Protecting intellectual property (IP) of text such as articles and code is increasingly important, especially as sophisticated attacks become possible, such as paraphrasing by large language models (LLMs) or even unauthorized training of LLMs on copyrighted text to infringe such IP. However, existing text watermarking methods are not robust enough against such attacks nor scalable to millions of users for practical implementation. In this paper, we propose Waterfall, the first training-free framework for robust and scalable text watermarking applicable across multiple text types (e.g., articles, code) and languages supportable by LLMs, for general text and LLM data provenance. Waterfall comprises several key innovations, such as being the first to use LLM as paraphrasers for watermarking along with a novel combination of techniques that are surprisingly effective in achieving robust verifiability and scalability. We empirically demonstrate that Waterfall achieves significantly better scalability, robust verifiability, and computational efficiency compared to SOTA article-text watermarking methods, and showed how it could be directly applied to the watermarking of code. We also demonstrated that Waterfall can be used for LLM data provenance, where the watermarks of LLM training data can be detected in LLM output, allowing for detection of unauthorized use of data for LLM training and potentially enabling model-centric watermarking of open-sourced LLMs which has been a limitation of existing LLM watermarking works. Our code is available at https://github.com/aoi3142/Waterfall.
Implicit Identity Technologies for LLMs: Fingerprinting and Watermarking across Datasets, Models, and Generated Content
School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China（西安交通大学计算机科学与工程学院）；State Grid Henan Marketing Service Center, Henan, China（国网河南营销服务中心）；Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China（中国科学院大学网络安全学院）；School of Information Technology, Deakin University, Geelong, Australia（迪金大学信息技术学院）
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络与信息安全学院）
Blind PRNG Hijacking: An Undetectable Integrity-Preserving Attack Against LLM Watermarking
Fujian Provincial Key Laboratory of Automotive Electronics and Electric Drive（福建省汽车电子与电力驱动重点实验室）；School of Electronic, Electrical and Physics（电子、电气与物理学院）；Fujian University of Technology（福建理工大学）；School of Humanities（人文学院）；Institute of Applied Physics and Materials Engineering（应用物理与材料工程学院）；University of Macau（澳门大学）
CISPA Helmholtz Center for Information Security（CISPA亥姆霍兹信息安全中心）
Recent advances in natural language generation have introduced powerful language models with high-quality output text. However, this raises concerns about the potential misuse of such models for malicious purposes. In this paper, we study natural language watermarking as a defense to help better mark and trace the provenance of text. We introduce the Adversarial Watermarking Transformer (AWT) with a jointly trained encoder-decoder and adversarial training that, given an input text and a binary message, generates an output text that is unobtrusively encoded with the given message. We further st…
Rethinking LLM Watermark Detection in Black-Box Settings: A Non-Intrusive Third-Party Framework
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；National Computer Network Emergency Response Technical Team, Coordination Center of China (CNCERT/CC)（国家计算机网络应急技术处理协调中心）
University of Science and Technology of China（中国科学技术大学）
Text content created by humans or language models is often stolen or misused by adversaries. Tracing text provenance can help claim the ownership of text content or identify the malicious users who distribute misleading content like machine-generated fake news. There have been some attempts to achieve this, mainly based on watermarking techniques. Specifically, traditional text watermarking methods embed watermarks by slightly altering text format like line spacing and font, which, however, are fragile to cross-media transmissions like OCR. Considering this, natural language watermarking metho…
With the rise of data-driven methods for traffic forecasting, accident prediction, and profiling driving behavior, personal GPS trajectory data has become an essential asset for businesses and emerging data markets. However, as personal data, GPS trajectories require protection. Especially by data breaches, verification of GPS data ownership is a challenging problem. Watermarking facilitates data ownership verification by encoding provenance information into the data. GPS trajectory watermarking is particularly challenging due to the spatio-temporal data properties and easiness of data modific…
Removing Watermarks with Partial Regeneration using Semantic Information
International Computer Science Institute（国际计算机科学研究所）；School of Computing and Augmented Intelligence（计算与增强智能学院）；Lawrence Berkeley National Laboratory（劳伦斯伯克利国家实验室）；Department of Statistics（统计学系）；University of California at Berkeley（加州大学伯克利分校）
MATRIX: Multi-Layer Code Watermarking via Dual-Channel Constrained Parity-Check Encoding
Beijing University of Posts and Telecommunications（北京邮电大学）；Nanyang Technological University（南洋理工大学）；Harbin Institute of Technology, Shenzhen（哈尔滨工业大学（深圳））；School of Cyberspace Security, Huazhong University of Science and Technology（华中科技大学网络空间安全学院）
MelShield: Robust Mel-Domain Audio Watermarking for Provenance Attribution of AI Generated Synthesized Speech
Department of Electrical and Computer Engineering, Queen's University, Kingston, ON, Canada（皇后大学电气与计算机工程系）；Department of Electrical and Computer Engineering, University of Waterloo, Waterloo, ON, Canada（滑铁卢大学电气与计算机工程系）
Advancements in deep generative models have made it possible to synthesize images, videos and audio signals that are difficult to distinguish from natural signals, creating opportunities for potential abuse of these capabilities. This motivates the problem of tracking the provenance of signals, i.e., being able to determine the original source of a signal. Watermarking the signal at the time of signal creation is a potential solution, but current techniques are brittle and watermark detection mechanisms can easily be bypassed by applying post-processing transformations (cropping images, shifti…
Deep Neural Network (DNN) watermarking is a method for provenance verification of DNN models. Watermarking should be robust against watermark removal attacks that derive a surrogate model that evades provenance verification. Many watermarking schemes that claim robustness have been proposed, but their robustness is only validated in isolation against a relatively small set of attacks. There is no systematic, empirical evaluation of these claims against a common, comprehensive set of removal attacks. This uncertainty about a watermarking scheme's robustness causes difficulty to trust their depl…
TriniMark: A Robust Generative Speech Watermarking Method for Trinity-Level Traceability
Huaqiao University（华侨大学）；East China Normal University（华东师范大学）；Shenzhen University（深圳大学）；French National Institute of Health and Medical Research（法国国家健康与医学研究院）
