DiPmark: A Stealthy, Efficient and Resilient Watermark for Large Language Models

W2 & Q2. Performance Parity with Baselines.

A2. Our work mainly focuses on building a stealthy, efficient, and resilient watermark. And we have demonstrated those three properties through our theoretical analysis and experiments. The detectability of baseline Kirchenbauer et al (2023) slightly outperformed DiPmark in some scenarios. However, building a watermark with super strong detectability is not the focus of our work, and we have demonstrated in Section 6.2 that DiPmark has comparable detectability to Kirchenbauer et al (2023) in most cases.

W3 & Q3. Efficiency Claims.

A3. That's a nice suggestion. Please check the efficient result in A1, we add the comparison of the efficiency of different watermarks. DiPmark can achieve the best watermark detection efficiency.

W4 & Q4. Lack of Open Sourced Code

A4. We upload the code of our DiPmark generator algorithm to the supplementary material (this is the major contribution of our work), please check it. We will release the full implementation in the final revision.

Q5. The resilience of the proposed method under stronger attacks.

A5. According to Kirchenbauer et al (2023), the text modification attack is the one of the strongest attacks against the reweight-based watermarks. In our experiment we evaluate the resilience of our model against random text modifications, which indicates our threat model is strong enough. Below we provide the resilience of DiPmark under paraphrasing attacks in Kirchenbauer et al (2023), which is another type of text modification attack. We see DiPmark is also robust against the paraphrasing attacks.

AUC score of different watermarks under varying attack strength ε on the poetry generation task with LLaMA-2 (chat, 7B).

Thanks for your detailed and valuable feedback. We address your concerns as below.

W1 & Q1. Limited Comparative Analysis.

A1. The topic of reweight-based watermarking in LLMs is a novel area of research, initially introduced by Kirchenbauer et al. (2023) (outstanding paper of ICML 2023). To date, there are only three concurrent studies that explore this subject: Christ et al. (2023), Kuditipudi et al. (2023), and Hu et al. (2023). These works collectively represent the emerging body of research related to reweight-based watermarking in LLMs. According to the ICLR reviewer guide (https://iclr.cc/Conferences/2024/ReviewerGuide), 'if a paper was published (i.e., at a peer-reviewed venue) on or after May 28, 2023, authors are not required to compare their own work to that paper'. We are not expected to compare with Christ et al. (2023), Kuditipudi et al. (2023), and Hu et al (2023) as all of them were published on arXiv within four months and without peer-reviewing. Thus, W1 should not be a weakness of our paper. Despite that, we still provide additional results with Kuditipudi et al. (2023) and Hu et al. (2023). We are not able to compare with Christ et al. (2023) as it is a pure theoretical paper with no experiments and codes.

Stealthy:

Performance of different watermarking methods on machine translation and text summarization

Result analysis: Kuditipudi et al (2023), Hu et al (2023), and DiPmark preserve the text quality, while the soft watermark (Kirchenbauer et al (2023)) degrades the output text quality.

Efficient:

We compare the time for detecting one and 1000 (100 batches) watermarked texts with different detection algorithms. The task is poetry generation with LLaMA-2 (chat, 7B). We use the same GPU (NVIDIA A6000) for all experiments.

We also compare the time for adding watermarks. As all four watermark generator algorithms are reweight-based, which only modify the output logits of tokens, there is no significant difference between the cost of adding watermarks. The extra time introduced by all watermarking methods in text generation is below 0.01s/100 tokens.

Result analysis: the detection algorithms of Soft and DiPmark are efficient without accessing LMs, while Hu et al (2023) requires additional access to LMs and Kuditipudi et al (2023) need significantly longer time.

Resilient:

AUC score of different watermarks under varying attack strength ε on poetry generation task with LLaMA-2 (chat, 7B).

Result analysis: All watermark algorithms are resilient to random text modification and paraphrasing attacks, while DiPmark and Soft watermark slightly outperform the other two algorithms.

