Watermarking Makes Language Models Radioactive
This paper investigates the radioactivity of LLM-generated texts, i.e.
whether it is possible to detect that such input was used as training data.
Conventional methods like membership inference can carry out this detection
with some level of accuracy. We show that watermarked training data leaves
traces easier to detect and much more reliable than membership inference. We
link the contamination level to the watermark robustness, its proportion in the
training set, and the fine-tuning process. We notably demonstrate that training
on watermarked synthetic instructions can be detected with high confidence
(p-value < 1e-5) even when as little as 5% of training text is watermarked.
Thus, LLM watermarking, originally designed for detecting machine-generated
text, gives the ability to easily identify if the outputs of a watermarked LLM
were used to fine-tune another LLM.
65dbffe052eca001fd09ea2b
Tom Sander
admin_assigned
2024-02-26T10:43:41.587Z
6548e467b17b77265dc334cb
/avatars/55f45f8ee6a4f477657cf0dd8409c533.svg
Tom Sander
user
tomsander1998
65dbffe052eca001fd09ea2c
Pierre Fernandez
admin_assigned
2024-02-26T10:43:49.016Z
616c22e040e2f69baa1c7ae0
/avatars/d6c00e7d98e5e8a52e99aa7b1a7815ee.svg
Pierre Fernandez
user
pierrefdz
65dbffe052eca001fd09ea2d
Alain Durmus
65dbffe052eca001fd09ea2e
Matthijs Douze
65dbffe052eca001fd09ea2f
Teddy Furon
claimed_verified
2024-10-04T20:11:54.125Z
670000393ec4cc293d41d92c
/avatars/b67843e1f7addaf6769c2cba868bf501.svg
Teddy Furon
user
tfuron
Watermarking Makes Language Models Radioactive
This paper investigates the radioactivity of LLM-generated texts, i.e.
whether it is possible to detect that such input was used as training data.
Conventional methods like membership inference can carry out this detection
with some level of accuracy. We show that watermarked training data leaves
traces easier to detect and much more reliable than membership inference. We
link the contamination level to the watermark robustness, its proportion in the
training set, and the fine-tuning process. We notably demonstrate that training
on watermarked synthetic instructions can be detected with high confidence
(p-value < 1e-5) even when as little as 5% of training text is watermarked.
Thus, LLM watermarking, originally designed for detecting machine-generated
text, gives the ability to easily identify if the outputs of a watermarked LLM
were used to fine-tune another LLM.
Watermarked training data can be detected with high confidence in LLMs, making it easier to identify if watermarked outputs were used for fine-tuning compared to conventional methods.
watermarked training data membership inference watermark robustness fine-tuning