An Unforgeable Publicly Verifiable Watermark for Large Language Models

Abstract: Recently, text watermarking algorithms for LLMs have been proposed to mitigate the potential harms of text generated by LLMs, including fake news and copyright issues. However, current watermark detection algorithms require the secret key used in the watermark generation process, making them susceptible to security breaches and counterfeiting during public detection. To address this limitation, we propose an unforgeable publicly verifiable watermark algorithm named UPV that uses two different neural networks for watermark generation and detection, instead of using the same key at both stages. Meanwhile, the token embedding parameters are shared between the generation and detection networks, which makes the detection network achieve a high accuracy very efficiently. Experiments demonstrate that our algorithm attains high detection accuracy and computational efficiency through neural networks. Subsequent analysis confirms the high complexity involved in forging the watermark from the detection network. Our code is available at \href{https://github.com/THU-BPM/unforgeable_watermark}{https://github.com/THU-BPM/unforgeable\_watermark}. Additionally, our algorithm could also be accessed through MarkLLM \citep{pan2024markllm} \footnote{https://github.com/THU-BPM/MarkLLM}.

• The paper proposes a novel watermarking method called UPV that separates watermark generation and detection using distinct neural networks.
• It embeds a small watermark signal into LLM logits, achieving near-optimal detection performance (F1 ≈ 99%) with minimal computational overhead.
• The approach enhances security by preventing forgery and reverse-engineering, ensuring robust verification of AI-generated content.

Overview of "An Unforgeable Publicly Verifiable Watermark for LLMs"

The paper "An Unforgeable Publicly Verifiable Watermark for LLMs" addresses the critical issue of verifying the authenticity of text generated by LLMs without compromising security. Given the proliferation of LLMs such as GPT-4 and their increasing use across multiple domains, the paper highlights potential risks like generating false information and copyright infringement. The work introduces a new watermarking approach called UPV, designed to embed an unforgeable publicly verifiable watermark into text generated by LLMs.

Methodology

The main innovation of this study is the separation of the watermark generation and detection processes using distinct neural networks. Unlike existing models that require a shared key for both operations, UPV embeds small watermark signals directly into LLM's logits during text generation. This novel approach effectively increases security and prevents counterfeiting, particularly in third-party detection scenarios.

The watermark generation network employs a window of $w$ tokens to predict watermark signals for the last token in the sequence. This network leverages shared token embedding parameters between the watermark generator and detector, which provides prior information to the detection mechanism. This setup facilitates the creation of highly accurate detection with limited computational resources.

For the detection process, UPV employs a neural network-based system that evaluates entire text sequences to determine the presence of watermarks. This detector functions as a binary classifier, effectively leveraging the token embeddings initialized by the generation network.

Experimental Results

In evaluating the proposed method, experiments demonstrated that UPV achieves near-optimal performance, mirroring traditional key-based watermark detection with an F1 score approaching 99%. The computational overhead introduced by the watermarking process is minimal, making the solution highly efficient compared to the computational demands of LLMs.

The paper presents an impressive suite of results, including robustness to various attack vectors. The watermark detection network was notably resistant to efforts aimed at extracting watermark generation rules, a feature attributed to its computational asymmetry. Forging attacks that sought to reverse-engineer the watermarking process using the detector as a guide proved essentially ineffective.

Implications and Future Directions

The ability to embed an unforgeable watermark in LLM outputs has numerous implications for both the theoretical understanding and practical deployment of these models. Practically, this mechanism advances the effort to curb misuse of AI-generated text, enhancing trust in systems deploying LLMs. Theoretically, this study paves the way for further exploration into watermarking algorithms which focus on balancing security, detection efficiency, and robustness to various potential attacks.

Future research could explore integrating these watermarking systems with broader AI safety frameworks and refining techniques to ensure watermark robustness across different text modification schemes, such as adversarial text transformations or sophisticated rewriting strategies. Additionally, extending this work to cover multimodal models that generate text interwoven with other media forms can elucidate broader applications of watermarking techniques in AI-generated content.

This paper contributes significantly to the discourse on securing AI-generated content by introducing mechanisms that facilitate verifying the authenticity of such content without exposing sensitive watermarking details. The UPV approach serves as a strong foundation for future innovations in digital watermarking within the AI domain.