We really appreciate reviewer 6R4r for the insightful and constructive feedback. As the discussion phase approaches its end, we would be grateful to receive any further comments or insights you may have regarding our response and we are more than happy to address them. Moreover, should our rebuttal have adequately addressed your concerns, we would deeply appreciate it if you would consider revising your evaluation scores. Once again, thank you for your valuable time and efforts!

Thanks for your positive and valuable feedback, below we address the concerns:

W1. Make the evaluation metrics of stealthiness, efficiency and resilience clear and highlight the results of DiPmark.

A1. That’s a great suggestion! We evaluate the stealthiness, efficiency and resilience of our model, see the experimental results in A2.

W2. Enriching the experiments and including more results and comparisons to other watermarking techniques mentioned in the paper.

A2. According to the ICLR reviewer guide (https://iclr.cc/Conferences/2024/ReviewerGuide), 'if a paper was published (i.e., at a peer-reviewed venue) on or after May 28, 2023, authors are not required to compare their own work to that paper'. We are not obligated to compare with Christ et al. (2023), Kuditipudi et al. (2023), and Hu et al (2023) as all of them were published on arXiv within four months and without peer-reviewing. Thus, W2 should not be a weakness of our paper. Despite that, we still provide additional results with Kuditipudi et al. (2023) and Hu et al. (2023). We are not able to compare with Christ et al. (2023) as it is a pure theoretical paper with no experiments and code.

Stealthy:

Performance of different watermarking methods on machine translation and text summarization

Result analysis: Kuditipudi et al (2023), Hu et al (2023), and DiPmark preserve the text quality, while the soft watermark (Kirchenbauer et al (2023)) degrades the output text quality.

Efficient:

We compare the time for detecting one and 1000 (100 batches) watermarked texts with different detection algorithms. The task is poetry generation with LLaMA-2 (chat, 7B). We use the same GPU (NVIDIA A6000) for all experiments.

We also compare the time for adding watermarks. As all four watermark generator algorithms are reweight-based, which only modify the output logits of tokens, there is no significant difference between the cost of adding watermarks. The extra time introduced by all watermarking methods in text generation is below 0.01s/100 tokens.

Result analysis: the detection algorithms of Soft and DiPmark are efficient without accessing LMs, while Hu et al (2023) requires additional access to LMs and Kuditipudi et al (2023) need significantly longer time.

Resilient:

AUC score of different watermarks under varying attack strength ε on poetry generation task with LLaMA-2 (chat, 7B).

Result analysis: All watermark algorithms are resilient to random text modification and paraphrasing attacks, while DiPmark and Soft watermark slightly outperform the other two algorithms.

We really appreciate reviewer NL4L for the insightful and constructive feedback. As the discussion phase approaches its end, we would be grateful to receive any further comments or insights you may have regarding our response and we are more than happy to address them. Moreover, should our rebuttal have adequately addressed your concerns, we would deeply appreciate it if you would consider revising your evaluation scores. Once again, thank you for your valuable time and efforts!

Minor points:

Thank you again for pointing out the grammatical errors in our work, we will polish the content and add the missing references based on your suggestions M1-7, M11-14, and M18-21. Below we will address the rest of the concerns.

M2: In Section 2 on "Related Work" it should be mentioned how this submission solves the problems enumerated for the previous watermarking schemes.

A: Thanks for the suggestion, we have such a discussion in the detailed related work in Appendix C. We will also add the discussion to our main content.

M8: What is important is how much time it takes to detect a single watermarked text instead of 1000.

A: For the detection time comparison of a single watermarked text, please see the efficient table in A2. Besides, we believe the efficiency of watermark detection is also important. Since governments around the world have expressed concerns about the misuse of large foundation models, there is likely to be a need for large-scale detection of text watermarks in the future. An efficient detecting algorithm can effectively reduce the time and financial cost.

M9: The resilience to change of the watermark sequence should not be measured with random but deliberate changes.

