Robust Distortion-free Watermarks for Language Models
We propose a methodology for planting watermarks in text from an
autoregressive language model that are robust to perturbations without changing
the distribution over text up to a certain maximum generation budget. We
generate watermarked text by mapping a sequence of random numbers -- which we
compute using a randomized watermark key -- to a sample from the language
model. To detect watermarked text, any party who knows the key can align the
text to the random number sequence. We instantiate our watermark methodology
with two sampling schemes: inverse transform sampling and exponential minimum
sampling. We apply these watermarks to three language models -- OPT-1.3B,
LLaMA-7B and Alpaca-7B -- to experimentally validate their statistical power
and robustness to various paraphrasing attacks. Notably, for both the OPT-1.3B
and LLaMA-7B models, we find we can reliably detect watermarked text (p leq
0.01) from 35 tokens even after corrupting between 40-50\% of the tokens
via random edits (i.e., substitutions, insertions or deletions). For the
Alpaca-7B model, we conduct a case study on the feasibility of watermarking
responses to typical user instructions. Due to the lower entropy of the
responses, detection is more difficult: around 25% of the responses -- whose
median length is around 100 tokens -- are detectable with p leq 0.01, and
the watermark is also less robust to certain automated paraphrasing attacks we
implement.
64c74ace77a6473ac322b54a
Rohith Kuditipudi
64c74ace77a6473ac322b54b
John Thickstun
admin_assigned
2023-07-31T07:10:47.420Z
619828ff465b7973a532dee6
https://cdn-avatars.huggingface.co/v1/production/uploads/619828ff465b7973a532dee6/A55HdKmHcZ9w6BxN-cGoE.jpeg
John Thickstun
user
jthickstun
64c74ace77a6473ac322b54c
Tatsunori Hashimoto
64c74ace77a6473ac322b54d
Percy Liang
admin_assigned
2023-07-31T07:11:38.383Z
6409651b9e9f790c905b2335
/avatars/1fb8c80b60f21f65a0a027319101f236.svg
Percy Liang
user
percyliang
Robust Distortion-free Watermarks for Language Models
We propose a methodology for planting watermarks in text from an
autoregressive language model that are robust to perturbations without changing
the distribution over text up to a certain maximum generation budget. We
generate watermarked text by mapping a sequence of random numbers -- which we
compute using a randomized watermark key -- to a sample from the language
model. To detect watermarked text, any party who knows the key can align the
text to the random number sequence. We instantiate our watermark methodology
with two sampling schemes: inverse transform sampling and exponential minimum
sampling. We apply these watermarks to three language models -- OPT-1.3B,
LLaMA-7B and Alpaca-7B -- to experimentally validate their statistical power
and robustness to various paraphrasing attacks. Notably, for both the OPT-1.3B
and LLaMA-7B models, we find we can reliably detect watermarked text (p leq
0.01) from 35 tokens even after corrupting between 40-50\% of the tokens
via random edits (i.e., substitutions, insertions or deletions). For the
Alpaca-7B model, we conduct a case study on the feasibility of watermarking
responses to typical user instructions. Due to the lower entropy of the
responses, detection is more difficult: around 25% of the responses -- whose
median length is around 100 tokens -- are detectable with p leq 0.01, and
the watermark is also less robust to certain automated paraphrasing attacks we
implement.
The paper presents a method to embed watermarks in text generated by autoregressive language models that can withstand perturbations while preserving the text distribution, validated across multiple models and various types of attacks.
autoregressive language model randomized watermark key inverse transform sampling exponential minimum sampling OPT-1.3B LLaMA-7B Alpaca-7B paraphrasing attacks