title: On the Reliability of Watermarks for Large Language Models
summary: Large language models (LLMs) are now deployed to everyday use and positioned
  to produce large quantities of text in the coming decade. Machine-generated
  text may displace human-written text on the internet and has the potential to
  be used for malicious purposes, such as spearphishing attacks and social media
  bots. Watermarking is a simple and effective strategy for mitigating such harms
  by enabling the detection and documentation of LLM-generated text. Yet, a
  crucial question remains: How reliable is watermarking in realistic settings in
  the wild? There, watermarked text might be mixed with other text sources,
  paraphrased by human writers or other language models, and used for
  applications in a broad number of domains, both social and technical. In this
  paper, we explore different detection schemes, quantify their power at
  detecting watermarks, and determine how much machine-generated text needs to be
  observed in each scenario to reliably detect the watermark. We especially
  highlight our human study, where we investigate the reliability of watermarking
  when faced with human paraphrasing. We compare watermark-based detection to
  other detection strategies, finding overall that watermarking is a reliable
  solution, especially because of its sample complexity - for all attacks we
  consider, the watermark evidence compounds the more examples are given, and the
  watermark is eventually detected.
paper_authors._id: 64813306de559d48dbb4de79
paper_authors.name: John Kirchenbauer
paper_authors.status: claimed_verified
paper_authors.statusLastChangedAt: 2023-06-09T15:32:30.484Z
paper_authors._id: 63d98af1897746d6496177df
paper_authors.avatarUrl: /avatars/c5d0031c796a3c11bcb0d01b959168dc.svg
paper_authors.fullname: John Kirchenbauer
paper_authors.type: user
paper_authors.user: jwkirchenbauer
paper_authors._id: 64813306de559d48dbb4de7a
paper_authors.name: Jonas Geiping
paper_authors.status: claimed_verified
paper_authors.statusLastChangedAt: 2023-06-08T16:07:32.819Z
paper_authors._id: 63d86dbf3130cadcaf8bdd11
paper_authors.avatarUrl: /avatars/29d79a0c6dcec01111ef192fecd0fa7a.svg
paper_authors.fullname: Jonas Geiping
paper_authors.type: user
paper_authors.user: JonasGeiping
paper_authors._id: 64813306de559d48dbb4de7b
paper_authors.name: Yuxin Wen
paper_authors.status: claimed_verified
paper_authors.statusLastChangedAt: 2023-06-08T16:07:27.789Z
paper_authors._id: 62cda27d248f9e6bc20c4261
paper_authors.avatarUrl: /avatars/907b9464071ff7ed1ff064331595f12f.svg
paper_authors.fullname: Yuxin Wen
paper_authors.type: user
paper_authors.user: ywen
paper_authors._id: 64813306de559d48dbb4de7c
paper_authors.name: Manli Shu
paper_authors.status: claimed_verified
paper_authors.statusLastChangedAt: 2023-06-27T07:28:06.203Z
paper_authors._id: 63bdcb129a15a3e94198e7d3
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/63bdcb129a15a3e94198e7d3/wFVtkekqyQLbS0-78fqcs.jpeg
paper_authors.fullname: Manli Shu
paper_authors.type: user
paper_authors.user: Manli
paper_authors._id: 64813306de559d48dbb4de7d
paper_authors.name: Khalid Saifullah
paper_authors.status: claimed_verified
paper_authors.statusLastChangedAt: 2023-06-12T09:12:42.578Z
paper_authors._id: 603406de3d343696d96ef2a6
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/603406de3d343696d96ef2a6/FS3xGIC9G_JpyQ806VAyc.jpeg
paper_authors.fullname: Khalid Saifullah
paper_authors.type: user
paper_authors.user: khalidsaifullaah
paper_authors._id: 64813306de559d48dbb4de7e
paper_authors.name: Kezhi Kong
paper_authors._id: 64813306de559d48dbb4de7f
paper_authors.name: Kasun Fernando
paper_authors._id: 64813306de559d48dbb4de80
paper_authors.name: Aniruddha Saha
paper_authors._id: 64813306de559d48dbb4de81
paper_authors.name: Micah Goldblum
paper_authors._id: 64813306de559d48dbb4de82
paper_authors.name: Tom Goldstein
paper_title: On the Reliability of Watermarks for Large Language Models
paper_summary: Large language models (LLMs) are now deployed to everyday use and positioned
  to produce large quantities of text in the coming decade. Machine-generated
  text may displace human-written text on the internet and has the potential to
  be used for malicious purposes, such as spearphishing attacks and social media
  bots. Watermarking is a simple and effective strategy for mitigating such harms
  by enabling the detection and documentation of LLM-generated text. Yet, a
  crucial question remains: How reliable is watermarking in realistic settings in
  the wild? There, watermarked text might be mixed with other text sources,
  paraphrased by human writers or other language models, and used for
  applications in a broad number of domains, both social and technical. In this
  paper, we explore different detection schemes, quantify their power at
  detecting watermarks, and determine how much machine-generated text needs to be
  observed in each scenario to reliably detect the watermark. We especially
  highlight our human study, where we investigate the reliability of watermarking
  when faced with human paraphrasing. We compare watermark-based detection to
  other detection strategies, finding overall that watermarking is a reliable
  solution, especially because of its sample complexity - for all attacks we
  consider, the watermark evidence compounds the more examples are given, and the
  watermark is eventually detected.
paper_ai_keywords: Large language models LLMs watermarks watermarking spearphishing attacks social media bots detection documentation realistic settings text sources paraphrased human writers machine-generated text applications domains detection schemes sample complexity