A: Deliberate / random change of the watermark sequence should have the same effect on the resilience of watermark under the black-box attack settings in Kirchenbauer et al (2023). As we have discussed in Appendix B, deliberate / random change of a token will affect the red/green list of $a+1$ tokens if we use the preceding $a$ tokens as the texture key. We also evaluate the resilience of DiPmark under paraphrasing attack using the settings in Kirchenbauer et al (2023), please check the table below. DiPmark is still resilient against deliberate change of the watermark sequence.

AUC score of different watermarks under varying attack strength ε on the poetry generation task with LLaMA-2 (chat, 7B).

M10: What is the difference between modifications and changes?

A: There is no difference between modifications and changes, we will change this sentence to “method faces resilience issues under modifications”

M15: How can the parameters from DiPmark and Soft be aligned?

A: As DiPmark and Soft watermark have totally different reweight strategy and watermark algorithm, their parameters represent different properties respectively and thus could not be aligned.

M16: Would the authors run their watermarking technique on their text in this submission?

A: We don’t understand the purpose of this question, as it is neither related to the quality of our presentation nor the discussion of our methods. According to ICLR 2024 submission policy “The use of LLMs is allowed as a general-purpose writing assist tool”. We will definitely be willing to run our watermarking technique on our text in this submission :).

M17: Other 3 related work for comparison

A: See A2.

Thanks for your detailed and valuable feedback. We address your concerns as below.

W0. In general, the results do not show a big difference from soft watermarking. The only difference is the better preservation of the output distribution, which is not presented clearly in the experimental section.

A0. First of all, we respectfully disagree that the only difference between our work and Kirchenbauer et al (2023) is the distribution-preserving property. As detailed in Section 5, our analysis identifies and addresses limitations in the detection algorithm of Kirchenbauer et al. (2023). We introduce a novel detection statistic based on a thorough examination of the red-green list distribution, and demonstrate that our detection algorithm is provably resilient to text modifications. These aspects are not covered by Kirchenbauer et al (2023) and should be considered as the contributions of our paper.

Secondly, we underscore the significance of the distribution-preserving property in our research. To achieve this, we developed an innovative distribution-preserving reweight method and watermarking algorithm, distinctly different from the soft watermark approach of Kirchenbauer et al. (2023). We have also addressed the importance of this distribution-preserving property in stealthy watermarking and industry-Level LLM applications in the paragraph “Significance of preserving text distribution in watermarking” of Section 4. We provide theoretical evidence of DiPmark's distribution-preserving nature (Corollary 4.3), in contrast to the non-preserving nature of the soft watermark (Section 3). Additionally, Section 6.1 is designed to empirically illustrate DiPmark's distribution-preserving characteristics. Thus, we believe that our work significantly diverges from Kirchenbauer et al. (2023) and our contributions are substantial. We hope this explanation clarifies the extent and value of our contributions for the reviewer.

W1. The access to the LLM via the API is not a problem.

A1. Kirchenbauer et al. (2023) highlighted the critical property of the reweight-based watermark, stating that ‘The watermark can be algorithmically detected without any knowledge of the model parameters or access to the language model API’. Building upon Kirchenbauer et al. (2023), we also emphasize this property in our discussion on efficiency. While we acknowledge that API access to a Large Language Model (LLM) may not significantly impact detection time, there are other notable considerations:

a) The detection method in Hu et al (2023) requires both the logits of the LLM and also the prompt used to generate the watermarked text. These elements are typically not accessible in industry-level LLMs such as GPT-3.5 or GPT-4.

b) Using APIs of such industry-level language models incurs financial costs, which can become expensive with large-scale watermark detection requirements (this scenario is realistic as governments around the world have expressed concerns about the misuse of large foundation models). For example, the cost of GPT-4 is \$0.06/1K tokens, which can lead to a cost of \\$300 for analyzing 10,000 news articles with an average length of 500 tokens each . In contrast, our proposed method removes the need for API access, and offers a cost-effective alternative. We will add these points in the introduction to strengthen our claims.

W3. Difference between our work and the Soft Watermark.

