Watermarking of language model outputs enables statistical detection of model-generated text, which can mitigate harms and misuses of language models. Existing watermarking strategies operate by altering the decoder of an existing language model. In this paper, we ask whether language models can directly learn to generate watermarked text, which would have significant implications for the real-world deployment of watermarks. First, learned watermarks could be used to build open models that naturally generate watermarked text, enabling watermarking for open models, where users can control the decoding procedure. Second, if watermarking is used to determine the provenance of generated text, an adversary can hurt the reputation of a victim model by spoofing its watermark and generating damaging watermarked text. To investigate the learnability of watermarks, we propose watermark distillation, which trains a student model to behave like a teacher model that uses decoding-based watermarking. We test our approach on three decoding-based watermarking strategies and various hyperparameter settings, finding that models can learn to generate watermarked text with high detectability. We also find limitations to learnability, including the loss of watermarking capabilities under fine-tuning on normal text and high sample complexity when learning low-distortion watermarks.
Publicly-Detectable Watermarking for Language Models
University of California, Berkeley（加州大学伯克利分校）；University of Wisconsin, Madison（威斯康星大学麦迪逊分校）；Meta；Fundamental Artificial Intelligence Research at Meta（元公司基础人工智能研究部）；University of Virginia（弗吉尼亚大学）；New York University Shanghai（上海纽约大学）
On the Reliability of Watermarks for Large Language Models
Max-Planck Institute for Intelligent Systems（马克斯·普朗克智能系统研究所）；Tübingen AI Center（蒂宾根人工智能中心）；University of Maryland（马里兰大学）；Scuola Normale Superiore di Pisa（比萨高等师范学校）；New York University（纽约大学）；ELLIS Institute Tübingen（ELLIS蒂宾根研究所）
Mark Your LLM: Detecting the Misuse of Open-Source Large Language Models via Watermarking
The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；Tsinghua University（清华大学）；The Hong Kong University of Science and Technology（香港科技大学）
Fudan University（复旦大学）；University of California, Los Angeles（加利福尼亚大学洛杉矶分校）
Large pre-trained language models (PLMs) have proven to be a crucial component of modern natural language processing systems. PLMs typically need to be fine-tuned on task-specific downstream datasets, which makes it hard to claim the ownership of PLMs and protect the developer's intellectual property due to the catastrophic forgetting phenomenon. We show that PLMs can be watermarked with a multi-task learning framework by embedding backdoors triggered by specific inputs defined by the owners, and those watermarks are hard to remove even though the watermarked PLMs are fine-tuned on multiple do…
RMCW: A Deletion-Robust Watermark Based on Reed--Muller Codes for Language Models
Tsinghua University（清华大学）；University of Wisconsin–Madison（威斯康星大学麦迪逊分校）；Shanghai Qi Zhi Institute（上海期智研究院）；The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳））；Chinese Academy of Sciences（中国科学院）；Xiongan AI Institute（雄安人工智能研究院）
How does Watermarking Affect Visual Language Models in Document Understanding?
Southeast University, China（东南大学）；University of California, Merced, USA（加州大学默塞德分校）；National University of Singapore, Singapore（新加坡国立大学）；The University of Queensland, Australia（昆士兰大学）
CISPA Helmholtz Center for Information Security（CISPA亥姆霍兹信息安全中心）
Recent advances in natural language generation have introduced powerful language models with high-quality output text. However, this raises concerns about the potential misuse of such models for malicious purposes. In this paper, we study natural language watermarking as a defense to help better mark and trace the provenance of text. We introduce the Adversarial Watermarking Transformer (AWT) with a jointly trained encoder-decoder and adversarial training that, given an input text and a binary message, generates an output text that is unobtrusively encoded with the given message. We further st…
