Research map / Large language models / Language, safety and interpretability
On the Reliability of Watermarks for Large Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Re-examines watermark reliability for LLM text under human rewriting, GPT-3.5 and Dipper paraphrasing, and copy-paste insertion, proposing improved hashing (SelfHash) and a windowed detector (WinMax) and comparing against DetectGPT, RADAR and retrieval.
Problem
Whether LLM watermarks remain detectable in realistic settings where generated text is paraphrased by humans or LLMs or mixed into larger human-written documents.
Approach
Generalizes the Kirchenbauer et al. green-list watermark with improved context hashing (SelfHash with Min-based seeding, h=4) and a windowed z-test (WinMax) for detecting short watermarked spans inside long documents, and evaluates detection as a function of token count under attacks.
Key results
- Under GPT-3.5 and Dipper paraphrase attacks, ROC-AUC stays above 0.85 at T=200 and above 0.9 at T=600 tokens.
- Human paraphrasers (14 graduate students) are detected at 1e-5 FPR after about 800 tokens on average.
- Copy-paste attack with 150 watermarked tokens in a 600-token document yields AUC above 0.95 while watermarking outperforms retrieval and RADAR at low FPR.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| paraphrase watermarked text with GPT-3.5 or Dipper | Watermark detection on LLaMA-7B text · Machine paraphrasing, T=200 and T=600 | ROC-AUC: 0.05-0.15 points AUC | Hurt |
| observe more tokens after GPT or Dipper paraphrasing | Watermark detection · Machine paraphrasing | ROC-AUC: > 0.9 | Helped |
| insert watermarked spans into a larger human-written document | Watermark detection · Copy-Paste, 25% watermarked text | AUC: below 0.7 for 200 tokens; below 0.85 for 600 tokens | Hurt |
| insert watermarked text into a 600-token human-written passage | Watermark detection · Copy-Paste, 150 watermarked tokens | AUC: above 0.95 | Helped |
| have human writers paraphrase with the goal of removing the watermark | Watermark detection · Human paraphrases | tokens required for detection at 1e-5 false positive rate: about 800 | Hurt |
| use WinMax instead of global z-score detection | Watermark detector · Copy-Paste attacks | detection performance at low FPR | Helped |
| increase context width and use Skip or Min hashing rather than Additive hashing (ablation) | Watermark hashing scheme · GPT paraphrasing attack | ROC-AUC | Helped |
| use Min hashing rather than Additive or Skip hashing (ablation) | Watermark hashing scheme · Watermarked text generation | text diversity | Hurt |
| increase watermark strength with Additive-LeftHash at context width 1 (ablation) | Watermark generation · Open-ended text generation | text diversity | Hurt |
| increase watermark strength with Skip-LeftHash at context width 4 (ablation) | Watermark generation · Open-ended text generation | text diversity | Helped |
| apply LeftHash watermark (ablation) | Llama2-7B-chat · TriviaQA | answer includes target: 0.523 -> 0.517 | No clear effect |
| apply SelfHash watermark (ablation) | Llama2-7B-chat · TriviaQA | answer includes target: 0.523 -> 0.524 | No clear effect |
Surprising findings
- Retrieval equals or outperforms watermarking under GPT and Dipper paraphrase attacks.
- Under strong copy-paste attacks, non-watermark detectors (retrieval, RADAR, DetectGPT) degrade as text length grows, while watermarking keeps improving.
Limitations
- Assumes a black-box threat model; a white-box attacker with the key and a strong paraphraser could remove the watermark via anti-watermarking.
- Paraphrasing shortens text, reducing sample size and raising required token counts.
- Human study uses a limited pool of 14 graduate student writers on a single dataset.
Experimental setup
Datasets: C4 ELI5 (LFQA) TriviaQA
Benchmarks: C4 open-ended generation ELI5 LFQA human paraphrase study TriviaQA
Metrics: ROC-AUC AUC @ T TPR at low FPR z-score P-SP log diversity
Baselines: DetectGPT RADAR Retrieval (BM25) LeftHash watermark
Builds on: Kirchenbauer et al. LLM watermark DetectGPT RADAR DIPPER
Closest papers by meaning
- Provable Robust Watermarking for AI-Generated Text (ICLR 2024 · similarity 0.91)
- PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs (NeurIPS 2026 · similarity 0.90)
- Black-Box Detection of Language Model Watermarks (ICLR 2025 · similarity 0.90)
- Revealing Weaknesses in Text Watermarking Through Self-Information Rewrite Attacks (ICML 2025 · similarity 0.90)
- Watermarking Makes Language Models Radioactive (NeurIPS 2024 · similarity 0.90)
- Robust Multi-bit Text Watermark with LLM-based Paraphrasers (ICML 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.