Research map / Large language models / Language, safety and interpretability
A Semantic Invariant Robust Watermark for Large Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SIR, a watermark for LLMs whose green/red-style watermark logits are generated from semantic embeddings of all preceding tokens via a trained watermark network, aiming to balance attack robustness and security robustness.
Problem
Existing LLM watermarks trade off attack robustness against security robustness: watermark logits depending on few preceding tokens are robust to edits but easy to crack, while those depending on many tokens are secure but fragile to modifications.
Approach
Derive watermark logits from the semantic embedding of all preceding tokens (via an embedding LLM) rather than their token IDs, and train a small watermark network with similarity and normalization losses so that semantically invariant edits leave watermark logits nearly unchanged while the rules remain diverse and hard to infer.
Key results
- Under GPT-3.5 rewrite, SIR reaches best-F1 0.900 vs KGW-1 0.905 and KGW-2 0.823 for LLaMA-7B sampling; average F1 across GPT-3.5 and DIPPER attacks is about 0.93, comparable to KGW-1.
- Security (word-frequency spoofing analysis) is reported as superior to KGW-3 and close to KGW-4, while KGW-1 is shown to be weak on security.
- Emoji attack: SIR achieves best-F1 0.986 vs KGW-2 0.532 and KGW-4 0.497 (KGW-1 0.990).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use semantic-invariant watermark logits instead of KGW-2 watermarking | LLaMA-7B text generation · DIPPER-2 rewrite, sampling | Best F1: 0.803 -> 0.931 | Helped |
| Use semantic-invariant watermark logits instead of KGW-2 watermarking | LLaMA-7B text generation · GPT3.5 rewrite, sampling | Best F1: 0.823 -> 0.900 | Helped |
| Use semantic-invariant watermark logits instead of KGW-1 watermarking | LLaMA-7B text generation · DIPPER-2 rewrite, sampling | Best F1: 0.925 -> 0.931 | Helped |
| Use semantic-invariant watermark logits instead of KGW-1 watermarking | LLaMA-7B text generation · GPT3.5 rewrite, sampling | Best F1: 0.905 -> 0.900 | No clear effect |
| Use SIR watermarking instead of no watermark | NLLB-200-distilled-600M translation · WMT14 FR-EN | BLEU: 37.9 -> 36.8 | Hurt |
| Run watermark generation in parallel with language-model generation | OPT-1.3B, Com-BERT Base · 200-token text generation | generation time (s): 3.14 -> 3.32 | Hurt |
| Replace the adopted tanh(1000*x) watermark-logit scaling with another tested scaling (ablation) | SIR watermark model · Text quality across watermark strengths | perplexity | No clear effect |
| Replace Compositional-BERT with Sentence-BERT for embeddings (ablation) | SIR watermark model · Watermark performance | watermark detection | No clear effect |
Surprising findings
- Generating watermark logits from a semantic embedding (with a 1/-1 tanh-scaled output) reportedly achieves robustness close to KGW-1 while keeping security closer to KGW-4, which contradicts the assumed trade-off.
Limitations
- No formal guarantee that the null hypothesis holds on out-of-domain text.
- Robustness degrades under copy-paste attacks with different topics.
- Relies on the robustness of the embedding model; embedding choice (BERT vs Compositional-BERT) strongly affects watermark behavior.
Experimental setup
Datasets: C4 WikiText-103 WordNet DBpedia Class WMT14
Benchmarks: C4 WMT14 DBpedia Class
Metrics: TPR at 1% FPR TPR at 10% FPR F1 perplexity BLEU watermark decryption accuracy n-gram repetition
Baselines: KGW-1 KGW-2 KGW-4 EXP-Edit
Builds on: KGW watermark exponential minimum sampling watermark Compositional-BERT
Closest papers by meaning
- Adaptive Text Watermark for Large Language Models (ICML 2024 · similarity 0.91)
- Provable Robust Watermarking for AI-Generated Text (ICLR 2024 · similarity 0.91)
- PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs (NeurIPS 2026 · similarity 0.90)
- Optimizing Adaptive Attacks against Watermarks for Language Models (ICML 2025 · similarity 0.90)
- Black-Box Detection of Language Model Watermarks (ICLR 2025 · similarity 0.89)
- Edit Distance Robust Watermarks via Indexing Pseudorandom Codes (NeurIPS 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.