Unforgeable Watermarks for Language Models via Robust Signatures
Paul G. Allen School of Computer Science & Engineering, University of Washington（保罗·G·艾伦计算机科学与工程学院，华盛顿大学）；Data Science Institute, University of Chicago（数据科学研究所，芝加哥大学）
语言模型现在经常生成难以与人类写作区分开的文本，这提出了对稳健工具进行验证的迫切需求。水印技术已成为一种有前景的对策，现有研究大多集中在模型质量的保持和稳健检测上。然而，当前方案对假 attribution 的保护有限。我们通过引入两个新的保证来加强 soundness 的概念：不可伪造性和可恢复性。不可伪造性防止对手制造假阳性，即这些文本远离水印模型的任何输出，但仍然被标记为水印。可恢复性提供额外的保护层：每当检测到水印时，检测器能够识别出源文本，该文本是被标记内容的来源。这些属性增强了内容所有权，通过将内容唯一地链接到其生成模型，使安全归属和细粒度追溯成为可能。我们构建了第一个不可检测的水印方案，该方案在替换（即汉明度量下的扰动）方面是稳健、不可伪造和可恢复的。关键技术成分是一种新的密码学原语，称为鲁棒（或可恢复）数字签名，它允许验证接近已签名消息的消息，同时防止伪造远离所有先前签名消息的消息。我们证明，任何标准数字签名方案可以通过属性保持哈希函数（Boyle, LaVigne, and Vaikuntanathan, ITCS 2019）提升为鲁棒方案。
英文摘要：
Language models now routinely produce text that is difficult to distinguish from human writing, raising the need for robust tools to verify content provenance. Watermarking has emerged as a promising countermeasure, with existing work largely focused on model quality preservation and robust detection. However, current schemes provide limited protection against false attribution. We strengthen the notion of soundness by introducing two novel guarantees: unforgeability and recoverability. Unforgeability prevents adversaries from crafting false positives, texts that are far from any output from the watermarked model but are nonetheless flagged as watermarked. Recoverability provides an additional layer of protection: whenever a watermark is detected, the detector identifies the source text from which the flagged content was derived. Together, these properties strengthen content ownership by linking content exclusively to its generating model, enabling secure attribution and fine-grained traceability. We construct the first undetectable watermarking scheme that is robust, unforgeable, and recoverable with respect to substitutions (i.e., perturbations in Hamming metric). The key technical ingredient is a new cryptographic primitive called robust (or recoverable) digital signatures, which allow verification of messages that are close to signed ones, while preventing forgery of messages that are far from all previously signed messages. We show that any standard digital signature scheme can be boosted to a robust one using property-preserving hash functions (Boyle, LaVigne, and Vaikuntanathan, ITCS 2019).
Forging the Unforgeable: On the Feasibility of Counterfeit Watermarks in Backdoor-Based Dataset Ownership Verification
College of Cyber Security, Jinan University（济南大学网络安全学院）；School of Artificial Intelligence, Beihang University（北京航空航天大学人工智能学院）；School of Advanced Technology, Xi’an Jiaotong-Liverpool University（西交利物浦大学前沿技术学院）
FedSOV: Federated Model Secure Ownership Verification with Unforgeable Signature
Sun Yat-sen University（中山大学）；University of Electronic Science and Technology of China（电子科技大学）；WeBank（微众银行）；The Hong Kong University of Science and Technology（香港科技大学）
Publicly-Detectable Watermarking for Language Models
University of California, Berkeley（加州大学伯克利分校）；University of Wisconsin, Madison（威斯康星大学麦迪逊分校）；Meta；Fundamental Artificial Intelligence Research at Meta（元公司基础人工智能研究部）；University of Virginia（弗吉尼亚大学）；New York University Shanghai（上海纽约大学）
Video Signature: Implicit Watermarking for Video Diffusion Models
AI Thrust, Hong Kong University of Science and Technology (Guangzhou)（香港科学与技术大学（广州）人工智能 thrust）；Hong Kong University of Science and Technology（香港科学与技术大学）；School of Software, BNRist, Tsinghua University（清华大学软件学院）
Hot-Swap MarkBoard: An Efficient Black-box Watermarking Approach for Large-scale Model Distribution
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of the Chinese Academy of Sciences（中国科学院大学网络安全学院）；Nanyang Technological University（南洋理工大学）；ShanghaiTech University（上海科技大学）
Gaussian Shading++: Rethinking the Realistic Deployment Challenge of Performance-Lossless Image Watermark for Diffusion Models
University of Science and Technology of China（中国科学技术大学）；Anhui Province Key Laboratory of Digital Security（安徽省数字安全重点实验室）；Department of Information Engineering and Mathematics（信息工程与数学系）；University of Siena（锡耶纳大学）；School of Computing（计算学院）；National University of Singapore（新加坡国立大学）
DHMark: Public-Key Watermarking for LLM-Generated Text via Diffie-Hellman-Guided Rejection Sampling
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）