A3. As we claimed in A0, we highlighted this difference as one of the most important contributions of this paper, which should be addressed as a positive point rather than a limitation of our work. We design an effective reweight method and a watermarking algorithm, which preserves the distribution of the watermark and enables its potential applications in the industry-level LLMs. This contribution is also acknowledged by reviewers Gfoi, NL4L, and 6R4r. We would greatly value further clarification from the reviewer regarding their perspective on why this distinction might be perceived as a weakness. Such feedback would be instrumental in enhancing our understanding and addressing any concerns effectively.

W4. DiPmark exhibits poor watermark detectability, similar to the Soft Watermark from Kirchenbauer et al. (2023).

A4. We respectfully disagree with this comment. To the best of our knowledge, Kirchenbauer et al. (2023) (ICML 2023 outstanding paper) is the only peer-reviewed work featuring a reweight-based watermark approach. Currently, there are no other peer-reviewed methods in this domain that have surpassed the detectability performance of the soft watermark technique presented by Kirchenbauer et al. (2023). Consequently, there is no substantiated evidence indicating that the soft watermark suffers from poor detectability. We would greatly appreciate it if the reviewer could provide references to any studies or methods that have demonstrated superior performance compared to Kirchenbauer et al. (2023) and DiPmark.

Furthermore, DiPmark is designed to ensure stealth, efficiency, and resilience, while also maintaining state-of-the-art detectability. The primary objective of our paper is to develop a watermark with enhanced applicability, focusing on stealth, efficiency, and resilience, rather than exclusively on achieving exceptionally strong detectability. We kindly request the reviewer to reconsider this perceived limitation in the context of the contributions our work makes to the field.

W2. Related work comparison from the stealthiness, efficient, and resilient perspective.

A2. Organizing the experimental result from the stealthiness, efficient, and resilient perspective is an excellent suggestion. According to the ICLR reviewer guide (https://iclr.cc/Conferences/2024/ReviewerGuide), 'if a paper was published (i.e., at a peer-reviewed venue) on or after May 28, 2023, authors are not required to compare their own work to that paper'. We are not expected to compare with Christ et al. (2023), Kuditipudi et al. (2023), and Hu et al (2023) as all of them were published on arXiv within four months and without peer-reviewing. Thus, W2 should not be a weakness of our paper. Despite that, we still provide additional results with Kuditipudi et al. (2023) and Hu et al. (2023) below. We are not able to compare with Christ et al. (2023) as it is a pure theoretical paper with no experiments and code.

Stealthy:

Performance of different watermarking methods on machine translation and text summarization

Result analysis: Kuditipudi et al (2023), Hu et al (2023), and DiPmark preserve the text quality, while the soft watermark (Kirchenbauer et al (2023)) degrades the output text quality.

Efficient:

We compare the time for detecting one and 1000 (100 batches) watermarked texts with different detection algorithms. The task is poetry generation with LLaMA-2 (chat, 7B). We use the same GPU (NVIDIA A6000) for all experiments.

We also compare the time for adding watermarks. As all four watermark generator algorithms are reweight-based, which only modify the output logits of tokens, there is no significant difference between the cost of adding watermarks. The extra time introduced by all watermarking methods in text generation is below 0.01s/100 tokens.

Result analysis: the detection algorithms of Soft and DiPmark are efficient without accessing LMs, while Hu et al (2023) requires additional access to LMs and Kuditipudi et al (2023) need significantly longer time.

Resilient:

AUC score of different watermarks under varying attack strength ε on poetry generation task with LLaMA-2 (chat, 7B).

Result analysis: All watermark algorithms are resilient to random text modification and paraphrasing attacks, while DiPmark and Soft watermark slightly outperform the other two algorithms.

We really appreciate reviewer mbUM for the insightful and constructive feedback. As the discussion phase approaches its end, we would be grateful to receive any further comments or insights you may have regarding our response and we are more than happy to address them. Moreover, should our rebuttal have adequately addressed your concerns, we would deeply appreciate it if you would consider revising your evaluation scores. Once again, thank you for your valuable time and efforts!

Thanks for your positive and valuable feedback. We address your concerns as below.

