Research map / Large language models / Language, safety and interpretability

Can Watermarking Large Language Models Prevent Copyrighted Text Generation and Hide Training Data?

AAAI 2025 · Large language models › Language, safety and interpretability · approach: Text watermarking · 3 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that LLM output watermarks (UMD, Unigram) sharply reduce verbatim memorization and generation of copyrighted training text, but also lower MIA AUC, and proposes an adaptive Min-K% Prob that corrects for watermark bias to recover some detection power.

Problem

Whether output watermarking of LLMs can deter generation of copyrighted training text, and how it affects membership inference attacks used to detect copyrighted data in pretraining sets.

Approach

Treats watermark-induced logit bias as a deterrent to verbatim memorization (perplexity increase on training texts), shows watermarks degrade MIA AUC, and proposes an adaptive Min-K% Prob that divides green-token probabilities by e^delta to undo the bias using known watermark keys.

Key results

• Under UMD with delta=10, watermarking increases minimum perplexity of WikiMIA-32 training samples by about 4.1 (Unigram, Llama-30B), which corresponds to a probability reduction of more than 4.3e22x per the paper's estimate.
• Watermarking reduces MIA AUC by up to 14.2% on WikiMIA-256 across 4 detection methods and 5 LLMs; up to 16.4% for Smaller Ref.
• The proposed adaptive Min-K% Prob improves over the non-adaptive baseline in 95% of cases, by up to 4.8%.

Measured effects reported in the paper

Surprising findings

• Watermarking, which is intended to deter copyrighted generation, simultaneously weakens membership inference attacks that could detect copyrighted training data.
• Finding a watermark that reduces MIA success is easy: in at least 80% of cases across green-token percentages, all attacks' AUC decreased.

Limitations

• Experiments on WikiMIA do not necessarily contain copyrighted data; BookMIA results are used as a proxy.
• The adaptive method relies on an approximation that the softmax denominator stays roughly constant under watermarking.
• Threat model assumes the attacker knows the watermark key and parameters.

Experimental setup

Datasets: WikiMIA BookMIA

Benchmarks: WikiMIA-32 WikiMIA-64 WikiMIA-128 WikiMIA-256 BookMIA

Metrics: perplexity increase AUC AUC drop edit similarity BLEU probability reduction factor

Baselines: UMD Unigram-Watermark Perplexity MIA Lowercase Zlib Smaller Ref Min-K% Prob

Builds on: UMD watermark Unigram-Watermark Min-K% Prob WikiMIA BookMIA

Closest papers by meaning

• Unbiased Watermark for Large Language Models (ICLR 2024 · similarity 0.91)
• PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs (NeurIPS 2026 · similarity 0.90)
• Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approach (NeurIPS 2025 · similarity 0.90)
• On the Learnability of Watermarks for Language Models (ICLR 2024 · similarity 0.90)
• Discovering Spoofing Attempts on Language Model Watermarks (ICML 2025 · similarity 0.90)
• Copyright Traps for Large Language Models (ICML 2024 · similarity 0.89)