Watermarking Low-entropy Generation for Large Language Models: An Unbiased and Low-risk Method

TL;DR

This work tackles the problem of reliably identifying LLM-generated content by watermarks that are unbiased, low-risk in low-entropy generation, detectable in a black-box setting, and computationally efficient. It introduces STA-1, a Sampling One Then Accepting watermark that preserves the original token distribution in expectation and provides statistical guarantees for detection via a z-test, while also offering a low detection time. The authors further extend to STA-M to strengthen watermarking in high-entropy steps, albeit with bias, and demonstrate through extensive experiments on high- and low-entropy datasets that STA-1 achieves competitive text quality, strong detection performance, and robustness against attacks. The work advances practical watermarking for LLMs by unifying unbiasedness, low risk, black-box detection, statistical guarantees, and efficiency, with STA-M offering a tunable trade-off between watermark strength and output quality.

Abstract

Recent advancements in large language models (LLMs) have highlighted the risk of misusing them, raising the need for accurate detection of LLM-generated content. In response, a viable solution is to inject imperceptible identifiers into LLMs, known as watermarks. Our research extends the existing watermarking methods by proposing the novel Sampling One Then Accepting (STA-1) method. STA-1 is an unbiased watermark that preserves the original token distribution in expectation and has a lower risk of producing unsatisfactory outputs in low-entropy scenarios compared to existing unbiased watermarks. In watermark detection, STA-1 does not require prompts or a white-box LLM, provides statistical guarantees, demonstrates high efficiency in detection time, and remains robust against various watermarking attacks. Experimental results on low-entropy and high-entropy datasets demonstrate that STA-1 achieves the above properties simultaneously, making it a desirable solution for watermarking LLMs. Implementation codes for this study are available online.

Figures (4)

• Figure 1: Result Comparison of Watermark Strength of TPR@0.1%FPR Between Our Method and Baselines for the C4 Dataset.
• Figure 2: Comparison on the Risk of Unsatisfactory Outputs for Unbiased Watermarks. For space concern, we denote the average number of passed codes among all passed problems as PC per PP.
• Figure 3: Attacking Watermarks for C4. For baselines, we report the highest AUC score of unbiased and biased watermarks against each attack. Full results are available in Appendix \ref{['appendix:attack']} and Table \ref{['tab:attack']}.
• Figure 4: Performance of STA-M w.r.t. $\tau$