W1: Using all previous tokens versus just the preceding tokens could potentially make a significant difference.

A1: We apologize for any confusion regarding the cipher settings. To clarify, our independent and identically distributed (i.i.d.) ciphers are typically derived from a fragment of the preceding context (e.g. $x_{i-5:i-1}$), rather than utilizing the entire previous context $x_{1:i-1}$. This approach is detailed in the first paragraph of Section 3, where it states: 'The cipher $\theta_i$ is usually generated by a secret key $k$ and a fragment of the previous context, named texture key, $s_i$'. Additionally, in our experiments, the generation of our i.i.d. ciphers also incorporate the $a=5$ preceding tokens, as described in Appendix E under the section titled 'Watermark Setup'.

W2. For the experimental robustness analysis, it would also be beneficial to consider paraphrasing attacks, which could alter the preceding $a$ tokens used for watermark detection.

A2: Thank you for your suggestion. We have included the results of paraphrasing attacks with the settings in Kirchenbauer et al. (2023) in the table below. Our findings indicate that DiPmark maintains robustness against these paraphrasing attacks. According to Kirchenbauer et al (2023), paraphrasing attack is a subclass of text modification attacks, leading to similar resilient results as random text modifications. Furthermore, we wish to emphasize that altering even a single token among the preceding $a$ tokens significantly impacts watermark detection for the current token. This effect arises because we utilize all preceding $a$ tokens to generate a random seed, which in turn is used to create the cipher. Therefore, any alteration within these $a$ tokens changes the random seed and consequently the cipher. Based on this understanding, we posit that random text substitution is a sufficiently strong method for attacking the reweight-based watermark.

AUC score of different watermarks under varying attack strength ε on the poetry generation task with LLaMA-2 (chat, 7B).

Q1. How the random function is implemented is not very clear.

A. We show the python implementation of the random function as below:

Input: context $x_{1:n-1}$, secret_key, vocab_size

# Extracts the preceding $a$ tokens in the context for generating ciphers
texture_key =  context[-self.a :].detach().cpu().numpy().tobytes()

# Create a torch.Generator() object for cipher generation
rng = torch.Generator().manual_seed(texture_key+secret_key) 

# Generate cipher (random permutation of the token set)
cipher = torch.randperm(vocab_size, generator=rng, device=rng.device)

We really appreciate reviewer Gfoi for the insightful and constructive feedback. As the discussion phase approaches its end, we would be grateful to receive any further comments or insights you may have regarding our response and we are more than happy to address them. Moreover, should our rebuttal have adequately addressed your concerns, we would deeply appreciate it if you would consider revising your evaluation scores. Once again, thank you for your valuable time and efforts!

Stealthy:

Performance of different watermarking methods on machine translation and text summarization

Result analysis: Kuditipudi et al (2023), Hu et al (2023), and DiPmark preserve the text quality, while the soft watermark (Kirchenbauer et al (2023)) degrades the output text quality.

Efficient:

We compare the time for detecting one and 1000 (100 batches) watermarked texts with different detection algorithms. The task is poetry generation with LLaMA-2 (chat, 7B). We use the same GPU (NVIDIA A6000) for all experiments.

We also compare the time for adding watermarks. As all four watermark generator algorithms are reweight-based, which only modify the output logits of tokens, there is no significant difference between the cost of adding watermarks. The extra time introduced by all watermarking methods in text generation is below 0.03s/100 tokens.

Result analysis: the detection algorithms of Soft and DiPmark are efficient without accessing LMs, while Hu et al (2023) requires additional access to LMs and Kuditipudi et al (2023) need significantly longer time.

Resilient:

AUC score of different watermarks under varying attack strength ε on poetry generation task with LLaMA-2 (chat, 7B).

Result analysis: All watermark algorithms are resilient to random text modification and paraphrasing attacks, while DiPmark and Soft watermark slightly outperform the other two algorithms.

We hope the reviewers can kindly re-evaluate the novelty and value of our efforts in light of the above clarification and experiments. We will be happy to answer any further questions related to our work.