An End-to-End Model For Logits Based Large Language Models Watermarking

TL;DR

The paper tackles the challenge of robustly watermarking LLM-generated text without sacrificing downstream task quality. It introduces an end-to-end logits-perturbation framework that jointly trains a lightweight encoder, a neural detector, and an online editing surrogate, augmented by an on-the-fly LLM-based semantic proxy via online prompting. A cross-LLM converter enables applicability across different models, while an MGDA-driven loss balance and curriculum learning stabilize training. Empirical results show substantial robustness gains against paraphrasing and edits (up to 37–39% over distortion-free baselines) with only modest increases in perplexity and strong maintenance of translation and code-generation performance. The approach demonstrates LLM-agnostic generalization, efficient detection, and practical potential for watermark-based provenance and copyright enforcement in AIGC systems.

Abstract

The rise of LLMs has increased concerns over source tracing and copyright protection for AIGC, highlighting the need for advanced detection technologies. Passive detection methods usually face high false positives, while active watermarking techniques using logits or sampling manipulation offer more effective protection. Existing LLM watermarking methods, though effective on unaltered content, suffer significant performance drops when the text is modified and could introduce biases that degrade LLM performance in downstream tasks. These methods fail to achieve an optimal tradeoff between text quality and robustness, particularly due to the lack of end-to-end optimization of the encoder and decoder. In this paper, we introduce a novel end-to-end logits perturbation method for watermarking LLM-generated text. By jointly optimization, our approach achieves a better balance between quality and robustness. To address non-differentiable operations in the end-to-end training pipeline, we introduce an online prompting technique that leverages the on-the-fly LLM as a differentiable surrogate. Our method achieves superior robustness, outperforming distortion-free methods by 37-39% under paraphrasing and 17.2% on average, while maintaining text quality on par with these distortion-free methods in terms of text perplexity and downstream tasks. Our method can be easily generalized to different LLMs. Code is available at https://github.com/KAHIMWONG/E2E_LLM_WM.

Figures (12)

• Figure 1: Overview of our end-to-end model, consisting of (a) watermarking via logits perturbation with encoder $E$; (b) simulating user edits using the online text editor $N$; and (c) detecting watermarked content through decoder $D$. The entire model is trained end-to-end to optimize both the quality and detection accuracy of the watermarked content. In the inference phase, (d) a converter is deployed for cross-LLM adaption. GSS is the abbreviation of the Gumbel-Softmax sampling.
• Figure 2: Online prompting technique for (a) computing semantic loss and (b) on-the-fly text editing. The prompts are first converted into the embeddings and then concatenated with the generated text $\mathbf{X}_\text{wm}$ and $\mathbf{X}_\text{nwm}$.
• Figure 3: Converter for cross-LLM Inference.
• Figure 4: Visualize the tokenization of OPT-1.3Bzhang2022opt, Llama2-7Btouvron2023llama, NLLB-600Mcosta2022no, and BERT-basekenton2019bert tokenizers. Each single token is indicated with a color block alternatively.
• Figure 5: The trade-off between F1 score after text editing and PPL. (a) paraphrasing and (b) copy-paste attack.