Optimized Couplings for Watermarking Large Language Models

TL;DR

This work analyzes watermarking of large language models in a one-shot, token-level setting framed as a hypothesis test with side information. It develops the Correlated Channel (CC) watermarking scheme, which couples the next-token distribution with a random partition of the vocab to achieve zero perceptual distortion while maintaining strong detectability, and provides a closed-form expression for the detection rate under a worst-case, min-entropy constrained distribution. The authors characterize the minimax detection performance, establish optimal and near-optimal partition strategies, and extend the framework to sequential generation with preliminary sequence-level results. Empirical evaluations on synthetic data and WaterBench show CC delivering improved perceptual quality (lower PPL) and competitive or superior detectability (Z-scores) relative to existing methods, with public code for replication.

Abstract

Large-language models (LLMs) are now able to produce text that is, in many cases, seemingly indistinguishable from human-generated content. This has fueled the development of watermarks that imprint a ``signal'' in LLM-generated text with minimal perturbation of an LLM's output. This paper provides an analysis of text watermarking in a one-shot setting. Through the lens of hypothesis testing with side information, we formulate and analyze the fundamental trade-off between watermark detection power and distortion in generated textual quality. We argue that a key component in watermark design is generating a coupling between the side information shared with the watermark detector and a random partition of the LLM vocabulary. Our analysis identifies the optimal coupling and randomization strategy under the worst-case LLM next-token distribution that satisfies a min-entropy constraint. We provide a closed-form expression of the resulting detection rate under the proposed scheme and quantify the cost in a max-min sense. Finally, we provide an array of numerical results, comparing the proposed scheme with the theoretical optimum and existing schemes, in both synthetic data and LLM watermarking. Our code is available at https://github.com/Carol-Long/CC_Watermark

Figures (8)

• Figure 1: Watermarking problem as a hypothesis test with side information.
• Figure 2: Optimal coupling between side information $S$ and random partition $Y=f(X,B^m)$ for $\widetilde{p}_1 \leq 0.5$ (left), $\widetilde{p}_0 \leq 0.5$ (right), with $\beta(p)=\frac{2p-1}{2p}$.
• Figure 3: Optimal detection probability of CC in one-shot on the adversarial token distribution (Eq. \ref{['eq:maxmin']}) is plotted against the inf-norm constraint $\lambda$ (or equivalently, an entropy constraint) on $Q_X$$^3$. When $\lambda = 1$ (entropy $H(Q_X)=0$), $Q_X$ is deterministic, and detection is random. As entropy of $Q_X$ grows (moves to smaller $\lambda$ values), single-token optimal detection probability reaches a maximum of around 0.75 for binary side information. If the side information one transmits contain a larger set of values, CC achieves a higher detection probability correspondingly. The actual detection rate (solid lines) and approximate solutions (dotted lines) overlap for large enough vocabulary size$^4$, and their exact forms are provided in Theorem \ref{['thm:optimal_maxmin_detection']} and \ref{['thm:approx_maxmin_detection']}.
• Figure 4: One-shot watermark detection results on $Q_X=\mathsf{Unif}(\mathcal{X})$. For $\alpha_p=0$, CC achieves a detection probability of $0.75$ and $0.7$ with balanced and Bernoulli partitions, respectively. CC Balanced achieves the optimal detection (Eq. \ref{['eq:curve_opt_iid']} with $\gamma = 1$ and $|\mathcal{S}|=2$). Standard deviations plotted as two-sided bars.
• Figure 5: Detection probability vs. $k$ for two values of $m$ and a uniform token distribution $Q_X$.

Theorems & Definitions (16)

• Definition 1: Watermark Tests and Error Probabilities
• Proposition 1
• Remark 1
• Theorem 1: Zero perception bounds
• Theorem 2: Uniform detection upper bound
• Proposition 2
• Proposition 3
• Remark 2: Equivalence to the likelihood ratio test
• Lemma 1
• Theorem 3: Optimal max-min Detection