Research map / Large language models / Language, safety and interpretability
Provable Robust Watermarking for AI-Generated Text
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Unigram-Watermark, a K=1 (fixed green-list) statistical LLM watermark with provable quality, Type I/II error and edit-robustness guarantees, and shows improved detection under paraphrasing and editing attacks versus KGW.
Problem
Watermarking LLM-generated text so that it can be reliably detected, with formal guarantees on generation quality, detection error, and robustness to edits and paraphrasing attacks.
Approach
Simplify the K-gram soft watermark of Kirchenbauer et al. by using a single fixed green/red vocabulary split (K=1) for every token, enabling provable Renyi-divergence quality bounds, exponential Type I/II error decay, and edit-distance robustness that is about twice that of the baseline.
Key results
- Under ChatGPT paraphrasing on OpenGen with LLaMA-7B at 1% FPR, Unigram-Watermark reaches TPR 0.866 vs 0.565 for KGW+23.
- Under DIPPER-1 paraphrasing on OpenGen at 10% FPR, TPR 0.922 vs 0.738 for KGW+23.
- With no attack, both methods reach TPR 1.000 at 1% FPR; human quality ratings are 3.665 (watermarked) vs 3.660 (un-watermarked).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the fixed unigram green-red split instead of KGW+23 | LLaMA-7B watermarking · OpenGen and LFQA, paraphrasing attacks | TPR at 1% FPR: OpenGen: 0.565 -> 0.866 (ChatGPT), 0.386 -> 0.729 (DIPPER-1), 0.490 -> 0.777 (DIPPER-2), 0.342 -> 0.590 (BART); LFQA: 0. | Helped |
| Use the fixed unigram green-red split instead of KGW+23 | LLaMA-7B watermarking · OpenGen and LFQA, no attack | TPR at 1% FPR: 1.000 -> 1.000 | No clear effect |
| Increase watermark strength from δ=1.0 to δ=2.0 (ablation) | Unigram-Watermark · OpenGen and LFQA, nucleus sampling, z = 6.0 | TPR: OpenGen: 0.576 -> 0.998; LFQA: 0.455 -> 1.000 | Helped |
| Increase watermark strength from δ=1.0 to δ=2.0 (ablation) | Unigram-Watermark · OpenGen and LFQA, nucleus sampling | PPL: OpenGen: 18.37}{6.45 -> 19.42}{8.78; LFQA: 18.63}{7.19 -> 19.14}{11.11 | Hurt |
| Reduce green list ratio from γ=0.5 to γ=0.25 (ablation) | Unigram-Watermark · OpenGen and LFQA, nucleus sampling, z = 6.0 | TPR: OpenGen: 0.998 -> 1.000; LFQA: 1.000 -> 1.000 | Helped |
| Increase green list ratio from γ=0.5 to γ=0.75 (ablation) | Unigram-Watermark · OpenGen and LFQA, nucleus sampling, z = 6.0 | TPR: OpenGen: 0.998 -> 0.820; LFQA: 1.000 -> 0.893 | Hurt |
| Use multinomial sampling instead of nucleus sampling (ablation) | Unigram-Watermark · OpenGen and LFQA, z = 6.0 | TPR: OpenGen: 0.998 -> 0.951; LFQA: 1.000 -> 0.934 | Hurt |
| Use beam search instead of nucleus sampling (ablation) | Unigram-Watermark · OpenGen and LFQA, z = 6.0 | TPR: OpenGen: 0.998 -> 0.992 (4-beams), 0.984 (6-beams), 0.986 (8-beams); LFQA: 1.000 -> 0.990 (4-beams), 0.994 (6-beams), 0. | Mixed |
| Add the watermark | LLaMA-7B text generation · OpenGen, human evaluation | Avg Score: 3.660 -> 3.665 | No clear effect |
Surprising findings
- Estimating the fixed green list from watermarked and human text reaches only moderate accuracy (F1 0.46-0.76), and synonym-based evasion with known green list still yields AUC 0.84 detection.
Limitations
- Fixed green-red split may be learnable by an attacker, creating a robustness-learnability tradeoff.
- Type II error bound relies on assumptions (on-average high entropy, homophily) that do not directly extend to K>=2.
- Not immune to all attacks; edit distance does not capture paraphrasing effort.
Experimental setup
Datasets: OpenGen (WikiText-103 derived) LFQA (Reddit long-form QA) TOEFL essays C4
Benchmarks: OpenGen LFQA TOEFL
Metrics: TPR at 1% and 10% FPR F1 z-score perplexity (GPT-3 oracle) human quality rating AUC
Baselines: KGW+23 (soft watermark, Kirchenbauer et al.) DetectGPT-style detectors (discussed) cryptographic watermark (Christ et al., concurrent work discussed)
Builds on: Kirchenbauer et al. soft watermark (KGW) exponential mechanism / bounded range analysis from differential privacy nucleus sampling
Closest papers by meaning
- PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs (NeurIPS 2026 · similarity 0.92)
- Black-Box Detection of Language Model Watermarks (ICLR 2025 · similarity 0.91)
- Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approach (NeurIPS 2025 · similarity 0.91)
- Adaptive Text Watermark for Large Language Models (ICML 2024 · similarity 0.91)
- An End-to-End Model for Logits-Based Large Language Models Watermarking (ICML 2025 · similarity 0.91)
- Edit Distance Robust Watermarks via Indexing Pseudorandom Codes (NeurIPS 2024 · similarity 0.91)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.