[Paper Review] A Resilient and Accessible Distribution-Preserving Watermark for Large Language Models

Yihan Wu, Zhengmian Hu+3 more|arXiv (Cornell University)|Oct 11, 2023

Internet Traffic Analysis and Secure E-voting4 citations

TL;DR

DiPmark proposes a distribution-preserving watermarking framework for large language models that ensures stealthiness, efficiency, and resilience by using a context-aware hash function and reweighting strategy to embed watermarks without altering the model's output distribution. It achieves 90-second detection for 1,000 LLaMA-2 sequences without API access and maintains high detection accuracy (AUC > 0.95) under 30% text perturbations.

ABSTRACT

Watermarking techniques offer a promising way to identify machine-generated content via embedding covert information into the contents generated from language models. A challenge in the domain lies in preserving the distribution of original generated content after watermarking. Our research extends and improves upon existing watermarking framework, placing emphasis on the importance of a extbf{Di}stribution- extbf{P}reserving (DiP) watermark. Contrary to the current strategies, our proposed DiPmark simultaneously preserves the original token distribution during watermarking (distribution-preserving), is detectable without access to the language model API and prompts (accessible), and is provably robust to moderate changes of tokens (resilient). DiPmark operates by selecting a random set of tokens prior to the generation of a word, then modifying the token distribution through a distribution-preserving reweight function to enhance the probability of these selected tokens during the sampling process. Extensive empirical evaluation on various language models and tasks demonstrates our approach's distribution-preserving property, accessibility, and resilience, making it a effective solution for watermarking tasks that demand impeccable quality preservation.

Motivation & Objective

• Address the lack of watermarking schemes that simultaneously preserve model distribution, enable fast detection, and resist text modifications.
• Overcome limitations of existing methods that degrade model quality, require API access, or fail under text editing.
• Develop a watermarking framework that is provably distribution-preserving and detectable using only the secret key and watermarked text.
• Ensure resilience against common text manipulations such as insertion, deletion, and substitution without performance degradation.

Proposed method

• Introduces a reweighting strategy that modifies token probabilities during generation using a secret key and a context-dependent hash function to assign unique i.i.d. ciphers.
• Employs a deterministic hash function to generate a unique green-list of tokens per context, ensuring consistent watermark embedding across different prompts.
• Uses hypothesis testing with z-scores to detect watermarks efficiently, relying only on the secret key and the watermarked text—no model weights or API access required.
• Applies a statistical detection mechanism based on the frequency of green-list tokens, with provable robustness against perturbations up to 30% token modification.
• Designs the watermark to preserve the original model’s output distribution by ensuring the reweighting does not shift the underlying probability distribution significantly.
• Validates the method across multiple LLMs (BART-large, LLaMA-2) using tasks like text summarization and poetry generation to assess quality and detectability.

Experimental results

Research questions

• RQ1 Can a watermark be embedded in LLM-generated text without altering the model’s original output distribution, ensuring stealthiness?
• RQ2 Can watermark detection be performed efficiently without access to the model’s API or weights?
• RQ3 How resilient is the watermark to common text modifications such as insertion, deletion, and substitution?
• RQ4 To what extent does the watermark maintain detectability under increasing levels of perturbation (e.g., 20–30% token changes)?
• RQ5 Can a distribution-preserving watermark achieve high detection accuracy while maintaining low false positive rates across diverse generation tasks?

Key findings

• DiPmark maintains near-identical output distributions to the original model, with green token ratios of 0.9940 (α=0.5) and 0.9940 (α=0.45), demonstrating strong stealthiness.
• Detection of 1,000 watermarked sequences from LLaMA-2 takes only 90 seconds using the secret key and no API access, confirming high efficiency.
• Under 30% random perturbations (insertions, deletions, substitutions), DiPmark maintains an AUC score of 0.8060 (α=0.45) and 0.8006 (α=0.5), showing strong resilience.
• The method achieves a true positive rate of 1.0 and a false positive rate of 0.0 under ideal conditions, with AUC scores consistently above 0.95 for perturbation levels ≤0.2.
• The detection z-scores decrease gradually with increasing perturbation, but remain statistically significant, confirming robustness even under moderate editing.
• Empirical evaluation shows that longer sequences (n=260±5) improve detection accuracy, with z-scores increasing with sequence length, aligning with theoretical expectations.