Research map / Large language models / Language, safety and interpretability

Unbiased Watermark for Large Language Models

ICLR 2024 · Large language models › Language, safety and interpretability · approach: Text watermarking · 4 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes unbiased LLM watermarks (δ-reweight and γ-reweight) that leave the output distribution unchanged in expectation, with a maximin LLR detector that has a type I error bound, and shows no quality loss on summarization and translation.

Problem

Existing LLM watermarks (red/green list) trade off watermark strength against output quality because they bias the output distribution; the paper asks whether watermarks can be added without changing output quality or being detectable by users.

Approach

Define unbiased reweighting functions (expected reweighted distribution equals the original) and use inverse transform sampling or a permutation-based rescaling driven by hashed context codes and a secret key, with a context-code history to keep watermark codes independent across tokens; detection uses a maximin variant of the log-likelihood ratio score with an exponential-moment type I error boun

Key results

• On text summarization, δ-reweight and γ-reweight keep ROUGE-1 at 38.57 and 38.60 versus 38.56 without watermark, while Soft(δ=2.0) drops to 37.17.
• On machine translation, γ-reweight gives BLEU 21.8 matching no-watermark 21.8, while Soft(δ=2.0) drops BLEU to 19.5.
• The paper reports that the δ-reweight and γ-reweight outputs are detected with p-values as low as 1.2e-32 for OPT-6.7B text with score 75.9 (δ-RW).

Measured effects reported in the paper

Surprising findings

• Hard and soft red-list reweighting are shown to be biased, contradicting the belief that the strength-quality trade-off is unavoidable only in the sense of bias-free design is impossible for those schemes.
• Reusing a context code within a single generation requires skipping reweighting, and resetting the context code history limits guarantees to 1-shot undetectability.

Limitations

• Guarantees of n-shot undetectability require maintaining context code history, and skipping reweighting on repeated codes is a trade-off.
• Detection requires access to the original model's logits, which may not match the generation-time distribution (prompt, temperature unknown).
• Robustness to text editing and attacks is not designed in; error-correcting context codes are left for future work.

Experimental setup

Datasets: CNN-DM WMT14 En-Ro

Benchmarks: CNN-DM WMT14 En-Ro

Metrics: BERTScore ROUGE-1 perplexity BLEU watermark score p-value

Baselines: soft red list watermark hard red list watermark no watermark

Builds on: red-green list watermark (Kirchenbauer et al.) Neyman-Pearson lemma inverse transform sampling

Closest papers by meaning

• Can Watermarking Large Language Models Prevent Copyrighted Text Generation and Hide Training Data? (AAAI 2025 · similarity 0.91)
• PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs (NeurIPS 2026 · similarity 0.91)
• Provable Robust Watermarking for AI-Generated Text (ICLR 2024 · similarity 0.90)
• Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approach (NeurIPS 2025 · similarity 0.90)
• Black-Box Detection of Language Model Watermarks (ICLR 2025 · similarity 0.90)
• Break the Trade-off Between Watermark Strength and Speculative Sampling Efficiency for Language Models (ICLR 2026 · similarity 0.90)