title: Robust Distortion-free Watermarks for Language Models
summary: We propose a methodology for planting watermarks in text from an
  autoregressive language model that are robust to perturbations without changing
  the distribution over text up to a certain maximum generation budget. We
  generate watermarked text by mapping a sequence of random numbers -- which we
  compute using a randomized watermark key -- to a sample from the language
  model. To detect watermarked text, any party who knows the key can align the
  text to the random number sequence. We instantiate our watermark methodology
  with two sampling schemes: inverse transform sampling and exponential minimum
  sampling. We apply these watermarks to three language models -- OPT-1.3B,
  LLaMA-7B and Alpaca-7B -- to experimentally validate their statistical power
  and robustness to various paraphrasing attacks. Notably, for both the OPT-1.3B
  and LLaMA-7B models, we find we can reliably detect watermarked text (p leq
  0.01) from 35 tokens even after corrupting between 40-50\% of the tokens
  via random edits (i.e., substitutions, insertions or deletions). For the
  Alpaca-7B model, we conduct a case study on the feasibility of watermarking
  responses to typical user instructions. Due to the lower entropy of the
  responses, detection is more difficult: around 25% of the responses -- whose
  median length is around 100 tokens -- are detectable with p leq 0.01, and
  the watermark is also less robust to certain automated paraphrasing attacks we
  implement.
paper_authors._id: 64c74ace77a6473ac322b54a
paper_authors.name: Rohith Kuditipudi
paper_authors._id: 64c74ace77a6473ac322b54b
paper_authors.name: John Thickstun
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2023-07-31T07:10:47.420Z
paper_authors._id: 619828ff465b7973a532dee6
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/619828ff465b7973a532dee6/A55HdKmHcZ9w6BxN-cGoE.jpeg
paper_authors.fullname: John Thickstun
paper_authors.type: user
paper_authors.user: jthickstun
paper_authors._id: 64c74ace77a6473ac322b54c
paper_authors.name: Tatsunori Hashimoto
paper_authors._id: 64c74ace77a6473ac322b54d
paper_authors.name: Percy Liang
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2023-07-31T07:11:38.383Z
paper_authors._id: 6409651b9e9f790c905b2335
paper_authors.avatarUrl: /avatars/1fb8c80b60f21f65a0a027319101f236.svg
paper_authors.fullname: Percy Liang
paper_authors.type: user
paper_authors.user: percyliang
paper_title: Robust Distortion-free Watermarks for Language Models
paper_summary: We propose a methodology for planting watermarks in text from an
  autoregressive language model that are robust to perturbations without changing
  the distribution over text up to a certain maximum generation budget. We
  generate watermarked text by mapping a sequence of random numbers -- which we
  compute using a randomized watermark key -- to a sample from the language
  model. To detect watermarked text, any party who knows the key can align the
  text to the random number sequence. We instantiate our watermark methodology
  with two sampling schemes: inverse transform sampling and exponential minimum
  sampling. We apply these watermarks to three language models -- OPT-1.3B,
  LLaMA-7B and Alpaca-7B -- to experimentally validate their statistical power
  and robustness to various paraphrasing attacks. Notably, for both the OPT-1.3B
  and LLaMA-7B models, we find we can reliably detect watermarked text (p leq
  0.01) from 35 tokens even after corrupting between 40-50\% of the tokens
  via random edits (i.e., substitutions, insertions or deletions). For the
  Alpaca-7B model, we conduct a case study on the feasibility of watermarking
  responses to typical user instructions. Due to the lower entropy of the
  responses, detection is more difficult: around 25% of the responses -- whose
  median length is around 100 tokens -- are detectable with p leq 0.01, and
  the watermark is also less robust to certain automated paraphrasing attacks we
  implement.
paper_ai_summary: The paper presents a method to embed watermarks in text generated by autoregressive language models that can withstand perturbations while preserving the text distribution, validated across multiple models and various types of attacks.
paper_ai_keywords: autoregressive language model randomized watermark key inverse transform sampling exponential minimum sampling OPT-1.3B LLaMA-7B Alpaca-7B paraphrasing attacks