocabulary for each token is a representative watermark method @xcite @xcite . in each autoregressive step of generating one token, the method uses the previous tokens' hashes, to select a part of the vocabulary as "green" at a ratio of γ. subsequently, they elevate the likelihood of the tokens by boosting the logits of the softmax by δ. through this approach, at each token position, the probability of this matching between the seed and green tokens tends to increase. for a sentence with l tokens, it is viewed as a sample set of size l. each token is one sample from the vocabulary. a non-watermarked sentence is expected to have γl tokens showing this match, while the watermarked sentence is expected to have more. the watermark detection is approached as a z-test with null hypothesis that the text is nonwatermarke. if the z-statistic is large, i.e. it is significantly different from the null hypothesis, the null hypothesis can be rejected and the text can be predicted as watermarked: ## method in this section, we introduce the detailed design of semamark. we first present how to use the semantic information as the seed for watermark methods that are based on random partition of vocabulary in section 3.1. then in section 3.2 and section 3.3, we introduce the cl training scheme and the smoothed detection method for further improving the robustness, respectively. ## experiment in this section, we conduct experiments to demonstrate the robustness of semamark. in section 4.2, we demonstrate that its robustness is better than the baseline methods. in section 4.3, we show that our watermark has almost no influence on the quality of generated texts. in section 4.4, we use ablation studies to demonstrate the effectiveness of partition function and q-offset detection, and show the sensitivity of the partition function. in section 4.5 we visualize the distribution of ne-ring and provide analysis on the feature distribution of contractive learning. ## conclusion in this paper, we use the semantic information for watermarking to enhance the robustness against paraphrase. the existing watermark methods use the matching between the previous tokens and the partition vocabulary. this matching can be easily broken by paraphrase. however, we construct the mapping between the semantics and the vocabulary. in this way, the semantics will stay stable under paraphrase and the robustness of watermark can be enhanced. to make use of semantics, we propose semamark to discretize the embedding space on ne-ring and propose a training method based on cl. in addition, we use q-offset detection to further advance the robustness by increasing the tolerance of the semantic values close to the discrete boundary. in experiments, we demonstrate our method can perform much better compared with baseline methods under paraphrase while having little influence on the generation quality.